authpwn_rails 0.21.0 → 0.21.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 675fbc46f9cd1ca6ec4ea6390fd648ec5ad4ab06
-  data.tar.gz: b5aa2f310aa8e5d7ece6df9912d3e3175f718de6
+  metadata.gz: 79347acf991659271a428bfb677c3cee133139a0
+  data.tar.gz: 589da4ac9e17ef7b4991615066a2c145fcb14a95
 SHA512:
-  metadata.gz: 5d7d1c4b50aab9281d6b15c4ea51af277f1c7f1e3a1e0cc9958d48dbc7e748eda3cf46e2fad755a6769dc1bb7291d897192cf9fa1017c41f6fca6876f41cb23a
-  data.tar.gz: 3742acf28e0abf4e46d7819ece0d18c09d717fbde22cdd8ae2c8b4d8914823767bdf8d806cfe15853330f8bdda71b1cbe0280cbbbccafb74c047b42e5eecf8a8
+  metadata.gz: 74e5f7e2bc4418a0da94ead6d3300a7896294f27752f958863611d2412e2770149fb1afa1e9d0578afc6ab0073f2053336e24cd5e7fb5e992de08a27fad9b220
+  data.tar.gz: ea7df2b177956b08482bf5c11ab3e503e88f46777e8412798bef4307d617a6bba83ecc96ada668a4daa4ed9be83de59f60a83753988bf6bf435526b513bfdde9

data/.travis.yml

@@ -14,5 +14,5 @@ gemfile:
   - Gemfile.rails41
   - Gemfile.rails42
 rvm:
-  - 2.1.0
-  - 2.2.0
+  - 2.1.9
+  - 2.2.5

data/Gemfile

@@ -1,7 +1,7 @@
 source 'https://rubygems.org'
 
 gem 'base32', '>= 0.3.2'
-gem 'rails', '>= 4.0.13'
+gem 'rails', ['~> 4.0', '>= 4.0.13']
 
 group :development do
   gem 'bundler', '>= 1.6.6'

