authpwn_rails 0.21.1 → 0.22.0

data/lib/authpwn_rails/generators/templates/001_create_users.rb

@@ -1,4 +1,4 @@
-class CreateUsers < ActiveRecord::Migration
+class CreateUsers < ActiveRecord::Migration[5.0]
   def change
     create_table :users do |t|
       t.string :exuid, limit: 32, null: false

data/lib/authpwn_rails/generators/templates/003_create_credentials.rb

@@ -1,7 +1,7 @@
-class CreateCredentials < ActiveRecord::Migration
+class CreateCredentials < ActiveRecord::Migration[5.0]
   def change
     create_table :credentials do |t|
-      t.references :user, null: false
+      t.references :user, null: false, index: false, foreign_key: true
       t.string :type, limit: 32, null: false
       t.string :name, limit: 128, null: true
 

data/lib/authpwn_rails/generators/templates/session/forbidden.html.erb

@@ -3,7 +3,7 @@
 </p>
 
 <% if current_user %>
-<p>
+<p class="forbidden-logged-in-user">
   You should inform the user that they are logged in as
   <%= current_user.exuid %> and suggest them to
   <%= link_to 'sign out', session_path, method: :delete %> and sign in as a

data/lib/authpwn_rails/generators/templates/session/home.html.erb

@@ -1,5 +1,6 @@
-<p>
+<p class="welcome-page">
   This view gets displayed when the user is logged in. Right now,
-  user <%= current_user.exuid %> is logged in. You should allow the user to
+  user <span class="user-exuid"><%= current_user.exuid %></span> is logged in.
+  You should allow the user to
   <%= link_to 'sign out', session_path, method: :delete %>.
 </p>

data/lib/authpwn_rails/generators/templates/session_controller_test.rb

@@ -12,7 +12,7 @@ class SessionControllerTest < ActionController::TestCase
     set_session_current_user @user
     get :show
 
-    assert_equal @user, assigns(:user)
+    assert_select 'span.user-exuid', @user.exuid
     assert_select 'a[href="/session"][data-method="delete"]', 'sign out'
   end
 
@@ -20,8 +20,8 @@ class SessionControllerTest < ActionController::TestCase
     old_token = credentials(:jane_session_token)
     old_token.updated_at = Time.current - 1.year
     old_token.save!
-    post :create, session: { email: @email_credential.email,
-                             password: 'pa55w0rd' }
+    post :create, params: { session: { email: @email_credential.email,
+                                       password: 'pa55w0rd' } }
     assert_equal @user, session_current_user, 'session'
     assert_redirected_to session_url
     assert_nil Tokens::Base.with_code(old_token.code).first,
@@ -39,7 +39,6 @@ class SessionControllerTest < ActionController::TestCase
   test "application welcome page" do
     get :show
 
-    assert_equal User.count, assigns(:user_count)
     assert_select 'a[href="/session/new"]', 'sign in'
   end
 
@@ -51,7 +50,6 @@ class SessionControllerTest < ActionController::TestCase
 
   test "user login page" do
     get :new
-    assert_template :new
 
     assert_select 'form[action=?]', session_path do
       assert_select 'input[name=?]', 'session[email]'
@@ -64,14 +62,14 @@ class SessionControllerTest < ActionController::TestCase
   test "e-mail verification link" do
     token_credential = credentials(:john_email_token)
     email_credential = credentials(:john_email)
-    get :token, code: token_credential.code
+    get :token, params: { code: token_credential.code }
     assert_redirected_to session_url
     assert email_credential.reload.verified?, 'Email not verified'
   end
 
   test "password reset link" do
     password_credential = credentials(:jane_password)
-    get :token, code: credentials(:jane_password_token).code
+    get :token, params: { code: credentials(:jane_password_token).code }
     assert_redirected_to change_password_session_url
     assert_nil Credential.where(id: password_credential.id).first,
                'Password not cleared'
@@ -109,8 +107,9 @@ class SessionControllerTest < ActionController::TestCase
   test "password reset request" do
     ActionMailer::Base.deliveries = []
 
