authenticate 0.2.3 → 0.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.gitignore +4 -4
- data/CHANGELOG.md +12 -0
- data/Gemfile +1 -0
- data/Gemfile.lock +21 -6
- data/app/controllers/authenticate/passwords_controller.rb +1 -1
- data/authenticate.gemspec +7 -3
- data/config/locales/authenticate.en.yml +1 -1
- data/gemfiles/rails42.gemfile +6 -1
- data/lib/authenticate/callbacks/brute_force.rb +3 -4
- data/lib/authenticate/configuration.rb +2 -2
- data/lib/authenticate/controller.rb +1 -2
- data/lib/authenticate/model/brute_force.rb +2 -2
- data/lib/authenticate/model/db_password.rb +2 -3
- data/lib/authenticate/model/email.rb +3 -6
- data/lib/authenticate/model/lifetimed.rb +1 -1
- data/lib/authenticate/model/password_reset.rb +1 -1
- data/lib/authenticate/model/timeoutable.rb +2 -2
- data/lib/authenticate/model/trackable.rb +1 -1
- data/lib/authenticate/model/username.rb +1 -1
- data/lib/authenticate/session.rb +0 -4
- data/lib/authenticate/user.rb +12 -0
- data/lib/authenticate/version.rb +1 -1
- data/spec/controllers/passwords_controller_spec.rb +119 -0
- data/spec/controllers/secured_controller_spec.rb +70 -0
- data/spec/controllers/sessions_controller_spec.rb +86 -0
- data/spec/controllers/users_controller_spec.rb +82 -0
- data/spec/dummy/app/controllers/application_controller.rb +2 -0
- data/spec/dummy/app/controllers/welcome_controller.rb +4 -0
- data/spec/dummy/app/views/layouts/application.html.erb +14 -0
- data/spec/dummy/app/views/welcome/index.html.erb +4 -0
- data/spec/dummy/config/application.rb +2 -0
- data/spec/dummy/config/environments/production.rb +12 -0
- data/spec/dummy/config/initializers/authenticate.rb +4 -11
- data/spec/dummy/config/routes.rb +3 -0
- data/spec/dummy/db/test.sqlite3 +0 -0
- data/spec/factories/users.rb +2 -4
- data/spec/features/brute_force_spec.rb +49 -0
- data/spec/features/max_session_lifetime_spec.rb +30 -0
- data/spec/features/password_reset_spec.rb +69 -0
- data/spec/features/password_update_spec.rb +41 -0
- data/spec/features/sign_in_spec.rb +29 -0
- data/spec/features/sign_out_spec.rb +22 -0
- data/spec/features/sign_up_spec.rb +42 -0
- data/spec/features/timeoutable_spec.rb +30 -0
- data/spec/model/brute_force_spec.rb +26 -29
- data/spec/model/configuration_spec.rb +61 -0
- data/spec/model/db_password_spec.rb +8 -9
- data/spec/model/email_spec.rb +0 -1
- data/spec/model/lifetimed_spec.rb +6 -18
- data/spec/model/password_reset_spec.rb +2 -9
- data/spec/model/session_spec.rb +16 -23
- data/spec/model/timeoutable_spec.rb +8 -7
- data/spec/model/trackable_spec.rb +0 -1
- data/spec/model/user_spec.rb +1 -2
- data/spec/spec_helper.rb +33 -131
- data/spec/support/controllers/controller_helpers.rb +24 -0
- data/spec/support/features/feature_helpers.rb +36 -0
- metadata +80 -8
- data/spec/configuration_spec.rb +0 -60
data/spec/model/email_spec.rb
CHANGED
@@ -3,31 +3,19 @@ require 'authenticate/model/lifetimed'
|
|
3
3
|
|
4
4
|
|
5
5
|
describe Authenticate::Model::Lifetimed do
|
6
|
-
|
7
6
