# module Devise::Models::Authenticatable

Authenticatable module. Holds common settings for authentication.

## Options

Authenticatable adds the following options to devise_for:

    * +authentication_keys+: parameters used for authentication. By default [:email].

    * +request_keys+: parameters from the request object used for authentication.
      By specifying a symbol (which should be a request method), it will automatically be
      passed to find_for_authentication method and considered in your model lookup.

      For instance, if you set :request_keys to [:subdomain], :subdomain will be considered
      as key on authentication. This can also be a hash where the value is a boolean expliciting
      if the value is required or not.

    * +http_authenticatable+: if this model allows http authentication. By default true.
      It also accepts an array specifying the strategies that should allow http.

    * +params_authenticatable+: if this model allows authentication through request params. By default true.
      It also accepts an array specifying the strategies that should allow params authentication.

    * +skip_session_storage+: By default Devise will store the user in session.
      You can skip storage for http and token auth by appending values to array:
      :skip_session_storage => [:token_auth] or :skip_session_storage => [:http_auth, :token_auth],
      by default is set to :skip_session_storage => [:http_auth].

## active_for_authentication?

After authenticating a user and in each request, Devise checks if your model is active by calling model.active_for_authentication?. This method is overwriten by other devise modules. For instance, :confirmable overwrites .active_for_authentication? to only return true if your model was confirmed.

You overwrite this method yourself, but if you do, don’t forget to call super:

    def active_for_authentication?
      super && special_condition_is_valid?
    end

Whenever active_for_authentication? returns false, Devise asks the reason why your model is inactive using the #inactive_message method. You can overwrite it as well:

    def inactive_message
      special_condition_is_valid? ? super : :special_condition_is_not_valid
    end

### Public Instance Methods

active_for_authentication?() click to toggle source

    # File lib/devise/models/authenticatable.rb, line 75
    def active_for_authentication?
      true
    end

authenticatable_salt() click to toggle source

    # File lib/devise/models/authenticatable.rb, line 83
    def authenticatable_salt
    end

devise_mailer() click to toggle source

    # File lib/devise/models/authenticatable.rb, line 86
    def devise_mailer
      Devise.mailer
    end

downcase_keys() click to toggle source

    # File lib/devise/models/authenticatable.rb, line 94
    def downcase_keys
      (self.class.case_insensitive_keys || []).each { |k| self[k].try(:downcase!) }
    end

headers_for(name) click to toggle source

    # File lib/devise/models/authenticatable.rb, line 90
    def headers_for(name)
      {}
    end

inactive_message() click to toggle source

    # File lib/devise/models/authenticatable.rb, line 79
    def inactive_message
      :inactive
    end

strip_whitespace() click to toggle source

    # File lib/devise/models/authenticatable.rb, line 98
    def strip_whitespace
      (self.class.strip_whitespace_keys || []).each { |k| self[k].try(:strip!) }
    end

valid_for_authentication?() { |: true| ... } click to toggle source

Check if the current object is valid for authentication. This method and find_for_authentication are the methods used in a Warden::Strategy to check if a model should be signed in or not.

However, you should not overwrite this method, you should overwrite active_for_authentication? and #inactive_message instead.

    # File lib/devise/models/authenticatable.rb, line 71
    def valid_for_authentication?
      block_given? ? yield : true
    end