-    assert_difference 'Credential.count', 1 do
-      post :reset_password, session: { email: @email_credential.email }
+    assert_difference -> { Credential.count }, 1 do
+      post :reset_password, params: {
+          session: { email: @email_credential.email } }
     end
 
     assert !ActionMailer::Base.deliveries.empty?, 'email generated'
@@ -173,7 +172,7 @@ class SessionControllerTest < ActionController::TestCase
       request.env['omniauth.auth'] = {
           'provider' => @omniauth_credential.provider,
           'uid' => @omniauth_credential.uid }
-      post :omniauth, provider: @omniauth_credential.provider
+      post :omniauth, params: { provider: @omniauth_credential.provider }
       assert_equal @user, session_current_user, 'session'
       assert_redirected_to session_url
       assert_nil Tokens::Base.with_code(old_token.code).first,
@@ -190,7 +189,7 @@ class SessionControllerTest < ActionController::TestCase
           'provider' => @omniauth_credential.provider,
           'uid' => 'new_user_gmail_com_uid',
           'info' => { 'email' => 'new_user@gmail.com' } }
-      post :omniauth, provider: @omniauth_credential.provider
+      post :omniauth, params: { provider: @omniauth_credential.provider }
       assert_not_nil session_current_user, 'session'
       assert_equal true, Credentials::Email.with('new_user@gmail.com').verified?,
           'newly created e-mail credential not verified'
@@ -198,5 +197,6 @@ class SessionControllerTest < ActionController::TestCase
     ensure
       ActionController::Base.allow_forgery_protection = false
     end
+
   end
 end

data/lib/authpwn_rails/generators/templates/session_mailer_test.rb

@@ -12,11 +12,7 @@ class SessionMailerTest < ActionMailer::TestCase
   test 'email verification email' do
     email_draft = SessionMailer.email_verification_email @verification_token,
                                                          @root_url
-    if email_draft.respond_to? :deliver_now
-      email = email_draft.deliver_now  # Rails 4.2+
-    else
-      email = email_draft.deliver  # Rails 4.0 and 4.1
-    end
+    email = email_draft.deliver_now
     assert !ActionMailer::Base.deliveries.empty?
 
     assert_equal 'test.host e-mail verification', email.subject
@@ -30,11 +26,7 @@ class SessionMailerTest < ActionMailer::TestCase
   test 'password reset email' do
     email_draft = SessionMailer.reset_password_email @reset_email,
                                                      @reset_token, @root_url
-    if email_draft.respond_to? :deliver_now
-      email = email_draft.deliver_now  # Rails 4.2+
-    else
-      email = email_draft.deliver  # Rails 4.0 and 4.1
-    end
+    email = email_draft.deliver_now
     assert !ActionMailer::Base.deliveries.empty?
 
     assert_equal 'test.host password reset', email.subject

data/lib/authpwn_rails/http_basic.rb

@@ -9,7 +9,7 @@ class ActionController::Base
   # implement find_by_id.
   def self.authenticates_using_http_basic(options = {})
     include Authpwn::HttpBasicControllerInstanceMethods
-    before_filter :authenticate_using_http_basic, options
+    before_action :authenticate_using_http_basic, options
   end
 end
 
@@ -20,12 +20,12 @@ module Authpwn
 module HttpBasicControllerInstanceMethods
   include Authpwn::CurrentUser
 
-  # Filter that implements authenticates_using_http_basic.
+  # The before_action that implements authenticates_using_http_basic.
   #
   # If your ApplicationController contains authenticates_using_http_basic, you
-  # can opt out in individual controllers using skip_before_filter.
+  # can opt out in individual controllers using skip_before_action.
   #
-  #     skip_before_filter :authenticate_using_http_filter
+  #     skip_before_action :authenticate_using_http_basic
   def authenticate_using_http_basic
     return if current_user
     authenticate_with_http_basic do |email, password|

data/lib/authpwn_rails/http_token.rb

@@ -25,7 +25,7 @@ module HttpTokenControllerInstanceMethods
   # If your ApplicationController contains authenticates_using_http_token, you
   # can opt out in individual controllers using skip_before_action.
   #
-  #     skip_before_action :authenticate_using_http_filter
+  #     skip_before_action :authenticate_using_http_token
   def authenticate_using_http_token
     return if current_user
     authenticate_with_http_token do |token_code, options|

data/lib/authpwn_rails/session.rb

@@ -9,7 +9,7 @@ class ActionController::Base
   # find_by_id.
   def self.authenticates_using_session(options = {})
     include Authpwn::ControllerInstanceMethods
-    before_filter :authenticate_using_session, options
+    before_action :authenticate_using_session, options
   end
 
