devise-security 0.17.0 → 0.18.0

data/test/i18n_test.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+require 'i18n/tasks'
+
+class I18nTest < ActiveSupport::TestCase
+  def setup
+    @i18n = I18n::Tasks::BaseTask.new
+    @missing_keys = @i18n.missing_keys
+  end
+
+  def test_no_missing_keys
+    assert_empty @missing_keys,
+                 "Missing #{@missing_keys.leaves.count} i18n keys, run `i18n-tasks missing' to show them"
+  end
+
+  def test_no_inconsistent_interpolations
+    inconsistent_interpolations = @i18n.inconsistent_interpolations
+    error_message = "#{inconsistent_interpolations.leaves.count} i18n keys have inconsistent interpolations.\n" \
+                    "Please run `i18n-tasks check-consistent-interpolations' to show them"
+    assert_empty inconsistent_interpolations, error_message
+  end
+end

data/test/integration/test_paranoid_verification_code_workflow.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class TestParanoidVerificationCodeWorkflow < ActionDispatch::IntegrationTest
+  include IntegrationHelpers
+
+  setup do
+    @user = User.create!(
+      password: 'passWord1',
+      password_confirmation: 'passWord1',
+      email: 'bob@microsoft.com',
+      paranoid_verification_code: 'cookies'
+    ) # the default verification code is nil
+    @user.confirm
+
+    assert @user.valid?
+    assert @user.need_paranoid_verification?
+  end
+
+  test 'sign in and check paranoid verification code' do
+    sign_in(@user)
+    assert_redirected_to(root_path)
+    follow_redirect!
+    assert_redirected_to(user_paranoid_verification_code_path)
+    # @note This is not the same controller used by Devise for password changes
+    patch '/users/verification_code', params: {
+      user: {
+        paranoid_verification_code: 'cookies'
+      }
+    }
+    assert_redirected_to(root_path)
+    @user.reload
+    assert_not @user.need_paranoid_verification?
+  end
+
+  test 'sign in and paranoid verification code is checked before redirect completes' do
+    sign_in(@user)
+    assert_redirected_to(root_path)
+
+    # simulates an external process verifying the paranoid verification code
+    @user.update(paranoid_verification_code: nil)
+    assert_not @user.need_paranoid_verification?
+
+    follow_redirect!
+    assert_response :success
+
+    # if the paranoid verification code is not empty/nil at this point they will be redirected to the
+    # paranoid verification code change controller.
+    get root_path
+    assert_response :success
+  end
+end

data/test/integration/test_password_expirable_workflow.rb

@@ -26,8 +26,8 @@ class TestPasswordExpirableWorkflow < ActionDispatch::IntegrationTest
       user: {
         current_password: 'passWord1',
         password: 'Password12345!',
-        password_confirmation: 'Password12345!',
-      },
+        password_confirmation: 'Password12345!'
+      }
     }
     assert_redirected_to(root_path)
     @user.reload

data/test/integration/test_session_limitable_workflow.rb

@@ -31,7 +31,7 @@ class TestSessionLimitableWorkflow < ActionDispatch::IntegrationTest
       session.assert_redirected_to '/'
       session.get widgets_path
       session.assert_response(:success)
-      assert_equal session.response.body, 'success'
+      assert_equal('success', session.response.body)
       assert_not_nil @user.reload.unique_session_id
     end
   end
@@ -46,7 +46,7 @@ class TestSessionLimitableWorkflow < ActionDispatch::IntegrationTest
       session.assert_redirected_to '/'
       session.get widgets_path
       session.assert_response(:success)
-      assert_equal session.response.body, 'success'
+      assert_equal('success', session.response.body)
       unique_session_id = @user.reload.unique_session_id
       assert_not_nil unique_session_id
     end
@@ -56,7 +56,7 @@ class TestSessionLimitableWorkflow < ActionDispatch::IntegrationTest
       session.assert_redirected_to '/'
       session.get widgets_path
       session.assert_response(:success)
-      assert_equal session.response.body, 'success'
+      assert_equal('success', session.response.body)
       assert_not_equal unique_session_id, @user.reload.unique_session_id
     end
 

