cloudfoundry-devise 1.5.2

Sign up to get free protection for your applications and to get access to all the features.
Files changed (210) hide show
  1. data/.gitignore +12 -0
  2. data/.travis.yml +13 -0
  3. data/CHANGELOG.rdoc +755 -0
  4. data/Gemfile +35 -0
  5. data/MIT-LICENSE +20 -0
  6. data/README.rdoc +366 -0
  7. data/Rakefile +34 -0
  8. data/app/controllers/devise/confirmations_controller.rb +46 -0
  9. data/app/controllers/devise/omniauth_callbacks_controller.rb +26 -0
  10. data/app/controllers/devise/passwords_controller.rb +50 -0
  11. data/app/controllers/devise/registrations_controller.rb +114 -0
  12. data/app/controllers/devise/sessions_controller.rb +49 -0
  13. data/app/controllers/devise/unlocks_controller.rb +34 -0
  14. data/app/helpers/devise_helper.rb +25 -0
  15. data/app/mailers/devise/mailer.rb +15 -0
  16. data/app/views/devise/confirmations/new.html.erb +12 -0
  17. data/app/views/devise/mailer/confirmation_instructions.html.erb +5 -0
  18. data/app/views/devise/mailer/reset_password_instructions.html.erb +8 -0
  19. data/app/views/devise/mailer/unlock_instructions.html.erb +7 -0
  20. data/app/views/devise/passwords/edit.html.erb +16 -0
  21. data/app/views/devise/passwords/new.html.erb +12 -0
  22. data/app/views/devise/registrations/edit.html.erb +25 -0
  23. data/app/views/devise/registrations/new.html.erb +18 -0
  24. data/app/views/devise/sessions/new.html.erb +17 -0
  25. data/app/views/devise/shared/_links.erb +25 -0
  26. data/app/views/devise/unlocks/new.html.erb +12 -0
  27. data/cloudfoundry-devise.gemspec +25 -0
  28. data/config/locales/en.yml +59 -0
  29. data/lib/devise.rb +453 -0
  30. data/lib/devise/controllers/helpers.rb +260 -0
  31. data/lib/devise/controllers/internal_helpers.rb +161 -0
  32. data/lib/devise/controllers/rememberable.rb +52 -0
  33. data/lib/devise/controllers/scoped_views.rb +33 -0
  34. data/lib/devise/controllers/shared_helpers.rb +26 -0
  35. data/lib/devise/controllers/url_helpers.rb +53 -0
  36. data/lib/devise/delegator.rb +16 -0
  37. data/lib/devise/encryptors/authlogic_sha512.rb +19 -0
  38. data/lib/devise/encryptors/base.rb +20 -0
  39. data/lib/devise/encryptors/clearance_sha1.rb +17 -0
  40. data/lib/devise/encryptors/restful_authentication_sha1.rb +22 -0
  41. data/lib/devise/encryptors/sha1.rb +25 -0
  42. data/lib/devise/encryptors/sha512.rb +25 -0
  43. data/lib/devise/failure_app.rb +149 -0
  44. data/lib/devise/hooks/activatable.rb +11 -0
  45. data/lib/devise/hooks/forgetable.rb +9 -0
  46. data/lib/devise/hooks/rememberable.rb +6 -0
  47. data/lib/devise/hooks/timeoutable.rb +24 -0
  48. data/lib/devise/hooks/trackable.rb +9 -0
  49. data/lib/devise/mailers/helpers.rb +86 -0
  50. data/lib/devise/mapping.rb +175 -0
  51. data/lib/devise/models.rb +91 -0
  52. data/lib/devise/models/authenticatable.rb +181 -0
  53. data/lib/devise/models/confirmable.rb +220 -0
  54. data/lib/devise/models/database_authenticatable.rb +122 -0
  55. data/lib/devise/models/encryptable.rb +72 -0
  56. data/lib/devise/models/lockable.rb +169 -0
  57. data/lib/devise/models/omniauthable.rb +23 -0
  58. data/lib/devise/models/recoverable.rb +136 -0
  59. data/lib/devise/models/registerable.rb +21 -0
  60. data/lib/devise/models/rememberable.rb +114 -0
  61. data/lib/devise/models/serializable.rb +43 -0
  62. data/lib/devise/models/timeoutable.rb +45 -0
  63. data/lib/devise/models/token_authenticatable.rb +72 -0