|
context '#max_session_lifetime_exceeded?' do
|
8
|
-
before {
|
9
|
-
Authenticate.configure do |config|
|
10
|
-
config.max_session_lifetime = 10.minutes
|
11
|
-
end
|
12
|
-
}
|
13
7
|
|
14
8
|
it 'passes fresh sessions' do
|
15
|
-
|
16
|
-
|
9
|
+
Timecop.freeze do
|
10
|
+
user = create(:user, current_sign_in_at: 1.minute.ago.utc)
|
11
|
+
expect(user).to_not be_max_session_lifetime_exceeded
|
12
|
+
end
|
17
13
|
end
|
18
14
|
|
19
15
|
it 'detects timed out sessions' do
|
20
|
-
|
21
|
-
expect(user).to be_max_session_lifetime_exceeded
|
22
|
-
end
|
23
|
-
|
24
|
-
describe 'max_session_lifetime param not set' do
|
25
|
-
it 'does not time out' do
|
16
|
+
Timecop.freeze do
|
26
17
|
user = create(:user, current_sign_in_at: 5.hours.ago.utc)
|
27
|
-
|
28
|
-
config.max_session_lifetime = nil
|
29
|
-
end
|
30
|
-
expect(user).to_not be_max_session_lifetime_exceeded
|
18
|
+
expect(user).to be_max_session_lifetime_exceeded
|
31
19
|
end
|
32
20
|
end
|
33
21
|
end
|
@@ -3,9 +3,6 @@ require 'authenticate/model/password_reset'
|
|
3
3
|
|
4
4
|
|
5
5
|
describe Authenticate::Model::PasswordReset do
|
6
|
-
before(:all) {
|
7
|
-
Authenticate.configuration.reset_password_within = 5.minutes
|
8
|
-
}
|
9
6
|
context 'forgot_password!' do
|
10
7
|
subject { create(:user) }
|
11
8
|
before { subject.forgot_password! }
|
@@ -22,14 +19,13 @@ describe Authenticate::Model::PasswordReset do
|
|
22
19
|
|
23
20
|
context '#reset_password_period_valid?' do
|
24
21
|
subject { create(:user) }
|
25
|
-
before(:each) {
|
26
|
-
Authenticate.configuration.reset_password_within = 5.minutes
|
27
|
-
}
|
28
22
|
|
29
23
|
it 'always true if reset_password_within config param is nil' do
|
24
|
+
within = Authenticate.configuration.reset_password_within
|
30
25
|
subject.password_reset_sent_at = 10.days.ago
|
31
26
|
Authenticate.configuration.reset_password_within = nil
|
32
27
|
expect(subject.reset_password_period_valid?).to be_truthy
|
28
|
+
Authenticate.configuration.reset_password_within = within
|
33
29
|
end
|
34
30
|
|
35
31
|
it 'false if time exceeded' do
|
@@ -45,9 +41,6 @@ describe Authenticate::Model::PasswordReset do
|
|
45
41
|
|
46
42
|
context '#update_password' do
|
47
43
|
subject { create(:user) }
|
48
|
-
before(:each) {
|
49
|
-
Authenticate.configuration.reset_password_within = 5.minutes
|
50
|
-
}
|
51
44
|
|
52
45
|
context 'within time time' do
|
53
46
|
before(:each) {
|
data/spec/model/session_spec.rb
CHANGED
@@ -2,24 +2,23 @@ require 'spec_helper'
|
|
2
2
|
|
3
3
|
|
4
4
|
describe Authenticate::Session do
|
5
|
-
|
6
5
|
describe 'session token' do
|
7
6
|
it 'finds a user from session token' do
|
8
7
|
user = create(:user, :with_session_token)
|
9
|
-
request =
|
10
|
-
cookies =
|
8
|
+
request = mock_request
|
9
|
+
cookies = cookies_for user
|
11
10
|
session = Authenticate::Session.new(request, cookies)
|
12
11
|
expect(session.current_user).to eq user
|
13
12
|
end
|
14
|
-
it '
|
15
|
-
request =
|
16
|
-
cookies = {
