<img src=“https://travis-ci.org/scambra/devise_invitable.png”/>
It adds support to devise for send invitations by email (it requires to be authenticated) and accept the invitation setting the password.
DeviseInvitable currently only support Rails 3, if you want to use it with Rails 2.3 you must install version 0.2.3
Install DeviseInvitable gem, it will also install dependencies (such as devise and warden):
gem install devise_invitable
Add DeviseInvitable to your Gemfile (and Devise if you weren’t using them):
gem 'devise', '>= 2.0.0' gem 'devise_invitable', '~> 1.1.0'
Run the following generator to add DeviseInvitable’s configuration option in the Devise configuration file (config/initializers/devise.rb):
rails generate devise_invitable:install
When you are done, you are ready to add DeviseInvitable to any of your Devise models using the following generator:
rails generate devise_invitable MODEL
Replace MODEL by the class name you want to add DeviseInvitable, like User, Admin, etc. This will add the :invitable flag to your model’s Devise modules. The generator will also create a migration file (if your ORM support them). Continue reading this file to understand exactly what the generator produces and how to use it.
Follow the walkthrough for Devise and after it’s done, follow this walkthrough.
Add :invitable to the devise call in your model (we’re assuming here you already have a User model with some Devise modules):
class User < ActiveRecord::Base devise :database_authenticatable, :confirmable, :invitable end
Add t.invitable to your Devise model migration:
create_table :users do
...
## Invitable
t.string :invitation_token, :limit => 60
t.datetime :invitation_sent_at
t.datetime :invitation_accepted_at
t.integer :invitation_limit
t.integer :invited_by_id
t.string :invited_by_type
...
end
add_index :users, :invitation_token, :unique => true
or for a model that already exists, define a migration to add DeviseInvitable to your model:
change_table :users do |t| t.string :invitation_token, :limit => 60 t.datetime :invitation_sent_at t.datetime :invitation_accepted_at t.integer :invitation_limit t.integer :invited_by_id t.string :invited_by_type end # Allow null encrypted_password change_column :users, :encrypted_password, :string, :null => true # Allow null password_salt (add it if you are using Devise's encryptable module) change_column :users, :password_salt, :string, :null => true
If you are using Mongoid, define the following fields and indexes within your invitable model:
field :invitation_token, type: String field :invitation_sent_at, type: Time field :invitation_accepted_at, type: Time field :invitation_limit, type: Integer index( {invitation_token: 1}, {:background => true} ) index( {invitation_by_id: 1}, {:background => true} )
You do not need to define a belongs_to relationship, as DeviseInvitable does this on your behalf:
belongs_to :invited_by, :polymorphic => true
Remember to create indexes within the MongoDB database after deploying your changes.
rake db:mongoid:create_indexes
DeviseInvitable adds some new configuration options:
-
invite_for: The period the generated invitation token is valid, after this period, the invited resource won’t be able to accept the invitation. When invite_for is 0 (the default), the invitation won’t expire.
You can set this configuration option in the Devise initializer as follow:
# ==> Configuration for :invitable # The period the generated invitation token is valid, after # this period, the invited resource won't be able to accept the invitation. # When invite_for is 0 (the default), the invitation won't expire. # config.invite_for = 2.weeks
or directly as parameters to the devise method:
devise :database_authenticatable, :confirmable, :invitable, :invite_for => 2.weeks
-
invitation_limit: The number of invitations users can send. The default value of nil means users can send as many invites as they want, there is no limit for any user, invitation_limit column is not used. A setting of 0 means they can’t send invitations. A setting n > 0 means they can send n invitations. You can change invitation_limit column for some users so they can send more or less invitations, even with global invitation_limit = 0.
-
invite_key: The key to be used to check existing users when sending an invitation. You can use multiple keys. This value must be a hash with the invite key as hash keys, and regexp to validate format as values. If you don’t want to validate the key you can set nil as validation format. The default value is looking for users by email and validating with Devise.email_regexp {:email => Devise.email_regexp}.
-
validate_on_invite: force a record to be valid before being actually invited.
-
resend_invitation: resend invitation if user with invited status is invited again. Enabled by default.
-
invited_by_class_name: The class name of the inviting model. If this is nil, polymorphic association is used.
For more details, see config/initializers/devise.rb (after you invoked the “devise_invitable:install” generator described above).
All the views are packaged inside the gem. If you’d like to customize the views, invoke the following generator and it will copy all the views to your application:
rails generate devise_invitable:views
You can also use the generator to generate scoped views:
rails generate devise_invitable:views users
Please refer to Devise’s README for more information about views.
To change the controller’s behavior, create a controller that inherits from Devise::InvitationsController. The available methods are: new, create, edit, and update. You should read the original controllers source before editing any of these actions. Your controller might now look something like this:
class Users::InvitationsController < Devise::InvitationsController def update if this redirect_to root_path else super end end end
Now just tell Devise that you want to use your controller, the controller above is ‘users/invitations’, so our routes.rb would have this line:
devise_for :users, :controllers => { :invitations => 'users/invitations' }
be sure that you generate the views and put them into the controller that you generated, so for this example it would be:
rails generate devise_invitable:views users/invitations
To send an invitation to a user, use the invite! class method. :email must be present in the parameters hash. You can also include other attributes in the hash. The record will not be validated.
User.invite!(:email => "new_user@example.com", :name => "John Doe") # => an invitation email will be sent to new_user@example.com
If you want to create the invitation but not send it, you can set skip_invitation to true.