   # True for controllers belonging to the authentication implementation.
@@ -51,12 +51,12 @@ module ControllerInstanceMethods
     end
   end
 
-  # Filter that implements authenticates_using_session.
+  # The before_action that implements authenticates_using_session.
   #
   # If your ApplicationController contains authenticates_using_session, you
-  # can opt out in individual controllers using skip_before_filter.
+  # can opt out in individual controllers using skip_before_action.
   #
-  #     skip_before_filter :authenticate_using_session
+  #     skip_before_action :authenticate_using_session
   def authenticate_using_session
     return if current_user
     session_uid = session[:authpwn_suid]

data/lib/authpwn_rails/session_controller.rb

@@ -11,11 +11,11 @@ module SessionController
   extend ActiveSupport::Concern
 
   included do
-    skip_filter :authenticate_using_session
+    #skip_before_action :authenticate_using_session
     authenticates_using_session except: [:create, :reset_password, :token]
 
     # NOTE: The Omniauth callback uses POST in some cases.
-    skip_filter :verify_authenticity_token, only: [:omniauth]
+    skip_before_action :verify_authenticity_token, only: [:omniauth]
 
     # If set, every successful login will cause a database purge.
     class_attribute :auto_purge_sessions
@@ -145,12 +145,8 @@ module SessionController
     if user = (credential && credential.user)
       token = Tokens::PasswordReset.random_for user
       email = ::SessionMailer.reset_password_email(email, token, root_url)
-      if email.respond_to? :deliver_now
-        # TODO(pwnall): fix the serialization errors blocking deliver_later
-        email.deliver_now
-      else
-        email.deliver
-      end
+      # TODO(pwnall): fix the serialization errors blocking deliver_later
+      email.deliver_now
     end
 
     respond_to do |format|
@@ -231,7 +227,7 @@ module SessionController
     respond_to do |format|
       format.html do
         @credential = current_user.credentials.
-                                   find { |c| c.is_a? Credentials::Password }
+                                   where(type:  'Credentials::Password').first
         unless @credential
           @credential = Credentials::Password.new
           @credential.user = current_user
@@ -249,7 +245,7 @@ module SessionController
     end
 
     @credential = current_user.credentials.
-                               find { |c| c.is_a? Credentials::Password }
+                               where(type:  'Credentials::Password').first
     if @credential
       # An old password is set, must verify it.
       if @credential.check_password params[:credential][:old_password]

data/test/{test_extensions_test.rb → action_controller_test_extensions_test.rb}

@@ -1,6 +1,6 @@
 require_relative 'test_helper'
 
-class TestExtensionsTest < ActionController::TestCase
+class ActionControllerTestExtensionsTest < ActionController::TestCase
   def setup
     @user = users(:john)
     @token = credentials(:john_session_token)
@@ -16,7 +16,7 @@ class TestExtensionsTest < ActionController::TestCase
   end
 
   test 'set_session_current_user reuses existing token' do
-    assert_no_difference 'Credential.count' do
+    assert_no_difference -> { Credential.count } do
       set_session_current_user @user
     end
     assert_equal @token.suid, request.session[:authpwn_suid]
@@ -24,7 +24,7 @@ class TestExtensionsTest < ActionController::TestCase
 
   test 'set_session_current_user creates token if necessary' do
     @token.destroy
-    assert_difference 'Credential.count', 1 do
+    assert_difference -> { Credential.count }, 1 do
       set_session_current_user @user
     end
     assert_equal @user, session_current_user
@@ -32,10 +32,9 @@ class TestExtensionsTest < ActionController::TestCase
 
   test 'set_session_current_user to nil' do
     request.session[:authpwn_suid] = @token.suid
-    assert_no_difference 'Credential.count' do
+    assert_no_difference -> { Credential.count } do
       set_session_current_user nil
     end
     assert_nil request.session[:authpwn_suid]
   end
 end
-

data/test/cookie_controller_test.rb

@@ -4,11 +4,23 @@ require_relative 'test_helper'
 class CookieController < ApplicationController
   authenticates_using_session except: :update
 
