authlogic 2.0.0 → 2.1.0

data/test/acts_as_authentic_test/login_test.rb

@@ -33,7 +33,7 @@ module ActsAsAuthenticTest
     end
     
     def test_validates_format_of_login_field_options_config
-      default = {:with => /\A\w[\w\.\-_@ ]+\z/, :message => I18n.t('error_messages.login_invalid', :default => "should use only letters, numbers, spaces, and .-_@ please.")}
+      default = {:with => /\A\w[\w\.+\-_@ ]+\z/, :message => I18n.t('error_messages.login_invalid', :default => "should use only letters, numbers, spaces, and .-_@ please.")}
       assert_equal default, User.validates_format_of_login_field_options
       assert_equal default, Employee.validates_format_of_login_field_options
       
@@ -43,37 +43,67 @@ module ActsAsAuthenticTest
       assert_equal default, User.validates_format_of_login_field_options
     end
     
+    def test_validates_uniqueness_of_login_field_options_config
+      default = {:case_sensitive => false, :scope => User.validations_scope, :if => "#{User.login_field}_changed?".to_sym}
+      assert_equal default, User.validates_uniqueness_of_login_field_options
+      
+      User.validates_uniqueness_of_login_field_options = {:yes => "no"}
+      assert_equal({:yes => "no"}, User.validates_uniqueness_of_login_field_options)
+      User.validates_uniqueness_of_login_field_options default
+      assert_equal default, User.validates_uniqueness_of_login_field_options
+    end
+    
     def test_validates_length_of_login_field
       u = User.new
       u.login = "a"
       assert !u.valid?
-      assert u.errors.on(:login)
+      assert u.errors[:login].size > 0
       
       u.login = "aaaaaaaaaa"
       assert !u.valid?
-      assert !u.errors.on(:login)
+      assert u.errors[:login].size == 0
     end
     
     def test_validates_format_of_login_field
       u = User.new
       u.login = "fdsf@^&*"
       assert !u.valid?
-      assert u.errors.on(:login)
+      assert u.errors[:login].size > 0
       
       u.login = "fdsfdsfdsfdsfs"
       assert !u.valid?
-      assert !u.errors.on(:login)
+      assert u.errors[:login].size == 0
+      
+      u.login = "dakota.dux+1@gmail.com"
+      assert !u.valid?
+      assert u.errors[:login].size == 0
     end
     
     def test_validates_uniqueness_of_login_field
       u = User.new
       u.login = "bjohnson"
       assert !u.valid?
-      assert u.errors.on(:login)
+      assert u.errors[:login].size > 0
+      
+      u.login = "BJOHNSON"
+      assert !u.valid?
+      assert u.errors[:login].size > 0
       
       u.login = "fdsfdsf"
       assert !u.valid?
-      assert !u.errors.on(:login)
+      assert u.errors[:login].size == 0
+    end
+    
+    def test_find_by_smart_case_login_field
+      ben = users(:ben)
+      assert_equal ben, User.find_by_smart_case_login_field("bjohnson")
+      assert_equal ben, User.find_by_smart_case_login_field("BJOHNSON")
+      assert_equal ben, User.find_by_smart_case_login_field("Bjohnson")
+      
+      drew = employees(:drew)
+      assert_equal drew, Employee.find_by_smart_case_login_field("dgainor@binarylogic.com")
+      assert_equal drew, Employee.find_by_smart_case_login_field("Dgainor@binarylogic.com")
+      assert_equal drew, Employee.find_by_smart_case_login_field("DGAINOR@BINARYLOGIC.COM")
     end
   end
 end

data/test/acts_as_authentic_test/magic_columns_test.rb

@@ -6,22 +6,22 @@ module ActsAsAuthenticTest
       u = User.new
       u.login_count = -1
       assert !u.valid?
-      assert u.errors.on(:login_count)
+      assert u.errors[:login_count].size > 0
       
       u.login_count = 0
       assert !u.valid?
-      assert !u.errors.on(:login_count)
+      assert u.errors[:login_count].size == 0
     end
     
     def test_validates_numericality_of_failed_login_count
       u = User.new
       u.failed_login_count = -1
       assert !u.valid?
-      assert u.errors.on(:failed_login_count)
+      assert u.errors[:failed_login_count].size > 0
       
       u.failed_login_count = 0
       assert !u.valid?
-      assert !u.errors.on(:failed_login_count)
+      assert u.errors[:failed_login_count].size == 0
     end
   end
 end

data/test/acts_as_authentic_test/password_test.rb

@@ -22,6 +22,24 @@ module ActsAsAuthenticTest
       assert_equal :password_salt, User.password_salt_field
     end
     
