authpwn_rails 0.10.5 → 0.10.6

data/lib/authpwn_rails/session_mailer.rb

@@ -0,0 +1,66 @@
+# :nodoc: namespace
+module Authpwn
+
+# Included by the session mailer class.
+#
+# Parts of the codebase assume the mailer will be named SessionMailer.
+module SessionMailer
+  # Creates an e-mail containing a verification token for the e-mail address.
+  #
+  # Params:
+  #   token:: the e-mail confirmation token
+  #   host:: the server's hostname (e.g. "localhost:3000")
+  def email_verification_email(token, host)
+    @token, @host = token, host
+
+    hostname = host.split(':', 2).first  # Strip out any port.
+    
+    mail :to => @token.email,
+         :subject => email_verification_subject(token, hostname),
+         :from => email_verification_from(token, hostname)
+  end
+
+  # The subject line in an e-mail verification e-mail.
+  #
+  # The authpwn generator encourages applications to override this method.
+  def email_verification_subject(token, server_hostname)
+    "#{server_hostname} e-mail verification"
+  end
+  
+  # The sender e-mail address for an e-mail verification e-mail.
+  #
+  # The authpwn generator encourages applications to override this method.
+  def email_verification_from(token, server_hostname)
+    %Q|"#{server_hostname} staff" <admin@#{server_hostname}>|
+  end  
+
+  # Creates an e-mail containing a password reset token.
+  #
+  # Params:
+  #   email:: the email to send the token to
+  #   token:: the password reset token
+  #   host:: the server's hostname (e.g. "localhost:3000")
+  def reset_password_email(email, token, host)
+    @email, @token, @host = email, token, host
+
+    hostname = host.split(':', 2).first  # Strip out any port.
+    mail :to => email, :subject => reset_password_subject(token, hostname),
+         :from => reset_password_from(token, hostname)
+  end
+  
+  # The subject line in a password reset e-mail.
+  #
+  # The authpwn generator encourages applications to override this method.
+  def reset_password_subject(token, server_hostname)
+    "#{server_hostname} password reset"
+  end
+  
+  # The sender e-mail address for a password reset e-mail.
+  #
+  # The authpwn generator encourages applications to override this method.
+  def reset_password_from(token, server_hostname)
+    %Q|"#{server_hostname} staff" <admin@#{server_hostname}>|
+  end
+end  # namespace Authpwn::SessionMailer
+
+end  # namespace Authpwn

data/test/{email_credential_test.rb → credentials/email_credential_test.rb}

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require File.expand_path('../../test_helper', __FILE__)
 
 class EmailCredentialTest < ActiveSupport::TestCase  
   def setup

data/test/credentials/email_verification_token_test.rb

@@ -0,0 +1,78 @@
+require File.expand_path('../../test_helper', __FILE__)
+
+class EmailVerificationTokenCredentialTest < ActiveSupport::TestCase  
+  def setup
+    @credential = Tokens::EmailVerification.new(
+        :code => 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo',
+        :key => 'jane@gmail.com')
+    @credential.user = users(:jane)
+  end
+  
+  test 'setup' do
+    assert @credential.valid?
+  end
+  
+  test 'code required' do
+    @credential.code = nil
+    assert !@credential.valid?
+  end
+  
+  test 'code uniqueness' do
+    @credential.code = credentials(:john_token).code
+    assert !@credential.valid?
+  end
+  
+  test 'email required' do
+    @credential.email = nil
+    assert !@credential.valid?
+  end
+
+  test 'user required' do
+    @credential.user = nil
+    assert !@credential.valid?
+  end
+  
+  test 'email_credential' do
+    assert_equal credentials(:jane_email), @credential.email_credential
+    assert_equal credentials(:john_email),
+                 credentials(:john_email_token).email_credential
+  
+    @credential.email = 'bill@gmail.com'
+    assert_nil @credential.email_credential
+  end
+  
+  test 'spend verifies the e-mail and destroys the token' do
+    email_credential = credentials(:john_email)
+    assert !email_credential.verified, 'bad setup'
+    credential = credentials(:john_email_token)
+    assert_equal Tokens::EmailVerification, credential.class, 'bad setup'
+    
+    assert_difference 'Credential.count', -1 do
+      credential.spend
+    end
+    assert credential.frozen?, 'not destroyed'
+    assert email_credential.reload.verified?, 'e-mail not verified'
+  end
+
+  test 'spend does not verify a random e-mail and still destroys the token' do
+    email_credential = credentials(:john_email)
+    credential = credentials(:john_email_token)
+    credential.email = 'bill@gmail.com'
+    
+    assert_difference 'Credential.count', -1 do
+      credential.spend
+    end
+    assert credential.frozen?, 'not destroyed'
+    assert !email_credential.reload.verified?, 'e-mail wrongly verified'
+  end
+  
+  test 'random_for' do
+    token = Tokens::EmailVerification.random_for credentials(:jane_email)
+    assert token.valid?, 'valid token'
+    assert_equal users(:jane), token.user
+    assert_equal credentials(:jane_email).email, token.email
+    assert_equal Tokens::EmailVerification, token.class
+    assert !token.new_record?, 'saved token'
+    assert_operator users(:jane).credentials, :include?, token
+  end
+end

data/test/{facebook_credential_test.rb → credentials/facebook_credential_test.rb}

