devise-security 0.16.0 → 0.18.0

data/test/controllers/test_paranoid_verification_code_controller.rb

@@ -0,0 +1,133 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class Devise::ParanoidVerificationCodeControllerTest < ActionController::TestCase
+  include Devise::Test::ControllerHelpers
+
+  setup do
+    @controller.class.respond_to :json, :xml
+    @request.env['devise.mapping'] = Devise.mappings[:user]
+    @user = User.create!(
+      username: 'hello',
+      email: 'hello@path.travel',
+      password: 'Password4',
+      confirmed_at: 5.months.ago,
+      paranoid_verification_code: 'cookies'
+    )
+    assert @user.valid?
+    assert @user.need_paranoid_verification?
+
+    sign_in(@user)
+  end
+
+  test 'redirects to root on show if user not logged in' do
+    sign_out(@user)
+    get :show
+    assert_redirected_to :root
+  end
+
+  test "redirects to root on show if user doesn't need paranoid verification" do
+    @user.update(paranoid_verification_code: nil)
+    get :show
+    assert_redirected_to :root
+  end
+
+  test 'renders show on show if user needs paranoid verification' do
+    @user.update(paranoid_verification_code: 'cookies')
+    get :show
+    assert_template :show
+  end
+
+  test 'redirects on update if user not logged in' do
+    sign_out(@user)
+    patch :update
+    assert_redirected_to :root
+  end
+
+  test 'redirects on update if user does not need paranoid verification' do
+    @user.update(paranoid_verification_code: nil)
+    patch :update
+    assert_redirected_to :root
+  end
+
+  test 'update paranoid_verification_code with default format' do
+    patch(
+      :update,
+      params: {
+        user: {
+          paranoid_verification_code: 'cookies'
+        }
+      }
+    )
+    assert_redirected_to root_path
+    assert_equal 'Verification code accepted', flash[:notice]
+    assert_equal('text/html', response.media_type)
+  end
+
+  test 'update paranoid_verification_code using JSON format' do
+    patch(
+      :update,
+      format: :json,
+      params: {
+        user: {
+          paranoid_verification_code: 'cookies'
+        }
+      }
+    )
+
+    assert_response 204
+    assert_equal root_url, response.location
+    assert_nil response.media_type, 'No Content-Type header should be set for No Content response'
+  end
+
+  test 'update paranoid_verification_code using XML format' do
+    patch(
+      :update,
+      format: :xml,
+      params: {
+        user: {
+          paranoid_verification_code: 'cookies'
+        }
+      }
+    )
+    assert_response 204
+    assert_equal root_url, response.location
+    assert_nil response.media_type, 'No Content-Type header should be set for No Content response'
+  end
+end
+
+class ParanoidVerificationCodeCustomRedirectTest < ActionController::TestCase
+  include Devise::Test::ControllerHelpers
+  tests Overrides::ParanoidVerificationCodeController
+
+  setup do
+    @controller.class.respond_to :json, :xml
+    @request.env['devise.mapping'] = Devise.mappings[:paranoid_verification_user]
+    @user = ParanoidVerificationUser.create!(
+      username: 'hello',
+      email: 'hello@path.travel',
+      password: 'Password4',
+      confirmed_at: 5.months.ago,
+      paranoid_verification_code: 'cookies'
+    )
+    assert @user.valid?
+    assert @user.need_paranoid_verification?
+
+    sign_in(@user)
+  end
+
+  test 'redirects to custom redirect route on update' do
+    patch(
+      :update,
+      params: {
+        paranoid_verification_user: {
+          paranoid_verification_code: 'cookies'
+        }
+      }
+    )
+
+    assert_redirected_to '/cats'
+    assert_equal 'Verification code accepted', flash[:notice]
+  end
+end

data/test/controllers/test_password_expired_controller.rb

@@ -13,7 +13,7 @@ class Devise::PasswordExpiredControllerTest < ActionController::TestCase
       email: 'hello@path.travel',
       password: 'Password4',
       password_changed_at: 4.months.ago,
-      confirmed_at: 5.months.ago,
+      confirmed_at: 5.months.ago
     )
     assert @user.valid?
     assert @user.need_change_password?
@@ -51,60 +51,114 @@ class Devise::PasswordExpiredControllerTest < ActionController::TestCase
   end
 
