devise-security 0.12.0 → 0.18.0

data/test/test_secure_validatable.rb

@@ -1,85 +1,319 @@
+# frozen_string_literal: true
+
 require 'test_helper'
-require 'rails_email_validator'
 
 class TestSecureValidatable < ActiveSupport::TestCase
-  class User < ActiveRecord::Base
-    devise :database_authenticatable, :password_archivable,
-           :paranoid_verification, :password_expirable, :secure_validatable
+  class User < ApplicationRecord
+    devise :database_authenticatable, :secure_validatable
+    include ::Mongoid::Mappings if DEVISE_ORM == :mongoid
   end
 
-  setup do
-    Devise.password_regex = /(?=.*\d)(?=.*[a-z])(?=.*[A-Z])/
-  end
+  class EmailNotRequiredUser < User
+    protected
 
-  test 'email cannot be blank' do
-    msg = "Email can't be blank"
-    user = User.create password: 'passWord1', password_confirmation: 'passWord1'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ActiveRecord::RecordInvalid) do
-      user.save!
+    def email_required?
+      false
     end
   end
 
+  test 'email cannot be blank upon creation' do
+    user = User.new(
+      password: 'Password1!', password_confirmation: 'Password1!'
+    )
+
+    assert user.invalid?
+    assert_equal(["Email can't be blank"], user.errors.full_messages)
+  end
+
+  test 'email can be blank upon creation if email not required' do
+    user = EmailNotRequiredUser.new(
+      password: 'Password1!', password_confirmation: 'Password1!'
+    )
+
+    assert user.valid?
+  end
+
+  test 'email cannot be updated to be blank' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    )
+
+    assert user.valid?
+
+    user.email = nil
+
+    assert user.invalid?
+    assert_equal(["Email can't be blank"], user.errors.full_messages)
+  end
+
+  test 'email can be updated to be blank if email not required' do
+    user = EmailNotRequiredUser.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    )
+
+    assert user.valid?
+
+    user.email = nil
+
+    assert user.valid?
+  end
+
   test 'email must be valid' do
-    msg = 'Email is invalid'
-    user = User.create email: 'bob', password: 'passWord1', password_confirmation: 'passWord1'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ActiveRecord::RecordInvalid) do
-      user.save!
-    end
+    user = User.new(
+      email: 'bob', password: 'Password1!', password_confirmation: 'Password1!'
+    )
+
+    assert user.invalid?
+    assert_equal(['Email is invalid'], user.errors.full_messages)
+  end
+
+  test 'validate both email and password' do
+    user = User.new(
+      email: 'bob',
+      password: 'password1!',
+      password_confirmation: 'password1!'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      [
+        'Email is invalid',
+        'Password must contain at least one upper-case letter'
+      ],
+      user.errors.full_messages
+    )
   end
 
-  test 'valid both email and password' do
-    msgs = ['Email is invalid', 'Password must contain big, small letters and digits']
-    user = User.create email: 'bob@foo.tv', password: 'password1', password_confirmation: 'password1'
-    assert_equal(false, user.valid?)
+  test 'password cannot be blank upon creation' do
+    user = User.new(email: 'bob@microsoft.com')
+
+    msgs = ["Password can't be blank"]
+
+    msgs << "Encrypted password can't be blank" if DEVISE_ORM == :mongoid
+
+    assert user.invalid?
     assert_equal(msgs, user.errors.full_messages)
-    assert_raises(ActiveRecord::RecordInvalid) { user.save! }
+  end
+
+  test 'password cannot be updated to be blank' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    )
+
+    assert user.valid?
+
+    user.password = nil
+    user.password_confirmation = nil
+
+    assert user.invalid?
+    assert_equal(["Password can't be blank"], user.errors.full_messages)
+  end
+
+  test 'password_confirmation must match password' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'not the same password'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ["Password confirmation doesn't match Password"],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password_confirmation cannot be blank' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: ''
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ["Password confirmation doesn't match Password"],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password_confirmation can be skipped' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: nil
+    )
+
+    assert user.valid?
   end
 