+    def test_ignore_blank_passwords_config
+      assert User.ignore_blank_passwords
+      assert Employee.ignore_blank_passwords
+      
+      User.ignore_blank_passwords = false
+      assert !User.ignore_blank_passwords
+      User.ignore_blank_passwords true
+      assert User.ignore_blank_passwords
+    end
+    
+    def test_check_passwords_against_database
+      assert User.check_passwords_against_database
+      User.check_passwords_against_database = false
+      assert !User.check_passwords_against_database
+      User.check_passwords_against_database true
+      assert User.check_passwords_against_database
+    end
+    
     def test_validate_password_field_config
       assert User.validate_password_field
       assert Employee.validate_password_field
@@ -32,8 +50,19 @@ module ActsAsAuthenticTest
       assert User.validate_password_field
     end
     
+    def test_validates_length_of_password_field_options_config
+      default = {:minimum => 4, :if => :require_password?}
+      assert_equal default, User.validates_length_of_password_field_options
+      assert_equal default, Employee.validates_length_of_password_field_options
+      
+      User.validates_length_of_password_field_options = {:yes => "no"}
+      assert_equal({:yes => "no"}, User.validates_length_of_password_field_options)
+      User.validates_length_of_password_field_options default
+      assert_equal default, User.validates_length_of_password_field_options
+    end
+    
     def test_validates_confirmation_of_password_field_options_config
-      default = {:minimum => 4, :if => "#{User.password_salt_field}_changed?".to_sym}
+      default = {:if => :require_password?}
       assert_equal default, User.validates_confirmation_of_password_field_options
       assert_equal default, Employee.validates_confirmation_of_password_field_options
       
@@ -44,7 +73,7 @@ module ActsAsAuthenticTest
     end
     
     def test_validates_length_of_password_confirmation_field_options_config
-      default = {:minimum => 4, :if => :require_password_confirmation?}
+      default = {:minimum => 4, :if => :require_password?}
       assert_equal default, User.validates_length_of_password_confirmation_field_options
       assert_equal default, Employee.validates_length_of_password_confirmation_field_options
       
@@ -74,37 +103,15 @@ module ActsAsAuthenticTest
       assert_equal [], User.transition_from_crypto_providers
     end
     
-    def test_act_like_restful_authentication_config
-      assert !User.act_like_restful_authentication
-      assert !Employee.act_like_restful_authentication
-      
-      User.act_like_restful_authentication = true
-      assert User.act_like_restful_authentication
-      assert_equal Authlogic::CryptoProviders::Sha1, User.crypto_provider
-      assert defined?(::REST_AUTH_SITE_KEY)
-      assert_equal 1, Authlogic::CryptoProviders::Sha1.stretches
-
-      User.act_like_restful_authentication false
-      assert !User.act_like_restful_authentication
-      
-      User.crypto_provider = Authlogic::CryptoProviders::Sha512
-      User.transition_from_crypto_providers = []
-    end
-    
-    def test_transition_from_restful_authentication_config
-      assert !User.transition_from_restful_authentication
-      assert !Employee.transition_from_restful_authentication
-      
-      User.transition_from_restful_authentication = true
-      assert User.transition_from_restful_authentication
-      assert defined?(::REST_AUTH_SITE_KEY)
-      assert_equal 1, Authlogic::CryptoProviders::Sha1.stretches
-      
-      User.transition_from_restful_authentication false
-      assert !User.transition_from_restful_authentication
+    def test_validates_length_of_password
+      u = User.new
+      u.password_confirmation = "test2"
+      assert !u.valid?
+      assert u.errors[:password].size > 0
       
