class ActionDispatch::Routing::Mapper
def authenticate(scope = nil, block = nil)
end
root to: "admin/dashboard#show", as: :user_root
authenticate :user, lambda {|u| u.role == "admin"} do
end
resources :users
authenticate(:admin) do
end
resources :post
authenticate do
on the model instance itself.
Takes an optional scope and block to provide constraints
Allow you to add authentication request from the router.
def authenticate(scope = nil, block = nil) constraints_for(:authenticate!, scope, block) do yield end end
def authenticated(scope = nil, block = nil)
root to: 'landing#show'
end
root to: "admin/dashboard#show", as: :user_root
authenticated :user, lambda {|u| u.role == "admin"} do
end
root to: 'dashboard#show', as: :authenticated_root
authenticated do
end
root to: 'admin/dashboard#show', as: :admin_root
authenticated :admin do
a model and allows extra constraints to be done on the instance.
can optionally specify which scope and a block. The block accepts
Allow you to route based on whether a scope is authenticated. You
def authenticated(scope = nil, block = nil) constraints_for(:authenticate?, scope, block) do yield end end
def constraints_for(method_to_apply, scope = nil, block = nil)
def constraints_for(method_to_apply, scope = nil, block = nil) constraint = lambda do |request| request.env['warden'].send(method_to_apply, scope: scope) && (block.nil? || block.call(request.env["warden"].user(scope))) end constraints(constraint) do yield end end
def devise_confirmation(mapping, controllers) #:nodoc:
def devise_confirmation(mapping, controllers) #:nodoc: resource :confirmation, only: [:new, :create, :show], path: mapping.path_names[:confirmation], controller: controllers[:confirmations] end
def devise_for(*resources)
end
post "deactivate", to: "registrations#deactivate", as: "deactivate_registration"
devise_scope :owner do
In order to get Devise to recognize the deactivate action, your devise_scope entry should look like this:
end
end
# deactivate code here
# not a standard action
def deactivate
end
# do something different here
def update
class RegistrationsController < Devise::RegistrationsController
For example:
overrides an out of the box Devise controller.
list of known actions. This is important if you add a custom action to a controller that
You can pass a block to devise_for that will add any routes defined in the block to Devise's
==== Adding custom actions to override controllers
end
end
{ locale: I18n.locale }
def self.default_url_options
class ApplicationController < ActionController::Base
ApplicationController class, so Devise can pick it:
you are required to configure default_url_options in your
end
devise_for :users
scope ":locale" do
this has one caveat: If you are using a dynamic segment, like so ...
However, since Devise uses the request path to retrieve the current user,
end
devise_for :users
scope "/my" do
Following Rails 3 routes DSL, you can nest devise_for calls inside a scope:
==== Scoping
* router_name: allows application level router name to be overwritten for the current scope
* defaults: works the same as Rails' defaults
* constraints: works the same as Rails' constraints
devise_for :users, format: false
* format: include "(.:format)" in the generated routes? true by default, set to false to disable:
devise_for :users, skip_helpers: [:registrations, :confirmations]
devise_for :users, skip: [:registrations, :confirmations], skip_helpers: true
given in :skip but it also accepts specific helpers to be skipped:
It accepts true as option, meaning it will skip all the helpers for the controllers
This is useful to avoid conflicts with previous routes and is false by default.
* skip_helpers: skip generating Devise url helpers like new_session_path(@user).
devise_for :users, only: :sessions
* only: the opposite of :skip, tell which controllers only to generate routes to:
devise_for :users, skip: :sessions
It accepts :all as an option, meaning it will not generate any route at all:
* skip: tell which controller you want to skip routes from being created.
devise_for :users, module: "users"
to namespace all at once, use module:
accessing devise/sessions, devise/registrations, and so on). If you want
* module: the namespace to find controllers (default: "devise", thus
You need to make sure that your sign_out controls trigger a request with a matching HTTP method.
devise_for :users, sign_out_via: [:get, :post]
if you wish to restrict this to accept only :post or :delete requests you should do:
* sign_out_via: the HTTP method(s) accepted for the :sign_out action (default: :delete),
are also allowed as parameter.
* failure_app: a rack app which is invoked whenever there is a failure. Strings representing a given
devise_for :users, controllers: { sessions: "users/sessions" }
However, if you want them to point to custom controller, you should do:
* controllers: the controller which should be used. All routes by default points to Devise controllers.
}
registration: 'register', edit: 'edit/profile'
password: 'secret', confirmation: 'verification',
sign_in: 'login', sign_out: 'logout',
devise_for :users, path_names: {
:password, :confirmation, :unlock.
* path_names: configure different path names to overwrite defaults :sign_in, :sign_out, :sign_up,
end
end
...
