Class: Devise::FailureApp

Inherits:
ActionController::Metal
  • Object
show all
Includes:
ActionController::RackDelegation, ActionController::Redirecting, ActionController::UrlFor
Defined in:
lib/devise/failure_app.rb

Overview

Failure application that will be called every time :warden is thrown from any strategy or hook. Responsible for redirect the user to the sign in page based on current scope and mapping. If no scope is given, redirect to the default_url.

Class Method Summary collapse

Instance Method Summary collapse

Class Method Details

.call(env) ⇒ Object 



18
19
20
21
 
# File 'lib/devise/failure_app.rb', line 18

def self.call(env)
  @respond ||= action(:respond)
  @respond.call(env)
end

.default_url_options(*args) ⇒ Object 



23
24
25
26
27
28
29
 
# File 'lib/devise/failure_app.rb', line 23

def self.default_url_options(*args)
  if defined?(ApplicationController)
    ApplicationController.default_url_options(*args)
  else
    {}
  end
end

Instance Method Details

#attempted_path ⇒ Object (protected) 



174
175
176
 
# File 'lib/devise/failure_app.rb', line 174

def attempted_path
  warden_options[:attempted_path]
end

#http_auth ⇒ Object 



41
42
43
44
45
46
 
# File 'lib/devise/failure_app.rb', line 41

def http_auth
  self.status = 401
  self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect}) if http_auth_header?
  self.content_type = request.format.to_s
  self.response_body = http_auth_body
end

#http_auth? ⇒ Boolean (protected)

Choose whether we should respond in a http authentication fashion, including 401 and optional headers.

This method allows the user to explicitly disable http authentication on ajax requests in case they want to redirect on failures instead of handling the errors on their own. This is useful in case your ajax API is the same as your public API and uses a format like JSON (so you cannot mark JSON as a navigational format).

Returns:

  • (Boolean) 


125
126
127
128
129
130
131
 
# File 'lib/devise/failure_app.rb', line 125

def http_auth?
  if request.xhr?
    Devise.http_authenticatable_on_xhr
  else
    !(request_format && is_navigational_format?)
  end
end

#http_auth_body ⇒ Object (protected) 



139
140
141
142
143
144
145
146
147
148
149
 
# File 'lib/devise/failure_app.rb', line 139

def http_auth_body
  return i18n_message unless request_format
  method = "to_#{request_format}"
  if method == "to_xml"
    { :error => i18n_message }.to_xml(:root => "errors")
  elsif {}.respond_to?(method)
    { :error => i18n_message }.send(method)
  else
    i18n_message
  end
end

#http_auth_header? ⇒ Boolean (protected)

It does not make sense to send authenticate headers in ajax requests or if the user disabled them.

Returns:

  • (Boolean) 


135
136
137
 
# File 'lib/devise/failure_app.rb', line 135

def http_auth_header?
  Devise.mappings[scope].to.http_authenticatable && !request.xhr?
end

#i18n_message(default = nil) ⇒ Object (protected) 



67
68
69
70
71
72
73
74
75
76
 
# File 'lib/devise/failure_app.rb', line 67

def i18n_message(default = nil)
  message = warden_message || default || :unauthenticated

  if message.is_a?(Symbol)
    I18n.t(:"#{scope}.#{message}", :resource_name => scope,
           :scope => "devise.failure", :default => [message])
  else
    message.to_s
  end
end

#is_navigational_format? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


186
187
188
 
# File 'lib/devise/failure_app.rb', line 186

def is_navigational_format?
  Devise.navigational_formats.include?(request_format)
end

#recall ⇒ Object 



48
49
50
51
52
 
# File 'lib/devise/failure_app.rb', line 48

def recall
  env["PATH_INFO"]  = attempted_path
  flash.now[:alert] = i18n_message(:invalid)
  self.response = recall_app(warden_options[:recall]).call(env)
end

#recall_app(app) ⇒ Object (protected) 



151
152
153
154
155
156
 
# File 'lib/devise/failure_app.rb', line 151

def recall_app(app)
  controller, action = app.split("#")
  controller_name  = ActiveSupport::Inflector.camelize(controller)
  controller_klass = ActiveSupport::Inflector.constantize("#{controller_name}Controller")
  controller_klass.action(action)
end

#redirect ⇒ Object 



54
55
56
57
58
59
60
61
62
63
 
# File 'lib/devise/failure_app.rb', line 54

def redirect
  store_location!
  if flash[:timedout] && flash[:alert]
    flash.keep(:timedout)
    flash.keep(:alert)
  else
    flash[:alert] = i18n_message
  end
  redirect_to redirect_url
end

#redirect_url ⇒ Object (protected) 



78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/devise/failure_app.rb', line 78

def redirect_url
  if warden_message == :timeout
    flash[:timedout] = true

    path = if request.get?
      attempted_path
    else
      request.referrer
    end

    path || scope_path
  else
    scope_path
  end
end

#request_format ⇒ Object (protected) 



190
191
192
 
# File 'lib/devise/failure_app.rb', line 190

def request_format
  @request_format ||= request.format.try(:ref)
end

#respond ⇒ Object 



31
32
33
34
35
36
37
38
39
 
# File 'lib/devise/failure_app.rb', line 31

def respond
  if http_auth?
    http_auth
  elsif warden_options[:recall]
    recall
  else
    redirect
  end
end

#scope ⇒ Object (protected) 



170
171
172
 
# File 'lib/devise/failure_app.rb', line 170

def scope
  @scope ||= warden_options[:scope] || Devise.default_scope
end

#scope_path ⇒ Object (protected) 



94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
 
# File 'lib/devise/failure_app.rb', line 94

def scope_path
  opts  = {}
  route = :"new_#{scope}_session_path"
  opts[:format] = request_format unless skip_format?

  config = Rails.application.config
  opts[:script_name] = (config.relative_url_root if config.respond_to?(:relative_url_root))

  context = send(Devise.available_router_name)

  if context.respond_to?(route)
    context.send(route, opts)
  elsif respond_to?(:root_path)
    root_path(opts)
  else
    "/"
  end
end

#skip_format? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


113
114
115
 
# File 'lib/devise/failure_app.rb', line 113

def skip_format?
  %w(html */*).include? request_format.to_s
end

#store_location! ⇒ Object (protected)

Stores requested uri to redirect the user after signing in. We cannot use scoped session provided by warden here, since the user is not authenticated yet, but we still need to store the uri based on scope, so different scopes would never use the same uri to redirect.



182
183
184
 
# File 'lib/devise/failure_app.rb', line 182

def store_location!
  session["#{scope}_return_to"] = attempted_path if request.get? && !http_auth?
end

#warden ⇒ Object (protected) 



158
159
160
 
# File 'lib/devise/failure_app.rb', line 158

def warden
  env['warden']
end

#warden_message ⇒ Object (protected) 



166
167
168
 
# File 'lib/devise/failure_app.rb', line 166

def warden_message
  @message ||= warden.message || warden_options[:message]
end

#warden_options ⇒ Object (protected) 



162
163
164
 
# File 'lib/devise/failure_app.rb', line 162

def warden_options
  env['warden.options']
end