-      User.crypto_provider = Authlogic::CryptoProviders::Sha512
-      User.transition_from_crypto_providers = []
+      u.password = "test"
+      assert !u.valid?
+      assert u.errors[:password_confirmation].size == 0
     end
     
     def test_validates_confirmation_of_password
@@ -112,34 +119,31 @@ module ActsAsAuthenticTest
       u.password = "test"
       u.password_confirmation = "test2"
       assert !u.valid?
-      assert u.errors.on(:password)
+      assert u.errors[:password].size > 0
       
       u.password_confirmation = "test"
       assert !u.valid?
-      assert !u.errors.on(:password)
+      assert u.errors[:password].size == 0
     end
     
     def test_validates_length_of_password_confirmation
       u = User.new
       
-      assert !u.valid?
-      assert u.errors.on(:password_confirmation)
-      
       u.password = "test"
       u.password_confirmation = ""
       assert !u.valid?
-      assert u.errors.on(:password_confirmation)
+      assert u.errors[:password_confirmation].size > 0
       
       u.password_confirmation = "test"
       assert !u.valid?
-      assert !u.errors.on(:password_confirmation)
+      assert u.errors[:password_confirmation].size == 0
       
       ben = users(:ben)
       assert ben.valid?
       
       ben.password = "newpass"
       assert !ben.valid?
-      assert ben.errors.on(:password_confirmation)
+      assert ben.errors[:password_confirmation].size > 0
       
       ben.password_confirmation = "newpass"
       assert ben.valid?
@@ -161,6 +165,26 @@ module ActsAsAuthenticTest
       transition_password_to(Authlogic::CryptoProviders::Sha512, ben, [Authlogic::CryptoProviders::Sha1, Authlogic::CryptoProviders::BCrypt])
     end
     
+    def test_checks_password_against_database
+      ben = users(:ben)
+      ben.password = "new pass"
+      assert !ben.valid_password?("new pass")
+      assert ben.valid_password?("benrocks")
+    end
+    
+    def test_checks_password_against_database_and_always_fails_on_new_records
+      user = User.new
+      user.password = "new pass"
+      assert !user.valid_password?("new pass")
+    end
+    
+    def test_checks_password_against_object
+      ben = users(:ben)
+      ben.password = "new pass"
+      assert ben.valid_password?("new pass", false)
+      assert !ben.valid_password?("benrocks", false)
+    end
+    
     def test_reset_password
       ben = users(:ben)
       old_crypted_password = ben.crypted_password

data/test/acts_as_authentic_test/perishable_token_test.rb

@@ -26,7 +26,7 @@ module ActsAsAuthenticTest
       u = User.new
       u.perishable_token = users(:ben).perishable_token
       assert !u.valid?
-      assert u.errors.on(:perishable_token)
+      assert u.errors[:perishable_token].size > 0
     end
     
     def test_before_save_reset_perishable_token
@@ -52,5 +52,39 @@ module ActsAsAuthenticTest
       ben.reload
       assert_not_equal old_perishable_token, ben.perishable_token
     end
+    
+    def test_find_using_perishable_token
+      ben = users(:ben)
+      assert_equal ben, User.find_using_perishable_token(ben.perishable_token)
+    end
+    
+    def test_find_using_perishable_token_when_perished
+      ben = users(:ben)
+      ActiveRecord::Base.connection.execute("UPDATE users set updated_at = '#{1.week.ago.to_s(:db)}' where id = #{ben.id}")
+      assert_nil User.find_using_perishable_token(ben.perishable_token)
+    end
+    
+    def test_find_using_perishable_token_when_perished
+      User.perishable_token_valid_for = 1.minute
+      ben = users(:ben)
+      ActiveRecord::Base.connection.execute("UPDATE users set updated_at = '#{2.minutes.ago.to_s(:db)}' where id = #{ben.id}")
+      assert_nil User.find_using_perishable_token(ben.perishable_token)
+      User.perishable_token_valid_for = 10.minutes
+    end
+    
+    def test_find_using_perishable_token_when_passing_threshold
+      User.perishable_token_valid_for = 1.minute
+      ben = users(:ben)
+      ActiveRecord::Base.connection.execute("UPDATE users set updated_at = '#{10.minutes.ago.to_s(:db)}' where id = #{ben.id}")
+      assert_nil User.find_using_perishable_token(ben.perishable_token, 5.minutes)
+      assert_equal ben, User.find_using_perishable_token(ben.perishable_token, 20.minutes)
+      User.perishable_token_valid_for = 10.minutes
+    end
+
+    def test_find_perishable_token_with_bang
+      assert_raises ActiveRecord::RecordNotFound do
+        User.find_using_perishable_token!('some_bad_value')
+      end
+    end
   end
-end
+end