data/Gemfile.lock

@@ -1,36 +1,36 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (4.2.6)
-      actionpack (= 4.2.6)
-      actionview (= 4.2.6)
-      activejob (= 4.2.6)
+    actionmailer (4.2.7.1)
+      actionpack (= 4.2.7.1)
+      actionview (= 4.2.7.1)
+      activejob (= 4.2.7.1)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 1.0, >= 1.0.5)
-    actionpack (4.2.6)
-      actionview (= 4.2.6)
-      activesupport (= 4.2.6)
+    actionpack (4.2.7.1)
+      actionview (= 4.2.7.1)
+      activesupport (= 4.2.7.1)
       rack (~> 1.6)
       rack-test (~> 0.6.2)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (4.2.6)
-      activesupport (= 4.2.6)
+    actionview (4.2.7.1)
+      activesupport (= 4.2.7.1)
       builder (~> 3.1)
       erubis (~> 2.7.0)
       rails-dom-testing (~> 1.0, >= 1.0.5)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    activejob (4.2.6)
-      activesupport (= 4.2.6)
+    activejob (4.2.7.1)
+      activesupport (= 4.2.7.1)
       globalid (>= 0.3.0)
-    activemodel (4.2.6)
-      activesupport (= 4.2.6)
+    activemodel (4.2.7.1)
+      activesupport (= 4.2.7.1)
       builder (~> 3.1)
-    activerecord (4.2.6)
-      activemodel (= 4.2.6)
-      activesupport (= 4.2.6)
+    activerecord (4.2.7.1)
+      activemodel (= 4.2.7.1)
+      activesupport (= 4.2.7.1)
       arel (~> 6.0)
-    activesupport (4.2.6)
+    activesupport (4.2.7.1)
       i18n (~> 0.7)
       json (~> 1.7, >= 1.7.7)
       minitest (~> 5.1)
@@ -40,7 +40,7 @@ GEM
     arel (6.0.3)
     base32 (0.3.2)
     builder (3.2.2)
-    concurrent-ruby (1.0.1)
+    concurrent-ruby (1.0.2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
     docile (1.1.5)
@@ -49,19 +49,18 @@ GEM
       multipart-post (>= 1.2, < 3)
     ffi2-generators (0.1.1)
     git (1.3.0)
-    github_api (0.13.1)
+    github_api (0.14.5)
       addressable (~> 2.4.0)
       descendants_tracker (~> 0.0.4)
       faraday (~> 0.8, < 0.10)
       hashie (>= 3.4)
-      multi_json (>= 1.7.5, < 2.0)
-      oauth2
-    globalid (0.3.6)
+      oauth2 (~> 1.0)
+    globalid (0.3.7)
       activesupport (>= 4.1.0)
-    hashie (3.4.3)
+    hashie (3.4.4)
     highline (1.7.8)
     i18n (0.7.0)
-    jeweler (2.0.1)
+    jeweler (2.1.1)
       builder
       bundler (>= 1.0)
       git (>= 1.2.5)
@@ -70,29 +69,31 @@ GEM
       nokogiri (>= 1.5.10)
       rake
       rdoc
+      semver
     json (1.8.3)
-    jwt (1.5.1)
+    jwt (1.5.4)
     loofah (2.0.3)
       nokogiri (>= 1.5.9)
     mail (2.6.4)
       mime-types (>= 1.16, < 4)
     metaclass (0.0.4)
-    mime-types (3.0)
+    mime-types (3.1)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2016.0221)
-    mini_portile2 (2.0.0)
-    minitest (5.8.4)
+    mime-types-data (3.2016.0521)
+    mini_portile2 (2.1.0)
+    minitest (5.9.0)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
-    multi_json (1.11.2)
+    multi_json (1.12.1)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
-    mysql2 (0.4.3)
-    nokogiri (1.6.7.2)
-      mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (1.1.0)
+    mysql2 (0.4.4)
+    nokogiri (1.6.8)
+      mini_portile2 (~> 2.1.0)
+      pkg-config (~> 1.1.7)
+    oauth2 (1.2.0)
       faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0, < 1.5.2)
+      jwt (~> 1.0)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 3)
@@ -100,19 +101,20 @@ GEM
       hashie (>= 1.2, < 4)
       rack (>= 1.0, < 3)
     pg (0.18.4)
+    pkg-config (1.1.7)
     rack (1.6.4)
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.2.6)
-      actionmailer (= 4.2.6)
-      actionpack (= 4.2.6)
-      actionview (= 4.2.6)
-      activejob (= 4.2.6)
-      activemodel (= 4.2.6)
-      activerecord (= 4.2.6)
-      activesupport (= 4.2.6)
+    rails (4.2.7.1)
+      actionmailer (= 4.2.7.1)
+      actionpack (= 4.2.7.1)
+      actionview (= 4.2.7.1)
+      activejob (= 4.2.7.1)
+      activemodel (= 4.2.7.1)
+      activerecord (= 4.2.7.1)
+      activesupport (= 4.2.7.1)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.2.6)
+      railties (= 4.2.7.1)
       sprockets-rails
     rails-deprecated_sanitizer (1.0.3)
       activesupport (>= 4.2.0.alpha)
@@ -122,12 +124,12 @@ GEM
       rails-deprecated_sanitizer (>= 1.0.1)
     rails-html-sanitizer (1.0.3)
       loofah (~> 2.0)
-    railties (4.2.6)
-      actionpack (= 4.2.6)
-      activesupport (= 4.2.6)
+    railties (4.2.7.1)
+      actionpack (= 4.2.7.1)
+      activesupport (= 4.2.7.1)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (11.1.1)
+    rake (11.2.2)
     rdoc (4.2.2)
       json (~> 1.4)
     rubysl (2.2.0)
@@ -240,7 +242,7 @@ GEM
     rubysl-cmath (2.0.0)
     rubysl-complex (2.0.0)
     rubysl-continuation (2.0.0)
-    rubysl-coverage (2.0.3)
+    rubysl-coverage (2.1)
     rubysl-csv (2.0.2)
       rubysl-english (~> 2.0)
     rubysl-curses (2.0.1)
@@ -277,7 +279,7 @@ GEM
     rubysl-mathn (2.0.0)
     rubysl-matrix (2.1.0)
       rubysl-e2mmap (~> 2.0)
-    rubysl-mkmf (2.0.1)
+    rubysl-mkmf (2.1)
       rubysl-fileutils (~> 2.0)
       rubysl-shellwords (~> 2.0)
     rubysl-monitor (2.0.0)
@@ -304,7 +306,7 @@ GEM
     rubysl-prettyprint (2.0.3)
     rubysl-prime (2.0.1)
     rubysl-profile (2.0.0)
-    rubysl-profiler (2.0.1)
+    rubysl-profiler (2.1)
     rubysl-pstore (2.0.0)
     rubysl-pty (2.0.3)
     rubysl-rake (2.0.0)
@@ -330,7 +332,7 @@ GEM
     rubysl-set (2.0.1)
     rubysl-shellwords (2.0.0)
     rubysl-singleton (2.0.0)
-    rubysl-socket (2.1.1)
+    rubysl-socket (2.1.2)
       rubysl-fcntl (~> 2.0)
     rubysl-stringio (2.1.0)
     rubysl-strscan (2.0.0)
@@ -354,15 +356,16 @@ GEM
     rubysl-xmlrpc (2.0.0)
     rubysl-yaml (2.1.0)
     rubysl-zlib (2.0.1)
-    simplecov (0.11.2)
+    semver (1.0.1)
+    simplecov (0.12.0)
       docile (~> 1.1.0)
-      json (~> 1.8)
+      json (>= 1.8, < 3)
       simplecov-html (~> 0.10.0)
     simplecov-html (0.10.0)
-    sprockets (3.5.2)
+    sprockets (3.7.0)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (3.0.4)
+    sprockets-rails (3.2.0)
       actionpack (>= 4.0)
       activesupport (>= 4.0)
       sprockets (>= 3.0.0)
@@ -383,7 +386,7 @@ DEPENDENCIES
   mysql2 (>= 0.3.20)
   omniauth (>= 1.3.1)
   pg (>= 0.18.4)
-  rails (>= 4.0.13)
+  rails (~> 4.0, >= 4.0.13)
   rake (>= 11.1.1)
   rubysl
   rubysl-bundler

