spree_auth 0.30.2 → 0.40.0

data/app/models/user_mailer.rb

@@ -1,9 +1,8 @@
 class UserMailer < ActionMailer::Base
   default_url_options[:host] = Spree::Config[:site_url]
-  default :from => Spree::Config[:mails_from]
 
-  def password_reset_instructions(user)
-    @edit_password_reset_url = edit_password_reset_url(user.perishable_token)
+  def reset_password_instructions(user)
+    @edit_password_reset_url = edit_user_password_url(:reset_password_token => user.reset_password_token)
     mail(:to => user.email,
          :subject => Spree::Config[:site_name] + ' ' + I18n.t("password_reset_instructions"))
   end

data/app/views/checkout/registration.html.erb

@@ -2,7 +2,7 @@
 <h2><%= t("registration")%></h2>
 <div id="registration">
   <div id="account">
-    <%= render :file => 'users/new' %>
+    <%= render :file => 'user_sessions/new' %>
   </div>
   <% if Spree::Config[:allow_guest_checkout] %>
     <div id="guest_checkout">

data/app/views/shared/_error_messages.html.erb

@@ -7,4 +7,4 @@
   <% end %>
   </ul>
 </div>
-<% end %>
+<% end %>

data/app/views/shared/_login.html.erb

@@ -0,0 +1,20 @@
+<%= form_for(:user, :url => user_session_path) do |f| %>
+  <div id='password-credentials'>
+    <p>
+      <%= f.label(:email, t("email")) %><br />
+      <%= f.text_field('email', :class => 'title') %>
+    </p>
+    <p>
+      <%= f.label :password, t("password") %><br />
+      <%= f.password_field 'password', :class => 'title' %>
+    </p>
+  </div>
+  <p>
+    <label>
+      <%= f.check_box :remember_me %>
+      <%= f.label :remember_me, t('remember_me') %>
+    </label>
+  </p>
+
+  <p><%= submit_tag t("log_in"), :class => 'button primary'%></p>
+<% end %>

data/app/views/shared/_login_bar.html.erb

@@ -1,6 +1,6 @@
 <% if current_user %>
   <li><%= link_to t('my_account'), account_path %></li>
-  <li><%= link_to t('logout'), logout_path %></li>
+  <li><%= link_to t('logout'), destroy_user_session_path %></li>
 <% else %>
   <li><%= link_to t('log_in'), login_path %></li>
 <% end %>

data/app/views/shared/_user_form.html.erb

@@ -0,0 +1,17 @@
+<p>
+  <%= f.label :email, t("email") %><br />
+  <%= f.text_field :email, :class => 'title'  %>
+</p>
+<div id="password-credentials">
+  <p>
+    <%= f.label :password, t("password") %><br />
+    <%= f.password_field :password, :class => 'title'  %>
+  </p>
+
+  <p>
+    <%= f.label :password_confirmation, t(:confirm_password) %><br />
+    <%= f.password_field :password_confirmation, :class => 'title' %>
+  </p>
+</div>
+
+<%= hook :signup_below_password_fields %>

data/app/views/user_password_resets/edit.html.erb

@@ -0,0 +1,15 @@
+<%= render "shared/error_messages", :target => @user %>
+<h1><%= t(:change_my_password) %></h1>
+
+<%= form_for @user, :url => user_password_path, :html => {:method => :put} do |f| %>
+  <p>
+    <%= f.label :password %><br />
+    <%= f.password_field :password %><br />
+  </p>
+  <p>
+    <%= f.label :password_confirmation %><br />
+    <%= f.password_field :password_confirmation %><br />
+  </p>
+  <%= f.hidden_field :reset_password_token %>
+  <%= f.submit t("update_password") %>
+<% end %>

data/app/views/{password_resets → user_password_resets}/new.html.erb

@@ -1,13 +1,13 @@
 <h1><%= t(:forgot_password) %></h1>
 
 <p><%= t(:instructions_to_reset_password) %></p>
- 
-<%= form_tag password_resets_path do %>
+
+<%= form_for User.new, :as => :user, :url => user_password_path do |f| %>
   <p>
     <label><%= t(:email) %>:</label><br />
-    <%= text_field_tag "email", params[:email], :size => 30 %>
+    <%= f.email_field :email %>
   </p>
   <p>
-    <%= submit_tag t("reset_password") %>
+    <%= f.submit t("reset_password") %>
   </p>
 <% end %>

data/app/views/{users → user_registrations}/new.html.erb

@@ -7,7 +7,7 @@
 
   <%= hook :signup do %>
 
-    <%= form_for(@user) do |f| %>
+    <%= form_for(:user, :url => registration_path(@user)) do |f| %>
 
