devise-jdguyot 1.2.rc

data/test/integration/rememberable_test.rb

@@ -0,0 +1,180 @@
+require 'test_helper'
+
+class RememberMeTest < ActionController::IntegrationTest
+  def create_user_and_remember(add_to_token='')
+    user = create_user
+    user.remember_me!
+    raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
+    cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
+    user
+  end
+
+  def create_admin_and_remember
+    admin = create_admin
+    admin.remember_me!
+    raw_cookie = Admin.serialize_into_cookie(admin)
+    cookies['remember_admin_token'] = generate_signed_cookie(raw_cookie)
+    admin
+  end
+
+  def generate_signed_cookie(raw_cookie)
+    request = ActionDispatch::TestRequest.new
+    request.cookie_jar.signed['raw_cookie'] = raw_cookie
+    request.cookie_jar['raw_cookie']
+  end
+
+  def signed_cookie(key)
+    controller.send(:cookies).signed[key]
+  end
+
+  def cookie_expires(key)
+    cookie  = response.headers["Set-Cookie"].split("\n").grep(/^#{key}/).first
+    expires = cookie.split(";").map(&:strip).grep(/^expires=/).first
+    Time.parse(expires)
+  end
+
+  test 'do not remember the user if he has not checked remember me option' do
+    user = sign_in_as_user
+    assert_nil request.cookies["remember_user_cookie"]
+  end
+
+  test 'generate remember token after sign in' do
+    user = sign_in_as_user :remember_me => true
+    assert request.cookies["remember_user_token"]
+  end
+
+  test 'generate remember token after sign in setting cookie options' do
+    # We test this by asserting the cookie is not sent after the redirect
+    # since we changed the domain. This is the only difference with the
+    # previous test.
+    swap Devise, :cookie_options => { :domain => "omg.somewhere.com" } do
+      user = sign_in_as_user :remember_me => true
+      assert_nil request.cookies["remember_user_token"]
+    end
+  end
+
+  test 'generate remember token after sign in setting session options' do
+    begin
+      Rails.configuration.session_options[:domain] = "omg.somewhere.com"
+      user = sign_in_as_user :remember_me => true
+      assert_nil request.cookies["remember_user_token"]
+    ensure
+      Rails.configuration.session_options.delete(:domain)
+    end
+  end
+
+  test 'remember the user before sign in' do
+    user = create_user_and_remember
+    get users_path
+    assert_response :success
+    assert warden.authenticated?(:user)
+    assert warden.user(:user) == user
+    assert_match /remember_user_token[^\n]*HttpOnly\n/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
+  end
+
+  test 'does not extend remember period through sign in' do
+    swap Devise, :extend_remember_period => true, :remember_for => 1.year do
+      user = create_user
+      user.remember_me!
+
+      user.remember_created_at = old = 10.days.ago
+      user.save
+
+      sign_in_as_user :remember_me => true
+      user.reload
+
+      assert warden.user(:user) == user
+      assert_equal old.to_i, user.remember_created_at.to_i
+    end
+  end
+
+  test 'if both extend_remember_period and remember_across_browsers are true, sends the same token with a new expire date' do
+    swap Devise, :remember_across_browsers => true, :extend_remember_period => true, :remember_for => 1.year do
+      admin = create_admin_and_remember
+      token = admin.remember_token
+
+      admin.remember_created_at = old = 10.minutes.ago
+      admin.save!
+
+      get root_path
+      assert (cookie_expires("remember_admin_token") - 1.year) > (old + 5.minutes)
+      assert_equal token, signed_cookie("remember_admin_token").last
+    end
+  end
+
+  test 'if both extend_remember_period and remember_across_browsers are false, sends a new token with old expire date' do
+    swap Devise, :remember_across_browsers => false, :extend_remember_period => false, :remember_for => 1.year do
+      admin = create_admin_and_remember
+      token = admin.remember_token
+
+      admin.remember_created_at = old = 10.minutes.ago
+      admin.save!
+
+      get root_path
+      assert (cookie_expires("remember_admin_token") - 1.year) < (old + 5.minutes)
+      assert_not_equal token, signed_cookie("remember_admin_token").last
+    end
+  end
+
+  test 'do not remember other scopes' do
+    user = create_user_and_remember
+    get root_path
+    assert_response :success
+    assert warden.authenticated?(:user)
+    assert_not warden.authenticated?(:admin)
+  end
+
+  test 'do not remember with invalid token' do
+    user = create_user_and_remember('add')
+    get users_path
+    assert_not warden.authenticated?(:user)
+    assert_redirected_to new_user_session_path
+  end
+
+  test 'do not remember with expired token' do
+    user = create_user_and_remember
+    swap Devise, :remember_for => 0 do
+      get users_path
+      assert_not warden.authenticated?(:user)
+      assert_redirected_to new_user_session_path
+    end
+  end
+
+  test 'do not remember the user anymore after forget' do
+    user = create_user_and_remember
+    get users_path
+    assert warden.authenticated?(:user)
+
+    get destroy_user_session_path
+    assert_not warden.authenticated?(:user)
+    assert_nil warden.cookies['remember_user_token']
+
+    get users_path
+    assert_not warden.authenticated?(:user)
+    assert_nil warden.cookies['remember_user_token']
+  end
+
+  test 'do not remember the admin anymore after forget' do
+    admin = create_admin_and_remember
+    get root_path
+    assert warden.authenticated?(:admin)
+
+    get destroy_admin_session_path
+    assert_not warden.authenticated?(:admin)
+    assert_nil warden.cookies['remember_admin_token']
+
+    get root_path
+    assert_not warden.authenticated?(:admin)
+    assert_nil warden.cookies['remember_admin_token']
+  end
+
+  test 'changing user password expires remember me token' do
+    user = create_user_and_remember
+    user.password = "another_password"
+    user.password_confirmation = "another_password"
+    user.save!
+
+    get users_path
+    assert_not warden.authenticated?(:user)
+  end
+end

