devise-security 0.12.0 → 0.16.0

data/test/dummy/app/models/mongoid/confirmable_fields.rb

@@ -0,0 +1,13 @@
+module ConfirmableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Confirmable
+    field :confirmation_token, type: String
+    field :confirmed_at, type: Time
+    field :confirmation_sent_at, type: Time
+    field :unconfirmed_email, type: String # Only if using reconfirmable
+  end
+end

data/test/dummy/app/models/mongoid/database_authenticable_fields.rb

@@ -0,0 +1,17 @@
+module DatabaseAuthenticatableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Database authenticatable
+    field :username, type: String
+    field :email, type: String, default: ""
+    #validates_presence_of :email
+
+    field :encrypted_password, type: String, default: ""
+    validates_presence_of :encrypted_password
+
+    include Mongoid::Timestamps
+  end
+end

data/test/dummy/app/models/mongoid/expirable_fields.rb

@@ -0,0 +1,11 @@
+module ExpirableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Expirable
+    field :expired_at, type: Time
+    field :last_activity_at, type: Time
+  end
+end

data/test/dummy/app/models/mongoid/lockable_fields.rb

@@ -0,0 +1,13 @@
+module LockableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+    field :unlock_token, type: String # Only if unlock strategy is :email or :both
+    field :locked_at, type: Time
+    include Mongoid::Timestamps
+    index({ unlock_token: 1 }, { unique: true })
+  end
+end

data/test/dummy/app/models/mongoid/mappings.rb

@@ -0,0 +1,13 @@
+Dir[File.expand_path("*_fields.rb", __dir__)].each { |f| require_relative f }
+
+module Mongoid
+  module Mappings
+    extend ::ActiveSupport::Concern
+
+    included do
+      self.devise_modules.each do |devise_module_name|
+        include "#{devise_module_name.to_s.classify}Fields".constantize
+      end
+    end
+  end
+end

data/test/dummy/app/models/mongoid/omniauthable_fields.rb

@@ -0,0 +1,11 @@
+module OmniauthableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Omniautable
+    field :username, type: String
+    field :facebook_token, type: String
+  end
+end

data/test/dummy/app/models/mongoid/paranoid_verification_fields.rb

@@ -0,0 +1,10 @@
+module ParanoidVerificationFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+    field :paranoid_verification_code, type: String
+    field :paranoid_verified_at, type: Time
+    field :paranoid_verification_attempt, type: Integer, default: 0
+  end
+end

data/test/dummy/app/models/mongoid/password_archivable_fields.rb

@@ -0,0 +1,9 @@
+module PasswordArchivableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## PasswordArchivableFields
+  end
+end

data/test/dummy/app/models/mongoid/password_expirable_fields.rb

@@ -0,0 +1,10 @@
+module PasswordExpirableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    field :expired_at, type: Time
+    field :last_activity_at, type: Time
+  end
+end

data/test/dummy/app/models/mongoid/recoverable_fields.rb

@@ -0,0 +1,11 @@
+module RecoverableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Recoverable
+    field :reset_password_token, type: String
+    field :reset_password_sent_at, type: Time
+  end
+end

data/test/dummy/app/models/mongoid/registerable_fields.rb

@@ -0,0 +1,19 @@
+module RegisterableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Database authenticatable
+    field :email, type: String, default: ""
+    validates_presence_of :email
+
+    field :encrypted_password, type: String, default: ""
+    validates_presence_of :encrypted_password
+
+    field :password_changed_at, type: Time
+    index({ password_changed_at: 1 }, {})
+    index({ email: 1 }, {})
+    include Mongoid::Timestamps
+  end
+end

data/test/dummy/app/models/mongoid/rememberable_fields.rb

@@ -0,0 +1,10 @@
+module RememberableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Rememberable
+    field :remember_created_at, type: Time
+  end
+end

data/test/dummy/app/models/mongoid/secure_validatable_fields.rb

@@ -0,0 +1,11 @@
+module SecureValidatableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    field :password_changed_at, type: Time
+    index({ password_changed_at: 1 }, {})
+    include Mongoid::Timestamps
+  end
+end

data/test/dummy/app/models/mongoid/security_questionable_fields.rb

@@ -0,0 +1,13 @@
+module SecurityQuestionableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Security Questionable
+    field :locked_at, type: Time
+    field :unlock_token, type: String
+    field :security_question_id, type: Integer
+    field :security_question_answer, type: String
+  end
+end