data/Gemfile.rails41

@@ -1,7 +1,7 @@
 source 'https://rubygems.org'
 
 gem 'base32', '>= 0.3.2'
-gem 'rails', '~> 4.1.10'
+gem 'rails', '~> 4.1.16'
 
 group :development do
   gem 'bundler', '>= 1.6.6'

data/Gemfile.rails42

@@ -1,7 +1,7 @@
 source 'https://rubygems.org'
 
 gem 'base32', '>= 0.3.2'
-gem 'rails', '~> 4.2.5'
+gem 'rails', '~> 4.2.7'
 
 group :development do
   gem 'bundler', '>= 1.6.6'

data/Rakefile

@@ -28,8 +28,8 @@ require 'rake/testtask'
 Rake::TestTask.new(:test) do |test|
   test.libs << 'lib' << 'test'
   test.pattern = 'test/**/*_test.rb'
-  test.warning = false
   test.verbose = false
+  test.warning = false
 end
 
 task :default => :test

data/VERSION

@@ -1 +1 @@
-0.21.0
+0.21.1

data/app/models/tokens/session_uid.rb

@@ -38,7 +38,7 @@ class SessionUid < Tokens::Base
 
   # Updates the time associated with the session.
   def spend
-    self.touch if Time.now - updated_at >= updates_after
+    self.touch if Time.current - updated_at >= updates_after
   end
 
   # Garbage-collects database records of expired sessions.
@@ -46,7 +46,7 @@ class SessionUid < Tokens::Base
   # This method should be called periodically to keep the size of the session
   # table under control.
   def self.remove_expired
-    self.where('updated_at < ?', Time.now - expires_after).delete_all
+    self.where('updated_at < ?', Time.current - expires_after).delete_all
     self
   end
 end  # class Tokens::SessionUid

data/authpwn_rails.gemspec

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: authpwn_rails 0.21.0 ruby lib
+# stub: authpwn_rails 0.21.1 ruby lib
 
