|
1
|
# frozen_string_literal: true |
|
2
|
|
|
3
|
# Use this hook to configure devise mailer, warden hooks and so forth. |
|
4
|
# Many of these configuration options can be set straight in your model. |
|
5
|
Devise.setup do |config| |
|
6
|
# The secret key used by Devise. Devise uses this key to generate |
|
7
|
# random tokens. Changing this key will render invalid all existing |
|
8
|
# confirmation, reset password and unlock tokens in the database. |
|
9
|
# Devise will use the `secret_key_base` as its `secret_key` |
|
10
|
# by default. You can change it below and use your own secret key. |
|
11
|
# config.secret_key = 'd60b36ddacc39800c1748311ad3badf8eda316edf53f5fb878a828d4d23685ff30d944c968b780fe0ddbd6e6f8064bf4947ae501d1edd5ad915c1bc4ffb8b0ef' |
|
12
|
|
|
13
|
# ==> Controller configuration |
|
14
|
# Configure the parent class to the devise controllers. |
|
15
|
# config.parent_controller = 'DeviseController' |
|
16
|
|
|
17
|
# ==> Mailer Configuration |
|
18
|
# Configure the e-mail address which will be shown in Devise::Mailer, |
|
19
|
# note that it will be overwritten if you use your own mailer class |
|
20
|
# with default "from" parameter. |
|
21
|
config.mailer_sender = 'noreply@musik88.com' |
|
22
|
|
|
23
|
# Configure the class responsible to send e-mails. |
|
24
|
config.mailer = 'DeviseMailer' |
|
25
|
|
|
26
|
# Configure the parent class responsible to send e-mails. |
|
27
|
# config.parent_mailer = 'ActionMailer::Base' |
|
28
|
|
|
29
|
# ==> ORM configuration |
|
30
|
# Load and configure the ORM. Supports :active_record (default) and |
|
31
|
# :mongoid (bson_ext recommended) by default. Other ORMs may be |
|
32
|
# available as additional gems. |
|
33
|
require 'devise/orm/active_record' |
|
34
|
|
|
35
|
# ==> Configuration for any authentication mechanism |
|
36
|
# Configure which keys are used when authenticating a user. The default is |
|
37
|
# just :email. You can configure it to use [:username, :subdomain], so for |
|
38
|
# authenticating a user, both parameters are required. Remember that those |
|
39
|
# parameters are used only when authenticating and not when retrieving from |
|
40
|
# session. If you need permissions, you should implement that in a before filter. |
|
41
|
# You can also supply a hash where the value is a boolean determining whether |
|
42
|
# or not authentication should be aborted when the value is not present. |
|
43
|
# config.authentication_keys = [:email] |
|
44
|
|
|
45
|
# Configure parameters from the request object used for authentication. Each entry |
|
46
|
# given should be a request method and it will automatically be passed to the |
|
47
|
# find_for_authentication method and considered in your model lookup. For instance, |
|
48
|
# if you set :request_keys to [:subdomain], :subdomain will be used on authentication. |
|
49
|
# The same considerations mentioned for authentication_keys also apply to request_keys. |
|
50
|
# config.request_keys = [] |
|
51
|
|
|
52
|
# Configure which authentication keys should be case-insensitive. |
|
53
|
# These keys will be downcased upon creating or modifying a user and when used |
|
54
|
# to authenticate or find a user. Default is :email. |
|
55
|
config.case_insensitive_keys = [:email] |
|
56
|
|
|
57
|
# Configure which authentication keys should have whitespace stripped. |
|
58
|
# These keys will have whitespace before and after removed upon creating or |
|
59
|
# modifying a user and when used to authenticate or find a user. Default is :email. |
|
60
|
config.strip_whitespace_keys = [:email] |
|
61
|
|
|
62
|
# Tell if authentication through request.params is enabled. True by default. |
|
63
|
# It can be set to an array that will enable params authentication only for the |
|
64
|
# given strategies, for example, `config.params_authenticatable = [:database]` will |
|
65
|
# enable it only for database (email + password) authentication. |
|
