devise-security 0.11.1 → 0.12.0

data/lib/devise-security/patches/confirmations_controller_security_question.rb

@@ -10,13 +10,13 @@ module DeviseSecurity::Patches
           self.resource = resource_class.send_confirmation_instructions(params[resource_name])
 
           if successfully_sent?(resource)
-            respond_with({}, :location => after_resending_confirmation_instructions_path_for(resource_name))
+            respond_with({}, location: after_resending_confirmation_instructions_path_for(resource_name))
           else
             respond_with(resource)
           end
         else
           flash[:alert] = t('devise.invalid_security_question') if is_navigational_format?
-          respond_with({}, :location => new_confirmation_path(resource_name))
+          respond_with({}, location: new_confirmation_path(resource_name))
         end
       end
     end

data/lib/devise-security/patches/passwords_controller_captcha.rb

@@ -6,13 +6,13 @@ module DeviseSecurity::Patches
         if valid_captcha_if_defined?(params[:captcha])
           self.resource = resource_class.send_reset_password_instructions(params[resource_name])
           if successfully_sent?(resource)
-            respond_with({}, :location => new_session_path(resource_name))
+            respond_with({}, location: new_session_path(resource_name))
           else
             respond_with(resource)
           end
         else
           flash[:alert] = t('devise.invalid_captcha') if is_navigational_format?
-          respond_with({}, :location => new_password_path(resource_name))
+          respond_with({}, location: new_password_path(resource_name))
         end
       end
     end

data/lib/devise-security/patches/passwords_controller_security_question.rb

@@ -9,13 +9,13 @@ module DeviseSecurity::Patches
         if valid_captcha_or_security_question?(resource, params)
           self.resource = resource_class.send_reset_password_instructions(params[resource_name])
           if successfully_sent?(resource)
-            respond_with({}, :location => new_session_path(resource_name))
+            respond_with({}, location: new_session_path(resource_name))
           else
             respond_with(resource)
           end
         else
           flash[:alert] = t('devise.invalid_security_question') if is_navigational_format?
-          respond_with({}, :location => new_password_path(resource_name))
+          respond_with({}, location: new_password_path(resource_name))
         end
       end
     end

data/lib/devise-security/patches/registrations_controller_captcha.rb

@@ -11,11 +11,11 @@ module DeviseSecurity::Patches
             if resource.active_for_authentication?
               set_flash_message :notice, :signed_up if is_flashing_format?
               sign_up(resource_name, resource)
-              respond_with resource, :location => after_sign_up_path_for(resource)
+              respond_with resource, location: after_sign_up_path_for(resource)
             else
               set_flash_message :notice, :"signed_up_but_#{resource.inactive_message}" if is_flashing_format?
               expire_data_after_sign_in!
-              respond_with resource, :location => after_inactive_sign_up_path_for(resource)
+              respond_with resource, location: after_inactive_sign_up_path_for(resource)
             end
           else
             clean_up_passwords resource

data/lib/devise-security/patches/sessions_controller_captcha.rb

@@ -8,16 +8,16 @@ module DeviseSecurity::Patches
           set_flash_message(:notice, :signed_in) if is_flashing_format?
           sign_in(resource_name, resource)
           block.call(resource) if block
-          respond_with resource, :location => after_sign_in_path_for(resource)
+          respond_with resource, location: after_sign_in_path_for(resource)
         else
           flash[:alert] = t('devise.invalid_captcha') if is_flashing_format?
-          respond_with({}, :location => new_session_path(resource_name))
+          respond_with({}, location: new_session_path(resource_name))
         end
       end
 
       # for bad protected use in controller
       define_method :auth_options do
-        { :scope => resource_name, :recall => "#{controller_path}#new" }
+        { scope: resource_name, recall: "#{controller_path}#new" }
       end
     end
   end

data/lib/devise-security/patches/unlocks_controller_captcha.rb

@@ -6,13 +6,13 @@ module DeviseSecurity::Patches
         if valid_captcha_if_defined?(params[:captcha])
           self.resource = resource_class.send_unlock_instructions(params[resource_name])
           if successfully_sent?(resource)
-            respond_with({}, :location => new_session_path(resource_name))
+            respond_with({}, location: new_session_path(resource_name))
           else
             respond_with(resource)
           end
         else
           flash[:alert] = t('devise.invalid_captcha') if is_navigational_format?
-          respond_with({}, :location => new_unlock_path(resource_name))
+          respond_with({}, location: new_unlock_path(resource_name))
         end
       end
     end