data/test/acts_as_authentic_test/restful_authentication_test.rb

@@ -0,0 +1,40 @@
+require File.dirname(__FILE__) + '/../test_helper.rb'
+
+module ActsAsAuthenticTest
+  class RestfulAuthenticationTest < ActiveSupport::TestCase
+    def test_act_like_restful_authentication_config
+      assert !User.act_like_restful_authentication
+      assert !Employee.act_like_restful_authentication
+  
+      User.act_like_restful_authentication = true
+      assert User.act_like_restful_authentication
+      assert_equal Authlogic::CryptoProviders::Sha1, User.crypto_provider
+      assert defined?(::REST_AUTH_SITE_KEY)
+      assert_equal '', ::REST_AUTH_SITE_KEY
+      assert_equal 1, Authlogic::CryptoProviders::Sha1.stretches
+
+      User.act_like_restful_authentication false
+      assert !User.act_like_restful_authentication
+  
+      User.crypto_provider = Authlogic::CryptoProviders::Sha512
+      User.transition_from_crypto_providers = []
+    end
+
+    def test_transition_from_restful_authentication_config
+      assert !User.transition_from_restful_authentication
+      assert !Employee.transition_from_restful_authentication
+      
+      User.transition_from_restful_authentication = true
+      assert User.transition_from_restful_authentication
+      assert defined?(::REST_AUTH_SITE_KEY)
+      assert_equal '', ::REST_AUTH_SITE_KEY
+      assert_equal 1, Authlogic::CryptoProviders::Sha1.stretches
+  
+      User.transition_from_restful_authentication false
+      assert !User.transition_from_restful_authentication
+  
+      User.crypto_provider = Authlogic::CryptoProviders::Sha512
+      User.transition_from_crypto_providers = []
+    end
+  end
+end

data/test/acts_as_authentic_test/session_maintenance_test.rb

@@ -2,57 +2,73 @@ require File.dirname(__FILE__) + '/../test_helper.rb'
 
 module ActsAsAuthenticTest
   class SessionMaintenanceTest < ActiveSupport::TestCase
+    def test_maintain_sessions_config
+      assert User.maintain_sessions
+      User.maintain_sessions = false
+      assert !User.maintain_sessions
+      User.maintain_sessions true
+      assert User.maintain_sessions
+    end
+    
     def test_login_after_create
       assert User.create(:login => "awesome", :password => "saweet", :password_confirmation => "saweet", :email => "awesome@awesome.com")
       assert UserSession.find
     end
+    
+    def test_updating_session_with_failed_magic_state
+      ben = users(:ben)
+      ben.confirmed = false
+      ben.password = "newpass"
+      ben.password_confirmation = "newpass"
+      assert ben.save
+    end
 
     def test_update_session_after_password_modify
       ben = users(:ben)
       UserSession.create(ben)
-      old_session_key = @controller.session["user_credentials"]
-      old_cookie_key = @controller.cookies["user_credentials"]
+      old_session_key = controller.session["user_credentials"]
+      old_cookie_key = controller.cookies["user_credentials"]
       ben.password = "newpass"
       ben.password_confirmation = "newpass"
       assert ben.save
-      assert @controller.session["user_credentials"]
-      assert @controller.cookies["user_credentials"]
-      assert_not_equal @controller.session["user_credentials"], old_session_key
-      assert_not_equal @controller.cookies["user_credentials"], old_cookie_key
+      assert controller.session["user_credentials"]
+      assert controller.cookies["user_credentials"]
+      assert_not_equal controller.session["user_credentials"], old_session_key
+      assert_not_equal controller.cookies["user_credentials"], old_cookie_key
     end
 
     def test_no_session_update_after_modify
       ben = users(:ben)
       UserSession.create(ben)
-      old_session_key = @controller.session["user_credentials"]
-      old_cookie_key = @controller.cookies["user_credentials"]
+      old_session_key = controller.session["user_credentials"]
+      old_cookie_key = controller.cookies["user_credentials"]
       ben.first_name = "Ben"
       assert ben.save
-      assert_equal @controller.session["user_credentials"], old_session_key
-      assert_equal @controller.cookies["user_credentials"], old_cookie_key
+      assert_equal controller.session["user_credentials"], old_session_key
+      assert_equal controller.cookies["user_credentials"], old_cookie_key
     end
     