  64. data/lib/devise/models/trackable.rb +30 -0
  65. data/lib/devise/models/validatable.rb +62 -0
  66. data/lib/devise/modules.rb +30 -0
  67. data/lib/devise/omniauth.rb +28 -0
  68. data/lib/devise/omniauth/config.rb +45 -0
  69. data/lib/devise/omniauth/url_helpers.rb +33 -0
  70. data/lib/devise/orm/active_record.rb +44 -0
  71. data/lib/devise/orm/mongoid.rb +31 -0
  72. data/lib/devise/param_filter.rb +41 -0
  73. data/lib/devise/path_checker.rb +18 -0
  74. data/lib/devise/rails.rb +73 -0
  75. data/lib/devise/rails/routes.rb +385 -0
  76. data/lib/devise/rails/warden_compat.rb +120 -0
  77. data/lib/devise/schema.rb +109 -0
  78. data/lib/devise/strategies/authenticatable.rb +155 -0
  79. data/lib/devise/strategies/base.rb +15 -0
  80. data/lib/devise/strategies/database_authenticatable.rb +21 -0
  81. data/lib/devise/strategies/rememberable.rb +53 -0
  82. data/lib/devise/strategies/token_authenticatable.rb +57 -0
  83. data/lib/devise/test_helpers.rb +90 -0
  84. data/lib/devise/version.rb +3 -0
  85. data/lib/generators/active_record/devise_generator.rb +71 -0
  86. data/lib/generators/active_record/templates/migration.rb +29 -0
  87. data/lib/generators/active_record/templates/migration_existing.rb +26 -0
  88. data/lib/generators/devise/devise_generator.rb +22 -0
  89. data/lib/generators/devise/install_generator.rb +24 -0
  90. data/lib/generators/devise/orm_helpers.rb +31 -0
  91. data/lib/generators/devise/views_generator.rb +98 -0
  92. data/lib/generators/mongoid/devise_generator.rb +60 -0
  93. data/lib/generators/templates/README +32 -0
  94. data/lib/generators/templates/devise.rb +215 -0
  95. data/lib/generators/templates/markerb/confirmation_instructions.markerb +5 -0
  96. data/lib/generators/templates/markerb/reset_password_instructions.markerb +8 -0
  97. data/lib/generators/templates/markerb/unlock_instructions.markerb +7 -0
  98. data/lib/generators/templates/simple_form_for/confirmations/new.html.erb +15 -0
  99. data/lib/generators/templates/simple_form_for/passwords/edit.html.erb +19 -0
  100. data/lib/generators/templates/simple_form_for/passwords/new.html.erb +15 -0
  101. data/lib/generators/templates/simple_form_for/registrations/edit.html.erb +22 -0
  102. data/lib/generators/templates/simple_form_for/registrations/new.html.erb +17 -0
  103. data/lib/generators/templates/simple_form_for/sessions/new.html.erb +15 -0
  104. data/lib/generators/templates/simple_form_for/unlocks/new.html.erb +15 -0
  105. data/test/controllers/helpers_test.rb +254 -0
  106. data/test/controllers/internal_helpers_test.rb +96 -0
  107. data/test/controllers/sessions_controller_test.rb +16 -0
  108. data/test/controllers/url_helpers_test.rb +59 -0
  109. data/test/delegator_test.rb +19 -0
  110. data/test/devise_test.rb +72 -0
  111. data/test/encryptors_test.rb +30 -0
  112. data/test/failure_app_test.rb +207 -0
  113. data/test/generators/active_record_generator_test.rb +47 -0
  114. data/test/generators/devise_generator_test.rb +39 -0
  115. data/test/generators/install_generator_test.rb +13 -0
  116. data/test/generators/mongoid_generator_test.rb +23 -0
  117. data/test/generators/views_generator_test.rb +52 -0
  118. data/test/helpers/devise_helper_test.rb +51 -0
  119. data/test/indifferent_hash.rb +33 -0
  120. data/test/integration/authenticatable_test.rb +590 -0
  121. data/test/integration/confirmable_test.rb +262 -0
  122. data/test/integration/database_authenticatable_test.rb +82 -0
