authlogic 3.8.0 → 4.5.0

data/test/session_test/cookies_test.rb

@@ -1,8 +1,10 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module CookiesTest
-    class ConfiTest < ActiveSupport::TestCase
+    class ConfigTest < ActiveSupport::TestCase
       def test_cookie_key
         UserSession.cookie_key = "my_cookie_key"
         assert_equal "my_cookie_key", UserSession.cookie_key
@@ -43,7 +45,6 @@ module SessionTest
       end
 
       def test_secure
-        UserSession.secure = true
         assert_equal true, UserSession.secure
         session = UserSession.new
         assert_equal true, session.secure
@@ -55,7 +56,6 @@ module SessionTest
       end
 
       def test_httponly
-        UserSession.httponly = true
         assert_equal true, UserSession.httponly
         session = UserSession.new
         assert_equal true, session.httponly
@@ -66,6 +66,23 @@ module SessionTest
         assert_equal false, session.httponly
       end
 
+      def test_same_site
+        assert_nil UserSession.same_site
+        assert_nil UserSession.new.same_site
+
+        UserSession.same_site "Strict"
+        assert_equal "Strict", UserSession.same_site
+        session = UserSession.new
+        assert_equal "Strict", session.same_site
+        session.same_site = "Lax"
+        assert_equal "Lax", session.same_site
+        session.same_site = "None"
+        assert_equal "None", session.same_site
+
+        assert_raise(ArgumentError) { UserSession.same_site "foo" }
+        assert_raise(ArgumentError) { UserSession.new.same_site "foo" }
+      end
+
       def test_sign_cookie
         UserSession.sign_cookie = true
         assert_equal true, UserSession.sign_cookie
@@ -82,7 +99,7 @@ module SessionTest
     class InstanceMethodsTest < ActiveSupport::TestCase
       def test_credentials
         session = UserSession.new
-        session.credentials = { :remember_me => true }
+        session.credentials = { remember_me: true }
         assert_equal true, session.remember_me
       end
 
@@ -159,6 +176,22 @@ module SessionTest
         )
       end
 
+      def test_after_save_save_cookie_encrypted
+        ben = users(:ben)
+
+        assert_nil controller.cookies["user_credentials"]
+        payload = "#{ben.persistence_token}::#{ben.id}"
+
+        session = UserSession.new(ben)
+        session.encrypt_cookie = true
+        assert session.save
+        assert_equal payload, controller.cookies.encrypted["user_credentials"]
+        assert_equal(
+          Authlogic::TestCase::MockEncryptedCookieJar.encrypt(payload),
+          controller.cookies.encrypted.parent_jar["user_credentials"]
+        )
+      end
+
       def test_after_save_save_cookie_signed
         ben = users(:ben)
 
@@ -188,6 +221,16 @@ module SessionTest
         end
       end
 
+      def test_after_save_save_cookie_with_same_site
+        session = UserSession.new(users(:ben))
+        session.same_site = "Strict"
+        assert session.save
+        assert_equal(
+          "Strict",
+          controller.cookies.set_cookies["user_credentials"][:same_site]
+        )
+      end
+
       def test_after_destroy_destroy_cookie
         ben = users(:ben)
         set_cookie_for(ben)

data/test/session_test/existence_test.rb

@@ -1,26 +1,28 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module ExistenceTest
     class ClassMethodsTest < ActiveSupport::TestCase
       def test_create_with_good_credentials
         ben = users(:ben)
-        session = UserSession.create(:login => ben.login, :password => "benrocks")
+        session = UserSession.create(login: ben.login, password: "benrocks")
         refute session.new_session?
       end
 
       def test_create_with_bad_credentials
-        session = UserSession.create(:login => "somelogin", :password => "badpw2")
+        session = UserSession.create(login: "somelogin", password: "badpw2")
         assert session.new_session?
       end
 
       def test_create_bang
         ben = users(:ben)
         err = assert_raise(Authlogic::Session::Existence::SessionInvalidError) do
-          UserSession.create!(:login => ben.login, :password => "badpw")
+          UserSession.create!(login: ben.login, password: "badpw")
         end
         assert_includes err.message, "Password is not valid"
-        refute UserSession.create!(:login => ben.login, :password => "benrocks").new_session?
+        refute UserSession.create!(login: ben.login, password: "benrocks").new_session?
       end
     end
 
