clearance 1.16.2 → 1.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: eee44dd7c0385116b9826c9bb14cfddf034a0a9aa46ee2535af2da1f6ee77094
-  data.tar.gz: cfe86952de1ec17473707638dfe70858790d0567c7ec5cf90fc486b2da6824b9
+  metadata.gz: 3d2b65ce30d78d380c94d95fc6fa32f1fa4340a145f6e33573ad746f5da4600e
+  data.tar.gz: a8b154b5ccfed1470fcc29155f3f57c676571539f9794c5b9a32ef2b3f4b8a20
 SHA512:
-  metadata.gz: d1b61514574a5b9d164aad8bac7b1e33eb00aed80a53362fbfe84b8f8ae8279d4b902c212616571f1f6cd7d1e2133e26edd3b2ff2991d48edeedddac84644e93
-  data.tar.gz: 60b43d39aaa046e6962557d83a95199da5190df3114a958a8938e632530c6dd8500b41eb5d026f0210a8c24078e20792cc57e032ebaf08772a54c4750646788a
+  metadata.gz: 7ec8917dc40e39108f0ceb7333d8968d31d2cfa5d902ad1fc533a85fcc98b10d0665bd84484256ff9a3e3114f4c8d27c7bdad24c70cf72c63f6dfc3d151bac2f
+  data.tar.gz: 839701911aea43402b13d2d4ea84f13d904ccf1576a7d9bc913eeac2f48a992a08e57c0859aceb04764afc927425852f18084c0638978937db974449a5f25b4b

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    clearance (1.16.2)
+    clearance (1.17.0)
       actionmailer (>= 3.1)
       activemodel (>= 3.1)
       activerecord (>= 3.1)
@@ -12,35 +12,35 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (5.2.2)
-      actionpack (= 5.2.2)
-      actionview (= 5.2.2)
-      activejob (= 5.2.2)
+    actionmailer (5.2.3)
+      actionpack (= 5.2.3)
+      actionview (= 5.2.3)
+      activejob (= 5.2.3)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (5.2.2)
-      actionview (= 5.2.2)
-      activesupport (= 5.2.2)
+    actionpack (5.2.3)
+      actionview (= 5.2.3)
+      activesupport (= 5.2.3)
       rack (~> 2.0)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.2)
-    actionview (5.2.2)
-      activesupport (= 5.2.2)
+    actionview (5.2.3)
+      activesupport (= 5.2.3)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.0, >= 1.0.3)
-    activejob (5.2.2)
-      activesupport (= 5.2.2)
+    activejob (5.2.3)
+      activesupport (= 5.2.3)
       globalid (>= 0.3.6)
-    activemodel (5.2.2)
-      activesupport (= 5.2.2)
-    activerecord (5.2.2)
-      activemodel (= 5.2.2)
-      activesupport (= 5.2.2)
+    activemodel (5.2.3)
+      activesupport (= 5.2.3)
+    activerecord (5.2.3)
+      activemodel (= 5.2.3)
+      activesupport (= 5.2.3)
       arel (>= 9.0)
-    activesupport (5.2.2)
+    activesupport (5.2.3)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 0.7, < 2)
       minitest (~> 5.1)
@@ -58,7 +58,7 @@ GEM
     arel (9.0.0)
     bcrypt (3.1.12)
     builder (3.2.3)
-    capybara (3.13.2)
+    capybara (3.16.1)
       addressable
       mini_mime (>= 0.1.3)
       nokogiri (~> 1.8)
@@ -67,7 +67,7 @@ GEM
       regexp_parser (~> 1.2)
       xpath (~> 3.2)
     coderay (1.1.2)
-    concurrent-ruby (1.1.4)
+    concurrent-ruby (1.1.5)
     crass (1.0.4)
     database_cleaner (1.7.0)
     diff-lcs (1.3)
@@ -81,7 +81,7 @@ GEM
       railties (>= 4.2.0)
     globalid (0.4.2)
       activesupport (>= 4.2.0)
-    i18n (1.5.3)
+    i18n (1.6.0)
       concurrent-ruby (~> 1.0)
     loofah (2.2.3)
       crass (~> 1.0.2)
@@ -92,13 +92,13 @@ GEM
     mini_mime (1.0.1)
     mini_portile2 (2.4.0)
     minitest (5.11.3)
-    nokogiri (1.10.1)
+    nokogiri (1.10.2)
       mini_portile2 (~> 2.4.0)
     pry (0.12.2)
       coderay (~> 1.1.0)
       method_source (~> 0.9.0)
     public_suffix (3.0.3)
-    rack (2.0.6)
+    rack (2.0.7)
     rack-test (1.1.0)
       rack (>= 1.0, < 3)
     rails-dom-testing (2.0.3)
@@ -106,14 +106,14 @@ GEM
       nokogiri (>= 1.6)
     rails-html-sanitizer (1.0.4)
       loofah (~> 2.2, >= 2.2.2)
-    railties (5.2.2)
-      actionpack (= 5.2.2)
-      activesupport (= 5.2.2)
+    railties (5.2.3)
+      actionpack (= 5.2.3)
+      activesupport (= 5.2.3)
       method_source
       rake (>= 0.8.7)
       thor (>= 0.19.0, < 2.0)
     rake (12.3.2)
-    regexp_parser (1.3.0)
+    regexp_parser (1.4.0)
     rspec-core (3.8.0)
       rspec-support (~> 3.8.0)
     rspec-expectations (3.8.2)
@@ -131,7 +131,7 @@ GEM
       rspec-mocks (~> 3.8.0)
       rspec-support (~> 3.8.0)
     rspec-support (3.8.0)
-    shoulda-matchers (4.0.0)
+    shoulda-matchers (4.0.1)
       activesupport (>= 4.2.0)
     sqlite3 (1.3.13)
     thor (0.20.3)