   test 'password must have capital letter' do
-    msgs = ['Email is invalid', 'Password must contain big, small letters and digits']
-    user = User.create email: 'bob@example.org', password: 'password1', password_confirmation: 'password1'
-    assert_equal(false, user.valid?)
-    assert_equal(msgs, user.errors.full_messages)
-    assert_raises(ActiveRecord::RecordInvalid) { user.save! }
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'password1',
+      password_confirmation: 'password1'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least one upper-case letter'],
+      user.errors.full_messages
+    )
   end
 
   test 'password must have lowercase letter' do
-    msg = 'Password must contain big, small letters and digits'
-    user = User.create email: 'bob@microsoft.com', password: 'PASSWORD1', password_confirmation: 'PASSWORD1'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ActiveRecord::RecordInvalid) { user.save! }
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'PASSWORD1',
+      password_confirmation: 'PASSWORD1'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least one lower-case letter'],
+      user.errors.full_messages
+    )
   end
 
   test 'password must have number' do
-    msg = 'Password must contain big, small letters and digits'
-    user = User.create email: 'bob@microsoft.com', password: 'PASSword', password_confirmation: 'PASSword'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ActiveRecord::RecordInvalid) { user.save! }
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'PASSword',
+      password_confirmation: 'PASSword'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least one digit'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password must meet minimum length' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Pa3zZ',
+      password_confirmation: 'Pa3zZ'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password is too short (minimum is 7 characters)'],
+      user.errors.full_messages
+    )
   end
 
-  test 'password must have minimum length' do
-    msg = 'Password is too short (minimum is 6 characters)'
-    user = User.create email: 'bob@microsoft.com', password: 'Pa3zZ', password_confirmation: 'Pa3zZ'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ActiveRecord::RecordInvalid) { user.save! }
+  test "new user can't use existing user's email" do
+    options = {
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    }
+    User.create!(options)
+    user = User.new(options)
+
+    assert user.invalid?
+    assert_equal(['Email has already been taken'], user.errors.full_messages)
   end
 
-  test 'duplicate email validation message is added only once' do
+  test "new user can't use existing user's email with different casing" do
     options = {
-      email: 'test@example.org',
-      password: 'Test12345',
-      password_confirmation: 'Test12345',
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
     }
-    SecureUser.create!(options)
-    user = SecureUser.new(options)
-    refute user.valid?
-    assert_equal ['Email has already been taken'], user.errors.full_messages
+    User.create!(options)
+    options[:email] = 'BOB@MICROSOFT.COM'
+    user = User.new(options)
+
+    assert user.invalid?
+    assert_equal(['Email has already been taken'], user.errors.full_messages)
+  end
+
+  test 'password cannot equal email for new user' do
+    user = User.new(
+      email: 'Bob1@microsoft.com',
+      password: 'Bob1@microsoft.com',
+      password_confirmation: 'Bob1@microsoft.com'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the email.'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password cannot equal case sensitive version of email for new user' do
+    user = User.new(
+      email: 'bob1@microsoft.com',
+      password: 'BoB1@microsoft.com',
+      password_confirmation: 'BoB1@microsoft.com'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the email.'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password cannot equal email with spaces for new user' do
+    user = User.new(
+      email: 'Bob1@microsoft.com',
+      password: 'Bob1@microsoft.com    ',
+      password_confirmation: 'Bob1@microsoft.com    '
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the email.'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password cannot equal case sensitive version of email with spaces '\
+       'for new user' do
+    user = User.new(
+      email: 'Bob1@microsoft.com',
+      password: '  boB1@microsoft.com   ',
+      password_confirmation: '  boB1@microsoft.com   '
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the email.'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'new password cannot equal current password' do
+    user = User.create(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    )
+
+    user.password = 'Password1!'
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the current password.'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'should not be included in objects with invalid API' do
+    error = assert_raise RuntimeError do
+      class ::Dog; include Devise::Models::SecureValidatable; end
+    end
+
+    assert_equal('Could not use SecureValidatable on Dog', error.message)
   end
 end

