devise-security 0.16.0 → 0.18.0

data/test/test_secure_validatable.rb

@@ -1,161 +1,319 @@
 # frozen_string_literal: true
 
 require 'test_helper'
-require 'rails_email_validator'
 
 class TestSecureValidatable < ActiveSupport::TestCase
   class User < ApplicationRecord
-    devise :database_authenticatable, :password_archivable,
-           :paranoid_verification, :password_expirable, :secure_validatable
+    devise :database_authenticatable, :secure_validatable
     include ::Mongoid::Mappings if DEVISE_ORM == :mongoid
   end
 
-  test 'email cannot be blank' do
-    msg = "Email can't be blank"
-    user = User.create password: 'passWord1', password_confirmation: 'passWord1'
+  class EmailNotRequiredUser < User
+    protected
 
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ORMInvalidRecordException) do
-      user.save!
+    def email_required?
+      false
     end
   end
 
+  test 'email cannot be blank upon creation' do
+    user = User.new(
+      password: 'Password1!', password_confirmation: 'Password1!'
+    )
+
+    assert user.invalid?
+    assert_equal(["Email can't be blank"], user.errors.full_messages)
+  end
+
+  test 'email can be blank upon creation if email not required' do
+    user = EmailNotRequiredUser.new(
+      password: 'Password1!', password_confirmation: 'Password1!'
+    )
+
+    assert user.valid?
+  end
+
+  test 'email cannot be updated to be blank' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    )
+
+    assert user.valid?
+
+    user.email = nil
+
+    assert user.invalid?
+    assert_equal(["Email can't be blank"], user.errors.full_messages)
+  end
+
+  test 'email can be updated to be blank if email not required' do
+    user = EmailNotRequiredUser.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    )
+
+    assert user.valid?
+
+    user.email = nil
+
+    assert user.valid?
+  end
+
   test 'email must be valid' do
-    msg = 'Email is invalid'
-    user = User.create email: 'bob', password: 'passWord1', password_confirmation: 'passWord1'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ORMInvalidRecordException) do
-      user.save!
-    end
+    user = User.new(
+      email: 'bob', password: 'Password1!', password_confirmation: 'Password1!'
+    )
+
+    assert user.invalid?
+    assert_equal(['Email is invalid'], user.errors.full_messages)
   end
 
   test 'validate both email and password' do
-    msgs = ['Email is invalid', 'Password must contain at least one upper-case letter']
-    user = User.create email: 'bob@@foo.tv', password: 'password1', password_confirmation: 'password1'
-    assert_equal(false, user.valid?)
+    user = User.new(
+      email: 'bob',
+      password: 'password1!',
+      password_confirmation: 'password1!'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      [
+        'Email is invalid',
+        'Password must contain at least one upper-case letter'
+      ],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password cannot be blank upon creation' do
+    user = User.new(email: 'bob@microsoft.com')
+
+    msgs = ["Password can't be blank"]
+
+    msgs << "Encrypted password can't be blank" if DEVISE_ORM == :mongoid
+
+    assert user.invalid?
     assert_equal(msgs, user.errors.full_messages)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+  end
+
+  test 'password cannot be updated to be blank' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    )
+
+    assert user.valid?
+
+    user.password = nil
+    user.password_confirmation = nil
+
+    assert user.invalid?
+    assert_equal(["Password can't be blank"], user.errors.full_messages)
+  end
+
+  test 'password_confirmation must match password' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'not the same password'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ["Password confirmation doesn't match Password"],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password_confirmation cannot be blank' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: ''
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ["Password confirmation doesn't match Password"],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password_confirmation can be skipped' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: nil
+    )
+
+    assert user.valid?
   end
 
   test 'password must have capital letter' do
-    msgs = ['Password must contain at least one upper-case letter']
-    user = User.create email: 'bob@microsoft.com', password: 'password1', password_confirmation: 'password1'
-    assert_equal(false, user.valid?)
-    assert_equal(msgs, user.errors.full_messages)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'password1',
+      password_confirmation: 'password1'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least one upper-case letter'],
+      user.errors.full_messages
+    )
   end
 
   test 'password must have lowercase letter' do
-    msg = 'Password must contain at least one lower-case letter'
-    user = User.create email: 'bob@microsoft.com', password: 'PASSWORD1', password_confirmation: 'PASSWORD1'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'PASSWORD1',
+      password_confirmation: 'PASSWORD1'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least one lower-case letter'],
+      user.errors.full_messages
+    )
   end
 
   test 'password must have number' do
-    msg = 'Password must contain at least one digit'
-    user = User.create email: 'bob@microsoft.com', password: 'PASSword', password_confirmation: 'PASSword'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'PASSword',
+      password_confirmation: 'PASSword'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least one digit'],
+      user.errors.full_messages
+    )
   end
 