 Gem::Specification.new do |s|
   s.name = "authpwn_rails"
-  s.version = "0.21.0"
+  s.version = "0.21.1"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Victor Costan"]
-  s.date = "2016-03-27"
+  s.date = "2016-09-03"
   s.description = "Works with Facebook."
   s.email = "victor@costan.us"
   s.extra_rdoc_files = [
@@ -140,7 +140,7 @@ Gem::Specification.new do |s|
 
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
       s.add_runtime_dependency(%q<base32>, [">= 0.3.2"])
-      s.add_runtime_dependency(%q<rails>, [">= 4.0.13"])
+      s.add_runtime_dependency(%q<rails>, [">= 4.0.13", "~> 4.0"])
       s.add_development_dependency(%q<bundler>, [">= 1.6.6"])
       s.add_development_dependency(%q<mocha>, [">= 1.1.0"])
       s.add_development_dependency(%q<jeweler>, [">= 2.0.1"])
@@ -155,7 +155,7 @@ Gem::Specification.new do |s|
       s.add_development_dependency(%q<rubysl-rake>, [">= 0"])
     else
       s.add_dependency(%q<base32>, [">= 0.3.2"])
-      s.add_dependency(%q<rails>, [">= 4.0.13"])
+      s.add_dependency(%q<rails>, [">= 4.0.13", "~> 4.0"])
       s.add_dependency(%q<bundler>, [">= 1.6.6"])
       s.add_dependency(%q<mocha>, [">= 1.1.0"])
       s.add_dependency(%q<jeweler>, [">= 2.0.1"])
@@ -171,7 +171,7 @@ Gem::Specification.new do |s|
     end
   else
     s.add_dependency(%q<base32>, [">= 0.3.2"])
-    s.add_dependency(%q<rails>, [">= 4.0.13"])
+    s.add_dependency(%q<rails>, [">= 4.0.13", "~> 4.0"])
     s.add_dependency(%q<bundler>, [">= 1.6.6"])
     s.add_dependency(%q<mocha>, [">= 1.1.0"])
     s.add_dependency(%q<jeweler>, [">= 2.0.1"])

data/legacy/migrate_020_to_021.rb

@@ -2,14 +2,14 @@
 # 0.21 format.
 # It should be run in a rails console.
 
-User.all.each do |user|
-  user.exuid = nil
-  user.set_default_exuid
-  user.save!
-end
-
 Credential.all.each do |token|
   next unless token.kind_of? Tokens::Base
   token.code = Tokens::Base.random_code
   token.save!
 end
+
+User.all.each do |user|
+  user.exuid = nil
+  user.set_default_exuid
+  user.save!
+end

data/lib/authpwn_rails/expires.rb

@@ -16,7 +16,7 @@ module Expires
   # True if this password is too old and should not be used for authentication.
   def expired?
     return false unless expires_after
-    updated_at < Time.now - expires_after
+    updated_at < Time.current - expires_after
   end
 end  # module Authpwn::Expires
 

data/lib/authpwn_rails/generators/templates/session/api_token.html.erb

@@ -3,3 +3,7 @@
 <p>
   Your API token is: <span class="api-token"><%= @api_token %></span>
 </p>
+<p>
+  <%= link_to 'regenerate token', destroy_api_token_session_path,
+                                  method: :delete %>
+</p>

data/lib/authpwn_rails/generators/templates/session_controller_test.rb

@@ -18,7 +18,7 @@ class SessionControllerTest < ActionController::TestCase
 
   test "user login works and purges old sessions" do
     old_token = credentials(:jane_session_token)
-    old_token.updated_at = Time.now - 1.year
+    old_token.updated_at = Time.current - 1.year
     old_token.save!
     post :create, session: { email: @email_credential.email,
                              password: 'pa55w0rd' }
@@ -126,6 +126,8 @@ class SessionControllerTest < ActionController::TestCase
     get :api_token
 
     assert_select 'span[class="api-token"]', credentials(:john_api_token).code
+    assert_select 'a[href="/session/api_token"][data-method="delete"]',
+                  'regenerate token'
   end
 
   test "API token JSON request" do
@@ -137,6 +139,24 @@ class SessionControllerTest < ActionController::TestCase
         ActiveSupport::JSON.decode(response.body)['api_token']
   end
 