data/lib/devise-security/patches/unlocks_controller_security_question.rb

@@ -9,13 +9,13 @@ module DeviseSecurity::Patches
         if valid_captcha_or_security_question?(resource, params)
           self.resource = resource_class.send_unlock_instructions(params[resource_name])
           if successfully_sent?(resource)
-            respond_with({}, :location => new_session_path(resource_name))
+            respond_with({}, location: new_session_path(resource_name))
           else
             respond_with(resource)
           end
         else
           flash[:alert] = t('devise.invalid_security_question') if is_navigational_format?
-          respond_with({}, :location => new_unlock_path(resource_name))
+          respond_with({}, location: new_unlock_path(resource_name))
         end
       end
     end

data/lib/devise-security/rails.rb

@@ -3,8 +3,8 @@ module DeviseSecurity
     ActiveSupport.on_load(:action_controller) do
       include DeviseSecurity::Controllers::Helpers
     end
-    
-    if Rails.version > "5"
+
+    if Rails.version > '5'
       ActiveSupport::Reloader.to_prepare do
         DeviseSecurity::Patches.apply
       end

data/lib/devise-security/routes.rb

@@ -5,13 +5,12 @@ module ActionDispatch::Routing
 
     # route for handle expired passwords
     def devise_password_expired(mapping, controllers)
-      resource :password_expired, :only => [:show, :update], :path => mapping.path_names[:password_expired], :controller => controllers[:password_expired]
+      resource :password_expired, only: [:show, :update], path: mapping.path_names[:password_expired], controller: controllers[:password_expired]
     end
 
     # route for handle paranoid verification
     def devise_verification_code(mapping, controllers)
-      resource :paranoid_verification_code, :only => [:show, :update], :path => mapping.path_names[:verification_code], :controller => controllers[:paranoid_verification_code]
+      resource :paranoid_verification_code, only: [:show, :update], path: mapping.path_names[:verification_code], controller: controllers[:paranoid_verification_code]
     end
   end
 end
-

data/lib/devise-security/schema.rb

@@ -27,13 +27,13 @@ module DeviseSecurity
     # create_table :old_passwords do
     #   t.password_archivable
     # end
-    # add_index :old_passwords, [:password_archivable_type, :password_archivable_id], :name => :index_password_archivable
+    # add_index :old_passwords, [:password_archivable_type, :password_archivable_id], name: :index_password_archivable
     #
     def password_archivable
-      apply_devise_schema :encrypted_password, String, :limit => 128, :null => false
+      apply_devise_schema :encrypted_password, String, limit: 128, null: false
       apply_devise_schema :password_salt, String
-      apply_devise_schema :password_archivable_id, Integer, :null => false
-      apply_devise_schema :password_archivable_type, String, :null => false
+      apply_devise_schema :password_archivable_id, Integer, null: false
+      apply_devise_schema :password_archivable_type, String, null: false
       apply_devise_schema :created_at, DateTime
     end
 
@@ -49,11 +49,16 @@ module DeviseSecurity
     #
     # # or if the resource's table already exists, define a migration and put this in:
     # change_table :the_resources do |t|
-    #   t.string :unique_session_id, :limit => 20
+    #   t.string :unique_session_id, limit: 20
     # end
     #
     def session_limitable
-      apply_devise_schema :unique_session_id, String, :limit => 20
+      apply_devise_schema :unique_session_id, String, limit: 20
+    end
+
+    def expirable
+      apply_devise_schema :expired_at, DateTime
+      apply_devise_schema :last_activity_at, DateTime
     end
   end
 end

data/lib/devise-security/version.rb

@@ -1,3 +1,3 @@
 module DeviseSecurity
-  VERSION = "0.11.1".freeze
+  VERSION = '0.12.0'.freeze
 end

data/test/dummy/app/models/application_record.rb

@@ -0,0 +1,3 @@
+class ApplicationRecord < ActiveRecord::Base
+  self.abstract_class = true
+end

data/test/dummy/app/models/captcha_user.rb

@@ -1,5 +1,5 @@
 class CaptchaUser < ActiveRecord::Base
-  self.table_name = "users"
+  self.table_name = 'users'
   devise :database_authenticatable, :password_archivable,
          :paranoid_verification, :password_expirable
 end