@@ -71,5 +73,16 @@ module SessionTest
         refute session.record
       end
     end
+
+    class SessionInvalidErrorTest < ActiveSupport::TestCase
+      def test_message
+        session = UserSession.new
+        assert !session.valid?
+        error = Authlogic::Session::Existence::SessionInvalidError.new(session)
+        message = "Your session is invalid and has the following errors: " +
+          session.errors.full_messages.to_sentence
+        assert_equal message, error.message
+      end
+    end
   end
 end

data/test/session_test/foundation_test.rb

@@ -1,6 +1,24 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
+
+# We forbid the use of AC::Parameters, and we have a test to that effect, but we
+# do not want a development dependency on `actionpack`, so we define it here.
+module ActionController
+  class Parameters; end
+end
 
 module SessionTest
   class FoundationTest < ActiveSupport::TestCase
+    def test_credentials_raise_if_not_a_hash
+      session = UserSession.new
+      e = assert_raises(TypeError) {
+        session.credentials = ActionController::Parameters.new
+      }
+      assert_equal(
+        ::Authlogic::Session::Foundation::InstanceMethods::E_AC_PARAMETERS,
+        e.message
+      )
+    end
   end
 end

data/test/session_test/http_auth_test.rb

@@ -1,8 +1,10 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   class HttpAuthTest < ActiveSupport::TestCase
-    class ConfiTest < ActiveSupport::TestCase
+    class ConfigTest < ActiveSupport::TestCase
       def test_allow_http_basic_auth
         UserSession.allow_http_basic_auth = false
         assert_equal false, UserSession.allow_http_basic_auth
@@ -20,14 +22,16 @@ module SessionTest
       end
 
       def test_http_basic_auth_realm
-        assert_equal 'Application', UserSession.http_basic_auth_realm
-        UserSession.http_basic_auth_realm = 'TestRealm'
-        assert_equal 'TestRealm', UserSession.http_basic_auth_realm
+        assert_equal "Application", UserSession.http_basic_auth_realm
+        UserSession.http_basic_auth_realm = "TestRealm"
+        assert_equal "TestRealm", UserSession.http_basic_auth_realm
       end
     end
 
     class InstanceMethodsTest < ActiveSupport::TestCase
       def test_persist_persist_by_http_auth
+        UserSession.allow_http_basic_auth = true
+
         aaron = users(:aaron)
         http_basic_auth_for do
           refute UserSession.find
@@ -41,13 +45,13 @@ module SessionTest
         end
         unset_session
         UserSession.request_http_basic_auth = true
-        UserSession.http_basic_auth_realm = 'PersistTestRealm'
+        UserSession.http_basic_auth_realm = "PersistTestRealm"
         http_basic_auth_for(aaron) do
           assert session = UserSession.find
           assert_equal aaron, session.record
           assert_equal aaron.login, session.login
           assert_equal "aaronrocks", session.send(:protected_password)
-          assert_equal 'PersistTestRealm', controller.realm
+          assert_equal "PersistTestRealm", controller.realm
           assert controller.http_auth_requested?
         end
       end

data/test/session_test/id_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   class IdTest < ActiveSupport::TestCase

data/test/session_test/klass_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module KlassTest

data/test/session_test/magic_columns_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module MagicColumnsTest
@@ -27,7 +29,7 @@ module SessionTest
       def test_valid_increase_failed_login_count
         ben = users(:ben)
         old_failed_login_count = ben.failed_login_count
-        session = UserSession.create(:login => ben.login, :password => "wrong")
+        session = UserSession.create(login: ben.login, password: "wrong")
         assert session.new_session?
         ben.reload
         assert_equal old_failed_login_count + 1, ben.failed_login_count
@@ -37,24 +39,22 @@ module SessionTest
         aaron = users(:aaron)
 
         # increase failed login count
-        session = UserSession.create(:login => aaron.login, :password => "wrong")
+        session = UserSession.create(login: aaron.login, password: "wrong")
         assert session.new_session?
         aaron.reload
+        assert_equal 0, aaron.login_count
+        assert_nil aaron.current_login_at
+        assert_nil aaron.current_login_ip
 
-        # grab old values
-        old_login_count = aaron.login_count
-        old_current_login_at = aaron.current_login_at
-        old_current_login_ip = aaron.current_login_ip
-
-        session = UserSession.create(:login => aaron.login, :password => "aaronrocks")
+        session = UserSession.create(login: aaron.login, password: "aaronrocks")
         assert session.valid?
 