data/test/dummy/app/models/mongoid/session_limitable_fields.rb

@@ -0,0 +1,10 @@
+module SessionLimitableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Session Limitable
+    field :unique_session_id, type: String
+  end
+end

data/test/dummy/app/models/mongoid/timeoutable_fields.rb

@@ -0,0 +1,9 @@
+module TimeoutableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Timeoutable
+  end
+end

data/test/dummy/app/models/mongoid/trackable_fields.rb

@@ -0,0 +1,14 @@
+module TrackableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Trackable
+    field :sign_in_count, type: Integer, default: 0
+    field :current_sign_in_at, type: Time
+    field :last_sign_in_at, type: Time
+    field :current_sign_in_ip, type: String
+    field :last_sign_in_ip, type: String
+  end
+end

data/test/dummy/app/models/mongoid/validatable_fields.rb

@@ -0,0 +1,7 @@
+module ValidatableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+  end
+end

data/test/dummy/app/models/secure_user.rb

@@ -1,3 +1,9 @@
-class SecureUser < ActiveRecord::Base
+# frozen_string_literal: true
+
+class SecureUser < ApplicationUserRecord
   devise :database_authenticatable, :secure_validatable, email_validation: false
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+  end
 end

data/test/dummy/app/models/security_question_user.rb

@@ -1,5 +1,10 @@
-class SecurityQuestionUser < ActiveRecord::Base
-  self.table_name = 'users'
-  devise :database_authenticatable, :password_archivable, :lockable,
-         :paranoid_verification, :password_expirable, :security_questionable
+# frozen_string_literal: true
+
+class SecurityQuestionUser < ApplicationUserRecord
+  devise :database_authenticatable, :lockable, :security_questionable
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+    field :security_question_answer, type: String
+  end
 end

data/test/dummy/app/models/user.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class User < ApplicationRecord
 
   devise :database_authenticatable,
@@ -19,4 +21,17 @@ class User < ApplicationRecord
          :validatable
 
   has_many :widgets
+
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+    
+    def some_method_calling_mongoid
+      Mongoid.logger
+    end
+  elsif DEVISE_ORM == :active_record
+    def some_method_calling_active_record
+      ActiveRecord::Base.transaction {}
+    end
+  end
 end

data/test/dummy/app/models/widget.rb

@@ -1,4 +1,10 @@
+# frozen_string_literal: true
+
 class Widget < ApplicationRecord
   belongs_to :user
   validates_associated :user
+
+  if DEVISE_ORM == :mongoid
+    field :name, type: String
+  end
 end

data/test/dummy/app/mongoid/admin.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'shared_admin'
+
+class Admin
+  include Mongoid::Document
+  include Shim
+  include SharedAdmin
+
+  ## Database authenticatable
+  field :email,              type: String
+  field :encrypted_password, type: String
+
+  ## Recoverable
+  field :reset_password_token,   type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Confirmable
+  field :confirmation_token,   type: String
+  field :confirmed_at,         type: Time
+  field :confirmation_sent_at, type: Time
+  field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  field :locked_at, type: Time
+
+  field :active, type: Boolean, default: false
+end

data/test/dummy/app/mongoid/one_user.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'shared_user_with_password_verification'
+
+class OneUser
+  include Mongoid::Document
+  include Shim
+  include SharedUserWithPasswordVerification
+  include SharedSecurityQuestionsFields
+
+  field :password_changed_at, type: Time
+  index({ password_changed_at: 1 }, {})
+
+  #field :paranoid_verification_code, type: String
+  #field :paranoid_verified_at, type: Time
+  #field :paranoid_verification_attempt, type: Integer, default: 0
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email,              type: String, default: ""
+  field :encrypted_password, type: String, default: ""
+
+  ## Recoverable
+  field :reset_password_token,   type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count,      type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at,    type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip,    type: String
+
+  ## Confirmable
+  field :confirmation_token,   type: String
+  field :confirmed_at,         type: Time
+  field :confirmation_sent_at, type: Time
+  # field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token,    type: String # Only if unlock strategy is :email or :both
+  field :locked_at,       type: Time
+
+  cattr_accessor :validations_performed
+
+  after_validation :after_validation_callback
+
+  def after_validation_callback
+    # used to check in our test if the validations were called
+    @@validations_performed = true
+  end
+end

data/test/dummy/app/mongoid/shim.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Shim
+  extend ::ActiveSupport::Concern
+
+  included do
+    include ::Mongoid::Timestamps
+    field :created_at, type: DateTime
+  end
+
+  class_methods do
+    def order(attribute)
+      asc(attribute)
+    end
+
+    def find_by_email(email)
+      find_by(email: email)
+    end
+  end
+
+  # overwrite equality (because some devise tests use this for asserting model equality)
+  def ==(other)
+    other.is_a?(self.class) && _id == other._id
+  end
+end