data/test/support/integration_helpers.rb

@@ -6,12 +6,15 @@ module IntegrationHelpers
   # @param session [ActionDispatch::Integration::Session]
   # @return [void]
   def sign_in(user, session = integration_session)
-    session.post new_user_session_path, params: {
-      user: {
-        email: user.email,
-        password: user.password,
-      },
-    }
+    session.post(
+      new_user_session_path,
+      params: {
+        user: {
+          email: user.email,
+          password: user.password
+        }
+      }
+    )
   end
 
   # attempt to login the user with a bad password. This will exercise all the Warden Hooks
@@ -19,11 +22,14 @@ module IntegrationHelpers
   # @param session [ActionDispatch::Integration::Session]
   # @return [void]
   def failed_sign_in(user, session)
-    session.post new_user_session_path, params: {
-      user: {
-        email: user.email,
-        password: 'bad-password',
-      },
-    }
+    session.post(
+      new_user_session_path,
+      params: {
+        user: {
+          email: user.email,
+          password: 'bad-password'
+        }
+      }
+    )
   end
 end

data/test/test_complexity_validator.rb

@@ -37,8 +37,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
-      { password: ["must contain at least one upper-case letter"] }
+      { password: ['must contain at least one upper-case letter'] },
+      model.errors.messages
     )
   end
 
@@ -51,8 +51,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
-      { password: ["must contain at least 2 upper-case letters"] }
+      { password: ['must contain at least 2 upper-case letters'] },
+      model.errors.messages
     )
   end
 
@@ -65,7 +65,7 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages, { password: ["must contain at least one digit"] }
+      { password: ['must contain at least one digit'] }, model.errors.messages
     )
   end
 
@@ -78,7 +78,7 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages, { password: ["must contain at least 2 digits"] }
+      { password: ['must contain at least 2 digits'] }, model.errors.messages
     )
   end
 
@@ -91,7 +91,7 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages, { password: ["must contain at least one digit"] }
+      { password: ['must contain at least one digit'] }, model.errors.messages
     )
   end
 
@@ -104,7 +104,7 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages, { password: ["must contain at least 2 digits"] }
+      { password: ['must contain at least 2 digits'] }, model.errors.messages
     )
   end
 
@@ -117,8 +117,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
-      { password: ["must contain at least one lower-case letter"] }
+      { password: ['must contain at least one lower-case letter'] },
+      model.errors.messages
     )
   end
 
@@ -131,8 +131,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
-      { password: ["must contain at least 2 lower-case letters"] }
+      { password: ['must contain at least 2 lower-case letters'] },
+      model.errors.messages
     )
   end
 
@@ -145,8 +145,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
-      { password: ["must contain at least one punctuation mark or symbol"] }
+      { password: ['must contain at least one punctuation mark or symbol'] },
+      model.errors.messages
     )
   end
 
@@ -159,8 +159,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
-      { password: ["must contain at least 2 punctuation marks or symbols"] }
+      { password: ['must contain at least 2 punctuation marks or symbols'] },
+      model.errors.messages
     )
   end
 
@@ -173,8 +173,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
-      { password: ["must contain at least one punctuation mark or symbol"] }
+      { password: ['must contain at least one punctuation mark or symbol'] },
+      model.errors.messages
     )
   end
 
@@ -187,8 +187,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
-      { password: ["must contain at least 2 punctuation marks or symbols"] }
+      { password: ['must contain at least 2 punctuation marks or symbols'] },
+      model.errors.messages
     )
   end
 
@@ -201,15 +201,15 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
       {
         password:
         [
-          "must contain at least one digit",
-          "must contain at least one punctuation mark or symbol",
-          "must contain at least one upper-case letter"
+          'must contain at least one digit',
+          'must contain at least one punctuation mark or symbol',
+          'must contain at least one upper-case letter'
         ]
-      }
+      },
+      model.errors.messages
     )
   end
 