         aaron.reload
-        assert_equal old_login_count + 1, aaron.login_count
+        assert_equal 1, aaron.login_count
         assert_equal 0, aaron.failed_login_count
-        assert_equal old_current_login_at, aaron.last_login_at
-        assert aaron.current_login_at != old_current_login_at
-        assert_equal old_current_login_ip, aaron.last_login_ip
+        assert_nil aaron.last_login_at
+        assert_not_nil aaron.current_login_at
+        assert_nil aaron.last_login_ip
         assert_equal "1.1.1.1", aaron.current_login_ip
       end
     end

data/test/session_test/magic_states_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module SessionTest

data/test/session_test/params_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module ParamsTest
@@ -14,9 +16,13 @@ module SessionTest
       def test_single_access_allowed_request_types
         UserSession.single_access_allowed_request_types = ["my request type"]
         assert_equal ["my request type"], UserSession.single_access_allowed_request_types
-
-        UserSession.single_access_allowed_request_types ["application/rss+xml", "application/atom+xml"]
-        assert_equal ["application/rss+xml", "application/atom+xml"], UserSession.single_access_allowed_request_types
+        UserSession.single_access_allowed_request_types(
+          ["application/rss+xml", "application/atom+xml"]
+        )
+        assert_equal(
+          ["application/rss+xml", "application/atom+xml"],
+          UserSession.single_access_allowed_request_types
+        )
       end
     end
 
@@ -41,7 +47,9 @@ module SessionTest
         set_request_content_type("application/atom+xml")
         assert session.persisting?
         assert_equal ben, session.record
-        assert_nil controller.session["user_credentials"] # should not persist since this is single access
+
+        # should not persist since this is single access
+        assert_nil controller.session["user_credentials"]
 
         set_request_content_type("application/rss+xml")
         assert session.persisting?

data/test/session_test/password_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module PasswordTest
@@ -22,21 +24,21 @@ module SessionTest
       def test_generalize_credentials_error_mesages_set_to_false
         UserSession.generalize_credentials_error_messages false
         refute UserSession.generalize_credentials_error_messages
-        session = UserSession.create(:login => users(:ben).login, :password => "invalud-password")
+        session = UserSession.create(login: users(:ben).login, password: "invalud-password")
         assert_equal ["Password is not valid"], session.errors.full_messages
       end
 
       def test_generalize_credentials_error_messages_set_to_true
         UserSession.generalize_credentials_error_messages true
         assert UserSession.generalize_credentials_error_messages
-        session = UserSession.create(:login => users(:ben).login, :password => "invalud-password")
+        session = UserSession.create(login: users(:ben).login, password: "invalud-password")
         assert_equal ["Login/Password combination is not valid"], session.errors.full_messages
       end
 
       def test_generalize_credentials_error_messages_set_to_string
         UserSession.generalize_credentials_error_messages = "Custom Error Message"
         assert UserSession.generalize_credentials_error_messages
-        session = UserSession.create(:login => users(:ben).login, :password => "invalud-password")
+        session = UserSession.create(login: users(:ben).login, password: "invalud-password")
         assert_equal ["Custom Error Message"], session.errors.full_messages
       end
 
@@ -79,21 +81,21 @@ module SessionTest
 
       def test_credentials
         session = UserSession.new
-        session.credentials = { :login => "login", :password => "pass" }
+        session.credentials = { login: "login", password: "pass" }
         assert_equal "login", session.login
         assert_nil session.password
         assert_equal "pass", session.send(:protected_password)
-        assert_equal({ :password => "<protected>", :login => "login" }, session.credentials)
+        assert_equal({ password: "<protected>", login: "login" }, session.credentials)
       end
 
       def test_credentials_are_params_safe
         session = UserSession.new
-        assert_nothing_raised { session.credentials = { :hacker_method => "error!" } }
+        assert_nothing_raised { session.credentials = { hacker_method: "error!" } }
       end
 
       def test_save_with_credentials
         aaron = users(:aaron)
-        session = UserSession.new(:login => aaron.login, :password => "aaronrocks")
+        session = UserSession.new(login: aaron.login, password: "aaronrocks")
         assert session.save
         refute session.new_session?
         assert_equal 1, session.record.login_count

data/test/session_test/perishability_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   class PerishabilityTest < ActiveSupport::TestCase

data/test/session_test/persistence_test.rb

@@ -1,10 +1,13 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   class PersistenceTest < ActiveSupport::TestCase
     def test_find
       aaron = users(:aaron)
       refute UserSession.find
+      UserSession.allow_http_basic_auth = true
       http_basic_auth_for(aaron) { assert UserSession.find }
       set_cookie_for(aaron)
       assert UserSession.find

data/test/session_test/scopes_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   class ScopesTest < ActiveSupport::TestCase
@@ -6,7 +8,7 @@ module SessionTest
       assert_nil Authlogic::Session::Base.scope
 