  123. data/test/integration/http_authenticatable_test.rb +82 -0
  124. data/test/integration/lockable_test.rb +212 -0
  125. data/test/integration/omniauthable_test.rb +133 -0
  126. data/test/integration/recoverable_test.rb +287 -0
  127. data/test/integration/registerable_test.rb +335 -0
  128. data/test/integration/rememberable_test.rb +158 -0
  129. data/test/integration/timeoutable_test.rb +98 -0
  130. data/test/integration/token_authenticatable_test.rb +148 -0
  131. data/test/integration/trackable_test.rb +92 -0
  132. data/test/mailers/confirmation_instructions_test.rb +95 -0
  133. data/test/mailers/reset_password_instructions_test.rb +83 -0
  134. data/test/mailers/unlock_instructions_test.rb +77 -0
  135. data/test/mapping_test.rb +128 -0
  136. data/test/models/confirmable_test.rb +334 -0
  137. data/test/models/database_authenticatable_test.rb +167 -0
  138. data/test/models/encryptable_test.rb +67 -0
  139. data/test/models/lockable_test.rb +225 -0
  140. data/test/models/recoverable_test.rb +198 -0
  141. data/test/models/rememberable_test.rb +168 -0
  142. data/test/models/serializable_test.rb +38 -0
  143. data/test/models/timeoutable_test.rb +42 -0
  144. data/test/models/token_authenticatable_test.rb +49 -0
  145. data/test/models/trackable_test.rb +5 -0
  146. data/test/models/validatable_test.rb +113 -0
  147. data/test/models_test.rb +109 -0
  148. data/test/omniauth/config_test.rb +57 -0
  149. data/test/omniauth/url_helpers_test.rb +58 -0
  150. data/test/orm/active_record.rb +9 -0
  151. data/test/orm/mongoid.rb +14 -0
  152. data/test/rails_app/Rakefile +10 -0
  153. data/test/rails_app/app/active_record/admin.rb +6 -0
  154. data/test/rails_app/app/active_record/shim.rb +2 -0
  155. data/test/rails_app/app/active_record/user.rb +6 -0
  156. data/test/rails_app/app/controllers/admins/sessions_controller.rb +6 -0
  157. data/test/rails_app/app/controllers/admins_controller.rb +6 -0
  158. data/test/rails_app/app/controllers/application_controller.rb +8 -0
  159. data/test/rails_app/app/controllers/home_controller.rb +25 -0
  160. data/test/rails_app/app/controllers/publisher/registrations_controller.rb +2 -0
  161. data/test/rails_app/app/controllers/publisher/sessions_controller.rb +2 -0
  162. data/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb +14 -0
  163. data/test/rails_app/app/controllers/users_controller.rb +23 -0
  164. data/test/rails_app/app/helpers/application_helper.rb +3 -0
  165. data/test/rails_app/app/mailers/users/mailer.rb +3 -0
  166. data/test/rails_app/app/mongoid/admin.rb +24 -0
  167. data/test/rails_app/app/mongoid/shim.rb +24 -0
  168. data/test/rails_app/app/mongoid/user.rb +45 -0
  169. data/test/rails_app/app/views/admins/index.html.erb +1 -0
  170. data/test/rails_app/app/views/admins/sessions/new.html.erb +2 -0
  171. data/test/rails_app/app/views/home/admin_dashboard.html.erb +1 -0
  172. data/test/rails_app/app/views/home/index.html.erb +1 -0
  173. data/test/rails_app/app/views/home/join.html.erb +1 -0
  174. data/test/rails_app/app/views/home/private.html.erb +1 -0
  175. data/test/rails_app/app/views/home/user_dashboard.html.erb +1 -0
  176. data/test/rails_app/app/views/layouts/application.html.erb +24 -0
  177. data/test/rails_app/app/views/users/index.html.erb +1 -0
  178. data/test/rails_app/app/views/users/mailer/confirmation_instructions.erb +1 -0
  179. data/test/rails_app/app/views/users/sessions/new.html.erb +1 -0
  180. data/test/rails_app/config.ru +4 -0