       <%= hook :signup_inside_form do %>
         <%= render 'shared/user_form', :f => f %>
@@ -16,8 +16,8 @@
 
     <% end %>
     <%= t("or") %> <%= link_to t("login_as_existing"), login_path %>
-
   <% end %>
 
 </div>
 
+<%= hook :login_extras %>

data/app/views/user_sessions/new.html.erb

@@ -1,9 +1,13 @@
+<% if flash[:alert] %>
+  <div class="flash errors"><%= flash[:alert] %></div>
+<% end %>
+
 <% @body_id = 'login' %>
 <div id="existing-customer">
   <h2><%= t("login_as_existing") %></h2>
   <%= hook :login do %>
     <%= render :partial => 'shared/login' %>
-    <%= t("or") %> <%= link_to t("create_a_new_account"), signup_path %> | <%= link_to t("forgot_password"), new_password_reset_path %>
+    <%= t("or") %> <%= link_to t("create_a_new_account"), signup_path %> | <%= link_to t("forgot_password"), new_user_password_path %>
   <% end %>
 </div>
-
+<%= hook :login_extras %>

data/app/views/users/edit.html.erb

@@ -2,7 +2,7 @@
 
 <h1><%= t("editing_user") %></h1>
 
-<% form_for(:user, :url => object_url, :html => { :method => :put }) do |f| %>
+<%= form_for(:user, :url => object_url, :html => { :method => :put }) do |f| %>
   <%= render 'shared/user_form', :f => f %>
   <p>
     <%=submit_tag t("update") %>

data/config/initializers/devise.rb

@@ -0,0 +1,136 @@
+# Use this hook to configure devise mailer, warden hooks and so forth. The first
+# four configuration values can also be set straight in your models.
+Devise.setup do |config|
+  # ==> Mailer Configuration
+  # Configure the e-mail address which will be shown in DeviseMailer.
+  config.mailer_sender = "please-change-me@config-initializers-devise.com"
+
+  # Configure the class responsible to send e-mails.
+  config.mailer = "UserMailer"
+
+  # ==> ORM configuration
+  # Load and configure the ORM. Supports :active_record (default) and
+  # :mongoid (bson_ext recommended) by default. Other ORMs may be
+  # available as additional gems.
+  require 'devise/orm/active_record'
+
+  # ==> Configuration for any authentication mechanism
+  # Configure which keys are used when authenticating an user. By default is
+  # just :email. You can configure it to use [:username, :subdomain], so for
+  # authenticating an user, both parameters are required. Remember that those
+  # parameters are used only when authenticating and not when retrieving from
+  # session. If you need permissions, you should implement that in a before filter.
+  # config.authentication_keys = [ :email ]
+
+  # Tell if authentication through request.params is enabled. True by default.
+  # config.params_authenticatable = true
+
+  # Tell if authentication through HTTP Basic Auth is enabled. False by default.
+  config.http_authenticatable = true
+
+  # Set this to true to use Basic Auth for AJAX requests.  True by default.
+  #config.http_authenticatable_on_xhr = false
+
+  # The realm used in Http Basic Authentication
+  config.http_authentication_realm = "Spree Application"
+
+  # ==> Configuration for :database_authenticatable
+  # For bcrypt, this is the cost for hashing the password and defaults to 10. If
+  # using other encryptors, it sets how many times you want the password re-encrypted.
+  config.stretches = 20
+
+  # Setup a pepper to generate the encrypted password.
+  config.pepper = "0bfa9e2cb4a5efd0d976518a3d82e345060547913d2fd1dd2f32b0c8dbbbb5d3dc20b86d0fed31aca9513bccdf51643700ea277d9c64d9ce8ef886bf39293453"
+
+  # ==> Configuration for :confirmable
+  # The time you want to give your user to confirm his account. During this time
+  # he will be able to access your application without confirming. Default is nil.
+  # When confirm_within is zero, the user won't be able to sign in without confirming.
+  # You can use this to let your user access some features of your application
+  # without confirming the account, but blocking it after a certain period
+  # (ie 2 days).
+  # config.confirm_within = 2.days
+
+  # ==> Configuration for :rememberable
+  # The time the user will be remembered without asking for credentials again.
+  # config.remember_for = 2.weeks
+
+  # If true, a valid remember token can be re-used between multiple browsers.
+  # config.remember_across_browsers = true
+
+  # If true, extends the user's remember period when remembered via cookie.
+  # config.extend_remember_period = false
+
+  # ==> Configuration for :validatable
+  # Range for password length
+  # config.password_length = 6..20
+
+  # Regex to use to validate the email address
+  config.email_regexp = /^([\w\.%\+\-]+)@([\w\-]+\.)+([\w]{2,})$/i
+
+  # ==> Configuration for :timeoutable
+  # The time you want to timeout the user session without activity. After this
+  # time the user will be asked for credentials again.
+  # config.timeout_in = 10.minutes
+
+  # ==> Configuration for :lockable
+  # Defines which strategy will be used to lock an account.
+  # :failed_attempts = Locks an account after a number of failed attempts to sign in.
+  # :none            = No lock strategy. You should handle locking by yourself.
+  # config.lock_strategy = :failed_attempts
+
+  # Defines which strategy will be used to unlock an account.
+  # :email = Sends an unlock link to the user email
+  # :time  = Re-enables login after a certain amount of time (see :unlock_in below)
+  # :both  = Enables both strategies
+  # :none  = No unlock strategy. You should handle unlocking by yourself.
+  # config.unlock_strategy = :both
+
+  # Number of authentication tries before locking an account if lock_strategy
+  # is failed attempts.
+  # config.maximum_attempts = 20
+
+  # Time interval to unlock the account if :time is enabled as unlock_strategy.
+  # config.unlock_in = 1.hour
+
+  # ==> Configuration for :token_authenticatable
+  # Defines name of the authentication token params key
+  config.token_authentication_key = :auth_token
+
+  # ==> Scopes configuration
+  # Turn scoped views on. Before rendering "sessions/new", it will first check for
+  # "users/sessions/new". It's turned off by default because it's slower if you
+  # are using only default views.
+  # config.scoped_views = true
+
+  # Configure the default scope given to Warden. By default it's the first
+  # devise role declared in your routes.
+  # config.default_scope = :user
+
+  # Configure sign_out behavior.
+  # By default sign_out is scoped (i.e. /users/sign_out affects only :user scope).
+  # In case of sign_out_all_scopes set to true any logout action will sign out all active scopes.
+  # config.sign_out_all_scopes = false
+
+  # ==> Navigation configuration
+  # Lists the formats that should be treated as navigational. Formats like
+  # :html, should redirect to the sign in page when the user does not have
+  # access, but formats like :xml or :json, should return 401.
+  # If you have any extra navigational formats, like :iphone or :mobile, you
+  # should add them to the navigational formats lists. Default is [:html]
+  config.navigational_formats = [:html, :json, :xml]
+
+  # ==> Warden configuration
+  # If you want to use other strategies, that are not (yet) supported by Devise,
+  # you can configure them inside the config.warden block. The example below
+  # allows you to setup OAuth, using http://github.com/roman/warden_oauth
+  #
+  # config.warden do |manager|
+  #   manager.oauth(:twitter) do |twitter|
+  #     twitter.consumer_secret = <YOUR CONSUMER SECRET>
+  #     twitter.consumer_key  = <YOUR CONSUMER KEY>
+  #     twitter.options :site => 'http://twitter.com'
+  #   end
+  #   manager.default_strategies(:scope => :user).unshift :twitter_oauth
+  # end
+end

