Class: Devise::FailureApp

Inherits:
ActionController::Metal
  • Object
show all
Includes:
ActionController::RackDelegation, ActionController::Redirecting, ActionController::UrlFor
Defined in:
lib/devise/failure_app.rb

Overview

Failure application that will be called every time :warden is thrown from any strategy or hook. Responsible for redirect the user to the sign in page based on current scope and mapping. If no scope is given, redirect to the default_url.

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.call(env) ⇒ Object 



18
19
20
21
 
# File 'lib/devise/failure_app.rb', line 18

def self.call(env)
  @respond ||= action(:respond)
  @respond.call(env)
end

.default_url_options(*args) ⇒ Object 



23
24
25
26
27
28
29
 
# File 'lib/devise/failure_app.rb', line 23

def self.default_url_options(*args)
  if defined?(ApplicationController)
    ApplicationController.default_url_options(*args)
  else
    {}
  end
end

Instance Method Details

#attempted_path ⇒ Object (protected) 



167
168
169
 
# File 'lib/devise/failure_app.rb', line 167

def attempted_path
  warden_options[:attempted_path]
end

#http_auth ⇒ Object 



41
42
43
44
45
46
 
# File 'lib/devise/failure_app.rb', line 41

def http_auth
  self.status = 401
  self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect}) if http_auth_header?
  self.content_type = request.format.to_s
  self.response_body = http_auth_body
end

#http_auth? ⇒ Boolean (protected)

Choose whether we should respond in a http authentication fashion, including 401 and optional headers.

This method allows the user to explicitly disable http authentication on ajax requests in case they want to redirect on failures instead of handling the errors on their own. This is useful in case your ajax API is the same as your public API and uses a format like JSON (so you cannot mark JSON as a navigational format).

Returns:

  • (Boolean) 


118
119
120
121
122
123
124
 
# File 'lib/devise/failure_app.rb', line 118

def http_auth?
  if request.xhr?
    Devise.http_authenticatable_on_xhr
  else
    !(request_format && is_navigational_format?)
  end
end

#http_auth_body ⇒ Object (protected) 



132
133
134
135
136
137
138
139
140
141
142
 
# File 'lib/devise/failure_app.rb', line 132

def http_auth_body
  return i18n_message unless request_format
  method = "to_#{request_format}"
  if method == "to_xml"
    { :error => i18n_message }.to_xml(:root => "errors")
  elsif {}.respond_to?(method)
    { :error => i18n_message }.send(method)
  else
    i18n_message
  end
end

#http_auth_header? ⇒ Boolean (protected)

It does not make sense to send authenticate headers in ajax requests or if the user disabled them.

Returns:

  • (Boolean) 


128
129
130
 
# File 'lib/devise/failure_app.rb', line 128

def http_auth_header?
  Devise.mappings[scope].to.http_authenticatable && !request.xhr?
end

#i18n_message(default = nil) ⇒ Object (protected) 



67
68
69
70
71
72
73
74
75
76
 
# File 'lib/devise/failure_app.rb', line 67

def i18n_message(default = nil)
  message = warden_message || default || :unauthenticated

  if message.is_a?(Symbol)
    I18n.t(:"#{scope}.#{message}", :resource_name => scope,
           :scope => "devise.failure", :default => [message])
  else
    message.to_s
  end
end

#is_navigational_format? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


179
180
181
 
# File 'lib/devise/failure_app.rb', line 179

def is_navigational_format?
  Devise.navigational_formats.include?(request_format)
end

#recall ⇒ Object 



48
49
50
51
52
 
# File 'lib/devise/failure_app.rb', line 48

def recall
  env["PATH_INFO"]  = attempted_path
  flash.now[:alert] = i18n_message(:invalid)
  self.response = recall_app(warden_options[:recall]).call(env)
end

#recall_app(app) ⇒ Object (protected) 



144
145
146
147
148
149
 
# File 'lib/devise/failure_app.rb', line 144

def recall_app(app)
  controller, action = app.split("#")
  controller_name  = ActiveSupport::Inflector.camelize(controller)
  controller_klass = ActiveSupport::Inflector.constantize("#{controller_name}Controller")
  controller_klass.action(action)
end

#redirect ⇒ Object 



54
55
56
57
58
59
60
61
62
63
 
# File 'lib/devise/failure_app.rb', line 54

def redirect
  store_location!
  if flash[:timedout] && flash[:alert]
    flash.keep(:timedout)
    flash.keep(:alert)
  else
    flash[:alert] = i18n_message
  end
  redirect_to redirect_url
end

#redirect_url ⇒ Object (protected) 



78
79
80
81
82
83
84
85
 
# File 'lib/devise/failure_app.rb', line 78

def redirect_url
  if warden_message == :timeout
    flash[:timedout] = true
    attempted_path || scope_path
  else
    scope_path
  end
end

#request_format ⇒ Object (protected) 



183
184
185
 
# File 'lib/devise/failure_app.rb', line 183

def request_format
  @request_format ||= request.format.try(:ref)
end

#respond ⇒ Object 



31
32
33
34
35
36
37
38
39
 
# File 'lib/devise/failure_app.rb', line 31

def respond
  if http_auth?
    http_auth
  elsif warden_options[:recall]
    recall
  else
    redirect
  end
end

#scope ⇒ Object (protected) 



163
164
165
 
# File 'lib/devise/failure_app.rb', line 163

def scope
  @scope ||= warden_options[:scope] || Devise.default_scope
end

#scope_path ⇒ Object (protected) 



87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
 
# File 'lib/devise/failure_app.rb', line 87

def scope_path
  opts  = {}
  route = :"new_#{scope}_session_path"
  opts[:format] = request_format unless skip_format?

  config = Rails.application.config
  opts[:script_name] = (config.relative_url_root if config.respond_to?(:relative_url_root))

  context = send(Devise.available_router_name)

  if context.respond_to?(route)
    context.send(route, opts)
  elsif respond_to?(:root_path)
    root_path(opts)
  else
    "/"
  end
end

#skip_format? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


106
107
108
 
# File 'lib/devise/failure_app.rb', line 106

def skip_format?
  %w(html */*).include? request_format.to_s
end

#store_location! ⇒ Object (protected)

Stores requested uri to redirect the user after signing in. We cannot use scoped session provided by warden here, since the user is not authenticated yet, but we still need to store the uri based on scope, so different scopes would never use the same uri to redirect.



175
176
177
 
# File 'lib/devise/failure_app.rb', line 175

def store_location!
  session["#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
end

#warden ⇒ Object (protected) 



151
152
153
 
# File 'lib/devise/failure_app.rb', line 151

def warden
  env['warden']
end

#warden_message ⇒ Object (protected) 



159
160
161
 
# File 'lib/devise/failure_app.rb', line 159

def warden_message
  @message ||= warden.message || warden_options[:message]
end

#warden_options ⇒ Object (protected) 



155
156
157
 
# File 'lib/devise/failure_app.rb', line 155

def warden_options
  env['warden.options']
end