  181. data/test/rails_app/config/application.rb +41 -0
  182. data/test/rails_app/config/boot.rb +8 -0
  183. data/test/rails_app/config/database.yml +18 -0
  184. data/test/rails_app/config/environment.rb +5 -0
  185. data/test/rails_app/config/environments/development.rb +18 -0
  186. data/test/rails_app/config/environments/production.rb +33 -0
  187. data/test/rails_app/config/environments/test.rb +33 -0
  188. data/test/rails_app/config/initializers/backtrace_silencers.rb +7 -0
  189. data/test/rails_app/config/initializers/devise.rb +197 -0
  190. data/test/rails_app/config/initializers/inflections.rb +2 -0
  191. data/test/rails_app/config/initializers/secret_token.rb +2 -0
  192. data/test/rails_app/config/routes.rb +87 -0
  193. data/test/rails_app/db/migrate/20100401102949_create_tables.rb +71 -0
  194. data/test/rails_app/db/schema.rb +52 -0
  195. data/test/rails_app/lib/shared_admin.rb +10 -0
  196. data/test/rails_app/lib/shared_user.rb +26 -0
  197. data/test/rails_app/public/404.html +26 -0
  198. data/test/rails_app/public/422.html +26 -0
  199. data/test/rails_app/public/500.html +26 -0
  200. data/test/rails_app/public/favicon.ico +0 -0
  201. data/test/rails_app/script/rails +10 -0
  202. data/test/routes_test.rb +240 -0
  203. data/test/support/assertions.rb +27 -0
  204. data/test/support/helpers.rb +109 -0
  205. data/test/support/integration.rb +88 -0
  206. data/test/support/locale/en.yml +4 -0
  207. data/test/support/webrat/integrations/rails.rb +24 -0
  208. data/test/test_helper.rb +27 -0
  209. data/test/test_helpers_test.rb +134 -0
  210. metadata +295 -0
@@ -0,0 +1,158 @@
1
+ require 'test_helper'
2
+
3
+ class RememberMeTest < ActionController::IntegrationTest
4
+ def create_user_and_remember(add_to_token='')
5
+ user = create_user
6
+ user.remember_me!
7
+ raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
8
+ cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
9
+ user
10
+ end
11
+
12
+ def generate_signed_cookie(raw_cookie)
13
+ request = ActionDispatch::TestRequest.new
14
+ request.cookie_jar.signed['raw_cookie'] = raw_cookie
15
+ request.cookie_jar['raw_cookie']
16
+ end
17
+
18
+ def signed_cookie(key)
19
+ controller.send(:cookies).signed[key]
20
+ end
21
+
22
+ def cookie_expires(key)
23
+ cookie = response.headers["Set-Cookie"].split("\n").grep(/^#{key}/).first
24
+ expires = cookie.split(";").map(&:strip).grep(/^expires=/).first
25
+ Time.parse(expires).utc
26
+ end
27
+
28
+ test 'do not remember the user if he has not checked remember me option' do
29
+ user = sign_in_as_user
30
+ assert_nil request.cookies["remember_user_cookie"]
31
+ end
32
+
33
+ test 'handles unverified requests gets rid of caches' do
34
+ swap UsersController, :allow_forgery_protection => true do
35
+ post exhibit_user_url(1)
36
+ assert_not warden.authenticated?(:user)
37
+
38
+ create_user_and_remember
39
+ post exhibit_user_url(1)
40
+ assert_equal "User is not authenticated", response.body
41
+ assert_not warden.authenticated?(:user)
42
+ end
43
+ end
44
+
45
+ test 'generate remember token after sign in' do
46
+ user = sign_in_as_user :remember_me => true
47
+ assert request.cookies["remember_user_token"]
48
+ end
49
+
50
+ test 'generate remember token after sign in setting cookie options' do
51
+ # We test this by asserting the cookie is not sent after the redirect
52
+ # since we changed the domain. This is the only difference with the
53
+ # previous test.