data/test/integration/timeoutable_test.rb

@@ -0,0 +1,89 @@
+require 'test_helper'
+
+class SessionTimeoutTest < ActionController::IntegrationTest
+
+  def last_request_at
+    @controller.user_session['last_request_at']
+  end
+
+  test 'set last request at in user session after each request' do
+    sign_in_as_user
+    old_last_request = last_request_at
+    assert_not_nil last_request_at
+
+    get users_path
+    assert_not_nil last_request_at
+    assert_not_equal old_last_request, last_request_at
+  end
+
+  test 'not time out user session before default limit time' do
+    sign_in_as_user
+    assert_response :success
+    assert warden.authenticated?(:user)
+
+    get users_path
+    assert_response :success
+    assert warden.authenticated?(:user)
+  end
+
+  test 'time out user session after default limit time' do
+    user = sign_in_as_user
+    get expire_user_path(user)
+    assert_not_nil last_request_at
+
+    get users_path
+    assert_redirected_to new_user_session_path
+    assert_not warden.authenticated?(:user)
+  end
+
+  test 'time out is not triggered on sign out' do
+    user = sign_in_as_user
+    get expire_user_path(user)
+
+    get destroy_user_session_path
+    assert_response :redirect
+    assert_redirected_to root_path
+
+    follow_redirect!
+    assert_contain 'Signed out successfully'
+  end
+
+  test 'user configured timeout limit' do
+    swap Devise, :timeout_in => 8.minutes do
+      user = sign_in_as_user
+
+      get users_path
+      assert_not_nil last_request_at
+      assert_response :success
+      assert warden.authenticated?(:user)
+
+      get expire_user_path(user)
+      get users_path
+      assert_redirected_to new_user_session_path
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
+  test 'error message with i18n' do
+    store_translations :en, :devise => {
+      :failure => { :user => { :timeout => 'Session expired!' } }
+    } do
+      user = sign_in_as_user
+
+      get expire_user_path(user)
+      get users_path
+      follow_redirect!
+      assert_contain 'Session expired!'
+    end
+  end
+  
+  test 'time out not triggered if remembered' do
+    user = sign_in_as_user :remember_me => true
+    get expire_user_path(user)
+    assert_not_nil last_request_at
+    
+    get users_path
+    assert_response :success
+    assert warden.authenticated?(:user)
+  end
+end