|
13
|
+
it 'nil user without a session token' do
|
14
|
+
request = mock_request
|
15
|
+
cookies = {}
|
17
16
|
session = Authenticate::Session.new(request, cookies)
|
18
17
|
expect(session.current_user).to be_nil
|
19
18
|
end
|
20
19
|
it 'returns nil with a bogus session token' do
|
21
|
-
request =
|
22
|
-
cookies = {
|
20
|
+
request = mock_request
|
21
|
+
cookies = {Authenticate.configuration.cookie_name.freeze.to_sym => 'some made up value'}
|
23
22
|
session = Authenticate::Session.new(request, cookies)
|
24
23
|
expect(session.current_user).to be_nil
|
25
24
|
end
|
@@ -27,23 +26,20 @@ describe Authenticate::Session do
|
|
27
26
|
|
28
27
|
describe '#login' do
|
29
28
|
it 'sets current_user' do
|
30
|
-
user =
|
29
|
+
user = create(:user)
|
31
30
|
session = Authenticate::Session.new(mock_request, {})
|
32
31
|
session.login(user)
|
33
32
|
expect(session.current_user).to eq user
|
34
33
|
end
|
35
34
|
context 'with a block' do
|
36
35
|
it 'passes the success status to the block when login succeeds' do
|
37
|
-
user =
|
36
|
+
user = create(:user)
|
38
37
|
session = Authenticate::Session.new(mock_request, {})
|
39
|
-
session.login
|
38
|
+
session.login(user) do |status|
|
40
39
|
expect(status.success?).to eq true
|
41
40
|
end
|
42
41
|
end
|
43
42
|
it 'passes the failure status to the block when login fails' do
|
44
|
-
Authenticate.configure do |config|
|
45
|
-
config.max_consecutive_bad_logins_allowed = nil
|
46
|
-
end
|
47
43
|
session = Authenticate::Session.new(mock_request, {})
|
48
44
|
session.login nil do |status|
|
49
45
|
expect(status.success?).to eq false
|
@@ -65,20 +61,17 @@ describe Authenticate::Session do
|
|
65
61
|
expect{session.login(user)}.to change{user.sign_in_count}.by(1)
|
66
62
|
end
|
67
63
|
it 'fails login if a callback fails' do
|
68
|
-
|
69
|
-
Authenticate.lifecycle.after_authentication do |user, session, opts|
|
70
|
-
throw(:failure, failure_message)
|
71
|
-
end
|
72
|
-
user = create(:user, :with_session_token, last_access_at: 10.minutes.ago)
|
73
|
-
cookies = {authenticate_session_token: user.session_token}
|
64
|
+
cookies = {}
|
74
65
|
session = Authenticate::Session.new(mock_request, cookies)
|
75
|
-
session.login
|
66
|
+
session.login nil do |status|
|
76
67
|
expect(status.success?).to eq false
|
77
|
-
expect(status.message).to eq
|
68
|
+
expect(status.message).to eq I18n.t('callbacks.authenticatable.failure')
|
78
69
|
end
|
79
70
|
end
|
80
71
|
end
|
81
72
|
end
|
73
|
+
end
|
82
74
|
|
83
|
-
|
75
|
+
def cookies_for user
|
76
|
+
{ Authenticate.configuration.cookie_name.freeze.to_sym => user.session_token }
|
84
77
|
end
|
@@ -3,18 +3,19 @@ require 'authenticate/model/timeoutable'
|
|
3
3
|
|
4
4
|
|
5
5
|
describe Authenticate::Model::Timeoutable do
|
6
|
-
before(:all) {
|
7
|
-
Authenticate.configuration.timeout_in = 45.minutes
|
8
|
-
}
|
9
6
|
subject { create(:user) }
|
10
7
|
|
11
8
|
it 'does not timeout while last_access_at is valid' do
|
12
|
-