-  test 'password must have minimum length' do
-    msg = 'Password is too short (minimum is 7 characters)'
-    user = User.create email: 'bob@microsoft.com', password: 'Pa3zZ', password_confirmation: 'Pa3zZ'
-    assert_equal(false, user.valid?)
-    assert_equal([msg], user.errors.full_messages)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+  test 'password must meet minimum length' do
+    user = User.new(
+      email: 'bob@microsoft.com',
+      password: 'Pa3zZ',
+      password_confirmation: 'Pa3zZ'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password is too short (minimum is 7 characters)'],
+      user.errors.full_messages
+    )
   end
 
-  test 'duplicate email validation message is added only once' do
+  test "new user can't use existing user's email" do
     options = {
-      email: 'test@example.org',
-      password: 'Test12345',
-      password_confirmation: 'Test12345',
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
     }
-    SecureUser.create!(options)
-    user = SecureUser.new(options)
-    refute user.valid?
-    assert_equal DEVISE_ORM == :active_record ? ['Email has already been taken'] : ['Email is already taken'], user.errors.full_messages
-  end
+    User.create!(options)
+    user = User.new(options)
 
-  test 'password can not equal email for new user' do
-    msg = 'Password must be different than the email.'
-    user = User.create email: 'bob@microsoft.com', password: 'bob@microsoft.com', password_confirmation: 'bob@microsoft.com'
-    refute user.valid?
-    assert_includes(user.errors.full_messages, msg)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+    assert user.invalid?
+    assert_equal(['Email has already been taken'], user.errors.full_messages)
   end
 
-  test 'password can not equal case sensitive version of email for new user' do
-    msg = 'Password must be different than the email.'
-    user = User.create email: 'bob@microsoft.com', password: 'BoB@microsoft.com', password_confirmation: 'BoB@microsoft.com'
-    refute user.valid?
-    assert_includes(user.errors.full_messages, msg)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+  test "new user can't use existing user's email with different casing" do
+    options = {
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    }
+    User.create!(options)
+    options[:email] = 'BOB@MICROSOFT.COM'
+    user = User.new(options)
+
+    assert user.invalid?
+    assert_equal(['Email has already been taken'], user.errors.full_messages)
   end
 
-  test 'password can not equal email with spaces for new user' do
-    msg = 'Password must be different than the email.'
-    user = User.create email: 'bob@microsoft.com', password: 'bob@microsoft.com    ', password_confirmation: 'bob@microsoft.com    '
-    refute user.valid?
-    assert_includes(user.errors.full_messages, msg)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+  test 'password cannot equal email for new user' do
+    user = User.new(
+      email: 'Bob1@microsoft.com',
+      password: 'Bob1@microsoft.com',
+      password_confirmation: 'Bob1@microsoft.com'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the email.'],
+      user.errors.full_messages
+    )
   end
 
-  test 'password can not equal case sensitive version of email with spaces for new user' do
-    msg = 'Password must be different than the email.'
-    user = User.create email: 'bob@microsoft.com', password: '  BoB@microsoft.com   ', password_confirmation: '  BoB@microsoft.com   '
-    refute user.valid?
-    assert_includes(user.errors.full_messages, msg)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+  test 'password cannot equal case sensitive version of email for new user' do
+    user = User.new(
+      email: 'bob1@microsoft.com',
+      password: 'BoB1@microsoft.com',
+      password_confirmation: 'BoB1@microsoft.com'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the email.'],
+      user.errors.full_messages
+    )
   end
 
-  test 'password can not equal email for existing user' do
-    user = User.create email: 'bob@microsoft.com', password: 'pAs5W0rd!Is5e6Ure', password_confirmation: 'pAs5W0rd!Is5e6Ure'
+  test 'password cannot equal email with spaces for new user' do
+    user = User.new(
+      email: 'Bob1@microsoft.com',
+      password: 'Bob1@microsoft.com    ',
+      password_confirmation: 'Bob1@microsoft.com    '
+    )
 
-    msg = 'Password must be different than the email.'
-    user.password = 'bob@microsoft.com'
-    user.password_confirmation = 'bob@microsoft.com'
-    refute user.valid?
-    assert_includes(user.errors.full_messages, msg)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the email.'],
+      user.errors.full_messages
+    )
   end
 
-  test 'password can not equal case sensitive version of email for existing user' do
-    user = User.create email: 'bob@microsoft.com', password: 'pAs5W0rd!Is5e6Ure', password_confirmation: 'pAs5W0rd!Is5e6Ure'
+  test 'password cannot equal case sensitive version of email with spaces '\
+       'for new user' do
+    user = User.new(
+      email: 'Bob1@microsoft.com',
+      password: '  boB1@microsoft.com   ',
+      password_confirmation: '  boB1@microsoft.com   '
+    )
 