66
|
# config.params_authenticatable = true |
|
67
|
|
|
68
|
# Tell if authentication through HTTP Auth is enabled. False by default. |
|
69
|
# It can be set to an array that will enable http authentication only for the |
|
70
|
# given strategies, for example, `config.http_authenticatable = [:database]` will |
|
71
|
# enable it only for database authentication. The supported strategies are: |
|
72
|
# :database = Support basic authentication with authentication key + password |
|
73
|
# config.http_authenticatable = false |
|
74
|
|
|
75
|
# If 401 status code should be returned for AJAX requests. True by default. |
|
76
|
# config.http_authenticatable_on_xhr = true |
|
77
|
|
|
78
|
# The realm used in Http Basic Authentication. 'Application' by default. |
|
79
|
# config.http_authentication_realm = 'Application' |
|
80
|
|
|
81
|
# It will change confirmation, password recovery and other workflows |
|
82
|
# to behave the same regardless if the e-mail provided was right or wrong. |
|
83
|
# Does not affect registerable. |
|
84
|
# config.paranoid = true |
|
85
|
|
|
86
|
# By default Devise will store the user in session. You can skip storage for |
|
87
|
# particular strategies by setting this option. |
|
88
|
# Notice that if you are skipping storage for all authentication paths, you |
|
89
|
# may want to disable generating routes to Devise's sessions controller by |
|
90
|
# passing skip: :sessions to `devise_for` in your config/routes.rb |
|
91
|
config.skip_session_storage = [:http_auth] |
|
92
|
|
|
93
|
# By default, Devise cleans up the CSRF token on authentication to |
|
94
|
# avoid CSRF token fixation attacks. This means that, when using AJAX |
|
95
|
# requests for sign in and sign up, you need to get a new CSRF token |
|
96
|
# from the server. You can disable this option at your own risk. |
|
97
|
# config.clean_up_csrf_token_on_authentication = true |
|
98
|
|
|
99
|
# When false, Devise will not attempt to reload routes on eager load. |
|
100
|
# This can reduce the time taken to boot the app but if your application |
|
101
|
# requires the Devise mappings to be loaded during boot time the application |
|
102
|
# won't boot properly. |
|
103
|
# config.reload_routes = true |
|
104
|
|
|
105
|
# ==> Configuration for :database_authenticatable |
|
106
|
# For bcrypt, this is the cost for hashing the password and defaults to 11. If |
|
107
|
# using other algorithms, it sets how many times you want the password to be hashed. |
|
108
|
# |
|
109
|
# Limiting the stretches to just one in testing will increase the performance of |
|
110
|
# your test suite dramatically. However, it is STRONGLY RECOMMENDED to not use |
|
111
|
# a value less than 10 in other environments. Note that, for bcrypt (the default |
|
112
|
# algorithm), the cost increases exponentially with the number of stretches (e.g. |
|
113
|
# a value of 20 is already extremely slow: approx. 60 seconds for 1 calculation). |
|
114
|
config.stretches = Rails.env.test? ? 1 : 11 |
|
115
|
|
|
116
|
# Set up a pepper to generate the hashed password. |
|
117
|
# config.pepper = '60f7bc7ce3b1c6da3d1651bff697698e24cb0d44cb3411496227d47ae991ef60ee9c2869472fe47da3067f007a0991a885acc77925121d205a95121857d33b40' |
|
118
|
|
|
119
|
# Send a notification to the original email when the user's email is changed. |
|
120
|
# config.send_email_changed_notification = false |
|
121
|
|
|
122
|
# Send a notification email when the user's password is changed. |
|
123
|
# config.send_password_change_notification = false |
|
124
|
|
|
125
|
# ==> Configuration for :invitable |
|
126
|
# The period the generated invitation token is valid. |
|
127
|
# After this period, the invited resource won't be able to accept the invitation. |
|
128
|
# When invite_for is 0 (the default), the invitation won't expire. |
|
129
|
# config.invite_for = 2.weeks |
|
130
|
|
|
131
|