+  # NOTE: As of Rails 5, tests can't use assigns to reach into the controllers'
+  #       instance variables. current_user is a part of authpwn's API, so we
+  #       must test it.
+  before_action :export_current_user_to_cookie
+  def export_current_user_to_cookie
+    cookies['_authpwn_test_cuid'] = if current_user
+      current_user.id.to_s
+    else
+      'nil'
+    end
+  end
+
   def show
     if current_user
-      render text: "User: #{current_user.id}"
+      render plain: "User: #{current_user.id}"
     else
-      render text: "No user"
+      render plain: "No user"
     end
   end
 
@@ -18,7 +30,7 @@ class CookieController < ApplicationController
     else
       set_session_current_user User.with_param(params[:exuid]).first
     end
-    render text: ''
+    render plain: ''
   end
 
   def bouncer
@@ -35,7 +47,7 @@ class CookieControllerTest < ActionController::TestCase
   test "no suid in session" do
     get :show
     assert_response :success
-    assert_nil assigns(:current_user)
+    assert_equal 'nil', cookies['_authpwn_test_cuid']
     assert_equal 'No user', response.body
   end
 
@@ -43,7 +55,7 @@ class CookieControllerTest < ActionController::TestCase
     request.session[:authpwn_suid] = @token.suid
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
     john_id =  ActiveRecord::FixtureSet.identify :john
     assert_equal "User: #{john_id}", response.body
   end
@@ -54,7 +66,7 @@ class CookieControllerTest < ActionController::TestCase
     @token.save!
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
     assert_operator @token.reload.updated_at, :<=, Time.current - 5.minutes
   end
 
@@ -64,7 +76,7 @@ class CookieControllerTest < ActionController::TestCase
     @token.save!
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
     assert_operator @token.reload.updated_at, :<=, Time.current - 5.minutes
   end
 
@@ -74,7 +86,7 @@ class CookieControllerTest < ActionController::TestCase
     @token.save!
     get :show
     assert_response :success
-    assert_nil assigns(:current_user), 'current_user set'
+    assert_equal 'nil', cookies['_authpwn_test_cuid']
     assert_nil Tokens::Base.with_code(@token.suid).first,
                'session token not destroyed'
   end
@@ -84,126 +96,125 @@ class CookieControllerTest < ActionController::TestCase
     @token.destroy
     get :show
     assert_response :success
-    assert_nil assigns(:current_user)
+    assert_equal 'nil', cookies['_authpwn_test_cuid']
   end
 
   test "set_session_current_user creates new token by default" do
-    assert_difference 'Credential.count', 1 do
-      put :update, exuid: @user.exuid
+    assert_difference -> { Credential.count }, 1 do
+      put :update, params: { exuid: @user.exuid }
     end
     assert_response :success
     assert_not_equal @token.suid, request.session[:authpwn_suid]
 
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
   end
 
   test "set_session_current_user reuses existing token when suitable" do
     request.session[:authpwn_suid] = @token.suid
-    assert_no_difference 'Credential.count', 'existing token not reused' do
-      put :update, exuid: @user.exuid
+    assert_no_difference -> { Credential.count },
+        'existing token not reused' do
+      put :update, params: { exuid: @user.exuid }
     end
     assert_response :success
     assert_equal @token.suid, request.session[:authpwn_suid]
-    assert_equal @user, assigns(:current_user)
 
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
   end
 
   test "set_session_current_user refreshes old token" do
     @token.updated_at = Time.current - 1.day
     request.session[:authpwn_suid] = @token.suid
-    assert_no_difference 'Credential.count', 'existing token not reused' do
-      put :update, exuid: @user.exuid
+    assert_no_difference -> { Credential.count },
+        'existing token not reused' do
+      put :update, params: { exuid: @user.exuid }
     end
     assert_response :success
     assert_operator @token.reload.updated_at, :>=, Time.current - 1.hour,
         'Old token not refreshed'
-    assert_equal @user, assigns(:current_user)
 
