Class: Devise::FailureApp

Inherits:
ActionController::Metal
  • Object
show all
Includes:
ActionController::RackDelegation, ActionController::Redirecting, ActionController::UrlFor, Controllers::StoreLocation
Defined in:
lib/devise/failure_app.rb

Overview

Failure application that will be called every time :warden is thrown from any strategy or hook. Responsible for redirect the user to the sign in page based on current scope and mapping. If no scope is given, redirect to the default_url.

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Controllers::StoreLocation

#store_location_for, #stored_location_for

Class Method Details

.call(env) ⇒ Object 



20
21
22
23
 
# File 'lib/devise/failure_app.rb', line 20

def self.call(env)
  @respond ||= action(:respond)
  @respond.call(env)
end

.default_url_options(*args) ⇒ Object 



25
26
27
28
29
30
31
 
# File 'lib/devise/failure_app.rb', line 25

def self.default_url_options(*args)
  if defined?(ApplicationController)
    ApplicationController.default_url_options(*args)
  else
    {}
  end
end

Instance Method Details

#attempted_path ⇒ Object (protected) 



192
193
194
 
# File 'lib/devise/failure_app.rb', line 192

def attempted_path
  warden_options[:attempted_path]
end

#http_auth ⇒ Object 



43
44
45
46
47
48
 
# File 'lib/devise/failure_app.rb', line 43

def http_auth
  self.status = 401
  self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect}) if http_auth_header?
  self.content_type = request.format.to_s
  self.response_body = http_auth_body
end

#http_auth? ⇒ Boolean (protected)

Choose whether we should respond in a http authentication fashion, including 401 and optional headers.

This method allows the user to explicitly disable http authentication on ajax requests in case they want to redirect on failures instead of handling the errors on their own. This is useful in case your ajax API is the same as your public API and uses a format like JSON (so you cannot mark JSON as a navigational format).

Returns:

  • (Boolean) 


139
140
141
142
143
144
145
 
# File 'lib/devise/failure_app.rb', line 139

def http_auth?
  if request.xhr?
    Devise.http_authenticatable_on_xhr
  else
    !(request_format && is_navigational_format?)
  end
end

#http_auth_body ⇒ Object (protected) 



153
154
155
156
157
158
159
160
161
162
163
 
# File 'lib/devise/failure_app.rb', line 153

def http_auth_body
  return i18n_message unless request_format
  method = "to_#{request_format}"
  if method == "to_xml"
    { error: i18n_message }.to_xml(root: "errors")
  elsif {}.respond_to?(method)
    { error: i18n_message }.send(method)
  else
    i18n_message
  end
end

#http_auth_header? ⇒ Boolean (protected)

It does not make sense to send authenticate headers in ajax requests or if the user disabled them.

Returns:

  • (Boolean) 


149
150
151
 
# File 'lib/devise/failure_app.rb', line 149

def http_auth_header?
  scope_class.http_authenticatable && !request.xhr?
end

#i18n_message(default = nil) ⇒ Object (protected) 



73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
 
# File 'lib/devise/failure_app.rb', line 73

def i18n_message(default = nil)
  message = warden_message || default || :unauthenticated

  if message.is_a?(Symbol)
    options = {}
    options[:resource_name] = scope
    options[:scope] = "devise.failure"
    options[:default] = [message]
    auth_keys = scope_class.authentication_keys
    keys = auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys
    options[:authentication_keys] = keys.join(I18n.translate(:"support.array.words_connector"))
    options = i18n_options(options)

    I18n.t(:"#{scope}.#{message}", options)
  else
    message.to_s
  end
end

#i18n_options(options) ⇒ Object (protected) 



69
70
71
 
# File 'lib/devise/failure_app.rb', line 69

def i18n_options(options)
  options
end

#is_navigational_format? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


204
205
206
 
# File 'lib/devise/failure_app.rb', line 204

def is_navigational_format?
  Devise.navigational_formats.include?(request_format)
end

