devise-security 0.12.0 → 0.18.0

data/test/dummy/app/models/mongoid/expirable_fields.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module ExpirableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Expirable
+    field :expired_at, type: Time
+    field :last_activity_at, type: Time
+  end
+end

data/test/dummy/app/models/mongoid/lockable_fields.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module LockableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+    field :unlock_token, type: String # Only if unlock strategy is :email or :both
+    field :locked_at, type: Time
+    include Mongoid::Timestamps
+    index({ unlock_token: 1 }, { unique: true })
+  end
+end

data/test/dummy/app/models/mongoid/mappings.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+Dir[File.expand_path('*_fields.rb', __dir__)].each { |f| require_relative f }
+
+module Mongoid
+  module Mappings
+    extend ::ActiveSupport::Concern
+
+    included do
+      devise_modules.each do |devise_module_name|
+        include "#{devise_module_name.to_s.classify}Fields".constantize
+      end
+    end
+  end
+end

data/test/dummy/app/models/mongoid/omniauthable_fields.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module OmniauthableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Omniautable
+    field :username, type: String
+    field :facebook_token, type: String
+  end
+end

data/test/dummy/app/models/mongoid/paranoid_verification_fields.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module ParanoidVerificationFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+    field :paranoid_verification_code, type: String
+    field :paranoid_verified_at, type: Time
+    field :paranoid_verification_attempt, type: Integer, default: 0
+  end
+end

data/test/dummy/app/models/mongoid/password_archivable_fields.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module PasswordArchivableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## PasswordArchivableFields
+  end
+end

data/test/dummy/app/models/mongoid/password_expirable_fields.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module PasswordExpirableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    field :expired_at, type: Time
+    field :last_activity_at, type: Time
+  end
+end

data/test/dummy/app/models/mongoid/recoverable_fields.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module RecoverableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Recoverable
+    field :reset_password_token, type: String
+    field :reset_password_sent_at, type: Time
+  end
+end

data/test/dummy/app/models/mongoid/registerable_fields.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module RegisterableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Database authenticatable
+    field :email, type: String, default: ''
+    validates_presence_of :email
+
+    field :encrypted_password, type: String, default: ''
+    validates_presence_of :encrypted_password
+
+    field :password_changed_at, type: Time
+    index({ password_changed_at: 1 }, {})
+    index({ email: 1 }, {})
+    include Mongoid::Timestamps
+  end
+end

data/test/dummy/app/models/mongoid/rememberable_fields.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module RememberableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Rememberable
+    field :remember_created_at, type: Time
+  end
+end

data/test/dummy/app/models/mongoid/secure_validatable_fields.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module SecureValidatableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    field :password_changed_at, type: Time
+    index({ password_changed_at: 1 }, {})
+    include Mongoid::Timestamps
+  end
+end

data/test/dummy/app/models/mongoid/security_questionable_fields.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module SecurityQuestionableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Security Questionable
+    field :locked_at, type: Time
+    field :unlock_token, type: String
+    field :security_question_id, type: Integer
+    field :security_question_answer, type: String
+  end
+end

data/test/dummy/app/models/mongoid/session_limitable_fields.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module SessionLimitableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Session Limitable
+    field :unique_session_id, type: String
+  end
+end

data/test/dummy/app/models/mongoid/timeoutable_fields.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module TimeoutableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Timeoutable
+  end
+end

data/test/dummy/app/models/mongoid/trackable_fields.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module TrackableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+
+    ## Trackable
+    field :sign_in_count, type: Integer, default: 0
+    field :current_sign_in_at, type: Time
+    field :last_sign_in_at, type: Time
+    field :current_sign_in_ip, type: String
+    field :last_sign_in_ip, type: String
+  end
+end

data/test/dummy/app/models/mongoid/validatable_fields.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module ValidatableFields
+  extend ::ActiveSupport::Concern
+
+  included do
+    include Mongoid::Document
+  end
+end

