a have a client with a website built on RoR by other developer, the website uses devise for user authentication and registration.
The website allows users to registrate and then send them a confirmation email, when they confirm their email, then they can login, BUT they can't see the content until they are approved to see it.
My client ask me to don't allow users to login until two things happen: They confirm their email and him(my client) approve them to see the content.
I tried this adding active_for_authentication? to the user model and returning true or false deppending if they are approved or not, but like the documentation of devise saids: the method active_for_authentication? is overriden by other modules like confirmable.
How can i perform this two validation using devise?
thanks for your help
You have to add authorization control in your application.
So I advice you to use CanCan gem it's easy to set and it allows you to define access rules based on your criteria.
Related
I'm building a system using Devise as the gem responsible for handling users.
What I'm looking for it's a way to send the confirmation email always to the same email(it would be the admin), so that he can choose if the person should, or not, be allowed into the system.
You can refer to this How To to let admin confirm the user before signin, you probably won't need comfirmable module.
I was wondering if we can allow Admins to add Accounts for the Member Models? with out them having to confirm it if the Admin adds it?
I have two Devise Models
Admins
Members
To Launch the application i want to restrict Registration and Admins will create the Logins for Members from the Admin Scope. When he adds the Member i dont want them to confirm their account but just send a welcome Email may be with the login details.
I don't want them to confirm their account but just send a welcome Email may be with the login details
One way you could do this is by simply writing a new user form, saving the user and manually sending an email. If you are using Devise confirmable, then you must call confirm! on the built object, in order for them to log in.
However, sending a password in plain text is generally speaking a dodgy thing to do. Surely you'd then want to force each user to change their password anyway, for security reasons? As such, I'd recommend going for the more standard approach of Devise invitable - which will send an invitation token to the user, and ask them to set their initial password. You achieve this by calling invite! on the built user object.
Here are two RailsCast videos about Devise, which you may find helpful for further reference and examples:
http://railscasts.com/episodes/209-introducing-devise
http://railscasts.com/episodes/210-customizing-devise
Yes you can, just create the object and call confirm on it :)
However, as members will need a password to access their account, it could be nice to email them a link to enter this password, so this link could also confirm the account for you.
IMHO, It's a bad practice to send any password by email, a lot of email servers don't implement any secured protocol, better let your users chose it, with a one-time link
Within a rails app i'm working on. I'm trying to add the ability for users to signup simply by entering their email address and then confirming their account via the confirmation email. I don't want the user to have to enter in any password. How would I go about doing this?
This example is useful, but requires for the user to enter a password: https://github.com/plataformatec/devise/wiki/How-To:-Email-only-sign-up
Should I just automatically use one password for all users?
Devise is built for authentication, which is either a password, or a quick check with a social network that this is actually the person they claim to be. The email address is used as identification.
If you just want to identify a person by their email, I suggest you create your own system for it. You can even add some of the Devise features in if you like. First, create a User model with an email attribute:
rails generate model User email:string
Once you've migrated the database, create a controller for it:
rails generate controller users
Then create a Session model and let each User create sessions by logging in. There'll be plenty of great tutorials on the web of how to create a system like this. Writing helper methods like current_user or user_signed_in? should be quite easy too.
Now for the last point, if you want people to sign in after they signed up using the email confirmation, how will you make sure that it is actually the same person signing in as the person who confirmed the email? Any malicious user could simply use an already confirmed account to sign in, unless you have to do an email confirmation every time you sign in...
So while you can do the above, I would seriously recommend to have some kind of authentication, whether it be with a password, or using OmniAuth to connect to social networks. There's a railscast for that here.
Not sure if this would help you, but based on the simplicity of the authentication process, I would suggest not to use Devise at all. You can just create an action in your SessionsController, which will compare the params[:email] (or however you are calling it in your app) against the emails listed in the UsersTable.
I am working with devise invitable gem with rails 3.2 application . My problem is that
I have a user who involves in several groups , so group owner will send invitation to that user . Now I want to implement the functionality to send invitation for the same user from different groups , but devise invitable not allows me to do that ..
Can anyone help me .. thanks in advance ..
Devise is an authentication framework. Authentication only handles identifying who somebody is.
If you have a system where a user can get invited to multiple groups, then this is no longer authentication. Instead you need an authorization layer to manage what sort of access each user has.
You would still use Devise to log users into and out of your system but you need to use something like CanCan in order to implement this sort of access control.
I am using devise for authentication and i use rails as backend for ios application. I wanted to save the user attributes and it does not have password field in the registration, so i overrided the devise registration controller and made it as required.
Now i wanted to allow the user to be authenticated on the every request, so usually i use "authenticate_user!" method in other controllers so it would check the user on every request but it requires password to do so but in my case i now do not have password, so how can i verify the user on every request.
Can i able to override the authenticate_user! method and allow to check email and type(for example) instead of email and password or tell me if there is some other way.
Also please tell me how devise access the authorization header and use it in the authenticate_user! method. Please help me. I am stuck with this for quiet a long time.
As I answered before, you can override find_first_by_auth_conditions method in User model. See my previous answer please.
Is there a solution for Rails Gem Devise to allow a user to have multiple emails?