Question

I’m writing an application for myself, so I’ve got no rush and the my only target is to do things properly.
For authentication I use devise, but I turned out customizing it a lot.
I’ve seen some good features coming in Rails 3.1 that could make easier to implement auth myself.

In general, when does Devise stops to be useful and starts getting in your way?
Here is a list of customization I have at the moment, beside views of course, but I still would like to implement at least SEO friendly urls.

# model/User.rb
  #this method is called by devise to check for "active" state of the model
  def active?
    #remember to call the super
    #then put our own check to determine "active" state using 
    #our own "is_active" column
    super and self.is_active?
  end


protected #====================================================================

  # find in db the user with username or email login
  def self.find_record(login)
    where(attributes).where(["name = :value OR email = :value", { :value => login }]).first
  end

  # allow no case sensitive email
  # (saved downcase, fetched downcase)
  def self.find_for_authentication(conditions)
    conditions[:email].downcase!
    super(conditions)
  end

  # find the user in the db by username or email
  def self.find_for_database_authentication(conditions)
    login = conditions.delete(:login)
    where(conditions).where(["name = :value OR email = :value", { :value => login }]).first
  end

  # Attempt to find a user by it's email. If a record is found, send new
  # password instructions to it. If not user is found, returns a new user
  # with an email not found error.
  def self.send_reset_password_instructions(attributes={})
    recoverable = find_recoverable_or_initialize_with_errors(reset_password_keys, attributes, :not_found)
    recoverable.send_reset_password_instructions if recoverable.persisted?
    recoverable
  end

  def self.find_recoverable_or_initialize_with_errors(required_attributes, attributes, error=:invalid)
    case_insensitive_keys.each { |k| attributes[k].try(:downcase!) }

    attributes = attributes.slice(*required_attributes)
    attributes.delete_if { |key, value| value.blank? }

    if attributes.size == required_attributes.size
      if attributes.has_key?(:login)
        login = attributes.delete(:login)
        record = find_record(login)
      else
        record = where(attributes).first
      end
    end

    unless record
      record = new

      required_attributes.each do |key|
        value = attributes[key]
        record.send("#{key}=", value)
        record.errors.add(key, value.present? ? error : :blank)
      end
    end
    record
  end

  # password not required on edit
  # see: https://github.com/plataformatec/devise/wiki/How-To:-Allow-users-to-edit-their-account-without-providing-a-password
  def password_required?
    new_record?
  end


# controllers/registrations_controller.rb
# devise controller for registration
class RegistrationsController < Devise::RegistrationsController

  # update_attributes (with final S) without providing password
  # overrides devise
  # see: https://github.com/plataformatec/devise/wiki/How-To:-Allow-users-to-edit-their-account-without-providing-a-password
  def update
    # Devise use update_with_password instead of update_attributes.
    # This is the only change we make.
    if resource.update_attributes(params[resource_name])
      set_flash_message :notice, :updated
      # Line below required if using Devise >= 1.2.0
      sign_in resource_name, resource, :bypass => true
      redirect_to after_update_path_for(resource)
    else
      clean_up_passwords(resource)
      render_with_scope :edit
    end
  end

end

Thank you

Answer 1

I’d just stick with devise for the time being, your changes aren’t huge. However, I’d fork devise and extract the changes you’ve made into new features. Then attempt to get them pulled into devise itself. That way maintaining them doesn’t fall on you, it can fall on the many.

Maintaining a full authentication system can be a real headache and ultimately its reinventing the wheel. It only takes one mistake can leave you wide open.

Also your new find_for_authentication method, this has now been supported in devise, put in your devise initializer…

config.case_insensitive_keys = [ :email ]