data/test/dummy/app/models/security_question_user.rb

@@ -1,6 +1,5 @@
 class SecurityQuestionUser < ActiveRecord::Base
-  self.table_name = "users"
+  self.table_name = 'users'
   devise :database_authenticatable, :password_archivable, :lockable,
-         :paranoid_verification, :password_expirable,
-         :security_questionable 
+         :paranoid_verification, :password_expirable, :security_questionable
 end

data/test/dummy/app/models/user.rb

@@ -1,5 +1,22 @@
-class User < ActiveRecord::Base
-  devise :database_authenticatable, :password_archivable, :lockable,
-         :paranoid_verification, :password_expirable,
-         :security_questionable
+class User < ApplicationRecord
+
+  devise :database_authenticatable,
+         :confirmable,
+         :expirable,
+         :lockable,
+         :omniauthable,
+         :paranoid_verification,
+         :password_archivable,
+         :password_expirable,
+         :recoverable,
+         :registerable,
+         :rememberable,
+         :secure_validatable,
+         :security_questionable,
+         :session_limitable,
+         :timeoutable,
+         :trackable,
+         :validatable
+
+  has_many :widgets
 end

data/test/dummy/app/models/widget.rb

@@ -0,0 +1,4 @@
+class Widget < ApplicationRecord
+  belongs_to :user
+  validates_associated :user
+end

data/test/dummy/config/environments/test.rb

@@ -2,7 +2,7 @@ RailsApp::Application.configure do
   config.cache_classes = true
   config.eager_load = false
 
-  if Rails.version > "5"
+  if Rails.version > '5'
     config.public_file_server.enabled = true
     config.public_file_server.headers = { 'Cache-Control' => 'public, max-age=3600' }
   else
@@ -15,7 +15,7 @@ RailsApp::Application.configure do
 
   config.action_dispatch.show_exceptions = false
 
-  config.action_controller.allow_forgery_protection    = false
+  config.action_controller.allow_forgery_protection = false
 
   config.action_mailer.delivery_method = :test
   config.action_mailer.default_url_options = { host: 'test.host' }
@@ -24,4 +24,12 @@ RailsApp::Application.configure do
   I18n.enforce_available_locales = false
 
   config.active_support.test_order = :sorted
+  config.log_level = :debug
+  if Rails.gem_version >= Gem::Version.new('4.2') && Rails.gem_version < Gem::Version.new('5.0')
+    config.active_record.raise_in_transactional_callbacks = true
+  end
+  if Rails.gem_version.release >= Gem::Version.new('5.2')
+    config.active_record.sqlite3.represent_boolean_as_integer = true
+  end
 end
+ActiveSupport::Deprecation.debug = true

data/test/dummy/config/initializers/devise.rb

@@ -1,3 +1,4 @@
+require 'rails_email_validator'
 Devise.setup do |config|
   config.mailer_sender = 'please-change-me-at-config-initializers-devise@example.com'
 

data/test/dummy/config/secrets.yml

@@ -1,3 +1,2 @@
 test:
-  secret_token: 'fooooooooooo'
-  secret_key_base: 'fuuuuuuuuuuu'
+  secret_key_base: 'fuuuuuuuuuuu'

data/test/dummy/db/migrate/20120508165529_create_tables.rb

@@ -3,6 +3,7 @@ class CreateTables < MIGRATION_CLASS
     create_table :users do |t|
       t.string :username
       t.string :facebook_token
+      t.string :unique_session_id, :limit => 20
 
       ## Database authenticatable
       t.string :email,              null: false, default: ''
@@ -11,6 +12,8 @@ class CreateTables < MIGRATION_CLASS
       t.datetime :password_changed_at
       t.timestamps null: false
     end
+    add_index :users, :password_changed_at
+    add_index :users, :email
 
     create_table :secure_users do |t|
       t.string :email
@@ -19,10 +22,13 @@ class CreateTables < MIGRATION_CLASS
     end
 
     create_table :old_passwords do |t|
-      t.string :encrypted_password
-
-      t.references :password_archivable, polymorphic: true
+      t.string :encrypted_password, :null => false
+      t.string :password_salt
+      t.string :password_archivable_type, :null => false
+      t.integer :password_archivable_id, :null => false
+      t.datetime :created_at
     end
+    add_index :old_passwords, [:password_archivable_type, :password_archivable_id], :name => :index_password_archivable
   end
 
