Rails 4 devise_invitable邀请令牌无效 [英] Rails 4 devise_invitable invitation token invalid

问题描述

我一直在关注 Ryan Boland的优秀Rails多租户教程，但已经遇到用devise_invitable阻止。我正在使用...

I have been following Ryan Boland's excellent Rails multitenancy tutorial, but have run into a snag with devise_invitable. I am using...

Rails 4.1.5 
devise 3.3.0  
devise_invitable 1.3.6
Postgresql

我在选定的子域（mysubdomain）上创建了一个新帐户和用户/帐户所有者.lvh.me：3000），我可以从中发送用户邀请。我在无痕式Chrome会话中打开邀请链接，以确保我没有登录或者没有任何当前会话。点击邀请链接后，我被重定向到登录页面（mysubdomain.lvh.me:3000/users/sign_in），并看到闪烁通知：提供的邀请令牌无效！

I create a new account and user/account owner on a chosen subdomain (mysubdomain.lvh.me:3000), from which I can send a user invitation just fine. I open the invitation link in an incognito Chrome session to ensure I am not logged in or have any current session. Upon clicking on the invitation link, I am redirected to the sign in page (mysubdomain.lvh.me:3000/users/sign_in) and see a flash notice: "The invitation token provided is not valid!"

我正在使用一个非常简单的邮件视图（app / views / devise / mailer / invitation_instructions.html.erb）...

I am using a very simple mailer view (app/views/devise/mailer/invitation_instructions.html.erb)...

<%= link_to 'Accept invitation', accept_invitation_url(@resource, :invitation_token => @token) %>

如您所见，我确保使用@token，如 here 。

As you can see, I ensured the use of @token, as described here.

创建邀请后，我确认邀请令牌已保存到数据库（在这种情况下为[e-mail] - d1801fd8df78bd8cd125d5d8091fdc6a72c8f8faf4136cb282d497ec612195e9）。我已经确认这符合令牌在接受请求时的邀请查询（见下面的跟踪）。仍然，它重定向到用户登录页面，而不是完成注册，并且还显示在跟踪日志过滤器链暂停为：resource_from_invitation_token呈现或重定向。在这笔交易结束后，用户仍然未被确认。

Upon creating the invitation, I have confirmed the invitation token is saved to the database (in this case for [e-mail] - d1801fd8df78bd8cd125d5d8091fdc6a72c8f8faf4136cb282d497ec612195e9). I have confirmed this matches the token on invitation lookup upon acceptance request (see below traces). Still, it redirects to user sign in page rather than completing sign up, and also displays in the trace log "Filter chain halted as :resource_from_invitation_token rendered or redirected". The user remains uncomfirmed in the end after this transaction.

有关我在这里可能出现什么问题的任何想法？我正在包括日志，我的应用程序控制器和我的设计配置...

Any ideas on what might be going wrong for me here? I am including logs, my application controller, and my devise config below...

这是邀请创建的跟踪日志：

Here is the trace log for the invitation creation:

Started POST "/users/invitation" for 127.0.0.1 at 2014-09-07 01:28:33 +0800
Processing by Devise::InvitationsController#create as HTML
  Parameters: {"utf8"=>"✓", "authenticity_token"=>"BiIQ95wwdQz3CJ0+OoLOE9xHHvxhloHsRHrxsqf1D2Q=", "user"=>{"email"=>"[e-mail]"}, "commit"=>"Invite User"}
  User Load (4.1ms)  SELECT  "users".* FROM "users"  WHERE "users"."id" = 1  ORDER BY "users"."id" ASC LIMIT 1
  Account Load (0.4ms)  SELECT  "public"."accounts".* FROM "public"."accounts"  WHERE "public"."accounts"."subdomain" = 'mysubdomain' LIMIT 1
  User Load (0.7ms)  SELECT  "users".* FROM "users"  WHERE "users"."email" = '[e-mail]'  ORDER BY "users"."id" ASC LIMIT 1
  User Load (0.7ms)  SELECT  "users".* FROM "users"  WHERE "users"."invitation_token" = 'd1801fd8df78bd8cd125d5d8091fdc6a72c8f8faf4136cb282d497ec612195e9'  ORDER BY "users"."id" ASC LIMIT 1
   (0.1ms)  BEGIN
  SQL (0.5ms)  INSERT INTO "users" ("created_at", "email", "invitation_created_at", "invitation_sent_at", "invitation_token", "invited_by_id", "invited_by_type", "updated_at") VALUES ($1, $2, $3, $4, $5, $6, $7, $8) RETURNING "id"  [["created_at", "2014-09-06 17:28:34.296123"], ["email", "[e-mail]"], ["invitation_created_at", "2014-09-06 17:28:34.294987"], ["invitation_sent_at", "2014-09-06 17:28:34.294987"], ["invitation_token", "d1801fd8df78bd8cd125d5d8091fdc6a72c8f8faf4136cb282d497ec612195e9"], ["invited_by_id", 1], ["invited_by_type", "User"], ["updated_at", "2014-09-06 17:28:34.296123"]]
   (2.2ms)  COMMIT
  Rendered devise/mailer/invitation_instructions.html.erb (1.3ms)

Devise::Mailer#invitation_instructions: processed outbound mail in 23.5ms

Sent mail to [e-mail] (26.0ms)
Date: Sun, 07 Sep 2014 01:28:34 +0800
From: [e-mail]
Reply-To: [e-mail]
To: [e-mail]
Message-ID: <...>
Subject: Invitation instructions
Mime-Version: 1.0
Content-Type: text/html;
 charset=UTF-8
Content-Transfer-Encoding: 7bit

<a href="http://mysubdomain.lvh.me:3000/users/invitation/accept?invitation_token=3GXDmi7NntDRdhvo57q5">Accept invitation</a>
Redirected to http://mysubdomain.lvh.me:3000/users
Completed 302 Found in 888ms (ActiveRecord: 10.0ms)

以下是跟随邀请链接的痕迹...