   test 'update password with default format' do
-    put :update,
-        params: {
-          user: {
-            current_password: 'Password4',
-            password: 'Password5',
-            password_confirmation: 'Password5',
-          },
+    put(
+      :update,
+      params: {
+        user: {
+          current_password: 'Password4',
+          password: 'Password5',
+          password_confirmation: 'Password5'
         }
+      }
+    )
     assert_redirected_to root_path
-    assert_equal response.media_type, 'text/html'
+    assert_equal('text/html', response.media_type)
   end
 
   test 'password confirmation does not match' do
-    put :update,
-        params: {
-          user: {
-            current_password: 'Password4',
-            password: 'Password5',
-            password_confirmation: 'Password6',
-          },
+    put(
+      :update,
+      params: {
+        user: {
+          current_password: 'Password4',
+          password: 'Password5',
+          password_confirmation: 'Password6'
         }
+      }
+    )
 
     assert_response :success
     assert_template :show
-    assert_equal response.media_type, 'text/html'
+    assert_equal('text/html', response.media_type)
+    assert_includes(
+      response.body,
+      'Password confirmation doesn&#39;t match Password'
+    )
   end
 
   test 'update password using JSON format' do
-    put :update,
-        format: :json,
-        params: {
-          user: {
-            current_password: 'Password4',
-            password: 'Password5',
-            password_confirmation: 'Password5',
-          },
+    put(
+      :update,
+      format: :json,
+      params: {
+        user: {
+          current_password: 'Password4',
+          password: 'Password5',
+          password_confirmation: 'Password5'
         }
+      }
+    )
+
     assert_response 204
     assert_equal root_url, response.location
     assert_nil response.media_type, 'No Content-Type header should be set for No Content response'
   end
 
   test 'update password using XML format' do
-    put :update,
-        format: :xml,
-        params: {
-          user: {
-            current_password: 'Password4',
-            password: 'Password5',
-            password_confirmation: 'Password5',
-          },
+    put(
+      :update,
+      format: :xml,
+      params: {
+        user: {
+          current_password: 'Password4',
+          password: 'Password5',
+          password_confirmation: 'Password5'
         }
+      }
+    )
     assert_response 204
     assert_equal root_url, response.location
     assert_nil response.media_type, 'No Content-Type header should be set for No Content response'
   end
 end
+
+class PasswordExpiredCustomRedirectTest < ActionController::TestCase
+  include Devise::Test::ControllerHelpers
+  tests Overrides::PasswordExpiredController
+
+  setup do
+    @controller.class.respond_to :json, :xml
+    @request.env['devise.mapping'] = Devise.mappings[:password_expired_user]
+    @user = PasswordExpiredUser.create!(
+      username: 'hello',
+      email: 'hello@path.travel',
+      password: 'Password4',
+      password_changed_at: 4.months.ago,
+      confirmed_at: 5.months.ago
+    )
+    assert @user.valid?
+    assert @user.need_change_password?
+
+    sign_in(@user)
+  end
+
+  test 'update password with custom redirect route' do
+    put(
+      :update,
+      params: {
+        password_expired_user: {
+          current_password: 'Password4',
+          password: 'Password5',
+          password_confirmation: 'Password5'
+        }
+      }
+    )
+
+    assert_redirected_to '/cookies'
+  end
+
+  test 'yield resource to block on update' do
+    put(:update, params: { password_expired_user: { current_password: '123' } })
+    assert @controller.update_block_called?, 'Update failed to yield resource to provided block'
+  end
+end

data/test/controllers/test_security_question_controller.rb

@@ -7,29 +7,38 @@ class TestWithSecurityQuestion < ActionController::TestCase
   tests SecurityQuestion::UnlocksController
 