data/test/integration/token_authenticatable_test.rb

@@ -0,0 +1,99 @@
+require 'test_helper'
+
+class TokenAuthenticationTest < ActionController::IntegrationTest
+
+  test 'authenticate with valid authentication token key and value through params' do
+    swap Devise, :token_authentication_key => :secret_token do
+      sign_in_as_new_user_with_token
+
+      assert_response :success
+      assert_current_url "/users?secret_token=#{VALID_AUTHENTICATION_TOKEN}"
+      assert_contain 'Welcome'
+      assert warden.authenticated?(:user)
+    end
+  end
+
+  test 'authenticate with valid authentication token key but does not store if stateless' do
+    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true do
+      sign_in_as_new_user_with_token
+      assert warden.authenticated?(:user)
+
+      get users_path
+      assert_redirected_to new_user_session_path
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
+  test 'authenticate with valid authentication token key and value through http' do
+    swap Devise, :token_authentication_key => :secret_token do
+      sign_in_as_new_user_with_token(:http_auth => true)
+
+      assert_response :success
+      assert_match '<email>user@test.com</email>', response.body
+      assert warden.authenticated?(:user)
+    end
+  end
+
+  test 'does authenticate with valid authentication token key and value through params if not configured' do
+    swap Devise, :token_authentication_key => :secret_token, :params_authenticatable => [:database] do
+      sign_in_as_new_user_with_token
+
+      assert_contain 'You need to sign in or sign up before continuing'
+      assert_contain 'Sign in'
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
+  test 'does authenticate with valid authentication token key and value through http if not configured' do
+    swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => [:database] do
+      sign_in_as_new_user_with_token(:http_auth => true)
+
+      assert_response 401
+      assert_contain 'Invalid email or password.'
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
+  test 'does not authenticate with improper authentication token key' do
+    swap Devise, :token_authentication_key => :donald_duck_token do
+      sign_in_as_new_user_with_token(:auth_token_key => :secret_token)
+      assert_equal new_user_session_path, @request.path
+
+      assert_contain 'You need to sign in or sign up before continuing'
+      assert_contain 'Sign in'
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
+  test 'does not authenticate with improper authentication token value' do
+    store_translations :en, :devise => {:failure => {:invalid_token => 'LOL, that was not a single character correct.'}} do
+      sign_in_as_new_user_with_token(:auth_token => '*** INVALID TOKEN ***')
+      assert_equal new_user_session_path, @request.path
+
+      assert_contain 'LOL, that was not a single character correct.'
+      assert_contain 'Sign in'
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
+  private
+
+    def sign_in_as_new_user_with_token(options = {})
+      options[:auth_token_key] ||= Devise.token_authentication_key
+      options[:auth_token]     ||= VALID_AUTHENTICATION_TOKEN
+
+      user = create_user(options)
+      user.authentication_token = VALID_AUTHENTICATION_TOKEN
+      user.save
+
+      if options[:http_auth]
+        header = "Basic #{ActiveSupport::Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
+        get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
+      else
+        visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
+      end
+
+      user
+    end
+
+end