-    msg = 'Password must be different than the email.'
-    user.password = 'BoB@microsoft.com'
-    user.password_confirmation = 'BoB@microsoft.com'
-    refute user.valid?
-    assert_includes(user.errors.full_messages, msg)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the email.'],
+      user.errors.full_messages
+    )
   end
 
-  test 'password can not equal email with spaces for existing user' do
-    user = User.create email: 'bob@microsoft.com', password: 'pAs5W0rd!Is5e6Ure', password_confirmation: 'pAs5W0rd!Is5e6Ure'
+  test 'new password cannot equal current password' do
+    user = User.create(
+      email: 'bob@microsoft.com',
+      password: 'Password1!',
+      password_confirmation: 'Password1!'
+    )
+
+    user.password = 'Password1!'
 
-    msg = 'Password must be different than the email.'
-    user.password = 'bob@microsoft.com     '
-    user.password_confirmation = 'bob@microsoft.com     '
-    refute user.valid?
-    assert_includes(user.errors.full_messages, msg)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+    assert user.invalid?
+    assert_equal(
+      ['Password must be different than the current password.'],
+      user.errors.full_messages
+    )
   end
 
-  test 'password can not equal case sensitive version of email with spaces for existing user' do
-    user = User.create email: 'bob@microsoft.com', password: 'pAs5W0rd!Is5e6Ure', password_confirmation: 'pAs5W0rd!Is5e6Ure'
+  test 'should not be included in objects with invalid API' do
+    error = assert_raise RuntimeError do
+      class ::Dog; include Devise::Models::SecureValidatable; end
+    end
 
-    msg = 'Password must be different than the email.'
-    user.password = ' BoB@microsoft.com      '
-    user.password_confirmation = ' BoB@microsoft.com      '
-    refute user.valid?
-    assert_includes(user.errors.full_messages, msg)
-    assert_raises(ORMInvalidRecordException) { user.save! }
+    assert_equal('Could not use SecureValidatable on Dog', error.message)
   end
 end

data/test/test_secure_validatable_overrides.rb

@@ -0,0 +1,185 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class TestSecureValidatableOverrides < ActiveSupport::TestCase
+  class ::CustomClassPasswordValidator < DeviseSecurity::PasswordComplexityValidator
+    def patterns
+      super.merge(letter: /\p{Alpha}/)
+    end
+  end
+
+  class ::CustomInstancePasswordValidator < DeviseSecurity::PasswordComplexityValidator
+    # Add a pattern for alphanumeric characters. See
+    # [en.yml](file:///./test/dummy/config/locales/en.yml) for translations used in
+    # tests.
+    def patterns
+      super.merge(alnum: /\p{Alnum}/)
+    end
+  end
+
+  class User < ApplicationRecord
+    devise :database_authenticatable, :secure_validatable
+    include ::Mongoid::Mappings if DEVISE_ORM == :mongoid
+  end
+
+  class ClassLevelOverrideUser < User
+    self.allow_passwords_equal_to_email = true
+    self.email_validation = false
+    self.password_complexity = { symbol: 1, letter: 1 }
+    self.password_complexity_validator = 'custom_class_password_validator'
+    self.password_length = 10..100
+  end
+
+  class InstanceLevelOverrideUser < ClassLevelOverrideUser
+    def allow_passwords_equal_to_email
+      true
+    end
+
+    def email_validation
+      false
+    end
+
+    def password_complexity
+      { symbol: 2, alnum: 1 }
+    end
+
+    def password_length
+      11..100
+    end
+
+    def password_complexity_validator
+      'CustomInstancePasswordValidator'
+    end
+  end
+
+  test 'email equal to password can be overridden at the class level' do
+    user = ClassLevelOverrideUser.new(
+      email: 'bob1!@microsoft.com',
+      password: 'bob1!@microsoft.com',
+      password_confirmation: 'bob1!@microsoft.com'
+    )
+
+    assert user.valid?
+  end
+
+  test 'email equal to password can be overridden at the instance level' do
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob1!@microsoft.com',
+      password: 'bob1!@microsoft.com',
+      password_confirmation: 'bob1!@microsoft.com'
+    )
+
+    assert user.valid?
+  end
+
+  test 'email validation can be overridden at the class level' do
+    user = ClassLevelOverrideUser.new(
+      email: 'bob1!@f.com',
+      password: 'Pa3zZ1!!aaaaaa',
+      password_confirmation: 'Pa3zZ1!!aaaaaa'
+    )
+
+    assert user.valid?
+  end
+
+  test 'email validation can be overridden at the instance level' do
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob1!@f.com',
+      password: 'Pa3zZ1!!aaaaaa',
+      password_confirmation: 'Pa3zZ1!!aaaaaa'
+    )
+
+    assert user.valid?
+  end
+
+  test 'password complexity can be overridden at the class level' do
+    user = ClassLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: 'PASSwordddd',
+      password_confirmation: 'PASSwordddd'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least one punctuation mark or symbol'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password complexity can be overridden at the instance level' do
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: 'PASSwordddd',
+      password_confirmation: 'PASSwordddd'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password must contain at least 2 punctuation marks or symbols'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password length can be overridden at the class level' do
+    user = ClassLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: 'Pa3zZ1!',
+      password_confirmation: 'Pa3zZ1!'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password is too short (minimum is 10 characters)'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password length can be overridden at the instance level' do
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: 'Pa3zZ1!!',
+      password_confirmation: 'Pa3zZ1!!'
+    )
+
+    assert user.invalid?
+    assert_equal(
+      ['Password is too short (minimum is 11 characters)'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password validator can be overridden at the instance level' do
+    password = '!' * 11 # 11 characters, all symbols
+    user = InstanceLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: password,
+      password_confirmation: password
+    )
+
+    assert user.invalid?
+    # This validation error only occurs when the CustomInstancePasswordValidator
+    # is used.
+    assert_equal(
+      ['Password must contain at least one letter or number'],
+      user.errors.full_messages
+    )
+  end
+
+  test 'password validator can be overridden at the class level' do
+    password = '!' * 10 # 10 characters, all symbols
+    user = ClassLevelOverrideUser.new(
+      email: 'bob@microsoft.com',
+      password: password,
+      password_confirmation: password
+    )
+
+    assert user.invalid?
+    # This validation error only occurs when the CustomClassPasswordValidator
+    # is used.
+    assert_equal(
+      ['Password must contain at least one letter'],
+      user.errors.full_messages
+    )
+  end
+end

