authkit 0.2.1 → 0.4.0

data/lib/generators/authkit/templates/app/controllers/signup_controller.rb

@@ -7,10 +7,12 @@ class SignupController < ApplicationController
   end
 
   def create
+    remember = params[:remember_me] == "1"
+
     @signup = Signup.new(signup_params)
 
     if @signup.save
-      login(@signup.user)
+      login(@signup.user, remember)
       respond_to do |format|
         format.json { head :no_content }
         format.html {

data/lib/generators/authkit/templates/app/models/user.rb

@@ -31,52 +31,6 @@ class User < ActiveRecord::Base
   # Confirm emails check for existing emails for uniqueness as a convenience
   validate  :confirmation_email_uniqueness, if: :confirmation_email_set?
 
-  def self.user_from_token(token)
-    verifier = ActiveSupport::MessageVerifier.new(Rails.application.config.secret_key_base)
-    id = verifier.verify(token)
-    User.where(id: id).first
-  rescue ActiveSupport::MessageVerifier::InvalidSignature
-    nil
-  end
-
-  # The tokens created by this method have unique indexes but they are digests of the
-  # id which is unique. Because of this we shouldn't see a conflict. If we do, however
-  # we want the ActiveRecord::StatementInvalid or ActiveRecord::RecordNotUnique exeception
-  # to bubble up.
-  def set_token(field)
-    return unless self.persisted?
-    verifier = ActiveSupport::MessageVerifier.new(Rails.application.config.secret_key_base)
-    self.send("#{field}_created_at=", Time.now)
-    self.send("#{field}=", verifier.generate(self.id))
-    self.save
-  end
-
-  # These methods are a little redundant, but give you the opportunity to
-  # insert expiry for any of these token based authentication strategies.
-  # For example:
-  #
-  #    def self.user_from_remember_token(token)
-  #      user = user_from_token(token)
-  #      user = nil if user && user.remember_token_created_at < 30.days.ago
-  #      user
-  #    end
-  #
-  def self.user_from_remember_token(token)
-    user_from_token(token)
-  end
-
-  def self.user_from_reset_password_token(token)
-    user_from_token(token)
-  end
-
-  def self.user_from_confirmation_token(token)
-    user_from_token(token)
-  end
-
-  def self.user_from_unlock_token(token)
-    user_from_token(token)
-  end
-
   def display_name
     [first_name, last_name].compact.join(" ")
   end
@@ -90,31 +44,72 @@ class User < ActiveRecord::Base
     self.save
   end
 
-  def send_welcome
-    # TODO: insert your mailer logic here
-    true
+  # The tokens created by this method have unique indexes but collisions are very
+  # unlikely (1/64^32). Because of this there shouldn't be a conflict. If one occurs
+  # the ActiveRecord::StatementInvalid or ActiveRecord::RecordNotUnique exeception
+  # should bubble up.
+  def set_remember_token
+    self.remember_token = SecureRandom.urlsafe_base64(32)
+    self.remember_token_created_at = Time.now
+    self.save!
   end
 
   def clear_remember_token
     self.remember_token = nil
     self.remember_token_created_at = nil
-    self.save
+    self.save!
+  end
+
+  def reset_password_token_expired?
+    # TODO reset password tokens expire in 1 day by default
+    self.reset_password_token_created_at.blank? || self.reset_password_token_created_at <= 1.day.ago
+  end
+
+  def confirmation_token_expired?
+    # TODO confirmation tokens expire in 3 days by default
+    self.confirmation_token_created_at.blank? || self.confirmation_token_created_at <= 3.days.ago
+  end
+
+  def remember_token_expired?
+    # TODO remember tokens expire in 1 year by default
+    self.remember_token_created_at.blank? || self.remember_token_created_at <= 1.year.ago
   end
 
+  def send_welcome
+    # TODO insert your mailer logic here
+    true
+  end
+
+  # The tokens created by this method have unique indexes but collisions are very
+  # unlikely (1/64^32). Because of this there shouldn't be a conflict. If one occurs
+  # the ActiveRecord::StatementInvalid or ActiveRecord::RecordNotUnique exeception
+  # should bubble up.
   def send_reset_password
-    return false unless set_token(:reset_password_token)
+    self.reset_password_token = SecureRandom.urlsafe_base64(32)
+    self.reset_password_token_created_at = Time.now
+    self.save!
 