54
+ swap Devise, :cookie_options => { :domain => "omg.somewhere.com" } do
55
+ user = sign_in_as_user :remember_me => true
56
+ assert_nil request.cookies["remember_user_token"]
57
+ end
58
+ end
59
+
60
+ test 'generate remember token after sign in setting session options' do
61
+ begin
62
+ Rails.configuration.session_options[:domain] = "omg.somewhere.com"
63
+ user = sign_in_as_user :remember_me => true
64
+ assert_nil request.cookies["remember_user_token"]
65
+ ensure
66
+ Rails.configuration.session_options.delete(:domain)
67
+ end
68
+ end
69
+
70
+ test 'remember the user before sign in' do
71
+ user = create_user_and_remember
72
+ get users_path
73
+ assert_response :success
74
+ assert warden.authenticated?(:user)
75
+ assert warden.user(:user) == user
76
+ assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
77
+ end
78
+
79
+ test 'remember the user before sign up and redirect him to his home' do
80
+ user = create_user_and_remember
81
+ get new_user_registration_path
82
+ assert warden.authenticated?(:user)
83
+ assert_redirected_to root_path
84
+ end
85
+
86
+ test 'cookies are destroyed on unverified requests' do
87
+ swap ApplicationController, :allow_forgery_protection => true do
88
+ user = create_user_and_remember
89
+ get users_path
90
+ assert warden.authenticated?(:user)
91
+ post root_path, :authenticity_token => 'INVALID'
92
+ assert_not warden.authenticated?(:user)
93
+ end
94
+ end
95
+
96
+ test 'does not extend remember period through sign in' do
97
+ swap Devise, :extend_remember_period => true, :remember_for => 1.year do
98
+ user = create_user
99
+ user.remember_me!
100
+
101
+ user.remember_created_at = old = 10.days.ago
102
+ user.save
103
+
104
+ sign_in_as_user :remember_me => true
105
+ user.reload
106
+
107
+ assert warden.user(:user) == user
108
+ assert_equal old.to_i, user.remember_created_at.to_i
109
+ end
110
+ end
111
+
112
+ test 'do not remember other scopes' do
113
+ user = create_user_and_remember
114
+ get root_path
115
+ assert_response :success
116
+ assert warden.authenticated?(:user)
117
+ assert_not warden.authenticated?(:admin)
118
+ end
119
+
120
+ test 'do not remember with invalid token' do
121
+ user = create_user_and_remember('add')
122
+ get users_path
123
+ assert_not warden.authenticated?(:user)
124
+ assert_redirected_to new_user_session_path
125
+ end
126
+
127
+ test 'do not remember with expired token' do
128
+ user = create_user_and_remember
129
+ swap Devise, :remember_for => 0 do
130
+ get users_path
131
+ assert_not warden.authenticated?(:user)
132
+ assert_redirected_to new_user_session_path
133
+ end
134
+ end
135
+
136
+ test 'do not remember the user anymore after forget' do
137
+ user = create_user_and_remember
138
+ get users_path
139
+ assert warden.authenticated?(:user)
140
+
141
+ get destroy_user_session_path
142
+ assert_not warden.authenticated?(:user)
143
+ assert_nil warden.cookies['remember_user_token']
144
+
145
+ get users_path
146
+ assert_not warden.authenticated?(:user)
147
+ end
148
+
149
+ test 'changing user password expires remember me token' do
150
+ user = create_user_and_remember
151
+ user.password = "another_password"
152
+ user.password_confirmation = "another_password"
153
+ user.save!