+  test "API token destroy request" do
+    user = users(:john)
+    set_session_current_user user
+    delete :destroy_api_token
+
+    assert_redirected_to api_token_session_url
+    assert_nil Tokens::Api.where(user: user).first
+  end
+
+  test "API token destroy JSON request" do
+    user = users(:john)
+    set_session_current_user user
+    delete :destroy_api_token, format: 'json'
+
+    assert_equal({}, ActiveSupport::JSON.decode(response.body))
+    assert_nil Tokens::Api.where(user: user).first
+  end
+
   test "OmniAuth failure" do
     get :omniauth_failure
 
@@ -147,7 +167,7 @@ class SessionControllerTest < ActionController::TestCase
     ActionController::Base.allow_forgery_protection = true
     begin
       old_token = credentials(:jane_session_token)
-      old_token.updated_at = Time.now - 1.year
+      old_token.updated_at = Time.current - 1.year
       old_token.save!
 
       request.env['omniauth.auth'] = {

data/lib/authpwn_rails/routes.rb

@@ -39,6 +39,9 @@ module MapperMixin
 
     get "/#{paths}/api_token", controller: controller, action: 'api_token',
                                as: "api_token_#{methods}"
+    delete "/#{paths}/api_token", controller: controller,
+                                  action: 'destroy_api_token',
+                                  as: "destroy_api_token_#{methods}"
     get "/#{paths}/change_password", controller: controller,
                                     action: 'password_change',
                                     as: "change_password_#{methods}"

data/lib/authpwn_rails/session_controller.rb

@@ -109,6 +109,34 @@ module SessionController
     end
   end
 
+  # DELETE /api_token
+  def destroy_api_token
+    unless current_user
+      bounce_user
+      return
+    end
+
+    api_token = Tokens::Api.where(user_id: current_user.id).first
+    if api_token
+      api_token.destroy
+      respond_to do |format|
+        format.html do
+          redirect_to api_token_session_url,
+                      notice: 'Your old API token has been revoked'
+        end
+        format.json { render json: {} }
+      end
+    else
+      respond_to do |format|
+        format.html do
+          redirect_to api_token_session_url,
+                      alert: 'You had no old API token to revoke'
+        end
+        format.json { head :not_found }
+      end
+    end
+  end
+
   # POST /session/reset_password
   def reset_password
     email = params[:session] && params[:session][:email]

data/test/cookie_controller_test.rb

@@ -50,27 +50,27 @@ class CookieControllerTest < ActionController::TestCase
 
   test "valid suid in session does not refresh very recent session" do
     request.session[:authpwn_suid] = @token.suid
-    @token.updated_at = Time.now - 5.minutes
+    @token.updated_at = Time.current - 5.minutes
     @token.save!
     get :show
     assert_response :success
     assert_equal @user, assigns(:current_user)
-    assert_operator @token.reload.updated_at, :<=, Time.now - 5.minutes
+    assert_operator @token.reload.updated_at, :<=, Time.current - 5.minutes
   end
 
   test "valid suid in session refreshes recent session" do
     request.session[:authpwn_suid] = @token.suid
-    @token.updated_at = Time.now - 5.minutes
+    @token.updated_at = Time.current - 5.minutes
     @token.save!
     get :show
     assert_response :success
     assert_equal @user, assigns(:current_user)
-    assert_operator @token.reload.updated_at, :<=, Time.now - 5.minutes
+    assert_operator @token.reload.updated_at, :<=, Time.current - 5.minutes
   end
 
   test "valid suid in session is discarded if the session is old" do
     request.session[:authpwn_suid] = @token.suid
-    @token.updated_at = Time.now - 3.months
+    @token.updated_at = Time.current - 3.months
     @token.save!
     get :show
     assert_response :success
@@ -114,13 +114,13 @@ class CookieControllerTest < ActionController::TestCase
   end
 