   def self.down

data/test/dummy/db/migrate/20180318103603_add_expireable_columns.rb

@@ -0,0 +1,6 @@
+class AddExpireableColumns < MIGRATION_CLASS
+  def change
+    add_column :users, :expired_at, :datetime
+    add_column :users, :last_activity_at, :datetime
+  end
+end

data/test/dummy/db/migrate/20180318105329_add_confirmable_columns.rb

@@ -0,0 +1,8 @@
+class AddConfirmableColumns < MIGRATION_CLASS
+  def change
+    add_column :users, :confirmation_token, :string
+    add_column :users, :confirmed_at, :datetime
+    add_column :users, :confirmation_sent_at, :datetime
+    add_column :users, :unconfirmed_email, :string
+  end
+end

data/test/dummy/db/migrate/20180318105732_add_rememberable_columns.rb

@@ -0,0 +1,5 @@
+class AddRememberableColumns < MIGRATION_CLASS
+  def change
+    add_column :users, :remember_created_at, :datetime
+  end
+end

data/test/dummy/db/migrate/20180318111336_add_recoverable_columns.rb

@@ -0,0 +1,6 @@
+class AddRecoverableColumns < MIGRATION_CLASS
+  def change
+    add_column :users, :reset_password_token, :string
+    add_column :users, :reset_password_sent_at, :datetime
+  end
+end

data/test/dummy/db/migrate/20180319114023_add_widget.rb

@@ -0,0 +1,8 @@
+class AddWidget < MIGRATION_CLASS
+  def change
+    create_table :widgets do |t|
+      t.string :name
+      t.belongs_to :user
+    end
+  end
+end

data/test/test_captcha_controller.rb

@@ -5,18 +5,18 @@ class TestWithCaptcha < ActionController::TestCase
   tests Captcha::SessionsController
 
   setup do
-    @request.env["devise.mapping"] = Devise.mappings[:captcha_user]
+    @request.env['devise.mapping'] = Devise.mappings[:captcha_user]
   end
 
   test 'When captcha is enabled, it is inserted correctly' do
     post :create, params: {
       captcha_user: {
-        email: "wrong@email.com",
-        password: "wrongpassword"
+        email: 'wrong@email.com',
+        password: 'wrongpassword'
       }
     }
 
-    assert_equal "The captcha input was invalid.", flash[:alert]
+    assert_equal 'The captcha input was invalid.', flash[:alert]
     assert_redirected_to new_captcha_user_session_path
   end
 
@@ -26,14 +26,14 @@ class TestWithCaptcha < ActionController::TestCase
     end
 
     post :create, params: {
-      captcha: "ABCDE",
+      captcha: 'ABCDE',
       captcha_user: {
-        email: "wrong@email.com",
-        password: "wrongpassword"
+        email: 'wrong@email.com',
+        password: 'wrongpassword'
       }
     }
 
-    assert_equal "Invalid Email or password.", flash[:alert]
+    assert_equal 'Invalid Email or password.', flash[:alert]
   end
 end
 
@@ -42,17 +42,17 @@ class TestWithoutCaptcha < ActionController::TestCase
   tests Devise::SessionsController
 
   setup do
-    @request.env["devise.mapping"] = Devise.mappings[:user]
+    @request.env['devise.mapping'] = Devise.mappings[:user]
   end
 
   test 'When captcha is not enabled, it is not inserted' do
-    post :create, params: { 
+    post :create, params: {
       user: {
-        email: "wrong@email.com",
-        password: "wrongpassword"
+        email: 'wrong@email.com',
+        password: 'wrongpassword'
       }
     }
 
-    assert_equal "Invalid Email or password.", flash[:alert]
+    assert_equal 'Invalid Email or password.', flash[:alert]
   end
 end

data/test/test_helper.rb

@@ -1,5 +1,6 @@
 ENV['RAILS_ENV'] ||= 'test'
 
+require 'simplecov'
 require 'coveralls'
 Coveralls.wear!
 
@@ -11,3 +12,9 @@ require 'devise-security'
 ActiveRecord::Migration.verbose = false
 ActiveRecord::Base.logger = Logger.new(nil)
 ActiveRecord::Migrator.migrate(File.expand_path('../dummy/db/migrate', __FILE__))
+
+SimpleCov.formatter = Coveralls::SimpleCov::Formatter
+SimpleCov.start do
+  add_filter 'test/dummy'
+  add_filter 'gemfiles'
+end