     def test_creating_other_user
       ben = users(:ben)
       UserSession.create(ben)
-      old_session_key = @controller.session["user_credentials"]
-      old_cookie_key = @controller.cookies["user_credentials"]
+      old_session_key = controller.session["user_credentials"]
+      old_cookie_key = controller.cookies["user_credentials"]
       assert User.create(:login => "awesome", :password => "saweet", :password_confirmation => "saweet", :email => "awesome@saweet.com")
-      assert_equal @controller.session["user_credentials"], old_session_key
-      assert_equal @controller.cookies["user_credentials"], old_cookie_key
+      assert_equal controller.session["user_credentials"], old_session_key
+      assert_equal controller.cookies["user_credentials"], old_cookie_key
     end
 
     def test_updating_other_user
       ben = users(:ben)
       UserSession.create(ben)
-      old_session_key = @controller.session["user_credentials"]
-      old_cookie_key = @controller.cookies["user_credentials"]
+      old_session_key = controller.session["user_credentials"]
+      old_cookie_key = controller.cookies["user_credentials"]
       zack = users(:zack)
       zack.password = "newpass"
       zack.password_confirmation = "newpass"
       assert zack.save
-      assert_equal @controller.session["user_credentials"], old_session_key
-      assert_equal @controller.cookies["user_credentials"], old_cookie_key
+      assert_equal controller.session["user_credentials"], old_session_key
+      assert_equal controller.cookies["user_credentials"], old_cookie_key
     end
 
     def test_resetting_password_when_logged_out

data/test/acts_as_authentic_test/single_access_test.rb

@@ -16,7 +16,7 @@ module ActsAsAuthenticTest
       u = User.new
       u.single_access_token = users(:ben).single_access_token
       assert !u.valid?
-      assert u.errors.on(:single_access_token)
+      assert u.errors[:single_access_token].size > 0
     end
     
     def test_before_validation_reset_single_access_token
@@ -35,5 +35,10 @@ module ActsAsAuthenticTest
       
       User.change_single_access_token_with_password = false
     end
+    
+    def test_after_password_set_is_not_called
+      ldaper = Ldaper.new
+      assert ldaper.save
+    end
   end
 end

data/test/libs/affiliate.rb

@@ -0,0 +1,7 @@
+class Affiliate < ActiveRecord::Base
+  acts_as_authentic do |c|
+    c.crypted_password_field = :pw_hash
+  end
+  
+  belongs_to :company
+end

data/test/libs/ldaper.rb

@@ -0,0 +1,3 @@
+class Ldaper < ActiveRecord::Base
+  acts_as_authentic
+end

data/test/random_test.rb

@@ -1,4 +1,4 @@
-require File.dirname(__FILE__) + '/../test_helper.rb'
+require File.dirname(__FILE__) + '/test_helper.rb'
 
 class RandomTest < ActiveSupport::TestCase
   def test_random_tokens_have_consisten_length
@@ -36,7 +36,7 @@ class RandomTest < ActiveSupport::TestCase
     def reload_authlogic_with_sec_random!(secure_random, enabled = true)
       silence_warnings do
         secure_random.parent.const_set(secure_random.name.sub("#{secure_random.parent}::", ''), enabled ? secure_random : nil)
-        load(File.dirname(__FILE__) + '/../../lib/authlogic/random.rb')
+        load(File.dirname(__FILE__) + '/../lib/authlogic/random.rb')
       end
     end
 

data/test/session_test/activation_test.rb

@@ -36,7 +36,7 @@ module SessionTest
       def test_init
         UserSession.controller = nil
         assert_raise(Authlogic::Session::Activation::NotActivatedError) { UserSession.new }
-        UserSession.controller = @controller
+        UserSession.controller = controller
       end
     end
   end

data/test/session_test/active_record_trickery_test.rb

@@ -5,10 +5,11 @@ module SessionTest
     class ClassMethodsTest < ActiveSupport::TestCase
       def test_human_attribute_name
         assert_equal "Some attribute", UserSession.human_attribute_name("some_attribute")
+        assert_equal "Some attribute", UserSession.human_attribute_name(:some_attribute)
       end
     
       def test_human_name
-        assert_equal "User", UserSession.human_name
+        assert_equal "Usersession", UserSession.human_name
       end
     
       def test_self_and_descendents_from_active_record

data/test/session_test/brute_force_protection_test.rb

@@ -45,31 +45,56 @@ module SessionTest
         2.times do |i|
           session = UserSession.new(:login => ben.login, :password => "badpassword1")
           assert !session.save
-          assert session.errors.on(:password)
+          assert session.errors[:password].size > 0
           assert_equal i + 1, ben.reload.failed_login_count
         end
-      
+        
         session = UserSession.new(:login => ben.login, :password => "badpassword2")
         assert !session.save
-        assert !session.errors.on(:password)
-        assert_equal 2, ben.reload.failed_login_count
+        assert session.errors[:password].size == 0
+        assert_equal 3, ben.reload.failed_login_count
       