   test "set_session_current_user refreshes old token" do
-    @token.updated_at = Time.now - 1.day
+    @token.updated_at = Time.current - 1.day
     request.session[:authpwn_suid] = @token.suid
     assert_no_difference 'Credential.count', 'existing token not reused' do
       put :update, exuid: @user.exuid
     end
     assert_response :success
-    assert_operator @token.reload.updated_at, :>=, Time.now - 1.hour,
+    assert_operator @token.reload.updated_at, :>=, Time.current - 1.hour,
         'Old token not refreshed'
     assert_equal @user, assigns(:current_user)
 

data/test/credentials/api_token_test.rb

@@ -41,12 +41,16 @@ class ApiTokenTest < ActiveSupport::TestCase
   end
 
   test 'expired?' do
-    @credential.updated_at = Time.now - 1.year
+    @credential.updated_at = Time.current - 1.year
     assert_equal false, @credential.expired?
   end
 
   test 'spend does not update old token' do
-    old_updated_at = @credential.updated_at = Time.now - 1.year
+    # NOTE: Some databases don't support sub-second precision. In Rails 5, the
+    #       time values reflect this, and would cause the test to fail if we
+    #       don't round Time.current down to the nearest second.
+    old_updated_at = @credential.updated_at =
+        (Time.current - 1.year).change usec: 0
     @credential.spend
     assert_equal old_updated_at, @credential.updated_at
   end

data/test/credentials/password_credential_test.rb

@@ -71,27 +71,27 @@ class PasswordCredentialTest < ActiveSupport::TestCase
   end
 
   test 'expired?' do
-    @credential.updated_at = Time.now
+    @credential.updated_at = Time.current
     assert_equal false, @credential.expired?
-    @credential.updated_at = Time.now - 2.years
+    @credential.updated_at = Time.current - 2.years
     assert_equal true, @credential.expired?
     Credentials::Password.expires_after = nil
     assert_equal false, @credential.expired?
   end
 
   test 'authenticate' do
-    @credential.updated_at = Time.now
+    @credential.updated_at = Time.current
     assert_equal users(:bill), @credential.authenticate('awesome')
     assert_equal :invalid, @credential.authenticate('not awesome')
     Credentials::Password.expires_after = 1.month
-    @credential.updated_at = Time.now - 1.year
+    @credential.updated_at = Time.current - 1.year
     assert_equal :expired, @credential.authenticate('awesome')
   end
 
   test 'authenticate calls User#auth_bounce_reason' do
     user = @credential.user
     user.expects(:auth_bounce_reason).at_least_once.returns(:reason)
-    @credential.updated_at = Time.now
+    @credential.updated_at = Time.current
     assert_equal :reason, @credential.authenticate('awesome')
     assert_equal :invalid, @credential.authenticate('not awesome')
   end

data/test/credentials/session_uid_token_test.rb

@@ -46,9 +46,9 @@ class SessionUidTokenTest < ActiveSupport::TestCase
 
   test 'expired?' do
     Tokens::SessionUid.expires_after = 14.days
-    @credential.updated_at = Time.now - 1.day
+    @credential.updated_at = Time.current - 1.day
     assert_equal false, @credential.expired?
-    @credential.updated_at = Time.now - 1.month
+    @credential.updated_at = Time.current - 1.month
     assert_equal true, @credential.expired?
 
     Tokens::SessionUid.expires_after = nil
@@ -56,24 +56,28 @@ class SessionUidTokenTest < ActiveSupport::TestCase
   end
 
   test 'spend updates old token' do
-    @credential.updated_at = Time.now - 1.day
+    @credential.updated_at = Time.current - 1.day
     @credential.save!
     @credential.spend
-    assert_operator @credential.updated_at, :>=, Time.now - 1.minute
+    assert_operator @credential.updated_at, :>=, Time.current - 1.minute
   end
 
   test 'spend does not update reasonably new token' do
-    old_updated_at = @credential.updated_at = Time.now - 5.minutes
+    # NOTE: Some databases don't support sub-second precision. In Rails 5, the
+    #       time values reflect this, and would cause the test to fail if we
+    #       don't round Time.current down to the nearest second.
+    old_updated_at = @credential.updated_at =
+        (Time.current - 5.minutes).change(usec: 0)
     @credential.spend
     assert_equal old_updated_at, @credential.updated_at
   end
 
   test 'remove_expired gets rid of old tokens' do
     old_token = credentials(:john_session_token)
-    old_token.updated_at = Time.now - 1.year
+    old_token.updated_at = Time.current - 1.year
     old_token.save!
     fresh_token = credentials(:jane_session_token)
-    fresh_token.updated_at = Time.now - 1.minute
+    fresh_token.updated_at = Time.current - 1.minute
     fresh_token.save!
 
