== Devise

Devise is a flexible authentication solution for Rails based on Warden. It:

* Is Rack based;
* Is a complete MVC solution based on Rails engines;
* Allows you to have multiple roles (or models/scopes) signed in at the same time;
* Is based on a modularity concept: use just what you really need.

Right now it's composed of five mainly modules:

* Authenticatable: responsible for encrypting password and validating authenticity of a user while signing in.
* Confirmable: responsible for verifying whether an account is already confirmed to sign in, and to send emails with confirmation instructions.
* Recoverable: takes care of reseting the user password and send reset instructions.
* Rememberable: manages generating and clearing token for remember the user from a saved cookie.
* Validatable: creates all needed validations for email and password. It's totally optional, so you're able to to customize validations by yourself.

There's an example application using Devise at http://github.com/plataformatec/devise_example .

== Dependencies

Devise is based on Warden (http://github.com/hassox/warden), a Rack Authentication Framework so you need to install it as a gem. Please ensure you have it installed in order to use devise (see instalation below).

== Installation

All gems are on gemcutter, so you need to add gemcutter to your sources if you haven't yet:

  sudo gem sources -a http://gemcutter.org/

Install warden gem if you don't have it installed (requires 0.5.2 or higher):

  sudo gem install warden

Install devise gem:

  sudo gem install devise

Configure warden and devise gems inside your app:

  config.gem 'warden'
  config.gem 'devise'

And you're ready to go.

== Basic Usage

This is a walkthrough with all steps you need to setup a devise resource, including model, migration, route files, and optional configuration. You can also check out the *Generators* section below to help you start.

Devise must be set up within the model (or models) you want to use, and devise routes must be created inside your routes.rb file.

We're assuming here you want a User model. First of all you have to setup a migration with the following fields:

  create_table :users do
    t.authenticatable
    t.confirmable
    t.recoverable
    t.rememberable
    t.timestamps
  end

You may also want to add some indexes to improve performance:

  add_index :your_table, :email
  add_index :your_table, :confirmation_token    # for confirmable
  add_index :your_table, :reset_password_token  # for recoverable

Now let's setup a User model adding the devise line to have your authentication working:

  class User < ActiveRecord::Base
    devise
  end

This line adds devise authenticatable automatically for you inside your User class. Devise don't rely on _attr_accessible_ or _attr_protected_ inside its modules, so be sure to setup what attributes are accessible or protected in your model.

You could also include the other devise modules as below:

  # Same as using only devise, authenticatable is activated by default
  devise :authenticatable

  # Include authenticatable + confirmable
  devise :confirmable

  # Include authenticatable + recoverable + rememberable
  devise :recoverable, :rememberable

  # Include all of them
  devise :all

  # Include all except recoverable
  devise :all, :except => :recoverable

Note that validations aren't added by default, so you're able to customize it. In order to have automatic validations working just include :validatable.

== Model configuration

In addition to :except, you can provide :pepper, :stretches, :encryptor, :authentication_keys, :confirm_within and :remember_for as options to devise method.

All those options are described in "config/initializers/devise.rb", which is generated when you invoke `ruby script/generate devise_install` in your application root.

== Routes

The next step after setting up your model is to configure your routes for devise. You do this by opening up your config/routes.rb and adding:

  map.devise_for :users

This is going to look inside you User model and create a set of needed routes (you can see them by running `rake routes`).

There are also some options available for configuring your routes, as :class_name (to set the class for that route), :as and :path_names, where the last two have the same meaning as in common routes. The available :path_names are:

  map.devise_for :users, :as => "usuarios", :path_names => { :sign_in => 'login', :sign_out => 'logout', :password => 'secret', :confirmation => 'verification' }

Be sure to check devise_for documentation for detailed description.

== Controller filters and helpers

Devise is gonna create some helpers to use inside your controllers and views. To setup a controller that needs user authentication, just add this before_filter:

  before_filter :authenticate_user!

To verify if a user is signed in, you have the following helper:

  user_signed_in?