     # TODO: insert your mailer logic here
     true
   end
 
+  # The tokens created by this method have unique indexes but collisions are very
+  # unlikely (1/64^32). Because of this there shouldn't be a conflict. If one occurs
+  # the ActiveRecord::StatementInvalid or ActiveRecord::RecordNotUnique exeception
+  # should bubble up.
   def send_confirmation
-    return false unless set_token(:confirmation_token)
+    self.confirmation_token = SecureRandom.urlsafe_base64(32)
+    self.confirmation_token_created_at = Time.now
+    self.save!
 
     # TODO: insert your mailer logic here
     true
   end
 
+  def pending_confirmation?
+    self.confirmation_token.present?
+  end
+
   def email_confirmed
     return false if self.confirmation_token.blank? || self.confirmation_email.blank?
 
@@ -172,4 +167,5 @@ class User < ActiveRecord::Base
   def confirmation_email_uniqueness
     errors.add(:confirmation_email, :taken, value: email) if User.where('email = ?', confirmation_email).count > 0
   end
+
 end

data/lib/generators/authkit/templates/app/views/password_change/show.html.erb

@@ -2,6 +2,7 @@
 
 <%= form_tag(password_change_path, method: "post") do %>
   <%= hidden_field_tag :token, params[:token] %>
+  <%= hidden_field_tag :email, params[:email] %>
 
   <div class="field">
     <%= label_tag "password" %>

data/lib/generators/authkit/templates/app/views/sessions/new.html.erb

@@ -9,5 +9,9 @@
     <%= label_tag "password" %>
     <%= password_field_tag "password" %>
   </div>
+  <div class="field">
+    <%= check_box_tag :remember_me, "1", true %>
+    <label for="remember_me">Keep me signed in on this computer</label>
+  </div>
   <%= submit_tag "Login" %>
 <% end %>

data/lib/generators/authkit/templates/app/views/signup/new.html.erb

@@ -35,7 +35,7 @@
     <%= f.text_field "phone_number" %>
   </div>
   <div class="field">
-    <%= f.label "phone_number" %>
+    <%= f.label "time_zone" %>
     <%= f.time_zone_select('time_zone', ActiveSupport::TimeZone.us_zones, :default => "Pacific Time (US & Canada)") %>
   </div>
   <div class="field">
@@ -54,5 +54,9 @@
     <%= f.label "password_confirmation" %>
     <%= f.password_field "password_confirmation" %>
   </div>
+  <div class="field">
+    <%= check_box_tag :remember_me, "1", true %>
+    <label for="remember_me">Keep me signed in on this computer</label>
+  </div>
   <%= f.submit "Sign up" %>
 <% end %>

data/lib/generators/authkit/templates/app/views/users/edit.html.erb

@@ -35,7 +35,7 @@
     <%= f.text_field "phone_number" %>
   </div>
   <div class="field">
-    <%= f.label "phone_number" %>
+    <%= f.label "time_zone" %>
     <%= f.time_zone_select('time_zone', ActiveSupport::TimeZone.us_zones, :default => "Pacific Time (US & Canada)") %>
   </div>
   <div class="field">

data/lib/generators/authkit/templates/spec/controllers/application_controller_spec.rb