       thread1 = Thread.new do
-        scope = { :id => :scope1 }
+        scope = { id: :scope1 }
         Authlogic::Session::Base.send(:scope=, scope)
         assert_equal scope, Authlogic::Session::Base.scope
       end
@@ -15,7 +17,7 @@ module SessionTest
       assert_nil Authlogic::Session::Base.scope
 
       thread2 = Thread.new do
-        scope = { :id => :scope2 }
+        scope = { id: :scope2 }
         Authlogic::Session::Base.send(:scope=, scope)
         assert_equal scope, Authlogic::Session::Base.scope
       end
@@ -27,17 +29,23 @@ module SessionTest
     def test_with_scope_method
       assert_raise(ArgumentError) { UserSession.with_scope }
 
-      UserSession.with_scope(:find_options => { :conditions => "awesome = 1" }, :id => "some_id") do
-        assert_equal({ :find_options => { :conditions => "awesome = 1" }, :id => "some_id" }, UserSession.scope)
+      UserSession.with_scope(find_options: { conditions: "awesome = 1" }, id: "some_id") do
+        assert_equal(
+          { find_options: { conditions: "awesome = 1" }, id: "some_id" },
+          UserSession.scope
+        )
       end
 
       assert_nil UserSession.scope
     end
 
     def test_initialize
-      UserSession.with_scope(:find_options => { :conditions => "awesome = 1" }, :id => "some_id") do
+      UserSession.with_scope(find_options: { conditions: "awesome = 1" }, id: "some_id") do
         session = UserSession.new
-        assert_equal({ :find_options => { :conditions => "awesome = 1" }, :id => "some_id" }, session.scope)
+        assert_equal(
+          { find_options: { conditions: "awesome = 1" }, id: "some_id" },
+          session.scope
+        )
         session.id = :another_id
         assert_equal "another_id_some_id_test", session.send(:build_key, "test")
       end
@@ -51,7 +59,7 @@ module SessionTest
       session = UserSession.new
       assert_equal zack, session.send(:search_for_record, "find_by_login", zack.login)
 
-      session.scope = { :find_options => { :conditions => ["company_id = ?", binary_logic.id] } }
+      session.scope = { find_options: { conditions: ["company_id = ?", binary_logic.id] } }
       assert_nil session.send(:search_for_record, "find_by_login", zack.login)
 
       assert_equal ben, session.send(:search_for_record, "find_by_login", ben.login)

data/test/session_test/session_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module SessionTest
@@ -23,16 +25,16 @@ module SessionTest
 
       def test_persist_persist_by_session_with_session_fixation_attack
         ben = users(:ben)
-        controller.session["user_credentials"] = 'neo'
+        controller.session["user_credentials"] = "neo"
         controller.session["user_credentials_id"] = {
-          :select => " *,'neo' AS persistence_token FROM users WHERE id = #{ben.id} limit 1 -- "
+          select: " *,'neo' AS persistence_token FROM users WHERE id = #{ben.id} limit 1 -- "
         }
         @user_session = UserSession.find
         assert @user_session.blank?
       end
 
       def test_persist_persist_by_session_with_sql_injection_attack
-        controller.session["user_credentials"] = { :select => "ABRA CADABRA" }
+        controller.session["user_credentials"] = { select: "ABRA CADABRA" }
         controller.session["user_credentials_id"] = nil
         assert_nothing_raised do
           @user_session = UserSession.find

data/test/session_test/timeout_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   module TimeoutTest
@@ -70,7 +72,7 @@ module SessionTest
       def test_successful_login
         UserSession.logout_on_timeout = true
         ben = users(:ben)
-        session = UserSession.create(:login => ben.login, :password => "benrocks")
+        session = UserSession.create(login: ben.login, password: "benrocks")
         refute session.new_session?
         session = UserSession.find
         assert session

data/test/session_test/unauthorized_record_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   class UnauthorizedRecordTest < ActiveSupport::TestCase
@@ -7,7 +9,7 @@ module SessionTest
       session = UserSession.new
       session.credentials = [ben]
       assert_equal ben, session.unauthorized_record
-      assert_equal({ :unauthorized_record => "<protected>" }, session.credentials)
+      assert_equal({ unauthorized_record: "<protected>" }, session.credentials)
     end
   end
 end

data/test/session_test/validation_test.rb

@@ -1,4 +1,6 @@
-require 'test_helper'
+# frozen_string_literal: true
+
+require "test_helper"
 
 module SessionTest
   class ValidationTest < ActiveSupport::TestCase