Module: Devise::Models::DatabaseAuthenticatable

Extended by:
ActiveSupport::Concern
Defined in:
lib/devise/models/database_authenticatable.rb

Overview

Authenticatable Module, responsible for hashing the password and validating the authenticity of a user while signing in.

Options

DatabaseAuthenticatable adds the following options to devise_for:

* +pepper+: a random string used to provide a more secure hash. Use
  `rake secret` to generate new keys.

* +stretches+: the cost given to bcrypt.

Examples

User.find(1).valid_password?('password123')         # returns true/false

Defined Under Namespace

Modules: ClassMethods

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.required_fields(klass) ⇒ Object

[View source]

31
32
33
 
# File 'lib/devise/models/database_authenticatable.rb', line 31

def self.required_fields(klass)
  [:encrypted_password] + klass.authentication_keys
end

Instance Method Details

#after_database_authentication ⇒ Object

A callback initiated after successfully authenticating. This can be used to insert your own logic that is only run after the user successfully authenticates.

Example:

def after_database_authentication
  self.update_attribute(:invite_code, nil)
end
[View source]

127
128
 
# File 'lib/devise/models/database_authenticatable.rb', line 127

def after_database_authentication
end

#authenticatable_salt ⇒ Object

A reliable way to expose the salt regardless of the implementation.

[View source]

131
132
133
 
# File 'lib/devise/models/database_authenticatable.rb', line 131

def authenticatable_salt
  encrypted_password[0,29] if encrypted_password
end

#clean_up_passwords ⇒ Object

Set password and password confirmation to nil

[View source]

49
50
51
 
# File 'lib/devise/models/database_authenticatable.rb', line 49

def clean_up_passwords
  self.password = self.password_confirmation = nil
end

#destroy_with_password(current_password) ⇒ Object

Destroy record when :current_password matches, otherwise returns error on :current_password. It also automatically rejects :current_password if it is blank.

[View source]

105
106
107
108
109
110
111
112
113
114
115
 
# File 'lib/devise/models/database_authenticatable.rb', line 105

def destroy_with_password(current_password)
  result = if valid_password?(current_password)
    destroy
  else
    self.valid?
    self.errors.add(:current_password, current_password.blank? ? :blank : :invalid)
    false
  end

  result
end

#password=(new_password) ⇒ Object

Generates a hashed password based on the given value. For legacy reasons, we use ‘encrypted_password` to store the hashed password.

[View source]

38
39
40
41
 
# File 'lib/devise/models/database_authenticatable.rb', line 38

def password=(new_password)
  @password = new_password
  self.encrypted_password = password_digest(@password) if @password.present?
end

#password_digest(password) ⇒ Object (protected)

Hashes the password using bcrypt. Custom hash functions should override this method to apply their own algorithm.

See github.com/plataformatec/devise-encryptable for examples of other hashing engines.

[View source]

146
147
148
 
# File 'lib/devise/models/database_authenticatable.rb', line 146

def password_digest(password)
  Devise::Encryptor.digest(self.class, password)
end

#send_password_change_notification ⇒ Object

[View source]

135
136
137
 
# File 'lib/devise/models/database_authenticatable.rb', line 135

def send_password_change_notification
  send_devise_notification(:password_change)
end

#send_password_change_notification? ⇒ Boolean (protected)

Returns:

  • (Boolean)
[View source]

150
151
152
 
# File 'lib/devise/models/database_authenticatable.rb', line 150

def send_password_change_notification?
  self.class.send_password_change_notification && encrypted_password_changed?
end

#update_with_password(params, *options) ⇒ Object

Update record attributes when :current_password matches, otherwise returns error on :current_password.

This method also rejects the password field if it is blank (allowing users to change relevant information like the e-mail without changing their password). In case the password field is rejected, the confirmation is also rejected as long as it is also blank.

[View source]

60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/devise/models/database_authenticatable.rb', line 60

def update_with_password(params, *options)
  current_password = params.delete(:current_password)

  if params[:password].blank?
    params.delete(:password)
    params.delete(:password_confirmation) if params[:password_confirmation].blank?
  end

  result = if valid_password?(current_password)
    update_attributes(params, *options)
  else
    self.assign_attributes(params, *options)
    self.valid?
    self.errors.add(:current_password, current_password.blank? ? :blank : :invalid)
    false
  end

  clean_up_passwords
  result
end

#update_without_password(params, *options) ⇒ Object

Updates record attributes without asking for the current password. Never allows a change to the current password. If you are using this method, you should probably override this method to protect other attributes you would not like to be updated without a password.

Example:

def update_without_password(params, *options)
  params.delete(:email)
  super(params)
end
[View source]

93
94
95
96
97
98
99
100
 
# File 'lib/devise/models/database_authenticatable.rb', line 93

def update_without_password(params, *options)
  params.delete(:password)
  params.delete(:password_confirmation)

  result = update_attributes(params, *options)
  clean_up_passwords
  result
end

#valid_password?(password) ⇒ Boolean

Verifies whether a password (ie from sign in) is the user password.

Returns:

  • (Boolean)
[View source]

44
45
46
 
# File 'lib/devise/models/database_authenticatable.rb', line 44

def valid_password?(password)
  Devise::Encryptor.compare(self.class, encrypted_password, password)
end