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require File.expand_path('../../test_helper', __FILE__)
 
 class FacebookCredentialTest < ActiveSupport::TestCase  
   def setup

data/test/credentials/one_time_token_credential_test.rb

@@ -0,0 +1,84 @@
+require File.expand_path('../../test_helper', __FILE__)
+
+class OneTimeTokenCredentialTest < ActiveSupport::TestCase  
+  def setup
+    @credential = Tokens::OneTime.new(
+        :code => 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo')
+    @credential.user = users(:bill)
+  end
+  
+  test 'setup' do
+    assert @credential.valid?
+  end
+  
+  test 'code required' do
+    @credential.code = nil
+    assert !@credential.valid?
+  end
+  
+  test 'code uniqueness' do
+    @credential.code = credentials(:john_token).code
+    assert !@credential.valid?
+  end
+
+  test 'user presence' do
+    @credential.user = nil
+    assert !@credential.valid?
+  end
+  
+  test 'spend destroys the token' do
+    credential = credentials(:john_token)
+    assert_equal Tokens::OneTime, credential.class, 'bad setup'
+    
+    assert_difference 'Credential.count', -1 do
+      credential.spend
+    end
+    assert credential.frozen?, 'not destroyed'
+  end
+  
+  test 'authenticate spends the token' do
+    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
+    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    assert_difference 'Credential.count', -1, 'token spent' do
+      assert_equal users(:john), Credentials::Token.authenticate(john)
+    end
+    assert_no_difference 'Credential.count', 'token mistakenly spent' do
+      assert_equal :invalid, Credentials::Token.authenticate(bogus)
+    end
+  end
+  
+  test 'authenticate calls User#auth_bounce_reason' do
+    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
+    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+
+    with_blocked_credential credentials(:john_token), :reason do
+      assert_no_difference 'Credential.count', 'no token spent' do
+        assert_equal :reason, Credentials::Token.authenticate(john)
+      end
+    end
+  end
+  
+  test 'instance authenticate spends the token' do
+    assert_difference 'Credential.count', -1, 'token spent' do
+      assert_equal users(:john), credentials(:john_token).authenticate
+    end
+  end
+  
+  test 'instance authenticate calls User#auth_bounce_reason' do
+    with_blocked_credential credentials(:john_token), :reason do
+      assert_no_difference 'Credential.count', 'token mistakenly spent' do
+        assert_equal :reason, credentials(:john_token).authenticate
+      end
+    end
+  end
+  
+  test 'random_for' do
+    token = Tokens::OneTime.random_for users(:john)
+    assert token.valid?, 'valid token'
+    assert_equal users(:john), token.user
+    assert_equal Tokens::OneTime, token.class
+    assert !token.new_record?, 'saved token'
+    assert_operator users(:john).credentials, :include?, token
+  end
+end

data/test/{password_credential_test.rb → credentials/password_credential_test.rb}

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require File.expand_path('../../test_helper', __FILE__)
 
 class PasswordCredentialTest < ActiveSupport::TestCase  
   def setup

data/test/credentials/password_reset_token_test.rb

@@ -0,0 +1,72 @@
+require File.expand_path('../../test_helper', __FILE__)
+
+class PasswordVerificationTokenTest < ActiveSupport::TestCase  
+  def setup
+    @credential = Tokens::PasswordReset.new(
+        :code => 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo')
+    @credential.user = users(:john)
+  end
+  
+  test 'setup' do
+    assert @credential.valid?
+  end
+  
+  test 'code required' do
+    @credential.code = nil
+    assert !@credential.valid?
+  end
+  
+  test 'code uniqueness' do
+    @credential.code = credentials(:john_token).code
+    assert !@credential.valid?
+  end
+
+  test 'user required' do
+    @credential.user = nil
+    assert !@credential.valid?
+  end
+  
+  test 'password_credential' do
+    assert_equal credentials(:john_password), @credential.password_credential
+    assert_equal credentials(:jane_password),
+                 credentials(:jane_password_token).password_credential
+  
+    @credential.user = users(:bill)
+    assert_nil @credential.password_credential
+  end
+  
+  test 'spend blanks out the password and destroys the token' do
+    password_credential = credentials(:jane_password)
+    credential = credentials(:jane_password_token)
+    assert_equal Tokens::PasswordReset, credential.class, 'bad setup'
+    
+    assert_difference 'Credential.count', -2 do
+      assert_difference 'Credentials::Password.count', -1 do
+        credential.spend
+      end
+    end
+    assert credential.frozen?, 'not destroyed'
+    assert_nil Credential.where(:id => password_credential.id).first,
+               'password not blanked out'
+  end
+
+  test 'spend works on password-less user and still destroys the token' do
+    password_credential = credentials(:jane_password)
+    password_credential.destroy
+    credential = credentials(:jane_password_token)
+    
+    assert_difference 'Credential.count', -1 do
+      credential.spend
+    end
+    assert credential.frozen?, 'not destroyed'
+  end
+  
+  test 'random_for' do
+    token = Tokens::PasswordReset.random_for users(:john)
+    assert token.valid?, 'valid token'
+    assert_equal users(:john), token.user
+    assert_equal Tokens::PasswordReset, token.class
+    assert !token.new_record?, 'saved token'
+    assert_operator users(:john).credentials, :include?, token
+  end
+end