     assert_difference 'Credential.count', -1 do

data/test/credentials/token_crendential_test.rb

@@ -113,7 +113,7 @@ class TokenCredentialTest < ActiveSupport::TestCase
     jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
 
     Tokens::Base.all.each do |token|
-      token.updated_at = Time.now - 1.year
+      token.updated_at = Time.current - 1.year
       token.class.stubs(:expires_after).returns 1.week
       token.save!
     end
@@ -148,7 +148,7 @@ class TokenCredentialTest < ActiveSupport::TestCase
 
   test 'instance authenticate with expired tokens' do
     token = Tokens::Base.with_code(credentials(:jane_token).code).first
-    token.updated_at = Time.now - 1.year
+    token.updated_at = Time.current - 1.year
     token.save!
     token.class.stubs(:expires_after).returns 1.week
     assert_equal :invalid, token.authenticate,

data/test/routes_test.rb

@@ -17,6 +17,8 @@ class RoutesTest < ActionController::TestCase
                    {controller: 'session', action: 'destroy'})
     assert_routing({path: '/session/api_token', method: :get},
                    {controller: 'session', action: 'api_token'})
+    assert_routing({path: '/session/api_token', method: :delete},
+                   {controller: 'session', action: 'destroy_api_token'})
     assert_routing({path: '/session/change_password', method: :get},
                    {controller: 'session', action: 'password_change'})
     assert_routing({path: '/session/change_password', method: :post},

data/test/session_controller_api_test.rb

@@ -117,7 +117,7 @@ class SessionControllerApiTest < ActionController::TestCase
   test "create purges sessions when logging in" do
     BareSessionController.auto_purge_sessions = true
     old_token = credentials(:jane_session_token)
-    old_token.updated_at = Time.now - 1.year
+    old_token.updated_at = Time.current - 1.year
     old_token.save!
     post :create, session: { email: @email_credential.email,
                              password: 'pa55w0rd' }
@@ -129,7 +129,7 @@ class SessionControllerApiTest < ActionController::TestCase
   test "create does not purge sessions if auto_purge_sessions is false" do
     BareSessionController.auto_purge_sessions = false
     old_token = credentials(:jane_session_token)
-    old_token.updated_at = Time.now - 1.year
+    old_token.updated_at = Time.current - 1.year
     old_token.save!
     post :create, email: @email_credential.email, password: 'pa55w0rd'
     assert_equal @user, session_current_user, 'session'
@@ -159,7 +159,7 @@ class SessionControllerApiTest < ActionController::TestCase
   test "create by json purges sessions when logging in" do
     BareSessionController.auto_purge_sessions = true
     old_token = credentials(:jane_session_token)
-    old_token.updated_at = Time.now - 1.year
+    old_token.updated_at = Time.current - 1.year
     old_token.save!
     post :create, email: @email_credential.email, password: 'pa55w0rd',
                   format: 'json'
@@ -188,7 +188,7 @@ class SessionControllerApiTest < ActionController::TestCase
   end
 
   test "create does not log in with expired password" do
-    @password_credential.updated_at = Time.now - 2.years
+    @password_credential.updated_at = Time.current - 2.years
     @password_credential.save!
     post :create, session: { email: @email_credential.email,
                              password: 'pa55w0rd' }
@@ -202,7 +202,7 @@ class SessionControllerApiTest < ActionController::TestCase
   test "create does not purge sessions if not logged in" do
     BareSessionController.auto_purge_sessions = true
     old_token = credentials(:jane_session_token)
-    old_token.updated_at = Time.now - 1.year
+    old_token.updated_at = Time.current - 1.year
     old_token.save!
     post :create, session: { email: @email_credential.email, password: 'fail' }
     assert_nil session_current_user, 'session'
@@ -246,7 +246,7 @@ class SessionControllerApiTest < ActionController::TestCase
   end
 
   test "create by json does not log in with expired password" do
-    @password_credential.updated_at = Time.now - 2.years
+    @password_credential.updated_at = Time.current - 2.years
     @password_credential.save!
     post :create, email: @email_credential.email, password: 'pa55w0rd',
                   format: 'json'
@@ -450,6 +450,62 @@ class SessionControllerApiTest < ActionController::TestCase
     assert_equal 'Please sign in', data['error']
   end
 