154
+
155
+ get users_path
156
+ assert_not warden.authenticated?(:user)
157
+ end
158
+ end
@@ -0,0 +1,98 @@
1
+ require 'test_helper'
2
+
3
+ class SessionTimeoutTest < ActionController::IntegrationTest
4
+
5
+ def last_request_at
6
+ @controller.user_session['last_request_at']
7
+ end
8
+
9
+ test 'set last request at in user session after each request' do
10
+ sign_in_as_user
11
+ old_last_request = last_request_at
12
+ assert_not_nil last_request_at
13
+
14
+ get users_path
15
+ assert_not_nil last_request_at
16
+ assert_not_equal old_last_request, last_request_at
17
+ end
18
+
19
+ test 'set last request at in user session after each request is skipped if tracking is disabled' do
20
+ sign_in_as_user
21
+ old_last_request = last_request_at
22
+ assert_not_nil last_request_at
23
+
24
+ get users_path, {}, 'devise.skip_trackable' => true
25
+ assert_equal old_last_request, last_request_at
26
+ end
27
+
28
+ test 'not time out user session before default limit time' do
29
+ sign_in_as_user
30
+ assert_response :success
31
+ assert warden.authenticated?(:user)
32
+
33
+ get users_path
34
+ assert_response :success
35
+ assert warden.authenticated?(:user)
36
+ end
37
+
38
+ test 'time out user session after default limit time' do
39
+ user = sign_in_as_user
40
+ get expire_user_path(user)
41
+ assert_not_nil last_request_at
42
+
43
+ get users_path
44
+ assert_redirected_to new_user_session_path
45
+ assert_not warden.authenticated?(:user)
46
+ end
47
+
48
+ test 'time out is not triggered on sign out' do
49
+ user = sign_in_as_user
50
+ get expire_user_path(user)
51
+
52
+ get destroy_user_session_path
53
+ assert_response :redirect
54
+ assert_redirected_to root_path
55
+
56
+ follow_redirect!
57
+ assert_contain 'Signed out successfully'
58
+ end
59
+
60
+ test 'user configured timeout limit' do
61
+ swap Devise, :timeout_in => 8.minutes do
62
+ user = sign_in_as_user
63
+
64
+ get users_path
65
+ assert_not_nil last_request_at
66
+ assert_response :success
67
+ assert warden.authenticated?(:user)
68
+
69
+ get expire_user_path(user)
70
+ get users_path
71
+ assert_redirected_to new_user_session_path
72
+ assert_not warden.authenticated?(:user)
73
+ end
74
+ end
75
+
76
+ test 'error message with i18n' do
77
+ store_translations :en, :devise => {
78
+ :failure => { :user => { :timeout => 'Session expired!' } }
79
+ } do
80
+ user = sign_in_as_user
81
+
82
+ get expire_user_path(user)
83
+ get users_path
84
+ follow_redirect!
85
+ assert_contain 'Session expired!'
86
+ end
87
+ end
88
+
89
+ test 'time out not triggered if remembered' do
90
+ user = sign_in_as_user :remember_me => true
91
+ get expire_user_path(user)
92
+ assert_not_nil last_request_at
93
+
94
+ get users_path
95
+ assert_response :success
96
+ assert warden.authenticated?(:user)
97
+ end
98
+ end
@@ -0,0 +1,148 @@
1
+ require 'test_helper'
2
+
3
+ class TokenAuthenticationTest < ActionController::IntegrationTest
4
+
5
+ test 'authenticate with valid authentication token key and value through params' do
6
+ swap Devise, :token_authentication_key => :secret_token do
7
+ sign_in_as_new_user_with_token
8
+
9
+ assert_response :success
10
+ assert_current_url "/users?secret_token=#{VALID_AUTHENTICATION_TOKEN}"
11
+ assert_contain 'Welcome'
12
+ assert warden.authenticated?(:user)
13
+ end
14
+ end
15
+
16
+ test 'authenticate with valid authentication token key and value through params, when params with the same key as scope exist' do
17
+ swap Devise, :token_authentication_key => :secret_token do
18
+ user = create_user_with_authentication_token
19