#recall ⇒ Object 



50
51
52
53
54
 
# File 'lib/devise/failure_app.rb', line 50

def recall
  env["PATH_INFO"]  = attempted_path
  flash.now[:alert] = i18n_message(:invalid)
  self.response = recall_app(warden_options[:recall]).call(env)
end

#recall_app(app) ⇒ Object (protected) 



165
166
167
168
169
170
 
# File 'lib/devise/failure_app.rb', line 165

def recall_app(app)
  controller, action = app.split("#")
  controller_name  = ActiveSupport::Inflector.camelize(controller)
  controller_klass = ActiveSupport::Inflector.constantize("#{controller_name}Controller")
  controller_klass.action(action)
end

#redirect ⇒ Object 



56
57
58
59
60
61
62
63
64
65
 
# File 'lib/devise/failure_app.rb', line 56

def redirect
  store_location!
  if flash[:timedout] && flash[:alert]
    flash.keep(:timedout)
    flash.keep(:alert)
  else
    flash[:alert] = i18n_message
  end
  redirect_to redirect_url
end

#redirect_url ⇒ Object (protected) 



92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'lib/devise/failure_app.rb', line 92

def redirect_url
  if warden_message == :timeout
    flash[:timedout] = true

    path = if request.get?
      attempted_path
    else
      request.referrer
    end

    path || scope_url
  else
    scope_url
  end
end

#request_format ⇒ Object (protected) 



208
209
210
 
# File 'lib/devise/failure_app.rb', line 208

def request_format
  @request_format ||= request.format.try(:ref)
end

#respond ⇒ Object 



33
34
35
36
37
38
39
40
41
 
# File 'lib/devise/failure_app.rb', line 33

def respond
  if http_auth?
    http_auth
  elsif warden_options[:recall]
    recall
  else
    redirect
  end
end

#scope ⇒ Object (protected) 



184
185
186
 
# File 'lib/devise/failure_app.rb', line 184

def scope
  @scope ||= warden_options[:scope] || Devise.default_scope
end

#scope_class ⇒ Object (protected) 



188
189
190
 
# File 'lib/devise/failure_app.rb', line 188

def scope_class
  @scope_class ||= Devise.mappings[scope].to
end

#scope_url ⇒ Object (protected) 



108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
 
# File 'lib/devise/failure_app.rb', line 108

def scope_url
  opts  = {}
  route = :"new_#{scope}_session_url"
  opts[:format] = request_format unless skip_format?

  config = Rails.application.config
  opts[:script_name] = (config.relative_url_root if config.respond_to?(:relative_url_root))

  context = send(Devise.available_router_name)

  if context.respond_to?(route)
    context.send(route, opts)
  elsif respond_to?(:root_url)
    root_url(opts)
  else
    "/"
  end
end

#skip_format? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


127
128
129
 
# File 'lib/devise/failure_app.rb', line 127

def skip_format?
  %w(html */*).include? request_format.to_s
end

#store_location! ⇒ Object (protected)

Stores requested uri to redirect the user after signing in. We cannot use scoped session provided by warden here, since the user is not authenticated yet, but we still need to store the uri based on scope, so different scopes would never use the same uri to redirect.



200
201
202
 
# File 'lib/devise/failure_app.rb', line 200

def store_location!
  store_location_for(scope, attempted_path) if request.get? && !http_auth?
end

#warden ⇒ Object (protected) 



172
173
174
 
# File 'lib/devise/failure_app.rb', line 172

def warden
  env['warden']
end

#warden_message ⇒ Object (protected) 



180
181
182
 
# File 'lib/devise/failure_app.rb', line 180

def warden_message
  @message ||= warden.message || warden_options[:message]
end

#warden_options ⇒ Object (protected) 



176
177
178
 
# File 'lib/devise/failure_app.rb', line 176

def warden_options
  env['warden.options']
end