data/test/dummy/app/mongoid/user_on_engine.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'shared_user_without_omniauth'
+
+class UserOnEngine
+  include Mongoid::Document
+  include Shim
+  include SharedUserWithoutOmniauth
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ""
+  field :encrypted_password, type: String, default: ""
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Confirmable
+  field :confirmation_token, type: String
+  field :confirmed_at, type: Time
+  field :confirmation_sent_at, type: Time
+  # field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+end

data/test/dummy/app/mongoid/user_on_main_app.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'shared_user_without_omniauth'
+
+class UserOnMainApp
+  include Mongoid::Document
+  include Shim
+  include SharedUserWithoutOmniauth
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ""
+  field :encrypted_password, type: String, default: ""
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Confirmable
+  field :confirmation_token, type: String
+  field :confirmed_at, type: Time
+  field :confirmation_sent_at, type: Time
+  # field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+end

data/test/dummy/app/mongoid/user_with_validations.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require "shared_user"
+
+class UserWithValidations
+  include Mongoid::Document
+  include Shim
+  include SharedUser
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ""
+  field :encrypted_password, type: String, default: ""
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+
+  validates :email, presence: true
+end

data/test/dummy/app/mongoid/user_without_email.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require "shared_user_without_email"
+
+class UserWithoutEmail
+  include Mongoid::Document
+  include Shim
+  include SharedUserWithoutEmail
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ""
+  field :encrypted_password, type: String, default: ""
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+end

data/test/dummy/config/application.rb

@@ -1,21 +1,27 @@
+# frozen_string_literal: true
+
 require File.expand_path('../boot', __FILE__)
 
+require 'action_mailer/railtie'
+require "action_mailer/railtie"
+require "rails/test_unit/railtie"
+DEVISE_ORM = ENV.fetch('DEVISE_ORM', 'active_record').to_sym
+
+Bundler.require :default, DEVISE_ORM
+require "#{DEVISE_ORM}/railtie"
+
 require 'rails/all'
 require 'devise-security'
 
-if defined?(Bundler)
-  # If you precompile assets before deploying to production, use this line
-  Bundler.require(*Rails.groups(assets: %w[development test]))
-  # If you want your assets lazily compiled in production, use this line
-  # Bundler.require(:default, :assets, Rails.env)
-end
-
 module RailsApp
   class Application < Rails::Application
     config.encoding = 'utf-8'
 
     config.filter_parameters += [:password]
 
+    config.autoload_paths += ["#{config.root}/app/#{DEVISE_ORM}"]
+    config.autoload_paths += ["#{config.root}/lib"]
+
     config.assets.enabled = true
 
     config.assets.version = '1.0'

data/test/dummy/config/boot.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rubygems'
 
 # Set up gems listed in the Gemfile.

data/test/dummy/config/environment.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Load the rails application
 require File.expand_path('../application', __FILE__)
 

data/test/dummy/config/environments/test.rb

@@ -1,14 +1,11 @@
+# frozen_string_literal: true
+
 RailsApp::Application.configure do
   config.cache_classes = true
   config.eager_load = false
 
-  if Rails.version > '5'
-    config.public_file_server.enabled = true
-    config.public_file_server.headers = { 'Cache-Control' => 'public, max-age=3600' }
-  else
-    config.serve_static_files = true
-    config.static_cache_control = 'public, max-age=3600'
-  end
+  config.public_file_server.enabled = true
+  config.public_file_server.headers = { 'Cache-Control' => 'public, max-age=3600' }
 
   config.consider_all_requests_local       = true
   config.action_controller.perform_caching = false
@@ -25,11 +22,6 @@ RailsApp::Application.configure do
 
   config.active_support.test_order = :sorted
   config.log_level = :debug
-  if Rails.gem_version >= Gem::Version.new('4.2') && Rails.gem_version < Gem::Version.new('5.0')
-    config.active_record.raise_in_transactional_callbacks = true
-  end
-  if Rails.gem_version.release >= Gem::Version.new('5.2')
-    config.active_record.sqlite3.represent_boolean_as_integer = true
-  end
+  config.active_record.sqlite3.represent_boolean_as_integer = true if Rails.gem_version.release >= Gem::Version.new('5.2') && Rails.gem_version.release < Gem::Version.new('6.0')
 end
 ActiveSupport::Deprecation.debug = true