@@ -11,7 +11,6 @@ describe ApplicationController do
 
   controller do
     before_filter :require_login, only: [:index]
-    before_filter :require_token, only: [:show]
 
     def new
       head :ok
@@ -46,15 +45,30 @@ describe ApplicationController do
     end
 
     it "finds the current user from the remember cookie" do
+      user.save
+      user.set_remember_token
       # Need to sign the cookie
       request.env["action_dispatch.secret_token"] = "SECRET"
       verifier = ActiveSupport::MessageVerifier.new(request.env["action_dispatch.secret_token".freeze])
-      request.cookies[:remember] = verifier.generate("TOKEN")
-      User.should_receive(:user_from_remember_token).with("TOKEN").and_return(user)
+      request.cookies[:remember] = verifier.generate(user.remember_token)
       get :index
       controller.send(:current_user).should == user
     end
 
+    it "doesn't find the current user from the remember cookie if it is expired" do
+      # Setup expired token
+      user.set_remember_token
+      user.remember_token_created_at = 1.year.ago
+      user.save
+
+      # Need to sign the cookie
+      request.env["action_dispatch.secret_token"] = "SECRET"
+      verifier = ActiveSupport::MessageVerifier.new(request.env["action_dispatch.secret_token".freeze])
+      request.cookies[:remember] = verifier.generate(user.remember_token)
+      get :index
+      controller.send(:current_user).should be_nil
+    end
+
     it "sets the time zone" do
       User.any_instance.should_receive(:time_zone).and_return("Pacific Time (US & Canada)")
       get :index, {}, logged_in_session
@@ -111,27 +125,6 @@ describe ApplicationController do
     end
   end
 
-  describe "tokens" do
-    it "requires a user token" do
-      User.should_receive(:user_from_token).with('testtoken').and_return(user)
-      get 'show', {id: '1',  token: 'testtoken'}
-    end
-
-    it "returns an error if there is no user token" do
-      User.should_receive(:user_from_token).with('testtoken').and_return(nil)
-      controller.should_receive(:deny_user)
-      get 'show', {id: '1',  token: 'testtoken'}
-    end
-
-    it "verifies the token" do
-      request.env["action_dispatch.secret_token"] = "SECRET"
-      verifier = ActiveSupport::MessageVerifier.new(request.env["action_dispatch.secret_token".freeze])
-      token = verifier.generate("TOKEN")
-      User.should_receive(:user_from_token).with(token).and_return(user)
-      get 'show', {id: '1', token: token}
-    end
-  end
-
   describe "login" do
     it "tracks the login" do
       get :new
@@ -142,8 +135,15 @@ describe ApplicationController do
     it "remembers the user using a token and cookie" do
       get :new
       controller.should_receive(:set_remember_cookie)
-      user.should_receive(:set_token).with(:remember_token).and_return(:true)
-      controller.send(:login, user)
+      user.should_receive(:set_remember_token)
+      controller.send(:login, user, true)
+    end
+
+    it "does not remember the user using a token and cookie when not requested" do
+      get :new
+      controller.should_not_receive(:set_remember_cookie)
+      user.should_not_receive(:set_remember_token)
+      controller.send(:login, user, false)
     end
 
     it "resets the session" do

data/lib/generators/authkit/templates/spec/controllers/email_confirmation_controller_spec.rb

@@ -7,8 +7,25 @@ describe EmailConfirmationController do
   let(:token) { "TOKEN" }
 
   describe "GET 'show'" do
+    it "requires a login" do
+      controller.stub(:current_user).and_return(nil)
+      get 'show', token: token
+      response.should be_redirect
+      flash[:error].should_not be_empty
+    end
+
     it "requires a valid token" do
-      User.should_receive(:user_from_token).with(token).and_return(nil)
+      user.confirmation_token = "OTHER TOKEN"
+      controller.stub(:current_user).and_return(user)
+      get 'show', token: token
+      response.should be_redirect
+      flash[:error].should_not be_empty
+    end
+
+    it "requires an unexpired token" do
+      user.confirmation_token = token
+      user.confirmation_token_created_at = 4.days.ago
+      controller.stub(:current_user).and_return(user)
       get 'show', token: token
       response.should be_redirect
       flash[:error].should_not be_empty
@@ -18,36 +35,37 @@ describe EmailConfirmationController do
       before(:each) do
         user.confirmation_email = "new@example.com"
         user.confirmation_token = token
+        user.confirmation_token_created_at = Time.now
       end
 
       describe "when the confirmation is successful" do
         it "confirms the user email" do
-          User.should_receive(:user_from_token).with(token).and_return(user)
+          controller.stub(:current_user).and_return(user)
           user.should_receive(:email_confirmed).and_return(true)
           get 'show', token: token
         end
 