# Number of invitations users can send. |
|
132
|
# - If invitation_limit is nil, there is no limit for invitations, users can |
|
133
|
# send unlimited invitations, invitation_limit column is not used. |
|
134
|
# - If invitation_limit is 0, users can't send invitations by default. |
|
135
|
# - If invitation_limit n > 0, users can send n invitations. |
|
136
|
# You can change invitation_limit column for some users so they can send more |
|
137
|
# or less invitations, even with global invitation_limit = 0 |
|
138
|
# Default: nil |
|
139
|
# config.invitation_limit = 5 |
|
140
|
|
|
141
|
# The key to be used to check existing users when sending an invitation |
|
142
|
# and the regexp used to test it when validate_on_invite is not set. |
|
143
|
# config.invite_key = { email: /\A[^@]+@[^@]+\z/ } |
|
144
|
# config.invite_key = { email: /\A[^@]+@[^@]+\z/, username: nil } |
|
145
|
|
|
146
|
# Ensure that invited record is valid. |
|
147
|
# The invitation won't be sent if this check fails. |
|
148
|
# Default: false |
|
149
|
# config.validate_on_invite = true |
|
150
|
|
|
151
|
# Resend invitation if user with invited status is invited again |
|
152
|
# Default: true |
|
153
|
# config.resend_invitation = false |
|
154
|
|
|
155
|
# The class name of the inviting model. If this is nil, |
|
156
|
# the #invited_by association is declared to be polymorphic. |
|
157
|
# Default: nil |
|
158
|
# config.invited_by_class_name = 'User' |
|
159
|
|
|
160
|
# The foreign key to the inviting model (if invited_by_class_name is set) |
|
161
|
# Default: :invited_by_id |
|
162
|
# config.invited_by_foreign_key = :invited_by_id |
|
163
|
|
|
164
|
# The column name used for counter_cache column. If this is nil, |
|
165
|
# the #invited_by association is declared without counter_cache. |
|
166
|
# Default: nil |
|
167
|
# config.invited_by_counter_cache = :invitations_count |
|
168
|
|
|
169
|
# Auto-login after the user accepts the invite. If this is false, |
|
170
|
# the user will need to manually log in after accepting the invite. |
|
171
|
# Default: true |
|
172
|
# config.allow_insecure_sign_in_after_accept = false |
|
173
|
|
|
174
|
# ==> Configuration for :confirmable |
|
175
|
# A period that the user is allowed to access the website even without |
|
176
|
# confirming their account. For instance, if set to 2.days, the user will be |
|
177
|
# able to access the website for two days without confirming their account, |
|
178
|
# access will be blocked just in the third day. Default is 0.days, meaning |
|
179
|
# the user cannot access the website without confirming their account. |
|
180
|
# config.allow_unconfirmed_access_for = 2.days |
|
181
|
|
|
182
|
# A period that the user is allowed to confirm their account before their |
|
183
|
# token becomes invalid. For example, if set to 3.days, the user can confirm |
|
184
|
# their account within 3 days after the mail was sent, but on the fourth day |
|
185
|
# their account can't be confirmed with the token any more. |
|
186
|
# Default is nil, meaning there is no restriction on how long a user can take |
|
187
|
# before confirming their account. |
|
188
|
# config.confirm_within = 3.days |
|
189
|
|
|
190
|
# If true, requires any email changes to be confirmed (exactly the same way as |
|
191
|
# initial account confirmation) to be applied. Requires additional unconfirmed_email |
|
192
|
# db field (see migrations). Until confirmed, new email is stored in |
|
193
|
# unconfirmed_email column, and copied to email column on successful confirmation. |
|
194
|
config.reconfirmable = true |
|
195
|
|
|
196
|
# Defines which key will be used when confirming an account |
|
197
|
# config.confirmation_keys = [:email] |
|
198
|
|
|
199
|
# ==> Configuration for :rememberable |
|
200
|
# The time the user will be remembered without asking for credentials again. |
|
201
|
# config.remember_for = 2.weeks |
|
202
|
|
