From Mustafa Ekim via the mailing list.

I find it odd having to define constants in environment files as part of the config. I've updated my fork (samg/clearance) to use a config/clearance.yml file instead of HOST and DO_NOT_REPLY constants. This seems more in keeping with rails conventions, and more maintainable since it centralizes the engine's config.

All tests and features pass, and I've updated README.textile, and the generator README to reflect this configuration method.

(sorry for the pull request. missed that in the readme)

User#clear_token should raise unless email_confirmed?.

Just like the title says, Clearance routes are loaded before the app routes if ActiveSupport::Inflector.inflections is called. Issue occurs even if the block passed to #inflections is empty.

Clearly this is a problem in ActiveSupport or ActionPack (or both), but I'm stretching my knowledge of Rails internals, so maybe someone else can dig around and see what's what.

I'm running Rails 2.3.2 and Clearance 0.6.7.

Steps to reproduce:

1. Create a fresh Rails 2.3.2 app
   
2. Install Clearance like normal (add gem dependency to environment.rb, unpack to vendor/gems, script/generate clearance)
   
3. rake db:migrate
   

4. Open config/initializers/inflections.rb and change it to the following:

   # Be sure to restart your server when you modify this file.
   
   # Add new inflection rules using the following format 
   # (all these examples are active by default):
   ActiveSupport::Inflector.inflections do |inflect|
   #   inflect.plural /^(ox)$/i, '\1en'
   #   inflect.singular /^(ox)en/i, '\1'
   #   inflect.irregular 'person', 'people'
   #   inflect.uncountable %w( fish sheep )
   end
   

5. Add a route to config/routes.rb
   

6. rake routes ... the route added in step 5 will be at the bottom.

Chris

Hi,

I needed to have HTTP authentication on current project using Clearance, and discovered Clearance does not provide it. I implemented it as following patch:

http://gist.github.com/159604

Does adding feature like this make sense to you?

(Note: I've tried to implement it directly to Clearance, but have not found an obvious way where to put the tests. I could not persuade AccountsControllerTest to have access to User or Factory(:email_confirmed_user) etc and had to give up.)

looks like password_confirmation validation is not fired when a password is present because of the password_required if conditional:

validates_presence_of     :password, :if => :password_required?
validates_confirmation_of :password, :if => :password_required?

should rather validate if password is not blank, versus password_required right?

Unit test example:

def test_password_confirmation_is_never_checked
  unimportant = {
    :email => "someone@somewhere.com",
    :email_confirmed => true
  }
  @user = User.new( unimportant.merge(:password => 'password',
                         :password_confirmation => 'not_password' ))
  assert @user.valid?
end

For clearance 0.7.0:
In app/views/sessions/new.html.erb and lib/clearance/authentication.rb the old routes are still used. For aesthetics they should be changed to new named routes, sign_in_url and sign_up_path

Suggested changes in my fork
http://github.com/tonkapark/clearance/commit/21955077256a197751af6a6c5af89a55eb3ac334

Figure out how to write this test. Look at how Rails tests hide_action.

So I don't have to override them when I add before_filter :authenticate in my application controller.

Please pull this branch.
http://github.com/rmm5t/clearance/commits/fixing_ping_pong_sessions

This is in reference to the recent clearance google groups thread:
http://groups.google.com/group/thoughtbot-clearance/browse_thread/thread/d071ae84573e40ff

This includes:

• Deprecated User#remember_me! for User#reset_remember_token!
• Removed User#initialize_confirmation_token from before_save; added #generate_confirmation_token to before_create
• Reset the remember_token on sign out instead of sign in

This also includes the "global sign out" feature. I stuck it in there simply because there was already a controller test that expected the sign out to reset the remember_token; it just wasn't testing it correctly before. Plus I'm partial to the feature. If it's a problem, it's easy to change. Just remove the call to reset_remember_token! in Clearance::Authentication::InstanceMethods#signout.

It can be done in two ways:

1) Create the corresponding haml templates from the erbs and basically accept an additional command-line argument from the user when generating views. So, for generating haml templates the command would become:

script/generate clearance_views haml

This would basically copy the files over from templates/haml/formtastic to the appropriate location in the application.

2) Generate the haml templates from the corresponding erb templates on the fly by employing nifty html2haml.

Well, I have already implemented the first one as it is quite easy but my proclivity is towards the second one. I would like to take Dan's opinion on this one.

To recreate, simple create two users with the same password and log both users in on the same day with the remember me option selected. Because the remember_me token is only encrypt("--#{Time.now.utc}--#{password}--") and neither of these values are unique the tokens will clash.

We actually had this problem occur on one of our servers....

Well i officially don't know why this isn't working, even after the wiki update for the wonky route that was screwing me up before....

class SessionsController < Clearance::SessionsController
  # ssl_required :new
  private
  def url_after_create
    some_wicked_path
  end
end

and in the routes i have

map.session 'session', :controller => 'sessions', :action => 'create'

I'm not sure why this isn't working. i thought this is all i had to do after i read the wiki entry under useage. One day when i was messing around with the Clearance_routes.rb file, it started to work, because i changed clearance_routes to routes and got rid of the extentions/routes.rb file... Just to see what would happen.

So i was excited when i saw this functionality work, but in a new 0.7.0 version of clearance gem, it doesn't work for me. thoughts?

hi another issue i'd like to report, can i put clearance controllers into https://?

i tried simply adding

class SessionsController < Clearance::SessionsController
  ssl_required :new
end

into the controller but no dice. i didn't want to hack the gem yet either. wondering if it's possible?