And to get the current signed in user this helper is available:

  current_user

You have also access to the session for this scope:

  user_session

After signing in a user, confirming it's account or updating it's password, devise will look for a scoped root path to redirect. Example: For a :user resource, it will use user_root_path if it exists, otherwise default root_path will be used. To do it so, you need to create e default root inside your routes for your application:

  map.root :controller => 'home'

You can also overwrite after_sign_in_path_for and after_sign_out_path_for to customize better your redirect hooks.

Finally, if you are using confirmable or recoverable, you also need to setup default url options for the mailer. Here's is the configuration for development:

  DeviseMailer.sender = "no-reply@yourapp.com"
  config.action_mailer.default_url_options = { :host => 'localhost:3000' }

== Tidying up

Devise let's you setup as many roles as you want, so let's say you already have this User model and also want an Admin model with the same authentication stuff, but not confirmation or password recovery. Just follow the same steps:

  # Create a migration with the required fields
  create_table :admins do |t|
    t.authenticatable
  end

  # Inside your Admin model
  devise :validatable

  # Inside your routes
  map.devise_for :admin

  # Inside your protected controller
  before_filter :authenticate_admin!

  # Inside your controllers and views
  admin_signed_in?
  current_admin
  admin_session

== Generators

Devise comes with some generators to help you start:

  ruby script/generate devise_install

This will generate an initializer, with a description of all configuration values. You can also generate models through:

  ruby script/generate devise Model

A model configured with all devise modules and attr_accessible for default fields will be created. The generator will also create the migration and configure your routes for devise.

You can also copy devise views to your application, being able to modify them based on your needs. To do it so, run the following command:

  ruby script/generate devise_views

This is gonna copy all session, password, confirmation and mailer views to your app/views folder.

== I18n

Devise uses flash messages with I18n with the flash keys :success and :failure. To customize your app, you can setup your locale file this way:

  en:
    devise:
      sessions:
        signed_in: 'Signed in successfully.'

You can also create distinct messages based on the resource you've configured using the singular name given in routes:

  en:
    devise:
      sessions:
        user:
          signed_in: 'Welcome user, you are signed in.'
        admin:
          signed_in: 'Hello admin!'

Devise mailer uses the same pattern to create subject messages:

  en:
    devise:
      mailer:
        confirmation_instructions: 'Hello everybody!'
        user:
          confirmation_instructions: 'Hello User! Please confirm your email'
          reset_password_instructions: 'Reset instructions'

Take a look at our locale file to check all available messages.

== Test helpers

Devise includes some tests helpers for functional specs. To use them, you just
need to include Devise::TestHelpers in your test class and use the sign_in and
sign_out method. Such methods have the same signature as in controllers:

  sign_in :user, @user   # sign_in(scope, resource)
  sign_in @user          # sign_in(resource)

  sign_out :user         # sign_out(scope)
  sign_out @user         # sign_out(resource)

== Migrating from other solutions

Devise implements encryption strategies for Clearance, Authlogic and Restful-Authentication. To make use of it set the desired encryptor in the encryptor initializer config option. You might also need to rename your encrypted password and salt columns to match Devises's one (encrypted_password and password_salt).

== Other ORMs

Devise was made to work from scratch with ActiveRecord. However it currently supports MongoMapper as well.
To use it, just set Devise.orm or configure it in the initialization file (which is created with devise_install).

== TODO

Please refer to TODO file.

== Contributors

* José Valim (http://github.com/josevalim)
* Carlos Antônio da Silva (http://github.com/carlosantoniodasilva)
* Marcelo Silveira (http://github.com/mhfs)
* Cyril Mougel (http://github.com/shingara)

== Bugs and Feedback

If you discover any bugs or want to drop a line, feel free to create an issue on
GitHub or send an e-mail to the mailing list.

http://github.com/plataformatec/devise/issues
http://groups.google.com/group/plataformatec-devise

MIT License. Copyright 2009 Plataforma Tecnologia. http://blog.plataformatec.com.br