|
203
|
# Invalidates all the remember me tokens when the user signs out. |
|
204
|
config.expire_all_remember_me_on_sign_out = true |
|
205
|
|
|
206
|
# If true, extends the user's remember period when remembered via cookie. |
|
207
|
# config.extend_remember_period = false |
|
208
|
|
|
209
|
# Options to be passed to the created cookie. For instance, you can set |
|
210
|
# secure: true in order to force SSL only cookies. |
|
211
|
# config.rememberable_options = {} |
|
212
|
|
|
213
|
# ==> Configuration for :validatable |
|
214
|
# Range for password length. |
|
215
|
config.password_length = 6..128 |
|
216
|
|
|
217
|
# Email regex used to validate email formats. It simply asserts that |
|
218
|
# one (and only one) @ exists in the given string. This is mainly |
|
219
|
# to give user feedback and not to assert the e-mail validity. |
|
220
|
config.email_regexp = /\A[^@\s]+@[^@\s]+\z/ |
|
221
|
|
|
222
|
# ==> Configuration for :timeoutable |
|
223
|
# The time you want to timeout the user session without activity. After this |
|
224
|
# time the user will be asked for credentials again. Default is 30 minutes. |
|
225
|
# config.timeout_in = 30.minutes |
|
226
|
|
|
227
|
# ==> Configuration for :lockable |
|
228
|
# Defines which strategy will be used to lock an account. |
|
229
|
# :failed_attempts = Locks an account after a number of failed attempts to sign in. |
|
230
|
# :none = No lock strategy. You should handle locking by yourself. |
|
231
|
# config.lock_strategy = :failed_attempts |
|
232
|
|
|
233
|
# Defines which key will be used when locking and unlocking an account |
|
234
|
# config.unlock_keys = [:email] |
|
235
|
|
|
236
|
# Defines which strategy will be used to unlock an account. |
|
237
|
# :email = Sends an unlock link to the user email |
|
238
|
# :time = Re-enables login after a certain amount of time (see :unlock_in below) |
|
239
|
# :both = Enables both strategies |
|
240
|
# :none = No unlock strategy. You should handle unlocking by yourself. |
|
241
|
# config.unlock_strategy = :both |
|
242
|
|
|
243
|
# Number of authentication tries before locking an account if lock_strategy |
|
244
|
# is failed attempts. |
|
245
|
# config.maximum_attempts = 20 |
|
246
|
|
|
247
|
# Time interval to unlock the account if :time is enabled as unlock_strategy. |
|
248
|
# config.unlock_in = 1.hour |
|
249
|
|
|
250
|
# Warn on the last attempt before the account is locked. |
|
251
|
# config.last_attempt_warning = true |
|
252
|
|
|
253
|
# ==> Configuration for :recoverable |
|
254
|
# |
|
255
|
# Defines which key will be used when recovering the password for an account |
|
256
|
config.reset_password_keys = [:email] |
|
257
|
|
|
258
|
# Time interval you can reset your password with a reset password key. |
|
259
|
# Don't put a too small interval or your users won't have the time to |
|
260
|
# change their passwords. |
|
261
|
config.reset_password_within = 6.hours |
|
262
|
|
|
263
|
# When set to false, does not sign a user in automatically after their password is |
|
264
|
# reset. Defaults to true, so a user is signed in automatically after a reset. |
|
265
|
# config.sign_in_after_reset_password = true |
|
266
|
|
|
267
|
# ==> Configuration for :encryptable |
|
268
|
# Allow you to use another hashing or encryption algorithm besides bcrypt (default). |
|
269
|
# You can use :sha1, :sha512 or algorithms from others authentication tools as |
|
270
|
# :clearance_sha1, :authlogic_sha512 (then you should set stretches above to 20 |
|
271
|
# for default behavior) and :restful_authentication_sha1 (then you should set |
|
272
|
# stretches to 10, and copy REST_AUTH_SITE_KEY to pepper). |
|
273
|
# |
|
274
|
# Require the `devise-encryptable` gem when using anything other than bcrypt |
|
275
|
# config.encryptor = :sha512 |
|
276
|
|
|
277
|
# ==> Scopes configuration |
|
278
|
# Turn scoped views on. Before rendering "sessions/new", it will first check for |
|