data/test/credentials/token_crendential_test.rb

@@ -0,0 +1,102 @@
+require File.expand_path('../../test_helper', __FILE__)
+
+class TokenCredentialTest < ActiveSupport::TestCase  
+  def setup
+    @credential = Credentials::Token.new(
+        :code => 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo')
+    @credential.user = users(:bill)
+  end
+  
+  test 'setup' do
+    assert @credential.valid?
+  end
+  
+  test 'code required' do
+    @credential.code = nil
+    assert !@credential.valid?
+  end
+  
+  test 'code uniqueness' do
+    @credential.code = credentials(:john_token).code
+    assert !@credential.valid?
+  end
+
+  test 'user presence' do
+    @credential.user = nil
+    assert !@credential.valid?
+  end
+  
+  test 'spend does nothing' do
+    credential = credentials(:jane_token)
+    assert_equal Credentials::Token, credential.class, 'bad setup'
+    
+    assert_no_difference 'Credential.count' do
+      credential.spend
+    end
+  end
+  
+  test 'random_for' do
+    token = Credentials::Token.random_for users(:john)
+    assert token.valid?, 'valid token'
+    assert_equal users(:john), token.user
+    assert_equal Credentials::Token, token.class
+    assert !token.new_record?, 'saved token'
+    assert_operator users(:john).credentials, :include?, token
+  end
+  
+  test 'with_code' do
+    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
+    john2 = 'bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE'
+    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    assert_equal credentials(:john_token), Credentials::Token.with_code(john)
+    assert_equal credentials(:jane_token), Credentials::Token.with_code(jane)
+    assert_equal credentials(:john_email_token),
+                 Credentials::Token.with_code(john2)
+    assert_nil Credentials::Token.with_code(bogus)
+    assert_nil Credentials::Token.with_code('john@gmail.com')
+    assert_nil Credentials::Token.with_code(credentials(:jane_email).name)
+  end
+  
+  test 'find_by_param' do
+    assert_equal credentials(:john_token), Credentials::Token.
+        find_by_param(credentials(:john_token).to_param)
+    assert_equal credentials(:jane_token), Credentials::Token.
+        find_by_param(credentials(:jane_token).to_param)
+    assert_equal nil, Credentials::Token.find_by_param('bogus token')
+    assert_equal nil, Credentials::Token.find_by_param(nil)
+  end
+  
+  test 'class authenticate' do
+    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
+    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    assert_equal users(:john), Credentials::Token.authenticate(john)
+    assert_equal users(:jane), Credentials::Token.authenticate(jane)
+    assert_equal :invalid, Credentials::Token.authenticate(bogus)
+  end
+  
+  test 'class authenticate calls User#auth_bounce_reason' do
+    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
+    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+
+    with_blocked_credential credentials(:john_token), :reason do
+      assert_equal :reason, Credentials::Token.authenticate(john)
+      assert_equal users(:jane), Credentials::Token.authenticate(jane)
+      assert_equal :invalid, Credentials::Token.authenticate(bogus)
+    end
+  end
+
+  test 'instance authenticate' do
+    assert_equal users(:john), credentials(:john_token).authenticate
+    assert_equal users(:jane), credentials(:jane_token).authenticate
+  end
+  
+  test 'instance authenticate calls User#auth_bounce_reason' do
+    with_blocked_credential credentials(:john_token), :reason do
+      assert_equal :reason, credentials(:john_token).authenticate
+      assert_equal users(:jane), credentials(:jane_token).authenticate
+    end
+  end
+end

data/test/fixtures/bare_session/forbidden.html.erb

@@ -0,0 +1,20 @@
+<p>
+  This view gets displayed when the user tries to access something forbidden.
+</p>
+
+<% if current_user %>
+<p>
+  You should inform the user that they are logged in as
+  <%= current_user.exuid %> and suggest them to
+  <%= link_to 'Log out', session_path, :method => :destroy %> and log in as a
+  different user.  
+</p>
+<% else %>
+<p>
+  The user will only see this if JavaScript is disabled. Ask them to
+  <%= link_to 'Log in', new_session_path %>.
+</p>
+<script type="text/javascript">
+window.location = "<%= new_session_path %>";
+</script>
+<% end %>