data/test/dummy/app/models/paranoid_verification_user.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class ParanoidVerificationUser < ApplicationUserRecord
+  devise :database_authenticatable,
+         :confirmable,
+         :expirable,
+         :lockable,
+         :omniauthable,
+         :paranoid_verification,
+         :password_archivable,
+         :password_expirable,
+         :recoverable,
+         :registerable,
+         :rememberable,
+         :secure_validatable,
+         :security_questionable,
+         :session_limitable,
+         :timeoutable,
+         :trackable,
+         :validatable
+
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+  end
+end

data/test/dummy/app/models/password_expired_user.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class PasswordExpiredUser < ApplicationUserRecord
+  devise :database_authenticatable,
+         :confirmable,
+         :expirable,
+         :lockable,
+         :omniauthable,
+         :paranoid_verification,
+         :password_archivable,
+         :password_expirable,
+         :recoverable,
+         :registerable,
+         :rememberable,
+         :secure_validatable,
+         :security_questionable,
+         :session_limitable,
+         :timeoutable,
+         :trackable,
+         :validatable
+
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+  end
+end

data/test/dummy/app/models/security_question_user.rb

@@ -1,5 +1,10 @@
-class SecurityQuestionUser < ActiveRecord::Base
-  self.table_name = 'users'
-  devise :database_authenticatable, :password_archivable, :lockable,
-         :paranoid_verification, :password_expirable, :security_questionable
+# frozen_string_literal: true
+
+class SecurityQuestionUser < ApplicationUserRecord
+  devise :database_authenticatable, :lockable, :security_questionable
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+    field :security_question_answer, type: String
+  end
 end

data/test/dummy/app/models/user.rb

@@ -1,5 +1,6 @@
-class User < ApplicationRecord
+# frozen_string_literal: true
 
+class User < ApplicationRecord
   devise :database_authenticatable,
          :confirmable,
          :expirable,
@@ -19,4 +20,18 @@ class User < ApplicationRecord
          :validatable
 
   has_many :widgets
+
+  case DEVISE_ORM
+  when :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+
+    def some_method_calling_mongoid
+      Mongoid.logger
+    end
+  when :active_record
+    def some_method_calling_active_record
+      ActiveRecord::Base.transaction { break; }
+    end
+  end
 end

data/test/dummy/app/models/widget.rb

@@ -1,4 +1,8 @@
+# frozen_string_literal: true
+
 class Widget < ApplicationRecord
   belongs_to :user
   validates_associated :user
+
+  field :name, type: String if DEVISE_ORM == :mongoid
 end

data/test/dummy/app/mongoid/admin.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'shared_admin'
+
+class Admin
+  include Mongoid::Document
+  include Shim
+  include SharedAdmin
+
+  ## Database authenticatable
+  field :email,              type: String
+  field :encrypted_password, type: String
+
+  ## Recoverable
+  field :reset_password_token,   type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Confirmable
+  field :confirmation_token,   type: String
+  field :confirmed_at,         type: Time
+  field :confirmation_sent_at, type: Time
+  field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  field :locked_at, type: Time
+
+  field :active, type: Boolean, default: false
+end

data/test/dummy/app/mongoid/one_user.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'shared_user_with_password_verification'
+
+class OneUser
+  include Mongoid::Document
+  include Shim
+  include SharedUserWithPasswordVerification
+  include SharedSecurityQuestionsFields
+
+  field :password_changed_at, type: Time
+  index({ password_changed_at: 1 }, {})
+
+  field :paranoid_verification_code, type: String
+  field :paranoid_verified_at, type: Time
+  field :paranoid_verification_attempt, type: Integer, default: 0
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email,              type: String, default: ''
+  field :encrypted_password, type: String, default: ''
+
+  ## Recoverable
+  field :reset_password_token,   type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count,      type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at,    type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip,    type: String
+
+  ## Confirmable
+  field :confirmation_token,   type: String
+  field :confirmed_at,         type: Time
+  field :confirmation_sent_at, type: Time
+  # field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token,    type: String # Only if unlock strategy is :email or :both
+  field :locked_at,       type: Time
+
+  cattr_accessor :validations_performed
+
+  after_validation :after_validation_callback
+
+  def after_validation_callback
+    # used to check in our test if the validations were called
+    @@validations_performed = true
+  end
+end