279
|
# "users/sessions/new". It's turned off by default because it's slower if you |
|
280
|
# are using only default views. |
|
281
|
# config.scoped_views = false |
|
282
|
|
|
283
|
# Configure the default scope given to Warden. By default it's the first |
|
284
|
# devise role declared in your routes (usually :user). |
|
285
|
# config.default_scope = :user |
|
286
|
|
|
287
|
# Set this configuration to false if you want /users/sign_out to sign out |
|
288
|
# only the current scope. By default, Devise signs out all scopes. |
|
289
|
# config.sign_out_all_scopes = true |
|
290
|
|
|
291
|
# ==> Navigation configuration |
|
292
|
# Lists the formats that should be treated as navigational. Formats like |
|
293
|
# :html, should redirect to the sign in page when the user does not have |
|
294
|
# access, but formats like :xml or :json, should return 401. |
|
295
|
# |
|
296
|
# If you have any extra navigational formats, like :iphone or :mobile, you |
|
297
|
# should add them to the navigational formats lists. |
|
298
|
# |
|
299
|
# The "*/*" below is required to match Internet Explorer requests. |
|
300
|
# config.navigational_formats = ['*/*', :html] |
|
301
|
|
|
302
|
# The default HTTP method used to sign out a resource. Default is :delete. |
|
303
|
config.sign_out_via = :delete |
|
304
|
|
|
305
|
# ==> OmniAuth |
|
306
|
# Add a new OmniAuth provider. Check the wiki for more information on setting |
|
307
|
# up on your models and hooks. |
|
308
|
config.omniauth :facebook, ENV['FB_APP_ID'], ENV['FB_APP_SECRET'] |
|
309
|
|
|
310
|
config.omniauth :spotify, ENV['SPOTIFY_APP_ID'], ENV['SPOTIFY_APP_SECRET'], scope: %w[ |
|
311
|
playlist-read-private |
|
312
|
user-top-read |
|
313
|
user-read-private |
|
314
|
user-read-email |
|
315
|
user-read-recently-played |
|
316
|
].join(' ') |
|
317
|
|
|
318
|
config.omniauth :google_oauth2, ENV['GOOGLE_CLIENT_ID'], ENV['GOOGLE_CLIENT_SECRET'], scope: %w[ |
|
319
|
email |
|
320
|
profile |
|
321
|
https://www.googleapis.com/auth/youtube |
|
322
|
https://www.googleapis.com/auth/youtube.force-ssl |
|
323
|
].join(' ') |
|
324
|
|
|
325
|
config.omniauth :apple, ENV['APPLE_CLIENT_ID'], '', { |
|
326
|
scope: 'email name', |
|
327
|
team_id: ENV['APPLE_TEAM_ID'], |
|
328
|
key_id: ENV['APPLE_KEY_ID'], |
|
329
|
pem: ENV['APPLE_PRIVATE_KEY'] |
|
330
|
} |
|
331
|
|
|
332
|
# ==> Warden configuration |
|
333
|
# If you want to use other strategies, that are not supported by Devise, or |
|
334
|
# change the failure app, you can configure them inside the config.warden block. |
|
335
|
# |
|
336
|
# config.warden do |manager| |
|
337
|
# manager.intercept_401 = false |
|
338
|
# manager.default_strategies(scope: :user).unshift :some_external_strategy |
|
339
|
# end |
|
340
|
|
|
341
|
# ==> Mountable engine configurations |
|
342
|
# When using Devise inside an engine, let's call it `MyEngine`, and this engine |
|
343
|
# is mountable, there are some extra configurations to be taken into account. |
|
344
|
# The following options are available, assuming the engine is mounted as: |
|
345
|
# |
|
346
|
# mount MyEngine, at: '/my_engine' |
|
347
|
# |
|
348
|
# The router that invoked `devise_for`, in the example above, would be: |
|
349
|
# config.router_name = :my_engine |
|
350
|
# |
|
351
|
# When using OmniAuth, Devise cannot automatically set OmniAuth path, |
|
352
|
# so you need to do it manually. For the users scope, it would be: |
|
353
|
# config.omniauth_path_prefix = '/my_engine/users/auth' |
|
354
|
config.jwt do |jwt| |
|
355
|
jwt.secret = Rails.application.credentials.devise[:jwt_secret_key] |
|
356
|
jwt.dispatch_requests = [ |
|
357
|
['POST', %r{^/api/v1/login$}] |
|
358
|
] |
|
359
|
jwt.revocation_requests = [ |
|
360
|
['DELETE', %r{^/api/v1/logout$}] |
|
361
|
] |
|
362
|
jwt.expiration_time = 30.days.to_i |
|
363
|
end |
|
364
|
end |