data/NEWS.md

@@ -3,6 +3,17 @@
 The noteworthy changes for each Clearance version are included here. For a
 complete changelog, see the git history for each version via the version links.
 
+## [1.17.0] - April 11, 2019
+
+### Changed
+
+- Update the `HttpOnly` cookie setting for the remember token to default to
+  true, which prevents the value from being available to JavaScript.
+- Add configuration option to allow the auth backdoor to work in specified
+  environments (defaults to `test`, `development`, `ci`).
+
+[1.17.0]: https://github.com/thoughtbot/clearance/compare/v1.16.2...1.17.0
+
 ## [1.16.2] - February 25, 2019
 
 ### Fixed

data/README.md

@@ -438,7 +438,7 @@ Thank you, [contributors]!
 
 ## License
 
-Clearance is copyright © 2009-2018 thoughtbot. It is free software, and may be
+Clearance is copyright © 2009-2019 thoughtbot. It is free software, and may be
 redistributed under the terms specified in the [`LICENSE`] file.
 
 [`LICENSE`]: /LICENSE

data/lib/clearance/back_door.rb

@@ -31,8 +31,8 @@ module Clearance
   #   visit new_feedback_path(as: user)
   class BackDoor
     def initialize(app, &block)
-      unless ENV["RAILS_ENV"] == "test"
-        raise "Can't use backdoor outside test environment"
+      unless environment_is_allowed?
+        raise error_message
       end
 
       @app = app
@@ -65,5 +65,27 @@ module Clearance
         Clearance.configuration.user_model.find(user_param)
       end
     end
+
+    # @api private
+    def environment_is_allowed?
+      allowed_environments.include? ENV["RAILS_ENV"]
+    end
+
+    # @api private
+    def allowed_environments
+      Clearance.configuration.allowed_backdoor_environments || []
+    end
+
+    # @api private
+    def error_message
+      unless allowed_environments.empty?
+        <<-EOS.squish
+          Can't use auth backdoor outside of
+          configured environments (#{allowed_environments.join(", ")}).
+        EOS
+      else
+        "BackDoor auth is disabled."
+      end
+    end
   end
 end

data/lib/clearance/configuration.rb

@@ -35,8 +35,8 @@ module Clearance
     # @return [String]
     attr_accessor :cookie_path
 