data/test/dummy/app/mongoid/shim.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Shim
+  extend ::ActiveSupport::Concern
+
+  included do
+    include ::Mongoid::Timestamps
+    field :created_at, type: DateTime
+  end
+
+  class_methods do
+    def order(attribute)
+      asc(attribute)
+    end
+
+    def find_by_email(email)
+      find_by(email: email)
+    end
+  end
+
+  # overwrite equality (because some devise tests use this for asserting model equality)
+  def ==(other)
+    other.is_a?(self.class) && _id == other._id
+  end
+end

data/test/dummy/app/mongoid/user_on_engine.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'shared_user_without_omniauth'
+
+class UserOnEngine
+  include Mongoid::Document
+  include Shim
+  include SharedUserWithoutOmniauth
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ''
+  field :encrypted_password, type: String, default: ''
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Confirmable
+  field :confirmation_token, type: String
+  field :confirmed_at, type: Time
+  field :confirmation_sent_at, type: Time
+  # field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+end

data/test/dummy/app/mongoid/user_on_main_app.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'shared_user_without_omniauth'
+
+class UserOnMainApp
+  include Mongoid::Document
+  include Shim
+  include SharedUserWithoutOmniauth
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ''
+  field :encrypted_password, type: String, default: ''
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Confirmable
+  field :confirmation_token, type: String
+  field :confirmed_at, type: Time
+  field :confirmation_sent_at, type: Time
+  # field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+end

data/test/dummy/app/mongoid/user_with_validations.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+require 'shared_user'
+
+class UserWithValidations
+  include Mongoid::Document
+  include Shim
+  include SharedUser
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ''
+  field :encrypted_password, type: String, default: ''
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+
+  validates :email, presence: true
+end

data/test/dummy/app/mongoid/user_without_email.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'shared_user_without_email'
+
+class UserWithoutEmail
+  include Mongoid::Document
+  include Shim
+
+  devise :database_authenticatable, :lockable, :recoverable,
+         :registerable, :rememberable, :timeoutable,
+         :trackable
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ''
+  field :encrypted_password, type: String, default: ''
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+end

data/test/dummy/config/application.rb

@@ -1,24 +1,26 @@
-require File.expand_path('../boot', __FILE__)
+# frozen_string_literal: true
+
+require File.expand_path('boot', __dir__)
+
+require 'action_mailer/railtie'
+require 'rails/test_unit/railtie'
+DEVISE_ORM = ENV.fetch('DEVISE_ORM', 'active_record').to_sym
+
+Bundler.require :default, DEVISE_ORM
+require "#{DEVISE_ORM}/railtie"
 
 require 'rails/all'
 require 'devise-security'
 
-if defined?(Bundler)
-  # If you precompile assets before deploying to production, use this line
-  Bundler.require(*Rails.groups(assets: %w[development test]))
-  # If you want your assets lazily compiled in production, use this line
-  # Bundler.require(:default, :assets, Rails.env)
-end
-
 module RailsApp
   class Application < Rails::Application
     config.encoding = 'utf-8'
 
     config.filter_parameters += [:password]
 
-    config.assets.enabled = true
+    config.autoload_paths += ["#{config.root}/app/#{DEVISE_ORM}"]
+    config.autoload_paths += ["#{config.root}/lib"]
 
-    config.assets.version = '1.0'
-    config.secret_key_base = 'fuuuuuuuuuuu'
+    config.secret_key_base = 'foobar'
   end
 end

data/test/dummy/config/boot.rb

@@ -1,6 +1,8 @@
+# frozen_string_literal: true
+
 require 'rubygems'
 
 # Set up gems listed in the Gemfile.
-ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__)
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)
 
 require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])