devise-security 0.12.0 → 0.16.0

data/test/dummy/config/initializers/devise.rb

@@ -1,10 +1,17 @@
+# frozen_string_literal: true
+
 require 'rails_email_validator'
+require "devise/orm/#{DEVISE_ORM}"
+
 Devise.setup do |config|
   config.mailer_sender = 'please-change-me-at-config-initializers-devise@example.com'
-
-  require 'devise/orm/active_record'
   config.secret_key = 'f08cf11a38906f531d2dfc9a2c2d671aa0021be806c21255d4'
   config.case_insensitive_keys = [:email]
-
   config.strip_whitespace_keys = [:email]
+  config.password_complexity = {
+    digit: 1,
+    lower: 1,
+    upper: 1,
+  }
+  config.password_length = 7..128
 end

data/test/dummy/config/initializers/migration_class.rb

@@ -1,6 +1,3 @@
-MIGRATION_CLASS =
-  if ActiveRecord::VERSION::MAJOR >= 5
-    ActiveRecord::Migration[4.2]
-  else
-    ActiveRecord::Migration
-  end
+# frozen_string_literal: true
+
+MIGRATION_CLASS = ActiveRecord::Migration[Rails.version.to_f] if DEVISE_ORM == :active_record

data/test/dummy/config/mongoid.yml

@@ -0,0 +1,6 @@
+test:
+  clients:
+    default:
+      database: devise_security_test
+      hosts:
+        - localhost: <%= ENV.fetch('MONGODB_PORT', '27017') %>

data/test/dummy/config/routes.rb

@@ -1,10 +1,13 @@
+# frozen_string_literal: true
+
 RailsApp::Application.routes.draw do
   devise_for :users
 
-  devise_for :captcha_users, only: [:sessions], controllers: { sessions: "captcha/sessions" }
-  devise_for :security_question_users, only: [:sessions, :unlocks], controllers: { unlocks: "security_question/unlocks" }
+  devise_for :captcha_users, only: [:sessions], controllers: { sessions: 'captcha/sessions' }
+  devise_for :security_question_users, only: [:sessions, :unlocks], controllers: { unlocks: 'security_question/unlocks' }
 
   resources :foos
+  resource :widgets
 
-  root to: 'foos#index'
+  root to: 'widgets#show'
 end

data/test/dummy/config.ru

@@ -1,4 +1,6 @@
+# frozen_string_literal: true
+
 # This file is used by Rack-based servers to start the application.
 
-require ::File.expand_path('../config/environment',  __FILE__)
+require ::File.expand_path('../config/environment', __FILE__)
 run RailsApp::Application

data/test/dummy/db/migrate/20120508165529_create_tables.rb

@@ -1,15 +1,26 @@
+# frozen_string_literal: true
+
 class CreateTables < MIGRATION_CLASS
   def self.up
     create_table :users do |t|
       t.string :username
       t.string :facebook_token
-      t.string :unique_session_id, :limit => 20
+
+      # session_limitable
+      t.string :unique_session_id
 
       ## Database authenticatable
       t.string :email,              null: false, default: ''
       t.string :encrypted_password, null: false, default: ''
 
       t.datetime :password_changed_at
+
+      t.datetime :current_sign_in_at
+      t.datetime :last_sign_in_at
+      t.string :current_sign_in_ip
+      t.string :last_sign_in_ip
+      t.integer :sign_in_count, default: 0
+      t.integer :failed_attempts, default: 0
       t.timestamps null: false
     end
     add_index :users, :password_changed_at
@@ -28,7 +39,7 @@ class CreateTables < MIGRATION_CLASS
       t.integer :password_archivable_id, :null => false
       t.datetime :created_at
     end
-    add_index :old_passwords, [:password_archivable_type, :password_archivable_id], :name => :index_password_archivable
+    add_index :old_passwords, [:password_archivable_type, :password_archivable_id], name: 'index_password_archivable'
   end
 
   def self.down

data/test/dummy/db/migrate/20150402165590_add_verification_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddVerificationColumns < MIGRATION_CLASS
   def self.up
     add_column :users, :paranoid_verification_code, :string

data/test/dummy/db/migrate/20150407162345_add_verification_attempt_column.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddVerificationAttemptColumn < MIGRATION_CLASS
   def self.up
     add_column :users, :paranoid_verification_attempt, :integer, default: 0

data/test/dummy/db/migrate/20160320162345_add_security_questions_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddSecurityQuestionsFields < MIGRATION_CLASS
   def change
     add_column :users, :locked_at, :datetime