   setup do
-    @user = SecurityQuestionUser.create!(username: 'hello', email: 'hello@microsoft.com',
-                                         password: 'A1234567z!', security_question_answer: 'Right Answer')
+    @user = SecurityQuestionUser.create!(
+      username: 'hello', email: 'hello@microsoft.com', password: 'A1234567z!', security_question_answer: 'Right Answer'
+    )
     @user.lock_access!
     assert @user.locked_at.present?
     @request.env['devise.mapping'] = Devise.mappings[:security_question_user]
   end
 
   test 'When security question is enabled, it is inserted correctly' do
-    post :create, params: {
-      security_question_user: {
-        email: @user.email,
-      }, security_question_answer: 'wrong answer'
-    }
+    post(
+      :create,
+      params: {
+        security_question_answer: 'wrong answer',
+        security_question_user: {
+          email: @user.email
+        }
+      }
+    )
     assert_equal I18n.t('devise.invalid_security_question'), flash[:alert]
     assert_redirected_to new_security_question_user_unlock_path
   end
 
   test 'When security_question is valid, it runs as normal' do
-    post :create, params: {
-      security_question_user: {
-        email: @user.email,
-      }, security_question_answer: @user.security_question_answer
-    }
+    post(
+      :create,
+      params: {
+        security_question_answer: @user.security_question_answer,
+        security_question_user: {
+          email: @user.email
+        }
+      }
+    )
 
     assert_equal I18n.t('devise.unlocks.send_instructions'), flash[:notice]
     assert_redirected_to new_security_question_user_session_path
@@ -41,18 +50,15 @@ class TestWithoutSecurityQuestion < ActionController::TestCase
   tests Devise::UnlocksController
 
   setup do
-    @user = User.create(username: 'hello', email: 'hello@path.travel',
-                        password: '1234', security_question_answer: 'Right Answer')
+    @user = User.create(
+      username: 'hello', email: 'hello@path.travel', password: '1234', security_question_answer: 'Right Answer'
+    )
     @user.lock_access!
     @request.env['devise.mapping'] = Devise.mappings[:user]
   end
 
   test 'When security question is not enabled it is not inserted' do
-    post :create, params: {
-      user: {
-        email: @user.email,
-      },
-    }
+    post :create, params: { user: { email: @user.email } }
 
     assert_equal I18n.t('devise.unlocks.send_instructions'), flash[:notice]
     assert_redirected_to new_user_session_path

data/test/dummy/app/controllers/overrides/paranoid_verification_code_controller.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class Overrides::ParanoidVerificationCodeController < Devise::ParanoidVerificationCodeController
+  def after_paranoid_verification_code_update_path_for(_)
+    '/cats'
+  end
+end

data/test/dummy/app/controllers/overrides/password_expired_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class Overrides::PasswordExpiredController < Devise::PasswordExpiredController
+  def update
+    super do |resource|
+      @update_block_called = true
+    end
+  end
+
+  def after_password_expired_update_path_for(_)
+    '/cookies'
+  end
+
+  def update_block_called?
+    @update_block_called == true
+  end
+end

data/test/dummy/app/controllers/widgets_controller.rb

@@ -1,5 +1,8 @@
+# frozen_string_literal: true
+
 class WidgetsController < ApplicationController
   before_action :authenticate_user!
+
   def show
     render plain: 'success'
   end

data/test/dummy/app/models/application_user_record.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
+
 if DEVISE_ORM == :active_record
-  class ApplicationUserRecord < ActiveRecord::Base
+  class ApplicationUserRecord < ApplicationRecord
     self.table_name = 'users'
   end
 else

data/test/dummy/app/models/mongoid/confirmable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ConfirmableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/database_authenticable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DatabaseAuthenticatableFields
   extend ::ActiveSupport::Concern
 
@@ -6,10 +8,9 @@ module DatabaseAuthenticatableFields
 
     ## Database authenticatable
     field :username, type: String
-    field :email, type: String, default: ""
-    #validates_presence_of :email
+    field :email, type: String, default: ''
 
-    field :encrypted_password, type: String, default: ""
+    field :encrypted_password, type: String, default: ''
     validates_presence_of :encrypted_password
 
     include Mongoid::Timestamps

data/test/dummy/app/models/mongoid/expirable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ExpirableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/lockable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module LockableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/mappings.rb