User.invite!(:email => "new_user@example.com", :name => "John Doe") do |u| u.skip_invitation = true end # => the record will be created, but the invitation email will not be sent
When skip_invitation is used, you must also then set the invitation_sent_at field when the user is sent their token. Failure to do so will yield “Invalid invitation token” errors when the user attempts to accept the invite. You can set it like so:
user.invitation_sent_at = Time.now.utc user.save!
You can add :skip_invitation to attributes hash if skip_invitation is added to attr_accessible.
User.invite!(:email => "new_user@example.com", :name => "John Doe", :skip_invitation => true) # => the record will be created, but the invitation email will not be sent
Skip_invitation skips sending the email, but sets invitation_token, so invited_to_sign_up? on the resulting user returns true.
You can send an invitation to an existing user if your workflow creates them separately:
user = User.find(42) user.invite!(current_user) # current user is optional to set the invited_by attribute
You can also set invited_by when using the invite! class method:
User.invite!({:email => "new_user@example.com"}, current_user) # current_user will be set as invited_by
To accept an invitation with a token use the accept_invitation! class method. :invitation_token must be present in the parameters hash. You can also include other attributes in the hash.
User.accept_invitation!(:invitation_token => params[:invitation_token], :password => "ad97nwj3o2", :name => "John Doe")
A callback event is fired before and after an invitation is accepted (User#accept_invitation!). For example, in your resource model you can add:
after_invitation_accepted :email_invited_by def email_invited_by # ... end
The callbacks support all options and arguments available to the standard callbacks provided by AR.
A pair of scopes to find those users that have accepted, and those that have not accepted, invitations are defined:
User.invitation_accepted # => returns all Users for whom the invitation_accepted_at attribute is not nil User.invitation_not_accepted # => returns all Users for whom the invitation_accepted_at attribute is nil
Since the invitations controller take care of all the creation/acceptation of an invitation, in most cases you wouldn’t call the invite! and accept_invitation! methods directly. Instead, in your views, put a link to new_user_invitation_path or new_invitation_path(:user) or even /users/invitation/new to prepare and send an invitation (to a user in this example).
After an invitation is created and sent, the inviter will be redirected to after_invite_path_for(resource_name), which is stored path or the same path as after_sign_in_path_for by default.
After an invitation is accepted, the invitee will be redirected to after_accept_path_for(resource), which is the same path as after_sign_in_path_for by default. If you want to override the path, override invitations controller and define after_accept_path_for method. This is useful in the common case that a user is invited to a specific location in your application. More on Devise’s README, “Controller filters and helpers” section.
The invitation email includes a link to accept the invitation that looks like this: /users/invitation/accept?invitation_token=abcd123. When clicked, the invited must set a password in order to accept its invitation. Note that if the invitation_token is not present or not valid, the invited is redirected to after_sign_out_path_for(resource_name).
The controller sets the invited_by_id attribute for the new user to the current user. This will let you easily keep track of who invited who.
InvitationsController uses authenticate_inviter! filter to restrict who can send invitations. You can override this method in your ApplicationController.
Default behavior requires authentication of the same resource as the invited one. For example, if your model User is invitable, it will allow all authenticated users to send invitations to other users.
You would have a User model which is configured as invitable and an Admin model which is not. If you want to allow only admins to send invitations, simply overwrite the authenticate_inviter! method as follow:
class ApplicationController < ActionController::Base protected def authenticate_inviter! authenticate_admin!(:force => true) end end
And include DeviseInvitable::Inviter module into Admin model:
class Admin < ActiveRecord::Base devise :database_authenticatable, :validatable include DeviseInvitable::Inviter end
If you want to get all records invited by a resource, you should define has_many association in the model allowed to send invitations.
For the default behavior, define it like this:
has_many :invitations, :class_name => self.to_s, :as => :invited_by
For the previous example, where admins send invitations to users, define it like this:
has_many :invitations, :class_name => 'User', :as => :invited_by
DeviseInvitable uses flash messages with I18n with the flash keys :send_instructions, :invitation_token_invalid and :updated. To customize your app, you can modify the generated locale file:
en:
devise:
invitations:
send_instructions: 'An invitation email has been sent to %{email}.'
invitation_token_invalid: 'The invitation token provided is not valid!'
updated: 'Your password was set successfully. You are now signed in.'
You can also create distinct messages based on the resource you’ve configured using the singular name given in routes:
en:
devise:
invitations:
user:
send_instructions: 'A new user invitation has been sent to %{email}.'
invitation_token_invalid: 'Your invitation token is not valid!'
updated: 'Welcome on board! You are now signed in.'
The DeviseInvitable mailer uses the same pattern as Devise to create mail subject messages:
en:
devise:
mailer:
invitation_instructions:
subject: 'You got an invitation!'
user_subject: 'You got a user invitation!'
Take a look at the generated locale file (in config/locales/devise_invitable.en.yml) to check all available messages.
DeviseInvitable supports ActiveRecord and Mongoid, like Devise.
To test DeviseInvitable for the ActiveRecord ORM with RVM, Ruby 1.9.2, and Rubygems 1.8.17:
rvm use 1.9.2 rvm gemset create devise_invitable rvm gemset use devise_invitable gem install bundler bundle rake test DEVISE_ORM=active_record
Check them all at:
github.com/scambra/devise_invitable/contributors
Special thanks to rymai for the Rails 3 support, his fork was a great help.
-
Fork the project.
-
Make your feature addition or bug fix.
-
Add tests for it. This is important so I don’t break it in a future version unintentionally.
-
Commit, do not mess with rakefile, version, or history. (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
-
Send me a pull request. Bonus points for topic branches.
Copyright © 2012 Sergio Cambra. See LICENSE for details.