data/config/locales/en.yml

@@ -0,0 +1,45 @@
+en:
+  errors:
+    messages:
+      not_found: "not found"
+      already_confirmed: "was already confirmed"
+      not_locked: "was not locked"
+      not_saved:
+        one: "1 error prohibited this %{resource} from being saved:"
+        other: "%{count} errors prohibited this %{resource} from being saved:"
+  devise:
+    failure:
+      unauthenticated: 'You need to sign in or sign up before continuing.'
+      unconfirmed: 'You have to confirm your account before continuing.'
+      locked: 'Your account is locked.'
+      invalid: 'Invalid email or password.'
+      invalid_token: 'Invalid authentication token.'
+      timeout: 'Your session expired, please sign in again to continue.'
+      inactive: 'Your account was not activated yet.'
+    user_password_resets:
+      send_instructions: 'You will receive an email with instructions about how to reset your password in a few minutes.'
+      updated: 'Your password was changed successfully. You are now signed in.'
+    confirmations:
+      send_instructions: 'You will receive an email with instructions about how to confirm your account in a few minutes.'
+      confirmed: 'Your account was successfully confirmed. You are now signed in.'
+    user_registrations:
+      signed_up: 'Welcome! You have signed up successfully.'
+      inactive_signed_up: 'You have signed up successfully. However, we could not sign you in because your account is %{reason}.'
+      updated: 'You updated your account successfully.'
+      destroyed: 'Bye! Your account was successfully cancelled. We hope to see you again soon.'
+    user_sessions:
+      signed_in: 'Signed in successfully.'
+      signed_out: 'Signed out successfully.'
+    unlocks:
+      send_instructions: 'You will receive an email with instructions about how to unlock your account in a few minutes.'
+      unlocked: 'Your account was successfully unlocked. You are now signed in.'
+    oauth_callbacks:
+      success: 'Successfully authorized from %{kind} account.'
+      failure: 'Could not authorize you from %{kind} because "%{reason}".'
+    mailer:
+      confirmation_instructions:
+        subject: 'Confirmation instructions'
+      reset_password_instructions:
+        subject: 'Reset password instructions'
+      unlock_instructions:
+        subject: 'Unlock Instructions'