|
13
|
-
|
9
|
+
Timecop.freeze do
|
10
|
+
subject.last_access_at = 10.minutes.ago
|
11
|
+
expect(subject.timedout?).to be_falsey
|
12
|
+
end
|
14
13
|
end
|
15
14
|
|
16
15
|
it 'does timeout when last_access_at is stale' do
|
17
|
-
|
18
|
-
|
16
|
+
Timecop.freeze do
|
17
|
+
subject.last_access_at = 46.minutes.ago
|
18
|
+
expect(subject.timedout?).to be_truthy
|
19
|
+
end
|
19
20
|
end
|
20
21
|
end
|
data/spec/model/user_spec.rb
CHANGED
data/spec/spec_helper.rb
CHANGED
@@ -1,56 +1,52 @@
|
|
1
|
-
$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
|
2
1
|
$LOAD_PATH.unshift(File.dirname(__FILE__))
|
2
|
+
ENV['RAILS_ENV'] ||= 'test'
|
3
3
|
|
4
|
-
|
5
|
-
ENV["RAILS_ENV"] ||= 'test'
|
6
|
-
|
7
|
-
MY_ORM = :active_record
|
8
|
-
|
9
|
-
# require 'simplecov'
|
10
|
-
# SimpleCov.root File.join(File.dirname(__FILE__), '..', 'lib')
|
11
|
-
# SimpleCov.start
|
12
|
-
|
13
|
-
|
14
|
-
require 'rails/all'
|
4
|
+
require File.expand_path('../dummy/config/environment.rb', __FILE__)
|
15
5
|
require 'rspec/rails'
|
16
|
-
require '
|
17
|
-
|
18
|
-
|
19
|
-
require '
|
6
|
+
require 'shoulda-matchers'
|
7
|
+
require 'capybara/rails'
|
8
|
+
require 'capybara/rspec'
|
9
|
+
require 'database_cleaner'
|
10
|
+
require 'factory_girl'
|
11
|
+
require 'timecop'
|
20
12
|
|
21
|
-
|
22
|
-
|
13
|
+
Rails.backtrace_cleaner.remove_silencers!
|
14
|
+
DatabaseCleaner.strategy = :truncation
|
23
15
|
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
require "orm/#{MY_ORM}"
|
16
|
+
# No longer autoloading support, individually requiring instead.
|
17
|
+
#
|
18
|
+
# Dir[Rails.root.join("spec/support/**/*.rb")].each { |f| require f }
|
28
19
|
|
29
|
-
#
|
30
|
-
require
|
20
|
+
# Load factory girl factories.
|
21
|
+
Dir[File.join(File.dirname(__FILE__), 'factories/**/*.rb')].each { |f| require f }
|
31
22
|
|
32
|
-
|
23
|
+
RSpec.configure do |config|
|
24
|
+
config.include FactoryGirl::Syntax::Methods
|
25
|
+
config.infer_spec_type_from_file_location!
|
26
|
+
config.order = :random
|
27
|
+
config.use_transactional_fixtures = true
|
33
28
|
|
34
|
-
|
29
|
+
# config.mock_with :rspec
|
35
30
|
|
36
|
-
|
37
|
-
|
31
|
+
config.expect_with :rspec do |expectations|
|
32
|
+
expectations.syntax = :expect
|
33
|
+
end
|
38
34
|
|
39
|
-
config.
|
40
|
-
|
41
|
-
|
35
|
+
config.mock_with :rspec do |mocks|
|
36
|
+
mocks.syntax = :expect
|
37
|
+
end
|
42
38
|
|
43
|
-
config.use_transactional_fixtures = true
|
44
39
|
|
45
|
-
config.
|
46
|
-
|
47
|
-
|
40
|
+
config.after(:each, :type => :feature) do
|
41
|
+
DatabaseCleaner.clean # Truncate the database
|
42
|
+
Capybara.reset_sessions! # Forget the (simulated) browser state
|
43
|
+
Capybara.use_default_driver # Revert Capybara.current_driver to Capybara.default_driver
|
44
|
+
end
|
48
45
|
end
|
49
46
|
|
50
47
|
|
51
48
|
def restore_default_configuration
|
52
|
-
|
53
|
-
Authenticate.configure {}
|
49
|
+
puts 'restore_default_configuration called!!!!!!!!!!!!!!!!!!!!!'