data/test/integration/trackable_test.rb

@@ -0,0 +1,64 @@
+require 'test_helper'
+
+class TrackableHooksTest < ActionController::IntegrationTest
+
+  test "current and last sign in timestamps are updated on each sign in" do
+    user = create_user
+    assert_nil user.current_sign_in_at
+    assert_nil user.last_sign_in_at
+
+    sign_in_as_user
+    user.reload
+
+    assert_kind_of Time, user.current_sign_in_at
+    assert_kind_of Time, user.last_sign_in_at
+
+    assert_equal user.current_sign_in_at, user.last_sign_in_at
+    assert user.current_sign_in_at >= user.created_at
+
+    visit destroy_user_session_path
+    new_time = 2.seconds.from_now
+    Time.stubs(:now).returns(new_time)
+
+    sign_in_as_user
+    user.reload
+    assert user.current_sign_in_at > user.last_sign_in_at
+  end
+
+  test "current and last sign in remote ip are updated on each sign in" do
+    user = create_user
+    assert_nil user.current_sign_in_ip
+    assert_nil user.last_sign_in_ip
+
+    sign_in_as_user
+    user.reload
+
+    assert_equal "127.0.0.1", user.current_sign_in_ip
+    assert_equal "127.0.0.1", user.last_sign_in_ip
+  end
+
+  test "increase sign in count" do
+    user = create_user
+    assert_equal 0, user.sign_in_count
+
+    sign_in_as_user
+    user.reload
+    assert_equal 1, user.sign_in_count
+
+    visit destroy_user_session_path
+    sign_in_as_user
+    user.reload
+    assert_equal 2, user.sign_in_count
+  end
+
+  test "does not update anything if user has signed out along the way" do
+    swap Devise, :confirm_within => 0 do
+      user = create_user(:confirm => false)
+      sign_in_as_user
+
+      user.reload
+      assert_nil user.current_sign_in_at
+      assert_nil user.last_sign_in_at
+    end
+  end
+end

data/test/mailers/confirmation_instructions_test.rb

@@ -0,0 +1,84 @@
+require 'test_helper'
+
+class ConfirmationInstructionsTest < ActionMailer::TestCase
+
+  def setup
+    setup_mailer
+    Devise.mailer_sender = 'test@example.com'
+  end
+
+  def user
+    @user ||= create_user
+  end
+
+  def mail
+    @mail ||= begin
+      user
+      ActionMailer::Base.deliveries.first
+    end
+  end
+
+  test 'email sent after creating the user' do
+    assert_not_nil mail
+  end
+
+  test 'content type should be set to html' do
+    assert mail.content_type.include?('text/html')
+  end
+
+  test 'send confirmation instructions to the user email' do
+    mail
+    assert_equal [user.email], mail.to
+  end
+
+  test 'setup sender from configuration' do
+    assert_equal ['test@example.com'], mail.from
+  end
+
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
+  test 'setup subject from I18n' do
+    store_translations :en, :devise => { :mailer => { :confirmation_instructions => { :subject => 'Account Confirmation' } } } do
+      assert_equal 'Account Confirmation', mail.subject
+    end
+  end
+
+  test 'subject namespaced by model' do
+    store_translations :en, :devise => { :mailer => { :confirmation_instructions => { :user_subject => 'User Account Confirmation' } } } do
+      assert_equal 'User Account Confirmation', mail.subject
+    end
+  end
+
+  test 'body should have user info' do
+    assert_match /#{user.email}/, mail.body.encoded
+  end
+
+  test 'body should have link to confirm the account' do
+    host = ActionMailer::Base.default_url_options[:host]
+    confirmation_url_regexp = %r{<a href=\"http://#{host}/users/confirmation\?confirmation_token=#{user.confirmation_token}">}
+    assert_match confirmation_url_regexp, mail.body.encoded
+  end
+
+  test 'renders a scoped if scoped_views is set to true' do
+    swap Devise, :scoped_views => true do
+      assert_equal user.email, mail.body.decoded
+    end
+  end
+
+  test 'renders a scoped if scoped_views is set in the mailer class' do
+    begin
+      Devise::Mailer.scoped_views = true
+      assert_equal user.email, mail.body.decoded
+    ensure
+      Devise::Mailer.send :remove_instance_variable, :@scoped_views
+    end
+  end
+
+  test 'mailer sender accepts a proc' do
+    swap Devise, :mailer_sender => proc { "another@example.com" } do
+      assert_equal ['another@example.com'], mail.from
+    end
+  end
+end

