Thank you to all the contributors!
New for 1.0.0:
- Change default password strategy to BCrypt.
- Speed up test suites using
- Speed up integration suites with
- Replace email regular expression with
BCryptMigrationFromSHA1password strategy to help people migrate from SHA1 (the old default password strategy) to BCrypt (the new default).
- Require > Ruby 1.9.
- More extension points in more controllers.
remember_tokenfields of the users table are
NOT NULLin the default migration.
- Add a fake password strategy, which is useful when writing tests.
- Improve security when changing password.
- Replace Cucumber feature generator with RSpec + Capybara.
- Remove Diesel dependency.
- Remove deprecated methods on User:
params[:user]has changed to
params[:password_reset]to avoid locale conflicts.
- Prepare for Rails 4.
- Prepare for Ruby 2.
unloadablefrom controllers (Rails 4 bug fix in development environment).
- Unauthorized API requests return HTTP status 401 rather than a redirect to the sign in page.
- Remove support for supplying return_to value via request parameter.
New for 0.16.2 (May 11, 2012):
- Change default email sender to
New for 0.16.1 (April 16, 2012):
- Behave correctly when Rails whitelist attributes mass assignment protection is turned on.
- Fix for Rails 3.2.x modifying the HTTP cookie headers in rack requests.
New for 0.16.0 (March 16, 2012):
- Blowfish password encryption strategy.
New for 0.15.0 (February 3, 2012):
Usermodel can be swapped out using the
User::InstanceMethodsto silence a Rails 3.2 deprecation warning.
- Bump development dependency of cucumber-rails to 1.1.1.
New for 0.14.0 (January 13, 2012):
- Support clearance session management from the Rack environment.
New for 0.13.2 (January 13, 2012):
- Fixed the
New for 0.13.0 (October 11, 2011):
- In Clearance's optional generated features, use pure Capybara instead of
depending on Cucumber's removed
web_steps, paths, and selectors.
- Extract SHA-1-specific code out of
- Extract sign in form so that other methods can be added easily.
- Test against Rails 3.1. Required upgrades to Diesel and Appraisal.
- Improved README documentation for overrides.
New for 0.12.0 (June 30, 2011):
- Denying access redirects to
root_urlwhen signed in,
sign_in_urlwhen signed out.
- Using flash
:noticekey everywhere now instead of
:failure. More in line with Rails conventions.
redirect_back_oron sign up.
- Resetting password no longer redirects to sign in page. It displays a message telling them to look for an email.
- Removed redundant flash messages. ("Signed in.", "Signed out.", and "You are now signed up.")
New for 0.11.2 (June 29, 2011):
- Rails 3.1.rc compatible.
- Cucumber features no longer require password.
- No more Clearance
shoulda_macros. Instead providing RSpec- and Test::Unit-compliant test matchers (
should deny_access, etc).
New for 0.11.1 (April 30, 2011):
- Redirect to home page after sign up.
- Remove dependency on
dynamic_form. Replaced with flashes due to limited number of failure cases.
app/mailers. Moving spec to
validates_uniqueness_of. It was unnecessary and causes a small performance problem on some apps.
- Only development dependency in
bundler. All others are derived by bundling.
New for 0.11.0 (April 24, 2011):
- Removing password confirmation.
ActiveSupport::SecureRandomto clean up code.
controller#authenticate(params)method. Redefine username & password or other styles of authentication.
before_filter :authenticateAPI replaced with more aptly-named
New for 0.10.5 (April 19, 2011):
- Closing CSRF hole for Rails >= 3.0.4 apps.
New for 0.10.4 (April 16, 2011):
- Formtastic views generator removed.
- Emails forced to be downcased (particularly for iPhone user case).
- Suite converted from test/unit to RSpec.
- Password reset requires a password.
- Use HTML5 email fields.
New for 0.10.3.2 (March 6, 2011):
- Fix gemspec to include all necessary files.
New for 0.10.3.1 (February 20, 2011):
- Ensure everything within features inside any engine directory is included in
New for 0.10.3 (February 19, 2011):
- Include features/engines in
gemspecfile list so generator works as expected.
New for 0.10.2 (February 18, 2011):
test/rails_root& general testing strategy with Diesel.