+  test "api_token destroy request" do
+    user = users(:john)
+    set_session_current_user user
+    assert_difference 'Tokens::Api.count', -1 do
+      delete :destroy_api_token
+    end
+    assert_nil user.credentials.where(type: 'Tokens::Api').first
+    assert_redirected_to api_token_session_url
+    assert_match(/token.*revoked/, flash[:notice])
+  end
+
+  test "api_token destroy request from user without token" do
+    set_session_current_user @user
+    assert_no_difference 'Tokens::Api.count' do
+      delete :destroy_api_token
+    end
+    assert_nil @user.credentials.where(type: 'Tokens::Api').first
+    assert_redirected_to api_token_session_url
+    assert_match(/no.*token.*to.*revoke/, flash[:alert])
+  end
+
+  test "api_token destroy request without logged in user" do
+    delete :destroy_api_token
+    assert_response :forbidden
+  end
+
+  test "api_token destroy JSON request" do
+    user = users(:john)
+    set_session_current_user user
+    assert_difference 'Tokens::Api.count', -1 do
+      delete :destroy_api_token, format: 'json'
+    end
+
+    assert_nil user.credentials.where(type: 'Tokens::Api').first
+    assert_equal({}, ActiveSupport::JSON.decode(response.body))
+    assert_response :ok
+  end
+
+  test "api_token destroy JSON request from user without token" do
+    set_session_current_user @user
+    assert_no_difference 'Tokens::Api.count' do
+      delete :destroy_api_token, format: 'json'
+    end
+
+    assert_nil @user.credentials.where(type: 'Tokens::Api').first
+    assert_response :not_found
+  end
+
+  test "api_token destroy JSON request without logged in user" do
+    delete :destroy_api_token, format: 'json'
+    assert_response :ok
+
+    data = ActiveSupport::JSON.decode response.body
+    assert_equal 'Please sign in', data['error']
+  end
+
   test "password_change bounces without logged in user" do
     get :password_change
     assert_response :forbidden
@@ -737,7 +793,7 @@ class SessionControllerApiTest < ActionController::TestCase
     begin
       BareSessionController.auto_purge_sessions = true
       old_token = credentials(:jane_session_token)
-      old_token.updated_at = Time.now - 1.year
+      old_token.updated_at = Time.current - 1.year
       old_token.save!
       request.env['omniauth.auth'] =
           { 'provider' => @omniauth_credential.provider,
@@ -756,7 +812,7 @@ class SessionControllerApiTest < ActionController::TestCase
     begin
       BareSessionController.auto_purge_sessions = false
       old_token = credentials(:jane_session_token)
-      old_token.updated_at = Time.now - 1.year
+      old_token.updated_at = Time.current - 1.year
       old_token.save!
       request.env['omniauth.auth'] =
           { 'provider' => @omniauth_credential.provider,
@@ -775,7 +831,7 @@ class SessionControllerApiTest < ActionController::TestCase
     begin
       BareSessionController.auto_purge_sessions = true
       old_token = credentials(:jane_session_token)
-      old_token.updated_at = Time.now - 1.year
+      old_token.updated_at = Time.current - 1.year
       old_token.save!
       request.env['omniauth.auth'] =
           { 'provider' => @omniauth_credential.provider, 'uid' => 'fail' }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: authpwn_rails
 version: !ruby/object:Gem::Version
-  version: 0.21.0
+  version: 0.21.1
 platform: ruby
 authors:
 - Victor Costan
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-03-27 00:00:00.000000000 Z
+date: 2016-09-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base32
@@ -31,6 +31,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 4.0.13
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -38,6 +41,9 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 4.0.13
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '4.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement