devise-security 0.15.0 → 0.18.0

data/test/controllers/test_security_question_controller.rb

@@ -7,45 +7,38 @@ class TestWithSecurityQuestion < ActionController::TestCase
   tests SecurityQuestion::UnlocksController
 
   setup do
-    @user = SecurityQuestionUser.create!(username: 'hello', email: 'hello@microsoft.com',
-                        password: 'A1234567z!', security_question_answer: 'Right Answer')
+    @user = SecurityQuestionUser.create!(
+      username: 'hello', email: 'hello@microsoft.com', password: 'A1234567z!', security_question_answer: 'Right Answer'
+    )
     @user.lock_access!
     assert @user.locked_at.present?
     @request.env['devise.mapping'] = Devise.mappings[:security_question_user]
   end
 
   test 'When security question is enabled, it is inserted correctly' do
-    if Rails.gem_version.release <= Gem::Version.new('5.0')
-      post :create, {
+    post(
+      :create,
+      params: {
+        security_question_answer: 'wrong answer',
         security_question_user: {
           email: @user.email
-        }, security_question_answer: "wrong answer"
-      }
-    else
-      post :create, params: {
-        security_question_user: {
-          email: @user.email
-        }, security_question_answer: "wrong answer"
+        }
       }
-    end
+    )
     assert_equal I18n.t('devise.invalid_security_question'), flash[:alert]
     assert_redirected_to new_security_question_user_unlock_path
   end
 
   test 'When security_question is valid, it runs as normal' do
-    if Rails.gem_version.release <= Gem::Version.new('5.0')
-      post :create, {
-        security_question_user: {
-          email: @user.email
-        }, security_question_answer: @user.security_question_answer
-      }
-    else
-      post :create, params: {
+    post(
+      :create,
+      params: {
+        security_question_answer: @user.security_question_answer,
         security_question_user: {
           email: @user.email
-        }, security_question_answer: @user.security_question_answer
+        }
       }
-    end
+    )
 
     assert_equal I18n.t('devise.unlocks.send_instructions'), flash[:notice]
     assert_redirected_to new_security_question_user_session_path
@@ -57,26 +50,15 @@ class TestWithoutSecurityQuestion < ActionController::TestCase
   tests Devise::UnlocksController
 
   setup do
-    @user = User.create(username: 'hello', email: 'hello@path.travel',
-                        password: '1234', security_question_answer: 'Right Answer')
+    @user = User.create(
+      username: 'hello', email: 'hello@path.travel', password: '1234', security_question_answer: 'Right Answer'
+    )
     @user.lock_access!
     @request.env['devise.mapping'] = Devise.mappings[:user]
   end
 
   test 'When security question is not enabled it is not inserted' do
-    if Rails.gem_version.release <= Gem::Version.new('5.0')
-      post :create, {
-        user: {
-          email: @user.email
-        }
-      }
-    else
-      post :create, params: {
-        user: {
-          email: @user.email
-        }
-      }
-    end
+    post :create, params: { user: { email: @user.email } }
 
     assert_equal I18n.t('devise.unlocks.send_instructions'), flash[:notice]
     assert_redirected_to new_user_session_path

data/test/dummy/app/controllers/overrides/paranoid_verification_code_controller.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class Overrides::ParanoidVerificationCodeController < Devise::ParanoidVerificationCodeController
+  def after_paranoid_verification_code_update_path_for(_)
+    '/cats'
+  end
+end

data/test/dummy/app/controllers/overrides/password_expired_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class Overrides::PasswordExpiredController < Devise::PasswordExpiredController
+  def update
+    super do |resource|
+      @update_block_called = true
+    end
+  end
+
+  def after_password_expired_update_path_for(_)
+    '/cookies'
+  end
+
+  def update_block_called?
+    @update_block_called == true
+  end
+end

data/test/dummy/app/controllers/widgets_controller.rb

@@ -1,5 +1,8 @@
+# frozen_string_literal: true
+
 class WidgetsController < ApplicationController
   before_action :authenticate_user!
+
   def show
     render plain: 'success'
   end

data/test/dummy/app/models/application_user_record.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
+
 if DEVISE_ORM == :active_record
-  class ApplicationUserRecord < ActiveRecord::Base
+  class ApplicationUserRecord < ApplicationRecord
     self.table_name = 'users'
   end
 else

data/test/dummy/app/models/mongoid/confirmable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ConfirmableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/database_authenticable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DatabaseAuthenticatableFields
   extend ::ActiveSupport::Concern
 
@@ -6,10 +8,9 @@ module DatabaseAuthenticatableFields
 
     ## Database authenticatable
     field :username, type: String
-    field :email, type: String, default: ""
-    #validates_presence_of :email
+    field :email, type: String, default: ''
 
-    field :encrypted_password, type: String, default: ""
+    field :encrypted_password, type: String, default: ''
     validates_presence_of :encrypted_password
 
     include Mongoid::Timestamps

data/test/dummy/app/models/mongoid/expirable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ExpirableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/lockable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module LockableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/mappings.rb

@@ -1,11 +1,13 @@
-Dir[File.expand_path("*_fields.rb", __dir__)].each { |f| require_relative f }
+# frozen_string_literal: true
+
+Dir[File.expand_path('*_fields.rb', __dir__)].each { |f| require_relative f }
 
 module Mongoid
   module Mappings
     extend ::ActiveSupport::Concern
 
     included do
-      self.devise_modules.each do |devise_module_name|
+      devise_modules.each do |devise_module_name|
         include "#{devise_module_name.to_s.classify}Fields".constantize
       end
     end

data/test/dummy/app/models/mongoid/omniauthable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module OmniauthableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/paranoid_verification_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ParanoidVerificationFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/password_archivable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module PasswordArchivableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/password_expirable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module PasswordExpirableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/recoverable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module RecoverableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/registerable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module RegisterableFields
   extend ::ActiveSupport::Concern
 
@@ -5,10 +7,10 @@ module RegisterableFields
     include Mongoid::Document
 
     ## Database authenticatable
-    field :email, type: String, default: ""
+    field :email, type: String, default: ''
     validates_presence_of :email
 
-    field :encrypted_password, type: String, default: ""
+    field :encrypted_password, type: String, default: ''
     validates_presence_of :encrypted_password
 
     field :password_changed_at, type: Time

data/test/dummy/app/models/mongoid/rememberable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module RememberableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/secure_validatable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module SecureValidatableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/security_questionable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module SecurityQuestionableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/session_limitable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module SessionLimitableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/timeoutable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module TimeoutableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/trackable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module TrackableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/validatable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ValidatableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/paranoid_verification_user.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class ParanoidVerificationUser < ApplicationUserRecord
+  devise :database_authenticatable,
+         :confirmable,
+         :expirable,
+         :lockable,
+         :omniauthable,
+         :paranoid_verification,
+         :password_archivable,
+         :password_expirable,
+         :recoverable,
+         :registerable,
+         :rememberable,
+         :secure_validatable,
+         :security_questionable,
+         :session_limitable,
+         :timeoutable,
+         :trackable,
+         :validatable
+
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+  end
+end

data/test/dummy/app/models/password_expired_user.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class PasswordExpiredUser < ApplicationUserRecord
+  devise :database_authenticatable,
+         :confirmable,
+         :expirable,
+         :lockable,
+         :omniauthable,
+         :paranoid_verification,
+         :password_archivable,
+         :password_expirable,
+         :recoverable,
+         :registerable,
+         :rememberable,
+         :secure_validatable,
+         :security_questionable,
+         :session_limitable,
+         :timeoutable,
+         :trackable,
+         :validatable
+
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+  end
+end

data/test/dummy/app/models/user.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 class User < ApplicationRecord
-
   devise :database_authenticatable,
          :confirmable,
          :expirable,
@@ -22,16 +21,17 @@ class User < ApplicationRecord
 
   has_many :widgets
 
-  if DEVISE_ORM == :mongoid
+  case DEVISE_ORM
+  when :mongoid
     require './test/dummy/app/models/mongoid/mappings'
     include ::Mongoid::Mappings
-    
+
     def some_method_calling_mongoid
       Mongoid.logger
     end
-  elsif DEVISE_ORM == :active_record
+  when :active_record
     def some_method_calling_active_record
-      ActiveRecord::Base.transaction {}
+      ActiveRecord::Base.transaction { break; }
     end
   end
 end

data/test/dummy/app/models/widget.rb

@@ -4,7 +4,5 @@ class Widget < ApplicationRecord
   belongs_to :user
   validates_associated :user
 
-  if DEVISE_ORM == :mongoid
-    field :name, type: String
-  end
+  field :name, type: String if DEVISE_ORM == :mongoid
 end

data/test/dummy/app/mongoid/one_user.rb

@@ -11,16 +11,16 @@ class OneUser
   field :password_changed_at, type: Time
   index({ password_changed_at: 1 }, {})
 
-  #field :paranoid_verification_code, type: String
-  #field :paranoid_verified_at, type: Time
-  #field :paranoid_verification_attempt, type: Integer, default: 0
+  field :paranoid_verification_code, type: String
+  field :paranoid_verified_at, type: Time
+  field :paranoid_verification_attempt, type: Integer, default: 0
 
   field :username, type: String
   field :facebook_token, type: String
 
   ## Database authenticatable
-  field :email,              type: String, default: ""
-  field :encrypted_password, type: String, default: ""
+  field :email,              type: String, default: ''
+  field :encrypted_password, type: String, default: ''
 
   ## Recoverable
   field :reset_password_token,   type: String

data/test/dummy/app/mongoid/user_on_engine.rb

@@ -11,8 +11,8 @@ class UserOnEngine
   field :facebook_token, type: String
 
   ## Database authenticatable
-  field :email, type: String, default: ""
-  field :encrypted_password, type: String, default: ""
+  field :email, type: String, default: ''
+  field :encrypted_password, type: String, default: ''
 
   ## Recoverable
   field :reset_password_token, type: String

data/test/dummy/app/mongoid/user_on_main_app.rb

@@ -11,8 +11,8 @@ class UserOnMainApp
   field :facebook_token, type: String
 
   ## Database authenticatable
-  field :email, type: String, default: ""
-  field :encrypted_password, type: String, default: ""
+  field :email, type: String, default: ''
+  field :encrypted_password, type: String, default: ''
 
   ## Recoverable
   field :reset_password_token, type: String

data/test/dummy/app/mongoid/user_with_validations.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require "shared_user"
+require 'shared_user'
 
 class UserWithValidations
   include Mongoid::Document
@@ -11,8 +11,8 @@ class UserWithValidations
   field :facebook_token, type: String
 
   ## Database authenticatable
-  field :email, type: String, default: ""
-  field :encrypted_password, type: String, default: ""
+  field :email, type: String, default: ''
+  field :encrypted_password, type: String, default: ''
 
   ## Recoverable
   field :reset_password_token, type: String

data/test/dummy/app/mongoid/user_without_email.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
-require "shared_user_without_email"
+require 'shared_user_without_email'
 
 class UserWithoutEmail
   include Mongoid::Document
   include Shim
-  include SharedUserWithoutEmail
+
+  devise :database_authenticatable, :lockable, :recoverable,
+         :registerable, :rememberable, :timeoutable,
+         :trackable
 
   field :username, type: String
   field :facebook_token, type: String
 
   ## Database authenticatable
-  field :email, type: String, default: ""
-  field :encrypted_password, type: String, default: ""
+  field :email, type: String, default: ''
+  field :encrypted_password, type: String, default: ''
 
   ## Recoverable
   field :reset_password_token, type: String

data/test/dummy/config/application.rb

@@ -1,10 +1,9 @@
 # frozen_string_literal: true
 
-require File.expand_path('../boot', __FILE__)
+require File.expand_path('boot', __dir__)
 
 require 'action_mailer/railtie'
-require "action_mailer/railtie"
-require "rails/test_unit/railtie"
+require 'rails/test_unit/railtie'
 DEVISE_ORM = ENV.fetch('DEVISE_ORM', 'active_record').to_sym
 
 Bundler.require :default, DEVISE_ORM
@@ -22,9 +21,6 @@ module RailsApp
     config.autoload_paths += ["#{config.root}/app/#{DEVISE_ORM}"]
     config.autoload_paths += ["#{config.root}/lib"]
 
-    config.assets.enabled = true
-
-    config.assets.version = '1.0'
-    config.secret_key_base = 'fuuuuuuuuuuu'
+    config.secret_key_base = 'foobar'
   end
 end

data/test/dummy/config/boot.rb

@@ -3,6 +3,6 @@
 require 'rubygems'
 
 # Set up gems listed in the Gemfile.
-ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../Gemfile', __FILE__)
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../Gemfile', __dir__)
 
 require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])

data/test/dummy/config/environment.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 # Load the rails application
-require File.expand_path('../application', __FILE__)
+require File.expand_path('application', __dir__)
 