data/test/mailers/reset_password_instructions_test.rb

@@ -0,0 +1,72 @@
+require 'test_helper'
+
+class ResetPasswordInstructionsTest < ActionMailer::TestCase
+
+  def setup
+    setup_mailer
+    Devise.mailer_sender = 'test@example.com'
+  end
+
+  def user
+    @user ||= begin
+      user = create_user
+      user.send_reset_password_instructions
+      user
+    end
+  end
+
+  def mail
+    @mail ||= begin
+      user
+      ActionMailer::Base.deliveries.last
+    end
+  end
+
+  test 'email sent after reseting the user password' do
+    assert_not_nil mail
+  end
+
+  test 'content type should be set to html' do
+    assert mail.content_type.include?('text/html')
+  end
+
+  test 'send confirmation instructions to the user email' do
+    assert_equal [user.email], mail.to
+  end
+
+  test 'setup sender from configuration' do
+    assert_equal ['test@example.com'], mail.from
+  end
+
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
+  test 'setup subject from I18n' do
+    store_translations :en, :devise => { :mailer => { :reset_password_instructions => { :subject => 'Reset instructions' } } } do
+      assert_equal 'Reset instructions', mail.subject
+    end
+  end
+
+  test 'subject namespaced by model' do
+    store_translations :en, :devise => { :mailer => { :reset_password_instructions => { :user_subject => 'User Reset Instructions' } } } do
+      assert_equal 'User Reset Instructions', mail.subject
+    end
+  end
+
+  test 'body should have user info' do
+    assert_match(/#{user.email}/, mail.body.encoded)
+  end
+
+  test 'body should have link to confirm the account' do
+    host = ActionMailer::Base.default_url_options[:host]
+    reset_url_regexp = %r{<a href=\"http://#{host}/users/password/edit\?reset_password_token=#{user.reset_password_token}">}
+    assert_match reset_url_regexp, mail.body.encoded
+  end
+
+  test 'mailer sender accepts a proc' do
+    swap Devise, :mailer_sender => proc { "another@example.com" } do
+      assert_equal ['another@example.com'], mail.from
+    end
+  end
+end

data/test/mailers/unlock_instructions_test.rb

@@ -0,0 +1,66 @@
+require 'test_helper'
+
+class UnlockInstructionsTest < ActionMailer::TestCase
+
+  def setup
+    setup_mailer
+    Devise.mailer_sender = 'test@example.com'
+  end
+
+  def user
+    @user ||= begin
+      user = create_user
+      user.lock_access!
+      user
+    end
+  end
+
+  def mail
+    @mail ||= begin
+      user
+      ActionMailer::Base.deliveries.last
+    end
+  end
+
+  test 'email sent after locking the user' do
+    assert_not_nil mail
+  end
+
+  test 'content type should be set to html' do
+    assert mail.content_type.include?('text/html')
+  end
+
+  test 'send unlock instructions to the user email' do
+    assert_equal [user.email], mail.to
+  end
+
+  test 'setup sender from configuration' do
+    assert_equal ['test@example.com'], mail.from
+  end
+
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
+  test 'setup subject from I18n' do
+    store_translations :en, :devise => { :mailer => { :unlock_instructions =>  { :subject => 'Yo unlock instructions' } } } do
+      assert_equal 'Yo unlock instructions', mail.subject
+    end
+  end
+
+  test 'subject namespaced by model' do
+    store_translations :en, :devise => { :mailer => { :unlock_instructions => { :user_subject => 'User Unlock Instructions' } } } do
+      assert_equal 'User Unlock Instructions', mail.subject
+    end
+  end
+
+  test 'body should have user info' do
+    assert_match(/#{user.email}/, mail.body.encoded)
+  end
+
+  test 'body should have link to unlock the account' do
+    host = ActionMailer::Base.default_url_options[:host]
+    unlock_url_regexp = %r{<a href=\"http://#{host}/users/unlock\?unlock_token=#{user.unlock_token}">}
+    assert_match unlock_url_regexp, mail.body.encoded
+  end
+end