+ post exhibit_user_path(user), Devise.token_authentication_key => user.authentication_token, :user => { :some => "data" }
20
+
21
+ assert_response :success
22
+ assert_contain 'User is authenticated'
23
+ assert warden.authenticated?(:user)
24
+ end
25
+ end
26
+
27
+ test 'authenticate with valid authentication token key but does not store if stateless' do
28
+ swap Devise, :token_authentication_key => :secret_token, :stateless_token => true do
29
+ sign_in_as_new_user_with_token
30
+ assert warden.authenticated?(:user)
31
+
32
+ get users_path
33
+ assert_redirected_to new_user_session_path
34
+ assert_not warden.authenticated?(:user)
35
+ end
36
+ end
37
+
38
+ test 'authenticate with valid authentication token key and value through http' do
39
+ swap Devise, :token_authentication_key => :secret_token do
40
+ sign_in_as_new_user_with_token(:http_auth => true)
41
+
42
+ assert_response :success
43
+ assert_match '<email>user@test.com</email>', response.body
44
+ assert warden.authenticated?(:user)
45
+ end
46
+ end
47
+
48
+ test 'does authenticate with valid authentication token key and value through params if not configured' do
49
+ swap Devise, :token_authentication_key => :secret_token, :params_authenticatable => [:database] do
50
+ sign_in_as_new_user_with_token
51
+
52
+ assert_contain 'You need to sign in or sign up before continuing'
53
+ assert_contain 'Sign in'
54
+ assert_not warden.authenticated?(:user)
55
+ end
56
+ end
57
+
58
+ test 'does authenticate with valid authentication token key and value through http if not configured' do
59
+ swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => [:database] do
60
+ sign_in_as_new_user_with_token(:http_auth => true)
61
+
62
+ assert_response 401
63
+ assert_contain 'Invalid email or password.'
64
+ assert_not warden.authenticated?(:user)
65
+ end
66
+ end
67
+
68
+ test 'does not authenticate with improper authentication token key' do
69
+ swap Devise, :token_authentication_key => :donald_duck_token do
70
+ sign_in_as_new_user_with_token(:auth_token_key => :secret_token)
71
+ assert_equal new_user_session_path, @request.path
72
+
73
+ assert_contain 'You need to sign in or sign up before continuing'
74
+ assert_contain 'Sign in'
75
+ assert_not warden.authenticated?(:user)
76
+ end
77
+ end
78
+
79
+ test 'does not authenticate with improper authentication token value' do
80
+ store_translations :en, :devise => {:failure => {:invalid_token => 'LOL, that was not a single character correct.'}} do
81
+ sign_in_as_new_user_with_token(:auth_token => '*** INVALID TOKEN ***')
82
+ assert_equal new_user_session_path, @request.path
83
+
84
+ assert_contain 'LOL, that was not a single character correct.'
85
+ assert_contain 'Sign in'
86
+ assert_not warden.authenticated?(:user)
87
+ end
88
+ end
89
+
90
+ test 'authenticate with valid authentication token key and do not store if stateless and timeoutable are enabled' do
91
+ swap Devise, :token_authentication_key => :secret_token, :stateless_token => true, :timeout_in => (0.1).second do
92
+ user = sign_in_as_new_user_with_token
93
+ assert warden.authenticated?(:user)
94
+
95
+ # Expiring does not work because we are setting the session value when accessing it
96
+ sleep 0.3
97
+
98
+ get_users_path_as_existing_user(user)
99
+ assert warden.authenticated?(:user)
100
+ end
101
+ end
102
+
103
+ test 'should not be subject to injection' do
104
+ swap Devise, :token_authentication_key => :secret_token do
105
+ user1 = create_user_with_authentication_token()
106
+
107
+ # Clean up user cache
108
+ @user = nil
109
+
110
+ user2 = create_user_with_authentication_token(:email => "another@test.com")
111