@@ -1,11 +1,13 @@
-Dir[File.expand_path("*_fields.rb", __dir__)].each { |f| require_relative f }
+# frozen_string_literal: true
+
+Dir[File.expand_path('*_fields.rb', __dir__)].each { |f| require_relative f }
 
 module Mongoid
   module Mappings
     extend ::ActiveSupport::Concern
 
     included do
-      self.devise_modules.each do |devise_module_name|
+      devise_modules.each do |devise_module_name|
         include "#{devise_module_name.to_s.classify}Fields".constantize
       end
     end

data/test/dummy/app/models/mongoid/omniauthable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module OmniauthableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/paranoid_verification_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ParanoidVerificationFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/password_archivable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module PasswordArchivableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/password_expirable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module PasswordExpirableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/recoverable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module RecoverableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/registerable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module RegisterableFields
   extend ::ActiveSupport::Concern
 
@@ -5,10 +7,10 @@ module RegisterableFields
     include Mongoid::Document
 
     ## Database authenticatable
-    field :email, type: String, default: ""
+    field :email, type: String, default: ''
     validates_presence_of :email
 
-    field :encrypted_password, type: String, default: ""
+    field :encrypted_password, type: String, default: ''
     validates_presence_of :encrypted_password
 
     field :password_changed_at, type: Time

data/test/dummy/app/models/mongoid/rememberable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module RememberableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/secure_validatable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module SecureValidatableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/security_questionable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module SecurityQuestionableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/session_limitable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module SessionLimitableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/timeoutable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module TimeoutableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/trackable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module TrackableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/mongoid/validatable_fields.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ValidatableFields
   extend ::ActiveSupport::Concern
 

data/test/dummy/app/models/paranoid_verification_user.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class ParanoidVerificationUser < ApplicationUserRecord
+  devise :database_authenticatable,
+         :confirmable,
+         :expirable,
+         :lockable,
+         :omniauthable,
+         :paranoid_verification,
+         :password_archivable,
+         :password_expirable,
+         :recoverable,
+         :registerable,
+         :rememberable,
+         :secure_validatable,
+         :security_questionable,
+         :session_limitable,
+         :timeoutable,
+         :trackable,
+         :validatable
+
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+  end
+end

data/test/dummy/app/models/password_expired_user.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class PasswordExpiredUser < ApplicationUserRecord
+  devise :database_authenticatable,
+         :confirmable,
+         :expirable,
+         :lockable,
+         :omniauthable,
+         :paranoid_verification,
+         :password_archivable,
+         :password_expirable,
+         :recoverable,
+         :registerable,
+         :rememberable,
+         :secure_validatable,
+         :security_questionable,
+         :session_limitable,
+         :timeoutable,
+         :trackable,
+         :validatable
+
+  if DEVISE_ORM == :mongoid
+    require './test/dummy/app/models/mongoid/mappings'
+    include ::Mongoid::Mappings
+  end
+end

data/test/dummy/app/models/user.rb

@@ -1,7 +1,6 @@
 # frozen_string_literal: true
 
 class User < ApplicationRecord
-
   devise :database_authenticatable,
          :confirmable,
          :expirable,
@@ -22,16 +21,17 @@ class User < ApplicationRecord
 
   has_many :widgets
 
-  if DEVISE_ORM == :mongoid
+  case DEVISE_ORM
+  when :mongoid
     require './test/dummy/app/models/mongoid/mappings'
     include ::Mongoid::Mappings
-    
+
     def some_method_calling_mongoid
       Mongoid.logger
     end
-  elsif DEVISE_ORM == :active_record
+  when :active_record
     def some_method_calling_active_record
-      ActiveRecord::Base.transaction {}
+      ActiveRecord::Base.transaction { break; }
     end
   end
 end

data/test/dummy/app/models/widget.rb

@@ -4,7 +4,5 @@ class Widget < ApplicationRecord
   belongs_to :user
   validates_associated :user
 
-  if DEVISE_ORM == :mongoid
-    field :name, type: String
-  end
+  field :name, type: String if DEVISE_ORM == :mongoid
 end