@manager = current_manager
def show
before_action authenticate_manager!
class ManagerController < ApplicationController
end
...
devise_scope :manager do
devise_for :admins, singular: :manager
and "#{singular}_session"), as the scope name in routes and as the scope given to warden.
names in controller ("authenticate_#{singular}!", "#{singular}_signed_in?", "current_#{singular}"
* singular: set up the singular name for the given resource. This is used as the helper methods
devise_for :users, path: 'accounts'
The following route configuration would set up your route as /accounts instead of /users:
* path: allows you to set up path name that will be used, as rails routes does.
devise_for :users, class_name: 'Account'
properly found by the route name.
* class_name: set up a different class to be looked up by devise, if it cannot be
You can configure your routes with some options:
==== Options
model name can be explicitly set via the :class_name option.
The only aspect not affect by the router configuration is the model name. The
publisher_account_signed_in, etc.
following methods: current_publisher_account, authenticate_publisher_account!,
for controllers and views. For example, using the above setup you'll end with
Also note that when you use a namespace it will affect all the helpers and methods
option described below to +devise_for+.
controller. You can revert this change or configure it directly by passing the :module
The snippet above will use publisher/sessions controller instead of devise/sessions
end
devise_for :account
namespace :publisher do
controllers:
by calling +devise_for+ inside a namespace, it automatically nests your devise
+devise_for+ is meant to play nicely with other routes methods. For example,
==== Routes integration
POST /users/confirmation(.:format) {controller:"devise/confirmations", action:"create"}
user_confirmation GET /users/confirmation(.:format) {controller:"devise/confirmations", action:"show"}
new_user_confirmation GET /users/confirmation/new(.:format) {controller:"devise/confirmations", action:"new"}
# Confirmation routes for Confirmable, if User model has :confirmable configured
POST /users/password(.:format) {controller:"devise/passwords", action:"create"}
user_password PUT /users/password(.:format) {controller:"devise/passwords", action:"update"}
edit_user_password GET /users/password/edit(.:format) {controller:"devise/passwords", action:"edit"}
new_user_password GET /users/password/new(.:format) {controller:"devise/passwords", action:"new"}
# Password routes for Recoverable, if User model has :recoverable configured
destroy_user_session DELETE /users/sign_out {controller:"devise/sessions", action:"destroy"}
user_session POST /users/sign_in {controller:"devise/sessions", action:"create"}
new_user_session GET /users/sign_in {controller:"devise/sessions", action:"new"}
# Session routes for Authenticatable (default)
needed routes:
This method is going to look inside your User model and create the
devise_for :users
confirmable and recoverable modules. After creating this inside your routes:
Let's say you have an User model configured to use authenticatable,
==== Examples
defined in your model.
generate all needed routes for devise, based on what modules you have
Includes devise_for method for routes. This method is responsible to
def devise_for(*resources) @devise_finalized = false raise_no_secret_key unless Devise.secret_key options = resources.extract_options! options[:as] ||= @scope[:as] if @scope[:as].present? options[:module] ||= @scope[:module] if @scope[:module].present? options[:path_prefix] ||= @scope[:path] if @scope[:path].present? options[:path_names] = (@scope[:path_names] || {}).merge(options[:path_names] || {}) options[:constraints] = (@scope[:constraints] || {}).merge(options[:constraints] || {}) options[:defaults] = (@scope[:defaults] || {}).merge(options[:defaults] || {}) options[:options] = @scope[:options] || {} options[:options][:format] = false if options[:format] == false resources.map!(&:to_sym) resources.each do |resource| mapping = Devise.add_mapping(resource, options) begin raise_no_devise_method_error!(mapping.class_name) unless mapping.to.respond_to?(:devise) rescue NameError => e raise unless mapping.class_name == resource.to_s.classify warn "[WARNING] You provided devise_for #{resource.inspect} but there is " \ "no model #{mapping.class_name} defined in your application" next rescue NoMethodError => e raise unless e.message.include?("undefined method `devise'") raise_no_devise_method_error!(mapping.class_name) end if options[:controllers] && options[:controllers][:omniauth_callbacks] unless mapping.omniauthable? raise ArgumentError, "Mapping omniauth_callbacks on a resource that is not omniauthable\n" \ "Please add `devise :omniauthable` to the `#{mapping.class_name}` model" end end routes = mapping.used_routes devise_scope mapping.name do with_devise_exclusive_scope mapping.fullpath, mapping.name, options do routes.each { |mod| send("devise_#{mod}", mapping, mapping.controllers) } end end end end
def devise_omniauth_callback(mapping, controllers) #:nodoc:
def devise_omniauth_callback(mapping, controllers) #:nodoc: if mapping.fullpath =~ /:[a-zA-Z_]/ raise <<-ERROR does not support scoping OmniAuth callbacks under a dynamic segment u have set #{mapping.fullpath.inspect}. You can work around by passing :omniauth_callbacks` to the `devise_for` call and extract omniauth s to another `devise_for` call outside the scope. Here is an example: vise_for :users, only: :omniauth_callbacks, controllers: {omniauth_callbacks: 'users/omniauth_callbacks'} ope '/(:locale)', locale: /ru|en/ do devise_for :users, skip: :omniauth_callbacks d end current_scope = @scope.dup if @scope.respond_to? :new @scope = @scope.new path: nil else @scope[:path] = nil end path_prefix = Devise.omniauth_path_prefix || "/#{mapping.fullpath}/auth".squeeze("/") set_omniauth_path_prefix!(path_prefix) mapping.to.omniauth_providers.each do |provider| match "#{path_prefix}/#{provider}", to: "#{controllers[:omniauth_callbacks]}#passthru", as: "#{provider}_omniauth_authorize", via: [:get, :post] match "#{path_prefix}/#{provider}/callback", to: "#{controllers[:omniauth_callbacks]}##{provider}", as: "#{provider}_omniauth_callback", via: [:get, :post] end ensure @scope = current_scope end
def devise_password(mapping, controllers) #:nodoc:
def devise_password(mapping, controllers) #:nodoc: resource :password, only: [:new, :create, :edit, :update], path: mapping.path_names[:password], controller: controllers[:passwords] end
def devise_registration(mapping, controllers) #:nodoc:
def devise_registration(mapping, controllers) #:nodoc: path_names = { new: mapping.path_names[:sign_up], edit: mapping.path_names[:edit], cancel: mapping.path_names[:cancel] } options = { only: [:new, :create, :edit, :update, :destroy], path: mapping.path_names[:registration], path_names: path_names, controller: controllers[:registrations] } resource :registration, options do get :cancel end end
def devise_scope(scope)
devise_for :users
end
get "/some/route" => "some_devise_controller"
devise_scope :user do
good and working example.
noun where other devise route commands expect the plural form. This would be a
Also be aware of that 'devise_scope' and 'as' use the singular form of the
raise ActionNotFound error.
you try to access a devise controller without specifying a scope, it will
Notice you cannot have two scopes mapping to the same URL. And remember, if
end
get "sign_in", to: "devise/sessions#new"
as :user do
to which controller it is targeted.
you are required to call this method (also aliased as :as) in order to specify
Sets the devise scope to be used in the controller. If you have custom routes,
def devise_scope(scope) constraint = lambda do |request| request.env["devise.mapping"] = Devise.mappings[scope] true end constraints(constraint) do yield end end
def devise_session(mapping, controllers) #:nodoc:
def devise_session(mapping, controllers) #:nodoc: resource :session, only: [], controller: controllers[:sessions], path: "" do get :new, path: mapping.path_names[:sign_in], as: "new" post :create, path: mapping.path_names[:sign_in] match :destroy, path: mapping.path_names[:sign_out], as: "destroy", via: mapping.sign_out_via end end
def devise_unlock(mapping, controllers) #:nodoc:
def devise_unlock(mapping, controllers) #:nodoc: if mapping.to.unlock_strategy_enabled?(:email) resource :unlock, only: [:new, :create, :show], path: mapping.path_names[:unlock], controller: controllers[:unlocks] end end
def raise_no_devise_method_error!(klass) #:nodoc:
def raise_no_devise_method_error!(klass) #:nodoc: raise "#{klass} does not respond to 'devise' method. This usually means you haven't " \ "loaded your ORM file or it's being loaded too late. To fix it, be sure to require 'devise/orm/YOUR_ORM' " \ "inside 'config/initializers/devise.rb' or before your application definition in 'config/application.rb'" end
def raise_no_secret_key #:nodoc:
def raise_no_secret_key #:nodoc: raise <<-ERROR .secret_key was not set. Please add the following to your Devise initializer: ig.secret_key = '#{SecureRandom.hex(64)}' ensure you restarted your application after installing Devise or setting the key. end
def set_omniauth_path_prefix!(path_prefix) #:nodoc:
def set_omniauth_path_prefix!(path_prefix) #:nodoc: if ::OmniAuth.config.path_prefix && ::OmniAuth.config.path_prefix != path_prefix raise "Wrong OmniAuth configuration. If you are getting this exception, it means that either:\n\n" \ "1) You are manually setting OmniAuth.config.path_prefix and it doesn't match the Devise one\n" \ "2) You are setting :omniauthable in more than one model\n" \ "3) You changed your Devise routes/OmniAuth setting and haven't restarted your server" else ::OmniAuth.config.path_prefix = path_prefix end end
def unauthenticated(scope = nil)
root to: 'dashboard#show'
end
end
root to: 'devise/registrations#new'
as :user do
unauthenticated do
You can optionally specify which scope.
Allow you to route based on whether a scope is *not* authenticated.
def unauthenticated(scope = nil) constraint = lambda do |request| not request.env["warden"].authenticate? scope: scope end constraints(constraint) do yield end end
def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc:
def with_devise_exclusive_scope(new_path, new_as, options) #:nodoc: current_scope = @scope.dup exclusive = { as: new_as, path: new_path, module: nil } exclusive.merge!(options.slice(:constraints, :defaults, :options)) if @scope.respond_to? :new @scope = @scope.new exclusive else exclusive.each_pair { |key, value| @scope[key] = value } end yield ensure @scope = current_scope end