 # Initialize the rails application
 RailsApp::Application.initialize!

data/test/dummy/config/environments/test.rb

@@ -4,13 +4,8 @@ RailsApp::Application.configure do
   config.cache_classes = true
   config.eager_load = false
 
-  if Rails.version > '5'
-    config.public_file_server.enabled = true
-    config.public_file_server.headers = { 'Cache-Control' => 'public, max-age=3600' }
-  else
-    config.serve_static_files = true
-    config.static_cache_control = 'public, max-age=3600'
-  end
+  config.public_file_server.enabled = true
+  config.public_file_server.headers = { 'Cache-Control' => 'public, max-age=3600' }
 
   config.consider_all_requests_local       = true
   config.action_controller.perform_caching = false
@@ -27,11 +22,7 @@ RailsApp::Application.configure do
 
   config.active_support.test_order = :sorted
   config.log_level = :debug
-  if Rails.gem_version >= Gem::Version.new('4.2') && Rails.gem_version.release < Gem::Version.new('5.0')
-    config.active_record.raise_in_transactional_callbacks = true
-  end
-  if Rails.gem_version.release >= Gem::Version.new('5.2') && Rails.gem_version.release < Gem::Version.new('6.0')
-    config.active_record.sqlite3.represent_boolean_as_integer = true
-  end
+  config.active_record.sqlite3.represent_boolean_as_integer = true if Rails.gem_version.release >= Gem::Version.new('5.2') && Rails.gem_version.release < Gem::Version.new('6.0')
+  config.active_record.legacy_connection_handling = false if Rails.gem_version.release >= Gem::Version.new('6.1')
 end
 ActiveSupport::Deprecation.debug = true

data/test/dummy/config/initializers/devise.rb

@@ -8,10 +8,6 @@ Devise.setup do |config|
   config.secret_key = 'f08cf11a38906f531d2dfc9a2c2d671aa0021be806c21255d4'
   config.case_insensitive_keys = [:email]
   config.strip_whitespace_keys = [:email]
-  config.password_complexity = {
-    digit: 1,
-    lower: 1,
-    upper: 1,
-  }
+  config.password_complexity = { digit: 1, lower: 1, upper: 1 }
   config.password_length = 7..128
 end

data/test/dummy/config/initializers/migration_class.rb

@@ -1,10 +1,3 @@
 # frozen_string_literal: true
 
-if DEVISE_ORM == :active_record
-  MIGRATION_CLASS =
-    if Rails.gem_version >= Gem::Version.new('5.0')
-      ActiveRecord::Migration[Rails.version.to_f]
-    else
-      ActiveRecord::Migration
-    end
-end
+MIGRATION_CLASS = ActiveRecord::Migration[Rails.version.to_f] if DEVISE_ORM == :active_record

data/test/dummy/config/locales/en.yml

@@ -0,0 +1,10 @@
+en:
+  errors:
+    messages:
+      password_complexity:
+        letter:
+          one: must contain at least one letter
+          other: must contain at least %{count} letters
+        alnum:
+          one: must contain at least one letter or number
+          other: must contain at least %{count} letters or numbers

data/test/dummy/config/mongoid.yml

@@ -1,5 +1,5 @@
 test:
-  <%= Mongoid::VERSION.to_i > 4 ? 'clients' : 'sessions' %>:
+  clients:
     default:
       database: devise_security_test
       hosts:

data/test/dummy/config/routes.rb

@@ -4,7 +4,9 @@ RailsApp::Application.routes.draw do
   devise_for :users
 
   devise_for :captcha_users, only: [:sessions], controllers: { sessions: 'captcha/sessions' }
-  devise_for :security_question_users, only: [:sessions, :unlocks], controllers: { unlocks: 'security_question/unlocks' }
+  devise_for :password_expired_users, only: [:password_expired], controllers: { password_expired: 'overrides/password_expired' }
+  devise_for :paranoid_verification_users, only: [:verification_code], controllers: { paranoid_verification_code: 'overrides/paranoid_verification_code' }
+  devise_for :security_question_users, only: %i[sessions unlocks], controllers: { unlocks: 'security_question/unlocks' }
 
   resources :foos
   resource :widgets

data/test/dummy/config.ru

@@ -2,5 +2,5 @@
 
 # This file is used by Rack-based servers to start the application.
 
-require ::File.expand_path('../config/environment', __FILE__)
+require ::File.expand_path('config/environment', __dir__)
 run RailsApp::Application