data/test/test_secure_validatable_overrides.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class TestSecureValidatableOverrides < ActiveSupport::TestCase
+  class ::CustomClassPasswordValidator < DeviseSecurity::PasswordComplexityValidator
+    def patterns
+      super.merge(letter: /\p{Alpha}/)
+    end
+  end
+
+  class ::CustomInstancePasswordValidator < DeviseSecurity::PasswordComplexityValidator
+    # Add a pattern for alphanumeric characters. See
+    # [en.yml](file:///./test/dummy/config/locales/en.yml) for translations used in
+    # tests.
+    def patterns
+      super.merge(alnum: /\p{Alnum}/)
+    end
+  end
+
+  class User < ApplicationRecord
+    devise :database_authenticatable, :secure_validatable
+    include ::Mongoid::Mappings if DEVISE_ORM == :mongoid
+  end
+
+  class ClassLevelOverrideUser < User
+    self.allow_passwords_equal_to_email = true
+    self.email_validation = false
+    self.password_complexity = { symbol: 1, letter: 1 }
+    self.password_complexity_validator = 'custom_class_password_validator'
+    self.password_length = 10..100
+  end
+
+  class InstanceLevelOverrideUser < ClassLevelOverrideUser
+    def allow_passwords_equal_to_email
+      true
+    end
+
+    def email_validation
+      false
+    end
+
+    def password_complexity
+      { symbol: 2, alnum: 1 }
+    end
+
+    def password_length
+      11..100
+    end
+
+    def password_complexity_validator
+      'CustomInstancePasswordValidator'
+    end
+  end
+
+  test 'email equal to password can be overridden at the class level' do
+    user = ClassLevelOverrideUser.new(
+      email: 'bob1!@microsoft.com',
+      password: 'bob1!@microsoft.com',
+      password_confirmation: 'bob1!@microsoft.com'
+    )
+
+    assert user.valid?
+  end
+
+  test 'email equal to password can be overridden at the instance level' do
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob1!@microsoft.com',
+      password: 'bob1!@microsoft.com',
+      password_confirmation: 'bob1!@microsoft.com'
+    )
+
+    assert user.valid?
+  end
+
+  test 'email validation can be overridden at the class level' do
+    user = ClassLevelOverrideUser.new(
+      email: 'bob1!@f.com',
+      password: 'Pa3zZ1!!aaaaaa',
+      password_confirmation: 'Pa3zZ1!!aaaaaa'
+    )
+
+    assert user.valid?
+  end
+
+  test 'email validation can be overridden at the instance level' do
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob1!@f.com',
+      password: 'Pa3zZ1!!aaaaaa',
+      password_confirmation: 'Pa3zZ1!!aaaaaa'
+    )
+
+    assert user.valid?
+  end
+
+  test 'password complexity can be overridden at the class level' do
+    user = ClassLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: 'PASSwordddd',
+      password_confirmation: 'PASSwordddd'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least one punctuation mark or symbol'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password complexity can be overridden at the instance level' do
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: 'PASSwordddd',
+      password_confirmation: 'PASSwordddd'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least 2 punctuation marks or symbols'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password length can be overridden at the class level' do
+    user = ClassLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: 'Pa3zZ1!',
+      password_confirmation: 'Pa3zZ1!'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password is too short (minimum is 10 characters)'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password length can be overridden at the instance level' do
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: 'Pa3zZ1!!',
+      password_confirmation: 'Pa3zZ1!!'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password is too short (minimum is 11 characters)'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password validator can be overridden at the instance level' do
+    password = '!' * 11 # 11 characters, all symbols
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: password,
+      password_confirmation: password
+    )
+
+    assert user.invalid?
+    # This validation error only occurs when the CustomInstancePasswordValidator
+    # is used.
+    assert_equal(
+      ['Password must contain at least one letter or number'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password validator can be overridden at the class level' do
+    password = '!' * 10 # 10 characters, all symbols
+    user = ClassLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: password,
+      password_confirmation: password
+    )
+
+    assert user.invalid?
+    # This validation error only occurs when the CustomClassPasswordValidator
+    # is used.
+    assert_equal(
+      ['Password must contain at least one letter'],
+      user.errors.full_messages
+    )
+  end
+end

