Class: Devise::FailureApp

Inherits:
ActionController::Metal
  • Object
show all
Includes:
ActionController::Redirecting, ActionController::UrlFor, Controllers::StoreLocation
Defined in:
lib/devise/failure_app.rb

Overview

Failure application that will be called every time :warden is thrown from any strategy or hook. It is responsible for redirecting the user to the sign in page based on current scope and mapping. If no scope is given, it redirects to the default_url.

Class Method Summary collapse

Instance Method Summary collapse

Methods included from Controllers::StoreLocation

#store_location_for, #stored_location_for

Class Method Details

.call(env) ⇒ Object 



21
22
23
24
 
# File 'lib/devise/failure_app.rb', line 21

def self.call(env)
  @respond ||= action(:respond)
  @respond.call(env)
end

.default_url_options(*args) ⇒ Object

Try retrieving the URL options from the parent controller (usually ApplicationController). Instance methods are not supported at the moment, so only the class-level attribute is used.



29
30
31
32
33
34
35
 
# File 'lib/devise/failure_app.rb', line 29

def self.default_url_options(*args)
  if defined?(Devise.parent_controller.constantize)
    Devise.parent_controller.constantize.try(:default_url_options) || {}
  else
    {}
  end
end

Instance Method Details

#attempted_path ⇒ Object (protected) 



238
239
240
 
# File 'lib/devise/failure_app.rb', line 238

def attempted_path
  warden_options[:attempted_path]
end

#http_auth ⇒ Object 



47
48
49
50
51
52
 
# File 'lib/devise/failure_app.rb', line 47

def http_auth
  self.status = 401
  self.headers["WWW-Authenticate"] = %(Basic realm=#{Devise.http_authentication_realm.inspect}) if http_auth_header?
  self.content_type = request.format.to_s
  self.response_body = http_auth_body
end

#http_auth? ⇒ Boolean (protected)

Choose whether we should respond in an HTTP authentication fashion, including 401 and optional headers.

This method allows the user to explicitly disable HTTP authentication on AJAX requests in case they want to redirect on failures instead of handling the errors on their own. This is useful in case your AJAX API is the same as your public API and uses a format like JSON (so you cannot mark JSON as a navigational format).

Returns:

  • (Boolean) 


185
186
187
188
189
190
191
 
# File 'lib/devise/failure_app.rb', line 185

def http_auth?
  if request.xhr?
    Devise.http_authenticatable_on_xhr
  else
    !(request_format && is_navigational_format?)
  end
end

#http_auth_body ⇒ Object (protected) 



199
200
201
202
203
204
205
206
207
208
209
 
# File 'lib/devise/failure_app.rb', line 199

def http_auth_body
  return i18n_message unless request_format
  method = "to_#{request_format}"
  if method == "to_xml"
    { error: i18n_message }.to_xml(root: "errors")
  elsif {}.respond_to?(method)
    { error: i18n_message }.send(method)
  else
    i18n_message
  end
end

#http_auth_header? ⇒ Boolean (protected)

It doesn’t make sense to send authenticate headers in AJAX requests or if the user disabled them.

Returns:

  • (Boolean) 


195
196
197
 
# File 'lib/devise/failure_app.rb', line 195

def http_auth_header?
  scope_class.http_authenticatable && !request.xhr?
end

#i18n_message(default = nil) ⇒ Object (protected) 



100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/devise/failure_app.rb', line 100

def i18n_message(default = nil)
  message = warden_message || default || :unauthenticated

  if message.is_a?(Symbol)
    options = {}
    options[:resource_name] = scope
    options[:scope] = "devise.failure"
    options[:default] = [message]
    auth_keys = scope_class.authentication_keys
    keys = (auth_keys.respond_to?(:keys) ? auth_keys.keys : auth_keys).map { |key| scope_class.human_attribute_name(key) }
    options[:authentication_keys] = keys.join(I18n.translate(:"support.array.words_connector"))
    options = i18n_options(options)

    I18n.t(:"#{scope}.#{message}", **options)
  else
    message.to_s
  end
end

#i18n_options(options) ⇒ Object (protected) 



96
97
98
 
# File 'lib/devise/failure_app.rb', line 96

def i18n_options(options)
  options
end

#is_flashing_format? ⇒ Boolean (protected)

Check if flash messages should be emitted. Default is to do it on navigational formats

Returns:

  • (Boolean) 


256
257
258
 
# File 'lib/devise/failure_app.rb', line 256

def is_flashing_format?
  request.respond_to?(:flash) && is_navigational_format?
end

#is_navigational_format? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


250
251
252
 
# File 'lib/devise/failure_app.rb', line 250

def is_navigational_format?
  Devise.navigational_formats.include?(request_format)
end

#recall ⇒ Object 



54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
 
# File 'lib/devise/failure_app.rb', line 54

def recall
  header_info = if relative_url_root?
    base_path = Pathname.new(relative_url_root)
    full_path = Pathname.new(attempted_path)

    { "SCRIPT_NAME" => relative_url_root,
      "PATH_INFO" => '/' + full_path.relative_path_from(base_path).to_s }
  else
    { "PATH_INFO" => attempted_path }
  end

  header_info.each do | var, value|
    if request.respond_to?(:set_header)
      request.set_header(var, value)
    else
      request.env[var]  = value
    end
  end

  flash.now[:alert] = i18n_message(:invalid) if is_flashing_format?
  self.response = recall_app(warden_options[:recall]).call(request.env).tap { |response|
    response[0] = Rack::Utils.status_code(
      response[0].in?(300..399) ? Devise.responder.redirect_status : Devise.responder.error_status
    )
  }
end