data/test/test_session_limitable.rb

@@ -10,15 +10,15 @@ class TestSessionLimitable < ActiveSupport::TestCase
   end
 
   test 'check is not skipped by default' do
-    user = User.create email: 'bob@microsoft.com', password: 'password1', password_confirmation: 'password1'
-    assert_equal(false, user.skip_session_limitable?)
+    user = User.new(email: 'bob@microsoft.com', password: 'password1', password_confirmation: 'password1')
+    assert_not(user.skip_session_limitable?)
   end
 
   test 'default check can be overridden by record instance' do
-    modified_user = ModifiedUser.create email: 'bob2@microsoft.com', password: 'password1', password_confirmation: 'password1'
-    assert_equal(true, modified_user.skip_session_limitable?)
+    modified_user = ModifiedUser.new(email: 'bob2@microsoft.com', password: 'password1', password_confirmation: 'password1')
+    assert(modified_user.skip_session_limitable?)
   end
-    
+
   class SessionLimitableUser < User
     devise :session_limitable
     include ::Mongoid::Mappings if DEVISE_ORM == :mongoid
@@ -34,7 +34,7 @@ class TestSessionLimitable < ActiveSupport::TestCase
     assert_nil user.unique_session_id
     user.update_unique_session_id!('unique_value')
     user.reload
-    assert_equal user.unique_session_id, 'unique_value'
+    assert_equal('unique_value', user.unique_session_id)
   end
 
   test '#update_unique_session_id!(value) updates invalid record atomically' do
@@ -45,13 +45,13 @@ class TestSessionLimitable < ActiveSupport::TestCase
     assert_nil user.unique_session_id
     user.update_unique_session_id!('unique_value')
     user.reload
-    assert_equal user.email, 'bob@microsoft.com'
-    assert_equal user.unique_session_id, 'unique_value'
+    assert_equal('bob@microsoft.com', user.email)
+    assert_equal('unique_value', user.unique_session_id)
   end
 
   test '#update_unique_session_id!(value) raises an exception on an unpersisted record' do
     user = User.create
-    assert !user.persisted?
+    assert_not user.persisted?
     assert_raises(Devise::Models::Compatibility::NotPersistedError) { user.update_unique_session_id!('unique_value') }
   end
 end

data/test/tmp/config/initializers/{devise-security.rb → devise_security.rb}

@@ -7,7 +7,9 @@ Devise.setup do |config|
   # Should the password expire (e.g 3.months)
   # config.expire_password_after = false
 
-  # Need 1 char of A-Z, a-z and 0-9
+  # Need 1 char each of: A-Z, a-z, 0-9, and a punctuation mark or symbol
+  # You may use "digits" in place of "digit" and "symbols" in place of
+  # "symbol" based on your preference
   # config.password_complexity = { digit: 1, lower: 1, symbol: 1, upper: 1 }
 
   # How many passwords to keep in archive
@@ -44,4 +46,7 @@ Devise.setup do |config|
 
   # Allow password to equal the email
   # config.allow_passwords_equal_to_email = false
+
+  # paranoid_verification will regenerate verification code after failed attempt
+  # config.paranoid_code_regenerate_after_attempt = 10
 end