- Conveniences in factories for password/confirmation.
- New generator command:
rails generate clearance:install.
- Step definitions are now prefixed with
visitor_to use thoughtbot convention.
- When Clearance installed in an app that already has users, allow old users to sign in by resetting their password.
New for 0.10.1 (February 9, 2011):
ActionController::Forbiddenwith a user-friendly flash message.
- Improved language of Cucumber steps by allowing a little more flexibility.
New for 0.10.0 (June 29, 2010):
- Better email validation regular expression.
- Removed email confirmation step, was mostly a hassle and can always be added back in at the application level (instead of engine level) if necessary.
disable_withon forms since it does not allow IE users to submit forms. Read more.
New for 0.9.1 (June 29, 2010):
- This release supports Rails 3, capybara, and shoulda 2.10+.
New for 0.9.0 (June 11, 2010):
- Removed unnecessary db index.
- Allow customization of cookie duration.
rake generator:cleanupneeded to be... cleaned up.
New for 0.8.8 (February 25, 2010):
New for 0.8.7 (February 21, 2010):
- Fixed global sign out bug.
- Allow Rails apps to
before_filter :authenticatethe entire app in
ApplicationControllerand still have password recovery work without overriding any controllers.
- Rails 3 fix for
New for 0.8.6 (February 17, 2010):
- Clearance features capitalization should match view text.
:authenticate before_filterin controllers so apps can easily authenticate a whole site without subclassing.
- Added randomness to token and salt generation,
- Reset the
remember_tokenon sign out instead of sign in. Allows for the same user to sign in from two locations at once.
- Append the version number to generated update migrations.
- Allow overridden user models to skip email/password validations conditionally. This makes username/facebook integration easier.
New for 0.8.5 (January 20, 2010):
- Replaced routing hack with
Clearance::Routes.draw(map)to give more control to the application developer.
- Fixed bug in password reset feature.
- Use Jeweler for gemming.
- Remove dependency on
Clearance.configureblock to set mailer sender instead of
New for 0.8.4 (December 08, 2009):
- Remove unnecessary
require 'factory_girl'in generator.
- Reference gemcutter (not github) as the gem source in README.
- Add IRC, rdoc.info links to README.
- Move user confirmation email trigger into model.
New for 0.8.3 (September 21, 2009):
- Avoid possible collisions in the remember me token.
New for 0.8.2 (September 01, 2009):
New for 0.8.1 (August 31, 2009):
- Removed unnecessary
remember_token_expires_atcolumn and the
forget_me!user instance methods.
New for 0.8.0 (August 31, 2009):
- Always remember me. Replaced session-and-remember-me authentication with always using a cookie with a long timeout.
New for 0.7.0 (August 4, 2009):
- Redirect signed in user who clicks confirmation link again.
- Redirect signed out user who clicks confirmation link again.
signed_out?convenience method for controllers, helpers, views.
clearance_viewsgenerator. By default, creates formtastic views which pass all tests and features.
New for 0.6.9 (July 4, 2009):
- Added timestamps to create users migration.
- Ready for Ruby 1.9.
New for 0.6.8 (June 24, 2009):
defined?checks for various Rails constants such as
ActionControllerfor easier unit testing of Clearance extensions... particularly
New for 0.6.7 (June 13, 2009):
- Minimizing Reek smell: Duplication in
sign_user_in. Told developers to use
before_filterson confirmations controller.
should_be_signed_in_asshouldn't look in the session.
- README improvements.
- Move routes loading to separate file.
New for 0.6.6 (May 18, 2009):
Clearance::Userwith modules. This was needed so we could write our own validations.
New for 0.6.5 (May 17, 2009):
- Make Clearance i18n aware.
New for 0.6.4 (May 12, 2009):
- Moved issue tracking to Github from Lighthouse.
- Asking higher-level questions of controllers in webrat steps, such as
signed_in? instead of what's in the session. same for accessors.
sign_outshoulda macros with a stubbing (requires no dependency) approach. this will avoid dealing with the internals of
current_user, such as session & cookies. Added
sign_inmacro which signs in an email confirmed user from clearance's factories.