-    # Controls whether the  HttpOnly flag should be set on the remember token
-    # cookie. Defaults to `false`. If `true`, the cookie will not be made
+    # Controls whether the HttpOnly flag should be set on the remember token
+    # cookie. Defaults to `true`, which prevents the cookie from being made
     # available to JavaScript. For more see
     # [RFC6265](http://tools.ietf.org/html/rfc6265#section-5.2.6).
     # @return [Boolean]
@@ -90,17 +90,23 @@ module Clearance
     # @return [ActiveRecord::Base]
     attr_accessor :user_model
 
+    # The array of allowed environments where `Clearance::BackDoor` is enabled.
+    # Defaults to ["test", "ci", "development"]
+    # @return [Array<String>]
+    attr_accessor :allowed_backdoor_environments
+
     def initialize
       @allow_sign_up = true
-      @cookie_expiration = ->(cookies) { 1.year.from_now.utc }
+      @allowed_backdoor_environments = ["test", "ci", "development"]
       @cookie_domain = nil
-      @cookie_path = '/'
+      @cookie_expiration = ->(cookies) { 1.year.from_now.utc }
       @cookie_name = "remember_token"
-      @httponly = false
+      @cookie_path = '/'
+      @httponly = true
       @mailer_sender = 'reply@example.com'
       @redirect_url = '/'
-      @routes = true
       @rotate_csrf_on_sign_in = nil
+      @routes = true
       @secure_cookie = false
       @sign_in_guards = []
     end

data/lib/clearance/version.rb

@@ -1,3 +1,3 @@
 module Clearance
-  VERSION = "1.16.2".freeze
+  VERSION = "1.17.0".freeze
 end

data/spec/clearance/back_door_spec.rb

@@ -41,10 +41,45 @@ describe Clearance::BackDoor do
     expect(result).to eq mock_app.call(env)
   end
 
-  it "can't be used outside the test environment" do
+  it "can't be used outside the allowed environments" do
     with_environment("RAILS_ENV" => "production") do
       expect { Clearance::BackDoor.new(mock_app) }.
-        to raise_exception "Can't use backdoor outside test environment"
+        to raise_exception "Can't use auth backdoor outside of configured \
+          environments (test, ci, development).".squish
+    end
+  end
+
+  context "when the environments are disabled" do
+    before do
+      Clearance.configuration.allowed_backdoor_environments = nil
+    end
+
+    it "raises an error for a default allowed env" do
+      with_environment("RAILS_ENV" => "test") do
+        expect { Clearance::BackDoor.new(mock_app) }.
+          to raise_exception "BackDoor auth is disabled."
+      end
+    end
+  end
+
+  context "when the environments are not defaults" do
+    before do
+      Clearance.configuration.allowed_backdoor_environments = ['demo']
+    end
+
+    it "can be used with configured allowed environments" do
+      with_environment("RAILS_ENV" => "demo") do
+        user_id = "123"
+        user = double("user")
+        allow(User).to receive(:find).with(user_id).and_return(user)
+        env = env_for_user_id(user_id)
+        back_door = Clearance::BackDoor.new(mock_app)
+
+        result = back_door.call(env)
+
+        expect(env[:clearance]).to have_received(:sign_in).with(user)
+        expect(result).to eq mock_app.call(env)
+      end
     end
   end
 

data/spec/clearance/session_spec.rb

@@ -147,7 +147,6 @@ describe Clearance::Session do
 
   context 'if httponly is set' do
     before do
-      Clearance.configuration.httponly = true
       session.sign_in(user)
     end
 
@@ -160,6 +159,7 @@ describe Clearance::Session do
 
   context 'if httponly is not set' do
     before do
+      Clearance.configuration.httponly = false
       session.sign_in(user)
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clearance
 version: !ruby/object:Gem::Version
-  version: 1.16.2
+  version: 1.17.0
 platform: ruby
 authors:
 - Dan Croak
@@ -25,7 +25,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-02-25 00:00:00.000000000 Z
+date: 2019-04-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bcrypt
@@ -290,8 +290,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Rails authentication & authorization with email & password.