has_secure_password干什么

跟踪一下has_secure_password

class User < ApplicationRecord
  binding.trace_tree(html: true, tmp: ['rails', 'password.html']) do
  has_secure_password
  end
end

完整调用栈如下

简单来说，它include了两个module，并定义了三个validation

源码如下

def has_secure_password(options = {})
  # Load bcrypt gem only when has_secure_password is used.
  # This is to avoid ActiveModel (and by extension the entire framework)
  # being dependent on a binary library.
  begin
    require 'bcrypt'
  rescue LoadError
    $stderr.puts "You don't have bcrypt installed in your application. Please add it to your Gemfile and run bundle install"
    raise
  end

  include InstanceMethodsOnActivation

  if options.fetch(:validations, true)
    include ActiveModel::Validations

    # This ensures the model has a password by checking whether the password_digest
    # is present, so that this works with both new and existing records. However,
    # when there is an error, the message is added to the password attribute instead
    # so that the error message will make sense to the end-user.
    validate do |record|
      record.errors.add(:password, :blank) unless record.password_digest.present?
    end

    validates_length_of :password, maximum: ActiveModel::SecurePassword::MAX_PASSWORD_LENGTH_ALLOWED
    validates_confirmation_of :password, allow_blank: true
  end
end

那第二个include和三个validation与API DOC所说的是一致

Password must be present on creation

Password length should be less than or equal to 72 characters

Confirmation of password (using a password_confirmation attribute)

至于第一个include的module，其源码如下

module InstanceMethodsOnActivation
  # Returns +self+ if the password is correct, otherwise +false+.
  #
  #   class User < ActiveRecord::Base
  #     has_secure_password validations: false
  #   end
  #
  #   user = User.new(name: 'david', password: 'mUc3m00RsqyRe')
  #   user.save
  #   user.authenticate('notright')      # => false
  #   user.authenticate('mUc3m00RsqyRe') # => user
  def authenticate(unencrypted_password)
    BCrypt::Password.new(password_digest).is_password?(unencrypted_password) && self
  end

  attr_reader :password

  # Encrypts the password into the +password_digest+ attribute, only if the
  # new password is not empty.
  #
  #   class User < ActiveRecord::Base
  #     has_secure_password validations: false
  #   end
  #
  #   user = User.new
  #   user.password = nil
  #   user.password_digest # => nil
  #   user.password = 'mUc3m00RsqyRe'
  #   user.password_digest # => "$2a$10$4LEA7r4YmNHtvlAvHhsYAeZmk/xeUVtMTYqwIvYY76EW5GUqDiP4."
  def password=(unencrypted_password)
    if unencrypted_password.nil?
      self.password_digest = nil
    elsif !unencrypted_password.empty?
      @password = unencrypted_password
      cost = ActiveModel::SecurePassword.min_cost ? BCrypt::Engine::MIN_COST : BCrypt::Engine.cost
      self.password_digest = BCrypt::Password.create(unencrypted_password, cost: cost)
    end
  end

  def password_confirmation=(unencrypted_password)
    @password_confirmation = unencrypted_password
  end
end

它主要提供两种功能

1. 将password属性加密转给password_digest属性，即password=

2. 作对比，即authenticate

而这module里的password_confirmation=似乎是没用的，因为validates_confirmation_of已有定义它

module ActiveModel
  module Validations
    class ConfirmationValidator < EachValidator # :nodoc:
      def initialize(options)
        super({ case_sensitive: true }.merge!(options))
        setup!(options[:class])
      end

      private
      def setup!(klass)
        klass.send(:attr_reader, *attributes.map do |attribute|
          :"#{attribute}_confirmation" unless klass.method_defined?(:"#{attribute}_confirmation")
        end.compact)

        klass.send(:attr_writer, *attributes.map do |attribute|
          :"#{attribute}_confirmation" unless klass.method_defined?(:"#{attribute}_confirmation=")
        end.compact)
      end

（顺便记住password_digest）

class CreateUsers < ActiveRecord::Migration[5.0]
  def change
    create_table :users do |t|
      t.string :name
      t.string :password_digest

      t.timestamps
    end
  end
end