|
54
50
|
end
|
55
51
|
|
56
52
|
def mock_request(params = {})
|
@@ -59,97 +55,3 @@ def mock_request(params = {})
|
|
59
55
|
allow(req).to receive(:remote_ip).and_return('111.111.111.111')
|
60
56
|
req
|
61
57
|
end
|
62
|
-
|
63
|
-
|
64
|
-
# # This file was generated by the `rails generate rspec:install` command. Conventionally, all
|
65
|
-
# # specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`.
|
66
|
-
# # The generated `.rspec` file contains `--require spec_helper` which will cause
|
67
|
-
# # this file to always be loaded, without a need to explicitly require it in any
|
68
|
-
# # files.
|
69
|
-
# #
|
70
|
-
# # Given that it is always loaded, you are encouraged to keep this file as
|
71
|
-
# # light-weight as possible. Requiring heavyweight dependencies from this file
|
72
|
-
# # will add to the boot time of your test suite on EVERY test run, even for an
|
73
|
-
# # individual file that may not need all of that loaded. Instead, consider making
|
74
|
-
# # a separate helper file that requires the additional dependencies and performs
|
75
|
-
# # the additional setup, and require it from the spec files that actually need
|
76
|
-
# # it.
|
77
|
-
# #
|
78
|
-
# # The `.rspec` file also contains a few flags that are not defaults but that
|
79
|
-
# # users commonly want.
|
80
|
-
# #
|
81
|
-
# # See http://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
|
82
|
-
# RSpec.configure do |config|
|
83
|
-
# # rspec-expectations config goes here. You can use an alternate
|
84
|
-
# # assertion/expectation library such as wrong or the stdlib/minitest
|
85
|
-
# # assertions if you prefer.
|
86
|
-
# config.expect_with :rspec do |expectations|
|
87
|
-
# # This option will default to `true` in RSpec 4. It makes the `description`
|
88
|
-
# # and `failure_message` of custom matchers include text for helper methods
|
89
|
-
# # defined using `chain`, e.g.:
|
90
|
-
# # be_bigger_than(2).and_smaller_than(4).description
|
91
|
-
# # # => "be bigger than 2 and smaller than 4"
|
92
|
-
# # ...rather than:
|
93
|
-
# # # => "be bigger than 2"
|
94
|
-
# expectations.include_chain_clauses_in_custom_matcher_descriptions = true
|
95
|
-
# end
|
96
|
-
#
|
97
|
-
# # rspec-mocks config goes here. You can use an alternate test double
|
98
|
-
# # library (such as bogus or mocha) by changing the `mock_with` option here.
|
99
|
-
# config.mock_with :rspec do |mocks|
|
100
|
-
# # Prevents you from mocking or stubbing a method that does not exist on
|
101
|
-
# # a real object. This is generally recommended, and will default to
|
102
|
-
# # `true` in RSpec 4.
|
103
|
-
# mocks.verify_partial_doubles = true
|
104
|
-
# end
|
105
|
-
#
|
106
|
-
# # The settings below are suggested to provide a good initial experience
|
107
|
-
# # with RSpec, but feel free to customize to your heart's content.
|
108
|
-
# =begin
|
109
|
-
# # These two settings work together to allow you to limit a spec run
|
110
|
-
# # to individual examples or groups you care about by tagging them with
|
111
|
-
# # `:focus` metadata. When nothing is tagged with `:focus`, all examples
|
112
|
-
# # get run.
|
113
|
-
# config.filter_run :focus
|
114
|
-
# config.run_all_when_everything_filtered = true
|
115
|
-
#
|
116
|
-
# # Allows RSpec to persist some state between runs in order to support
|
117
|
-
# # the `--only-failures` and `--next-failure` CLI options. We recommend
|
118
|
-
# # you configure your source control system to ignore this file.
|