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
   end
 
   test "set_session_current_user creates new token if old token is invalid" do
     @token.destroy
     request.session[:authpwn_suid] = @token.suid
-    assert_difference 'Credential.count', 1, 'session token not created' do
-      put :update, exuid: @user.exuid
+    assert_difference -> { Credential.count }, 1,
+        'session token not created' do
+      put :update, params: { exuid: @user.exuid }
     end
     assert_response :success
     assert_not_equal @token.suid, request.session[:authpwn_suid]
 
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
   end
 
   test "set_session_current_user switches users correctly" do
     old_token = credentials(:jane_session_token)
     request.session[:authpwn_suid] = old_token.suid
-    assert_no_difference 'Credential.count',
+    assert_no_difference -> { Credential.count },
         "old user's token not destroyed or no new token created" do
-      put :update, exuid: @user.exuid
+      put :update, params: { exuid: @user.exuid }
     end
     assert_response :success
     assert_nil Tokens::Base.with_code(old_token.suid).first,
                "old user's token not destroyed"
     assert_not_equal @token.suid, request.session[:authpwn_suid]
-    assert_equal @user, assigns(:current_user)
 
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
   end
 
   test "set_session_current_user reuses token when switching users" do
     @token.destroy
     request.session[:authpwn_suid] = credentials(:jane_session_token).suid
-    assert_no_difference 'Credential.count',
+    assert_no_difference -> { Credential.count },
         "old user's token not destroyed or new user's token not created" do
-      put :update, exuid: @user.exuid
+      put :update, params: { exuid: @user.exuid }
     end
     assert_response :success
-    assert_equal @user, assigns(:current_user)
 
     get :show
     assert_response :success
-    assert_equal @user, assigns(:current_user)
+    assert_equal @user.id.to_s, cookies['_authpwn_test_cuid']
   end
 
   test "set_session_current_user logs off a user correctly" do
     request.session[:authpwn_suid] = @token.suid
-    assert_difference 'Credential.count', -1, 'token not destroyed' do
-      put :update, exuid: ''
+    assert_difference -> { Credential.count }, -1, 'token not destroyed' do
+      put :update, params: { exuid: '' }
     end
     assert_response :success
     assert_nil request.session[:authpwn_suid]
-    assert_equal nil, assigns(:current_user)
+    assert_equal 'nil', cookies['_authpwn_test_cuid']
 
     get :show
     assert_response :success
-    assert_equal nil, assigns(:current_user)
+    assert_equal 'nil', cookies['_authpwn_test_cuid']
   end
 
   test "set_session_current_user behavhttps://appear.in/pwnalles when no user is logged off" do
-    assert_no_difference 'Credential.count' do
-      put :update, exuid: ''
+    assert_no_difference -> { Credential.count } do
+      put :update, params: { exuid: '' }
     end
     assert_response :success
     assert_nil request.session[:authpwn_suid]
-    assert_equal nil, assigns(:current_user)
+    assert_equal 'nil', cookies['_authpwn_test_cuid']
   end
 
   test "valid user_id bounced" do
     request.session[:authpwn_suid] = @token.suid
     get :bouncer
     assert_response :forbidden
-    assert_template 'session/forbidden'
+    assert_select 'p.forbidden-logged-in-user'
     assert_select 'a[href="/session"][data-method="delete"]', 'sign out'
     # Make sure no layout was rendered.
     assert_select 'title', 0
@@ -221,13 +232,12 @@ class CookieControllerTest < ActionController::TestCase
   test "no user_id bounced" do
     get :bouncer
     assert_response :forbidden
-    assert_template 'session/forbidden'
     assert_equal bouncer_cookie_url, flash[:auth_redirect_url]
     # Make sure no layout was rendered.
     assert_select 'title', 0
     assert_select 'h1', 0
-
-    assert_select 'script', %r/.*window.location.*#{new_session_path}.*/
+    assert_select 'script[type="text/javascript"]',
+        %r/.*window.location.*#{new_session_path}.*/
   end
 
   test "no user_id bounced in json" do