+ user2.update_attribute(:authentication_token, "ANOTHERTOKEN")
112
+
113
+ assert_not_equal user1, user2
114
+ visit users_path(Devise.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
115
+ assert_nil warden.user(:user)
116
+ end
117
+ end
118
+
119
+ private
120
+
121
+ def sign_in_as_new_user_with_token(options = {})
122
+ user = options.delete(:user) || create_user_with_authentication_token(options)
123
+
124
+ options[:auth_token_key] ||= Devise.token_authentication_key
125
+ options[:auth_token] ||= user.authentication_token
126
+
127
+ if options[:http_auth]
128
+ header = "Basic #{ActiveSupport::Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
129
+ get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
130
+ else
131
+ visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
132
+ end
133
+
134
+ user
135
+ end
136
+
137
+ def create_user_with_authentication_token(options={})
138
+ user = create_user(options)
139
+ user.authentication_token = VALID_AUTHENTICATION_TOKEN
140
+ user.save
141
+ user
142
+ end
143
+
144
+ def get_users_path_as_existing_user(user)
145
+ sign_in_as_new_user_with_token(:user => user)
146
+ end
147
+
148
+ end
@@ -0,0 +1,92 @@
1
+ require 'test_helper'
2
+
3
+ class TrackableHooksTest < ActionController::IntegrationTest
4
+
5
+ test "current and last sign in timestamps are updated on each sign in" do
6
+ user = create_user
7
+ assert_nil user.current_sign_in_at
8
+ assert_nil user.last_sign_in_at
9
+
10
+ sign_in_as_user
11
+ user.reload
12
+
13
+ assert_kind_of Time, user.current_sign_in_at
14
+ assert_kind_of Time, user.last_sign_in_at
15
+
16
+ assert_equal user.current_sign_in_at, user.last_sign_in_at
17
+ assert user.current_sign_in_at >= user.created_at
18
+
19
+ visit destroy_user_session_path
20
+ new_time = 2.seconds.from_now
21
+ Time.stubs(:now).returns(new_time)
22
+
23
+ sign_in_as_user
24
+ user.reload
25
+ assert user.current_sign_in_at > user.last_sign_in_at
26
+ end
27
+
28
+ test "current and last sign in remote ip are updated on each sign in" do
29
+ user = create_user
30
+ assert_nil user.current_sign_in_ip
31
+ assert_nil user.last_sign_in_ip
32
+
33
+ sign_in_as_user
34
+ user.reload
35
+
36
+ assert_equal "127.0.0.1", user.current_sign_in_ip
37
+ assert_equal "127.0.0.1", user.last_sign_in_ip
38
+ end
39
+
40
+ test "current remote ip returns original ip behind a non transparent proxy" do
41
+ user = create_user
42
+
43
+ arbitrary_ip = '192.168.1.69'
44
+ sign_in_as_user do
45
+ header 'HTTP_X_FORWARDED_FOR', arbitrary_ip
46
+ end
47
+ user.reload
48
+ assert_equal arbitrary_ip, user.current_sign_in_ip
49
+ end
50
+
51
+ test "increase sign in count" do
52
+ user = create_user
53
+ assert_equal 0, user.sign_in_count
54
+
55
+ sign_in_as_user
56
+ user.reload
57
+ assert_equal 1, user.sign_in_count
58
+
59
+ visit destroy_user_session_path
60
+ sign_in_as_user
61
+ user.reload
62
+ assert_equal 2, user.sign_in_count
63
+ end
64
+
65
+ test "does not update anything if user has signed out along the way" do
66
+ swap Devise, :confirm_within => 0 do
67
+ user = create_user(:confirm => false)
68
+ sign_in_as_user
69
+
70
+ user.reload
71
+ assert_nil user.current_sign_in_at
72
+ assert_nil user.last_sign_in_at
73
+ end
74
+ end
75
+
76
+ test "do not track if devise.skip_trackable is set" do
77
+ user = create_user
78
+ sign_in_as_user do
79
+ header 'devise.skip_trackable', '1'
80
+ end
81
+ user.reload
82
+ assert_equal 0, user.sign_in_count
83
+ visit destroy_user_session_path
84
+
85
+ sign_in_as_user do
86
+ header 'devise.skip_trackable', false
87
+ end
88
+ user.reload
89
+ assert_equal 1, user.sign_in_count
90
+ end
91
+
92
+ end