-        it "signs the user in" do
-          User.should_receive(:user_from_token).with(token).and_return(user)
-          controller.should_receive(:login).with(user)
+        it "does not sign the user in" do
+          controller.stub(:current_user).and_return(user)
+          controller.should_not_receive(:login)
           get 'show', token: token
         end
 
         it "sets the flash" do
-          User.should_receive(:user_from_token).with(token).and_return(user)
+          controller.stub(:current_user).and_return(user)
           get 'show', token: token
           flash[:notice].should_not be_nil
         end
 
         it "redirects the user" do
-          User.should_receive(:user_from_token).with(token).and_return(user)
+          controller.stub(:current_user).and_return(user)
           get 'show', token: token
           response.should be_redirect
         end
 
         describe "from json" do
           it "returns http success" do
-            User.should_receive(:user_from_token).with(token).and_return(user)
+            controller.stub(:current_user).and_return(user)
             get 'show', token: token, format: 'json'
             response.should be_success
           end
@@ -57,7 +75,7 @@ describe EmailConfirmationController do
 
       describe "when the confirmation is not successful" do
         it "handles invalid confirmations" do
-          User.should_receive(:user_from_token).with(token).and_return(user)
+          controller.stub(:current_user).and_return(user)
           user.should_receive(:email_confirmed).and_return(false)
           get 'show', token: token
           flash[:error].should_not be_empty
@@ -66,7 +84,7 @@ describe EmailConfirmationController do
 
         describe "from json" do
           it "returns a 422" do
-            User.should_receive(:user_from_token).with(token).and_return(user)
+            controller.stub(:current_user).and_return(user)
             user.should_receive(:email_confirmed).and_return(false)
             get 'show', token: token, format: 'json'
             response.code.should == '422'

data/lib/generators/authkit/templates/spec/controllers/password_change_controller_spec.rb

@@ -3,63 +3,113 @@ require 'spec_helper'
 describe PasswordChangeController do
   render_views
 
-  let(:user) { build(:user) }
   let(:token) { "TOKEN" }
+  let(:user) { build(:user, reset_password_token: token, reset_password_token_created_at: Time.now) }
+  let(:valid_params) { {token: token, email: user.email} }
+  let(:password_params) { valid_params.merge(password: 'newpassword', password_confirmation: 'newpassword') }
 
   describe "GET 'show'" do
+    it "requires no user" do
+      controller.stub(:email_user).and_return(user)
+      controller.should_receive(:logout)
+      get 'show', valid_params
+    end
+
+    it "requires an email user" do
+      user.save
+      get 'show', valid_params
+      assigns(:user).id.should == user.id
+    end
+
+    it "redirects if there is no email user" do
+      user.save
+      expect {
+        get 'show', {token: token, email: "invalid@example.com"}
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+
     it "requires a valid token" do
-      User.should_receive(:user_from_token).with(token).and_return(nil)
-      get 'show', token: token
+      controller.stub(:email_user).and_return(user)
+      user.reset_password_token = "OTHER TOKEN"
+      get 'show', valid_params
+      response.should be_redirect
+      flash[:error].should_not be_empty
+    end
+
+    it "requires an unexpired token" do
+      controller.stub(:email_user).and_return(user)
+      user.reset_password_token_created_at = 1.year.ago
+      get 'show', valid_params
       response.should be_redirect
       flash[:error].should_not be_empty
     end
 