         UserSession.consecutive_failed_logins_limit = 50
       end
-    
-      def test_resetting_failed_logins_count
+      
+      def test_exceeded_ban_for
+        UserSession.consecutive_failed_logins_limit = 2
+        UserSession.generalize_credentials_error_messages true
         ben = users(:ben)
       
         2.times do |i|
-          session = UserSession.new(:login => ben.login, :password => "badpassword")
+          session = UserSession.new(:login => ben.login, :password => "badpassword1")
           assert !session.save
-          assert session.errors.on(:password)
+          assert session.invalid_password?
           assert_equal i + 1, ben.reload.failed_login_count
         end
-      
+        
+        ActiveRecord::Base.connection.execute("update users set updated_at = '#{1.day.ago.to_s(:db)}' where login = '#{ben.login}'")
         session = UserSession.new(:login => ben.login, :password => "benrocks")
         assert session.save
         assert_equal 0, ben.reload.failed_login_count
+      
+        UserSession.consecutive_failed_logins_limit = 50
+        UserSession.generalize_credentials_error_messages false
+      end
+
+      def test_exceeded_ban_and_failed_doesnt_ban_again
+        UserSession.consecutive_failed_logins_limit = 2
+        ben = users(:ben)
+      
+        2.times do |i|
+          session = UserSession.new(:login => ben.login, :password => "badpassword1")
+          assert !session.save
+          assert session.errors[:password].size > 0
+          assert_equal i + 1, ben.reload.failed_login_count
+        end
+        
+        ActiveRecord::Base.connection.execute("update users set updated_at = '#{1.day.ago.to_s(:db)}' where login = '#{ben.login}'")
+        session = UserSession.new(:login => ben.login, :password => "badpassword1")
+        assert !session.save
+        assert_equal 1, ben.reload.failed_login_count
+      
+        UserSession.consecutive_failed_logins_limit = 50
       end
     end
   end

data/test/session_test/cookies_test.rb

@@ -91,16 +91,16 @@ module SessionTest
         ben = users(:ben)
         session = UserSession.new(ben)
         assert session.save
-        assert_equal ben.persistence_token, @controller.cookies["user_credentials"]
+        assert_equal "#{ben.persistence_token}::#{ben.id}", controller.cookies["user_credentials"]
       end
     
       def test_after_destroy_destroy_cookie
         ben = users(:ben)
         set_cookie_for(ben)
         session = UserSession.find
-        assert @controller.cookies["user_credentials"]
+        assert controller.cookies["user_credentials"]
         assert session.destroy
-        assert !@controller.cookies["user_credentials"]
+        assert !controller.cookies["user_credentials"]
       end
     end
   end

data/test/session_test/http_auth_test.rb

@@ -2,14 +2,26 @@ require File.dirname(__FILE__) + '/../test_helper.rb'
 
 module SessionTest
   class HttpAuthTest < ActiveSupport::TestCase
-    def test_persist_persist_by_http_auth
-      ben = users(:ben)
-      http_basic_auth_for { assert !UserSession.find }
-      http_basic_auth_for(ben) do
-        assert session = UserSession.find
-        assert_equal ben, session.record
-        assert_equal ben.login, session.login
-        assert_equal "benrocks", session.send(:protected_password)
+    class ConfiTest < ActiveSupport::TestCase
+      def test_allow_http_basic_auth
+        UserSession.allow_http_basic_auth = false
+        assert_equal false, UserSession.allow_http_basic_auth
+    
+        UserSession.allow_http_basic_auth true
+        assert_equal true, UserSession.allow_http_basic_auth
+      end
+    end
+    
+    class InstanceMethodsTest < ActiveSupport::TestCase
+      def test_persist_persist_by_http_auth
+        ben = users(:ben)
+        http_basic_auth_for { assert !UserSession.find }
+        http_basic_auth_for(ben) do
+          assert session = UserSession.find
+          assert_equal ben, session.record
+          assert_equal ben.login, session.login
+          assert_equal "benrocks", session.send(:protected_password)
+        end
       end
     end
   end