- Move private methods on sessions controller into
- Audited flash keys.
New for 0.6.3 (April 23, 2009):
ClearanceMailerproperly within controllers so it works in production environments.
New for 0.6.2 (April 22, 2009):
Clearance::Userinto User model if it exists.
World(NavigationHelpers)Cucumber 3.0 style.
New for 0.6.1 (April 21, 2009):
- Scope operators are necessary to keep Rails happy. Reverting the original revert so they're back in the library now for constants referenced inside of the gem.
New for 0.6.0 (April 21, 2009):
- Converted Clearance to a Rails engine.
Clearance::Userin User model in app.
- Namespace controllers under
- Routes move to engine, use namespaced controllers but publicly the same.
- If you want to override a controller, subclass it like
SessionsController < Clearance::SessionsController. This gives you access to usual hooks such as
- Controllers, mailer, model, routes all unit tested inside engine. Use
script/generate clearance_featuresto test integration of Clearance with your Rails app. No longer including modules in your app's test files.
- Moved views to engine.
- Converted generated
test/factories/clearance.rbto use inheritence for
- Corrected some spelling errors with methods.
- Converted "I should see error messages" to use a regex in the features.
- Loading clearance routes after rails routes via some monkeypatching.
- Made the clearance controllers
unloadableto stop constant loading errors in development mode.
New for 0.5.6 (April 11, 2009):
- Step definition changed for "User should see error messages" so features won't fail for certain validations.
New for 0.5.5 (March 23, 2009):
- Removing duplicate test to get rid of warning.
New for 0.5.4 (March 21, 2009):
- When users fail logging in, redirect them instead of rendering.
New for 0.5.3 (March 5, 2009):
- Clearance now works with (and requires) Shoulda 2.10.0.
- Prefer flat over nested contexts in
New for 0.5.2 (March 2, 2009):
- Fixed last remaining errors in Rails 2.3 tests. Now fully compatible.
New for 0.5.1 (February 27, 2009):
- A user with unconfirmed email who resets password now confirms email.
User#authenticateto use more direct return code instead of ugly, harder to read ternary.
- Switch order of cookies and sessions to take advantage of Rails 2.3's "Rack-based lazy-loaded sessions",
- Altered generator to interact with
application.rbin Rails 2.3 apps.
- Bug fix. Rack-based session change altered how to test remember me cookie.
New for 0.5.0 (February 27, 2009):
- Fixed problem with Cucumber features.
- Fixed mising HTTP fluency use case.
User#update_passwordto take just parameters it needs.
Userunit tests to be more readable.
New for 0.4.9 (February 20, 2009):
- Protect passwords & confirmations actions with forbidden filters.
- Return 403 Forbidden status code in those cases.
- Test 403 Forbidden status code in Cucumber feature.
- Raise custom
ActionController::Forbiddenerror is raised in functional test.
- Fixed bug that allowed anyone to edit another user's password.
- Required Factory Girl >= 1.2.0.
New for 0.4.8 (February 16, 2009):
- Added support paths for Cucumber.
- Added documentation for the flash.
require 'test_helper'instead of
File.joinfor RR compatibility.
- Removed interpolated email address from flash message to make i18n easier.
- Standardized flash messages that refer to email delivery.
New for 0.4.7 (February 12, 2009):
Clearance::Test::TestHelperso there is one less setup step.
- All test helpers now in
New for 0.4.6 (February 11, 2009):
- Made the modules behave like mixins again.
PrivateMethodsmodules on controllers for future RDoc reasons.
New for 0.4.5 (February 9, 2009):
- Removed email downcasing because local-part is case sensitive per RFC5321.
- Removed dependency on Mocha.
- Required Shoulda >= 2.9.1.
- Added password reset feature to
- Removed unnecessary
- Only store location for
session[:return_to]for GET requests.
- Audited "sign up" naming convention. "Register" had slipped in a few places.
- Switched to
SHA1encryption. Cypher doesn't matter much for email confirmation, password reset. Better to have shorter hashes in the emails for clients who line break on 72 chars.
New for 0.4.4 (February 2, 2009):
- Added a generator for Cucumber features.
- Standardized naming for "Sign up," "Sign in," and "Sign out".