#recall_app(app) ⇒ Object (protected) 



211
212
213
214
215
216
 
# File 'lib/devise/failure_app.rb', line 211

def recall_app(app)
  controller, action = app.split("#")
  controller_name  = ActiveSupport::Inflector.camelize(controller)
  controller_klass = ActiveSupport::Inflector.constantize("#{controller_name}Controller")
  controller_klass.action(action)
end

#redirect ⇒ Object 



81
82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/devise/failure_app.rb', line 81

def redirect
  store_location!
  if is_flashing_format?
    if flash[:timedout] && flash[:alert]
      flash.keep(:timedout)
      flash.keep(:alert)
    else
      flash[:alert] = i18n_message
    end
  end
  redirect_to redirect_url
end

#redirect_url ⇒ Object (protected) 



119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
 
# File 'lib/devise/failure_app.rb', line 119

def redirect_url
  if warden_message == :timeout
    flash[:timedout] = true if is_flashing_format?

    path = if request.get?
      attempted_path
    else
      request.referrer
    end

    path || scope_url
  else
    scope_url
  end
end

#relative_url_root ⇒ Object (protected) 



264
265
266
267
268
269
270
 
# File 'lib/devise/failure_app.rb', line 264

def relative_url_root
  @relative_url_root ||= begin
    config = Rails.application.config

    config.try(:relative_url_root) || config.action_controller.try(:relative_url_root)
  end
end

#relative_url_root? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


272
273
274
 
# File 'lib/devise/failure_app.rb', line 272

def relative_url_root?
  relative_url_root.present?
end

#request_format ⇒ Object (protected) 



260
261
262
 
# File 'lib/devise/failure_app.rb', line 260

def request_format
  @request_format ||= request.format.try(:ref)
end

#respond ⇒ Object 



37
38
39
40
41
42
43
44
45
 
# File 'lib/devise/failure_app.rb', line 37

def respond
  if http_auth?
    http_auth
  elsif warden_options[:recall]
    recall
  else
    redirect
  end
end

#route(scope) ⇒ Object (protected) 



135
136
137
 
# File 'lib/devise/failure_app.rb', line 135

def route(scope)
  :"new_#{scope}_session_url"
end

#scope ⇒ Object (protected) 



230
231
232
 
# File 'lib/devise/failure_app.rb', line 230

def scope
  @scope ||= warden_options[:scope] || Devise.default_scope
end

#scope_class ⇒ Object (protected) 



234
235
236
 
# File 'lib/devise/failure_app.rb', line 234

def scope_class
  @scope_class ||= Devise.mappings[scope].to
end

#scope_url ⇒ Object (protected) 



139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
 
# File 'lib/devise/failure_app.rb', line 139

def scope_url
  opts  = {}

  # Initialize script_name with nil to prevent infinite loops in
  # authenticated mounted engines in rails 4.2 and 5.0
  opts[:script_name] = nil

  route = route(scope)

  opts[:format] = request_format unless skip_format?

  router_name = Devise.mappings[scope].router_name || Devise.available_router_name
  context = send(router_name)

  if relative_url_root?
    opts[:script_name] = relative_url_root

  # We need to add the rootpath to `script_name` manually for applications that use a Rails
  # version lower than 5.1. Otherwise, it is going to generate a wrong path for Engines
  # that use Devise. Remove it when the support of Rails 5.0 is dropped.
  elsif root_path_defined?(context) && !rails_51_and_up?
    rootpath = context.routes.url_helpers.root_path
    opts[:script_name] = rootpath.chomp('/') if rootpath.length > 1
  end

  if context.respond_to?(route)
    context.send(route, opts)
  elsif respond_to?(:root_url)
    root_url(opts)
  else
    "/"
  end
end

#skip_format? ⇒ Boolean (protected)

Returns:

  • (Boolean) 


173
174
175
 
# File 'lib/devise/failure_app.rb', line 173

def skip_format?
  %w(html */* turbo_stream).include? request_format.to_s
end

#store_location! ⇒ Object (protected)

Stores requested URI to redirect the user after signing in. We can’t use the scoped session provided by warden here, since the user is not authenticated yet, but we still need to store the URI based on scope, so different scopes would never use the same URI to redirect.



246
247
248
 
# File 'lib/devise/failure_app.rb', line 246

def store_location!
  store_location_for(scope, attempted_path) if request.get? && !http_auth?
end

#warden ⇒ Object (protected) 



218
219
220
 
# File 'lib/devise/failure_app.rb', line 218

def warden
  request.respond_to?(:get_header) ? request.get_header("warden") : request.env["warden"]
end

#warden_message ⇒ Object (protected) 



226
227
228
 
# File 'lib/devise/failure_app.rb', line 226

def warden_message
  @message ||= warden.message || warden_options[:message]
end

#warden_options ⇒ Object (protected) 



222
223
224
 
# File 'lib/devise/failure_app.rb', line 222

def warden_options
  request.respond_to?(:get_header) ? request.get_header("warden.options") : request.env["warden.options"]
end