data/test/test_session_limitable.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class TestSessionLimitable < ActiveSupport::TestCase
+  class ModifiedUser < User
+    def skip_session_limitable?
+      true
+    end
+  end
+
+  test 'check is not skipped by default' do
+    user = User.new(email: 'bob@microsoft.com', password: 'password1', password_confirmation: 'password1')
+    assert_not(user.skip_session_limitable?)
+  end
+
+  test 'default check can be overridden by record instance' do
+    modified_user = ModifiedUser.new(email: 'bob2@microsoft.com', password: 'password1', password_confirmation: 'password1')
+    assert(modified_user.skip_session_limitable?)
+  end
+
+  class SessionLimitableUser < User
+    devise :session_limitable
+    include ::Mongoid::Mappings if DEVISE_ORM == :mongoid
+  end
+
+  test 'includes Devise::Models::Compatibility' do
+    assert_kind_of(Devise::Models::Compatibility, SessionLimitableUser.new)
+  end
+
+  test '#update_unique_session_id!(value) updates valid record' do
+    user = User.create! password: 'passWord1', password_confirmation: 'passWord1', email: 'bob@microsoft.com'
+    assert user.persisted?
+    assert_nil user.unique_session_id
+    user.update_unique_session_id!('unique_value')
+    user.reload
+    assert_equal('unique_value', user.unique_session_id)
+  end
+
+  test '#update_unique_session_id!(value) updates invalid record atomically' do
+    user = User.create! password: 'passWord1', password_confirmation: 'passWord1', email: 'bob@microsoft.com'
+    assert user.persisted?
+    user.email = ''
+    assert user.invalid?
+    assert_nil user.unique_session_id
+    user.update_unique_session_id!('unique_value')
+    user.reload
+    assert_equal('bob@microsoft.com', user.email)
+    assert_equal('unique_value', user.unique_session_id)
+  end
+
+  test '#update_unique_session_id!(value) raises an exception on an unpersisted record' do
+    user = User.create
+    assert_not user.persisted?
+    assert_raises(Devise::Models::Compatibility::NotPersistedError) { user.update_unique_session_id!('unique_value') }
+  end
+end

data/test/tmp/config/initializers/devise_security.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+Devise.setup do |config|
+  # ==> Security Extension
+  # Configure security extension for devise
+
+  # Should the password expire (e.g 3.months)
+  # config.expire_password_after = false
+
+  # Need 1 char each of: A-Z, a-z, 0-9, and a punctuation mark or symbol
+  # You may use "digits" in place of "digit" and "symbols" in place of
+  # "symbol" based on your preference
+  # config.password_complexity = { digit: 1, lower: 1, symbol: 1, upper: 1 }
+
+  # How many passwords to keep in archive
+  # config.password_archiving_count = 5
+
+  # Deny old passwords (true, false, number_of_old_passwords_to_check)
+  # Examples:
+  # config.deny_old_passwords = false # allow old passwords
+  # config.deny_old_passwords = true # will deny all the old passwords
+  # config.deny_old_passwords = 3 # will deny new passwords that matches with the last 3 passwords
+  # config.deny_old_passwords = true
+
+  # enable email validation for :secure_validatable. (true, false, validation_options)
+  # dependency: see https://github.com/devise-security/devise-security/blob/master/README.md#e-mail-validation
+  # config.email_validation = true
+
+  # captcha integration for recover form
+  # config.captcha_for_recover = true
+
+  # captcha integration for sign up form
+  # config.captcha_for_sign_up = true
+
+  # captcha integration for sign in form
+  # config.captcha_for_sign_in = true
+
+  # captcha integration for unlock form
+  # config.captcha_for_unlock = true
+
+  # captcha integration for confirmation form
+  # config.captcha_for_confirmation = true
+
+  # Time period for account expiry from last_activity_at
+  # config.expire_after = 90.days
+
+  # Allow password to equal the email
+  # config.allow_passwords_equal_to_email = false
+
+  # paranoid_verification will regenerate verification code after failed attempt
+  # config.paranoid_code_regenerate_after_attempt = 10
+end