data/config/routes.rb

@@ -1,21 +1,28 @@
 Rails.application.routes.draw do
+  devise_for :users,
+             :controllers => { :sessions => 'user_sessions',
+                               :registrations => 'user_registrations',
+                               :passwords => "user_password_resets"},
+             :skip => [:unlocks, :omniauth_callbacks],
+             :path_names => { :sign_out => 'logout'}
+  resources :users, :only => [:edit, :update]
+
+  devise_scope :user do
+    get "/login" => "user_sessions#new", :as => :login
+    get "/signup" => "user_registrations#new", :as => :signup
+  end
+
 
   match '/checkout/registration' => 'checkout#registration', :via => :get, :as => :checkout_registration
   match '/checkout/registration' => 'checkout#update_registration', :via => :put, :as => :update_checkout_registration
 
-  match '/login', :to => 'user_sessions#new', :as => :login
-  match '/logout', :to => 'user_sessions#destroy', :as => :logout
-  match '/signup', :to => 'users#new', :as => :signup
-
   match '/orders/:id/token/:token' => 'orders#show', :via => :get, :as => :token_order
 
-  resource :user_session do
+  resource :session do
     member do
       get :nav_bar
     end
   end
   resource :account, :controller => "users"
-  resources :password_resets
-  resources :users
 
 end

data/db/migrate/20101101185116_rename_columns_for_devise.rb

@@ -0,0 +1,38 @@
+class RenameColumnsForDevise < ActiveRecord::Migration
+  def self.up
+    rename_column :users, :crypted_password, :encrypted_password
+    rename_column :users, :salt, :password_salt
+    rename_column :users, :remember_token_expires_at, :remember_created_at
+    rename_column :users, :login_count, :sign_in_count
+    rename_column :users, :failed_login_count, :failed_attempts
+    rename_column :users, :single_access_token, :reset_password_token
+    rename_column :users, :current_login_at, :current_sign_in_at
+    rename_column :users, :last_login_at, :last_sign_in_at
+    rename_column :users, :current_login_ip, :current_sign_in_ip
+    rename_column :users, :last_login_ip, :last_sign_in_ip
+    add_column :users, :authentication_token, :string
+    add_column :users, :unlock_token, :string
+    add_column :users, :locked_at, :datetime
+    remove_column :users, :api_key
+    remove_column :users, :openid_identifier
+  end
+
+  def self.down
+    remove_column :users, :authentication_token
+    remove_column :users, :locked_at
+    remove_column :users, :unlock_token
+    rename_column :table_name, :new_column_name, :column_name
+    rename_column :users, :last_sign_in_ip, :last_login_ip
+    rename_column :users, :current_sign_in_ip, :current_login_ip
+    rename_column :users, :last_sign_in_at, :last_login_at
+    rename_column :users, :current_sign_in_at, :current_login_at
+    rename_column :users, :reset_password_token, :single_access_token
+    rename_column :users, :failed_attempts, :failed_login_count
+    rename_column :users, :sign_in_count, :login_count
+    rename_column :users, :remember_created_at, :remember_token_expires_at
+    rename_column :users, :password_salt, :salt
+    rename_column :users, :encrypted_password, :crypted_password
+    add_column :users, :unlock_token, :string
+    add_column :users, :openid_identifier, :string
+  end
+end

data/db/migrate/20101214150824_convert_user_remember_field.rb

@@ -0,0 +1,11 @@
+class ConvertUserRememberField < ActiveRecord::Migration
+  def self.up
+    remove_column :users, :remember_created_at
+    add_column :users, :remember_created_at, :datetime
+  end
+
+  def self.down
+    remove_column :users, :remember_created_at
+    add_column :users, :remember_created_at, :string
+  end
+end

data/db/migrate/20101217012656_create_tokenized_permissions.rb

@@ -0,0 +1,18 @@
+class CreateTokenizedPermissions < ActiveRecord::Migration
+
+  def self.up
+
+    create_table :tokenized_permissions do |t|
+      t.integer :permissable_id
+      t.string  :permissable_type
+      t.string  :token
+      t.timestamps
+    end
+
+    add_index "tokenized_permissions", ["permissable_id", "permissable_type"], :name => "index_tokenized_name_and_type"
+  end
+
+  def self.down
+    drop_table :tokenized_permissions
+  end
+end