data/test/dummy/db/migrate/20180318103603_add_expireable_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddExpireableColumns < MIGRATION_CLASS
   def change
     add_column :users, :expired_at, :datetime

data/test/dummy/db/migrate/20180318105329_add_confirmable_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddConfirmableColumns < MIGRATION_CLASS
   def change
     add_column :users, :confirmation_token, :string

data/test/dummy/db/migrate/20180318105732_add_rememberable_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddRememberableColumns < MIGRATION_CLASS
   def change
     add_column :users, :remember_created_at, :datetime

data/test/dummy/db/migrate/20180318111336_add_recoverable_columns.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddRecoverableColumns < MIGRATION_CLASS
   def change
     add_column :users, :reset_password_token, :string

data/test/dummy/db/migrate/20180319114023_add_widget.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 class AddWidget < MIGRATION_CLASS
   def change
     create_table :widgets do |t|

data/test/dummy/lib/shared_expirable_columns.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+require 'shared_user'
+
+module SharedVerificationColumns
+  extend ActiveSupport::Concern
+
+  included do
+    include SharedUser
+    devise :expirable
+
+    field :expired_at, type: Time
+    field :last_activity_at, type: Time
+  end
+end

data/test/dummy/lib/shared_security_questions_fields.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+require 'shared_user'
+
+module SharedSecurityQuestionsFields
+  extend ActiveSupport::Concern
+
+  included do
+    include SharedUser
+    devise :lockable, :security_questionable
+
+    field :locked_at, type: Time
+    field :unlock_token, type: String
+    field :security_question_id, type: Integer
+    field :security_question_answer, type: String
+  end
+end

data/test/dummy/lib/shared_user.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module SharedUser
+  extend ActiveSupport::Concern
+
+  included do
+    devise :database_authenticatable, :confirmable, :lockable, :recoverable,
+           :registerable, :rememberable, :timeoutable,
+           :trackable, :secure_validatable, :omniauthable, :validatable, password_length: 7..72,
+           reconfirmable: false
+
+    attr_accessor :other_key
+
+    # They need to be included after Devise is called.
+    extend ExtendMethods
+  end
+
+  def raw_confirmation_token
+    @raw_confirmation_token
+  end
+
+  module ExtendMethods
+    def new_with_session(params, session)
+      super.tap do |user|
+        if data = session["devise.facebook_data"]
+          user.email = data["email"]
+          user.confirmed_at = Time.zone.now
+        end
+      end
+    end
+  end
+end

data/test/dummy/lib/shared_user_with_password_verification.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module SharedUserWithPasswordVerification
+  extend ActiveSupport::Concern
+
+  included do
+    include SharedVerificationFields
+  end
+
+  def raw_confirmation_token
+    @raw_confirmation_token
+  end
+end

data/test/dummy/lib/shared_user_without_email.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module SharedUserWithoutEmail
+  extend ActiveSupport::Concern
+
+  included do
+    # NOTE: This is missing :validatable and :confirmable, as they both require
+    # an email field at the moment. It is also missing :omniauthable because that
+    # adds unnecessary complexity to the setup
+    devise :database_authenticatable, :lockable, :recoverable,
+           :registerable, :rememberable, :timeoutable,
+           :trackable
+  end
+
+  # This test stub is a bit rubbish because it's tied very closely to the
+  # implementation where we care about this one case. However, completely
+  # removing the email field breaks "recoverable" tests completely, so we are
+  # just taking the approach here that "email" is something that is a not an
+  # ActiveRecord field.
+  def email_changed?
+    raise NoMethodError
+  end
+
+  def respond_to?(method_name, include_all=false)
+    return false if method_name.to_sym == :email_changed?
+    super(method_name, include_all)
+  end
+end

data/test/dummy/lib/shared_user_without_omniauth.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module SharedUserWithoutOmniauth
+  extend ActiveSupport::Concern
+
+  included do
+    devise :database_authenticatable, :confirmable, :lockable, :recoverable,
+      :registerable, :rememberable, :timeoutable,
+      :trackable, :validatable, reconfirmable: false
+  end
+
+  def raw_confirmation_token
+    @raw_confirmation_token
+  end
+end

data/test/dummy/lib/shared_verification_fields.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+require 'shared_user'
+
+module SharedVerificationFields
+  extend ActiveSupport::Concern
+
+  included do
+    include SharedUser
+    devise :paranoid_verification
+
+    field :paranoid_verified_at, type: Time
+    field :paranoid_verification_attempt, type: Integer, default: 0
+    field :paranoid_verification_code, type: String
+  end
+end