Here is the trace upon following the invitation link...

Started GET "/users/invitation/accept?invitation_token=3GXDmi7NntDRdhvo57q5" for 127.0.0.1 at 2014-09-07 01:28:38 +0800
Processing by Devise::InvitationsController#edit as HTML
  Parameters: {"invitation_token"=>"3GXDmi7NntDRdhvo57q5"}
  User Load (0.6ms)  SELECT  "users".* FROM "users"  WHERE "users"."invitation_token" = 'd1801fd8df78bd8cd125d5d8091fdc6a72c8f8faf4136cb282d497ec612195e9'  ORDER BY "users"."id" ASC LIMIT 1
Redirected to http://mysubdomain.lvh.me:3000/users/sign_in
Filter chain halted as :resource_from_invitation_token rendered or redirected
Completed 302 Found in 5ms (ActiveRecord: 0.6ms)


Started GET "/users/sign_in" for 127.0.0.1 at 2014-09-07 01:28:38 +0800
Processing by Devise::SessionsController#new as HTML
  Account Load (0.4ms)  SELECT  "public"."accounts".* FROM "public"."accounts"  WHERE "public"."accounts"."subdomain" = 'mysubdomain' LIMIT 1
  Rendered devise/shared/_links.erb (0.7ms)
  Rendered devise/sessions/new.html.erb within layouts/application (4.4ms)
Completed 200 OK in 21ms (Views: 16.6ms | ActiveRecord: 1.3ms)

这是我的应用程序控制器的良好措施...

Here is my application_controller for good measure...

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception
  before_filter :load_schema, :authenticate_user!, :set_mailer_host
  before_filter :configure_permitted_parameters, if: :devise_controller?


  protected

  def configure_permitted_parameters
    devise_parameter_sanitizer.for(:sign_up) { |u| u.permit(:first_name, :last_name, :company, :email, :password, :password_confirmation, :remember_me, :image, :image_cache)}
    devise_parameter_sanitizer.for(:account_update) { |u| u.permit(:first_name, :last_name, :company, :email, :password_confirmation, :current_password, :image, :image_cache)}
  end

private
  def load_schema
    Apartment::Database.switch('public')
    return unless request.subdomain.present?

    if current_account
      Apartment::Database.switch(current_account.subdomain)
    else
      redirect_to root_url(subdomain: false)
    end
  end  

  def current_account
    @current_account ||= Account.find_by(subdomain: request.subdomain)
  end
  helper_method :current_account

  def set_mailer_host
    subdomain = current_account ? "#{current_account.subdomain}." : ""
    ActionMailer::Base.default_url_options[:host] = "#{subdomain}lvh.me:3000"
  end

  def after_sign_out_path_for(resource_or_scope)
    new_user_session_path
  end

  def after_invite_path_for(resource)
    users_path
  end

end

这是我的Devise初始化器（config / initializers / devise.rb），我添加了config.allow_insecure_token_lookup = true行，看看是否有帮助，但无效...

Here is my Devise initializer (config/initializers/devise.rb), I have added the line "config.allow_insecure_token_lookup = true" to see if this helps, but to no avail...

Devise.setup do |config|

  config.mailer_sender = '[e-mail]'

  require 'devise/orm/active_record'

  config.case_insensitive_keys = [ :email ]

  config.strip_whitespace_keys = [ :email ]

  config.skip_session_storage = [:http_auth]

  config.stretches = Rails.env.test? ? 1 : 10

  config.reconfirmable = true

  config.expire_all_remember_me_on_sign_out = true

  config.password_length = 8..128

  config.sign_out_via = :delete

  config.allow_insecure_token_lookup = true
end

推荐答案

我更喜欢评论，但我只有36分，不允许，所以这里是一个不完整的答案：

I'd prefer to comment but I have only 36 points and am not allowed so here's an incomplete answer:

这是来自devise_invitable InvitationsController的代码，它正在重定向您的请求

this is the code from devise_invitable InvitationsController which is redirecting your request

def resource_from_invitation_token
  unless params[:invitation_token] && self.resource = resource_class.find_by_invitation_token(params[:invitation_token], true)
    set_flash_message(:alert, :invitation_token_invalid)
    redirect_to after_sign_out_path_for(resource_name)
  end
end

尝试运行：

token = '3GXDmi7NntDRdhvo57q5' #the token sent in the invitation email
User.find_by_invitation_token(token, true)

，看看是否返回您的用户。这可能不会，但也许这将使你更接近答案。我希望如此。

and see if that returns your User. It probably won't but maybe this will bring you closer to an answer. I hope so.

这篇关于Rails 4 devise_invitable邀请令牌无效的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！