119
|
-
# config.example_status_persistence_file_path = "spec/examples.txt"
|
120
|
-
#
|
121
|
-
# # Limits the available syntax to the non-monkey patched syntax that is
|
122
|
-
# # recommended. For more details, see:
|
123
|
-
# # - http://rspec.info/blog/2012/06/rspecs-new-expectation-syntax/
|
124
|
-
# # - http://www.teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/
|
125
|
-
# # - http://rspec.info/blog/2014/05/notable-changes-in-rspec-3/#zero-monkey-patching-mode
|
126
|
-
# config.disable_monkey_patching!
|
127
|
-
#
|
128
|
-
# # Many RSpec users commonly either run the entire suite or an individual
|
129
|
-
# # file, and it's useful to allow more verbose output when running an
|
130
|
-
# # individual spec file.
|
131
|
-
# if config.files_to_run.one?
|
132
|
-
# # Use the documentation formatter for detailed output,
|
133
|
-
# # unless a formatter has already been configured
|
134
|
-
# # (e.g. via a command-line flag).
|
135
|
-
# config.default_formatter = 'doc'
|
136
|
-
# end
|
137
|
-
#
|
138
|
-
# # Print the 10 slowest examples and example groups at the
|
139
|
-
# # end of the spec run, to help surface which specs are running
|
140
|
-
# # particularly slow.
|
141
|
-
# config.profile_examples = 10
|
142
|
-
#
|
143
|
-
# # Run specs in random order to surface order dependencies. If you find an
|
144
|
-
# # order dependency and want to debug it, you can fix the order by providing
|
145
|
-
# # the seed, which is printed after each run.
|
146
|
-
# # --seed 1234
|
147
|
-
# config.order = :random
|
148
|
-
#
|
149
|
-
# # Seed global randomization in this process using the `--seed` CLI option.
|
150
|
-
# # Setting this allows you to use `--seed` to deterministically reproduce
|
151
|
-
# # test failures related to randomization by passing the same `--seed` value
|
152
|
-
# # as the one that triggered the failure.
|
153
|
-
# Kernel.srand config.seed
|
154
|
-
# =end
|
155
|
-
# end
|
@@ -0,0 +1,24 @@
|
|
1
|
+
require 'authenticate/controller'
|
2
|
+
|
3
|
+
module Controllers
|
4
|
+
module ControllerHelpers
|
5
|
+
|
6
|
+
def sign_in
|
7
|
+
user = create(:user)
|
8
|
+
sign_in_as user
|
9
|
+
end
|
10
|
+
|
11
|
+
def sign_in_as(user)
|
12
|
+
controller.login user
|
13
|
+
end
|
14
|
+
|
15
|
+
def sign_out
|
16
|
+
controller.logout
|
17
|
+
end
|
18
|
+
|
19
|
+
end
|
20
|
+
end
|
21
|
+
|
22
|
+
RSpec.configure do |config|
|
23
|
+
config.include Controllers::ControllerHelpers, type: :controller
|
24
|
+
end
|
@@ -0,0 +1,36 @@
|
|
1
|
+
module Features
|
2
|
+
module FeatureHelpers
|
3
|
+
|
4
|
+
|
5
|
+
def sign_in_with(email, password)
|
6
|
+
visit sign_in_path
|
7
|
+
fill_in 'session_email', with: email
|
8
|
+
fill_in 'session_password', with: password
|
9
|
+
click_button 'Sign in'
|
10
|
+
end
|
11
|
+
|
12
|
+
def sign_out
|
13
|
+
within '#header' do
|
14
|
+
click_link I18n.t("layouts.application.sign_out")
|
15
|
+
end
|
16
|
+
end
|
17
|
+
|
18
|
+
def expect_user_to_be_signed_in
|
19
|
+
visit root_path
|
20
|
+
expect(page).to have_link 'Sign out'
|
21
|
+
end
|
22
|
+
|
23
|
+
def expect_page_to_display_sign_in_error
|
24
|
+
expect(page).to have_content 'Invalid id or password'
|
25
|
+
end
|
26
|
+
|
27
|
+
def expect_user_to_be_signed_out
|
28
|
+
expect(page).to have_content 'Sign in'
|
29
|
+
end
|
30
|
+
|
31
|
+
end
|
32
|
+
end
|
33
|
+
|
34
|
+
RSpec.configure do |config|
|
35
|
+
config.include Features::FeatureHelpers, type: :feature
|
36
|
+
end
|