     it "returns http success" do
-      User.should_receive(:user_from_token).with(token).and_return(user)
-      get 'show', token: token
+      controller.stub(:email_user).and_return(user)
+      get 'show', valid_params
       response.should be_success
     end
   end
 
   describe "POST 'create'" do
+    it "requires no user" do
+      controller.stub(:email_user).and_return(user)
+      controller.should_receive(:logout)
+      get 'show', valid_params
+    end
+
+    it "requires an email user" do
+      user.save
+      post 'create', password_params
+      assigns(:user).id.should == user.id
+    end
+
+    it "redirects if there is no email user" do
+      user.save
+      expect {
+        get 'show', {token: token, email: "invalid@example.com"}
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+
     it "requires a valid token" do
-      User.should_receive(:user_from_token).with(token).and_return(nil)
-      post 'create', {token: token, password: 'newpassword', password_confirmation: 'newpassword'}
+      controller.stub(:email_user).and_return(user)
+      user.reset_password_token = "OTHER TOKEN"
+      post 'create', password_params
       response.should be_redirect
       flash[:error].should_not be_empty
     end
 
     describe "with valid params" do
       before(:each) do
-        User.should_receive(:user_from_token).with(token).and_return(user)
+        controller.stub(:email_user).and_return(user)
       end
 
       it "changes the password" do
         expect {
-          post 'create', {token: token, password: 'newpassword', password_confirmation: 'newpassword'}
+          post 'create', password_params
         }.to change(user, :password_digest)
 
         user.should be_valid
       end
 
-      it "signs the user in" do
-        controller.should_receive(:login).with(user)
-        post 'create', {token: token, password: 'newpassword', password_confirmation: 'newpassword'}
+      it "does not sign the user in" do
+        controller.should_not_receive(:login)
+        post 'create', password_params
       end
 
       it "redirects the user" do
-        post 'create', {token: token, password: 'newpassword', password_confirmation: 'newpassword'}
+        post 'create', password_params
         response.should be_redirect
       end
 
       it "sets the flash" do
-        post 'create', {token: token, password: 'newpassword', password_confirmation: 'newpassword'}
+        post 'create', password_params
         flash[:notice].should =~ /successfully/i
       end
 
       describe "from json" do
         it "returns http success" do
-          post 'create', {token: token, password: 'newpassword', password_confirmation: 'newpassword', format: 'json'}
+          post 'create', password_params.merge(format: 'json')
           response.should be_success
         end
       end
@@ -67,27 +117,27 @@ describe PasswordChangeController do
 
     describe "with invalid params" do
       before(:each) do
-        User.should_receive(:user_from_token).with(token).and_return(user)
+        controller.stub(:email_user).and_return(user)
       end
 
       it "doesn't sign the user in" do
         controller.should_not_receive(:login)
-        post 'create', {token: token, password: 'newpassword', password_confirmation: 'invalid'}
+        post 'create', {token: token, email: user.email, password: 'newpassword', password_confirmation: 'invalid'}
       end
 
       it "renders the show template" do
-        post 'create', {token: token, password: 'newpassword', password_confirmation: 'invalid'}
+        post 'create', {token: token, email: user.email, password: 'newpassword', password_confirmation: 'invalid'}
         response.should render_template(:show)
       end
 
       it "has errors" do
-        post 'create', {token: token, password: 'newpassword', password_confirmation: 'invalid'}
-        assigns(:user).should have(2).errors_on(:password_confirmation)
+        post 'create', {token: token, email: user.email, password: 'newpassword', password_confirmation: 'invalid'}
+        user.should have(2).errors_on(:password_confirmation)
       end
 
       describe "from json" do
         it "returns an error" do
-          post 'create', {token: token, password: 'newpassword', password_confirmation: 'invalid', format: 'json'}
+          post 'create', {token: token, email: user.email, password: 'newpassword', password_confirmation: 'invalid', format: 'json'}
           response.code.should == '422'
           response.body.should =~ /doesn't match/i
         end