@@ -218,15 +218,15 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
       {
         password:
         [
-          "must contain at least one digit",
-          "must contain at least one lower-case letter",
-          "must contain at least one punctuation mark or symbol"
+          'must contain at least one digit',
+          'must contain at least one lower-case letter',
+          'must contain at least one punctuation mark or symbol'
         ]
-      }
+      },
+      model.errors.messages
     )
   end
 
@@ -235,15 +235,15 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
       {
         password:
         [
-          "must contain at least one lower-case letter",
-          "must contain at least one punctuation mark or symbol",
-          "must contain at least one upper-case letter"
+          'must contain at least one lower-case letter',
+          'must contain at least one punctuation mark or symbol',
+          'must contain at least one upper-case letter'
         ]
-      }
+      },
+      model.errors.messages
     )
   end
 
@@ -252,15 +252,15 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages,
       {
         password:
         [
-          "must contain at least one digit",
-          "must contain at least one lower-case letter",
-          "must contain at least one upper-case letter"
+          'must contain at least one digit',
+          'must contain at least one lower-case letter',
+          'must contain at least one upper-case letter'
         ]
-      }
+      },
+      model.errors.messages
     )
   end
 
@@ -269,7 +269,8 @@ class PasswordComplexityValidatorTest < ActiveSupport::TestCase
 
     assert_not(model.valid?)
     assert_equal(
-      model.errors.messages, { password: ["must contain at least one digit"] }
+      { password: ['must contain at least one digit'] },
+      model.errors.messages
     )
   end
 

data/test/test_database_authenticatable_patch.rb

@@ -51,7 +51,7 @@ class TestDatabaseAuthenticatablePatch < ActiveSupport::TestCase
       }
     )
 
-    assert_equal(["Current password is invalid"], user.errors.full_messages)
+    assert_equal(['Current password is invalid'], user.errors.full_messages)
   end
 
   test 'does not update if password is missing' do
@@ -71,7 +71,7 @@ class TestDatabaseAuthenticatablePatch < ActiveSupport::TestCase
   test 'does not update if password is invalid and mismatches confirmation' do
     user = create_user
 
-    result = user.update_with_password(
+    user.update_with_password(
       {
         current_password: 'Password1!',
         password: 'f',
@@ -93,7 +93,7 @@ class TestDatabaseAuthenticatablePatch < ActiveSupport::TestCase
   test 'does not update if password is invalid and matches confirmation' do
     user = create_user
 
-    result = user.update_with_password(
+    user.update_with_password(
       {
         current_password: 'Password1!',
         password: 'f',

data/test/test_paranoid_verification.rb

@@ -6,12 +6,12 @@ class TestParanoidVerification < ActiveSupport::TestCase
   test 'need to paranoid verify if code present' do
     user = User.new
     user.generate_paranoid_code
-    assert_equal(true, user.need_paranoid_verification?)
+    assert(user.need_paranoid_verification?)
   end
 
   test 'no need to paranoid verify if no code' do
     user = User.new
-    assert_equal(false, user.need_paranoid_verification?)
+    assert_not(user.need_paranoid_verification?)
   end
 
   test 'generate code' do
@@ -29,23 +29,23 @@ class TestParanoidVerification < ActiveSupport::TestCase
     user.generate_paranoid_code
     # default generator generates 5 char string
     assert_equal(user.paranoid_verification_code.class, String)
-    assert_equal(user.paranoid_verification_code.length, 5)
+    assert_equal(5, user.paranoid_verification_code.length)
   end
 
   test 'when code match upon verify code, should mark record that it\'s no loger needed to verify' do
     user = User.new(paranoid_verification_code: 'abcde')
 
-    assert_equal(true, user.need_paranoid_verification?)
+    assert(user.need_paranoid_verification?)
     user.verify_code('abcde')
-    assert_equal(false, user.need_paranoid_verification?)
+    assert_not(user.need_paranoid_verification?)
   end
 
   test 'when code match upon verify code, should no longer need verification' do
     user = User.new(paranoid_verification_code: 'abcde')
 
-    assert_equal(true, user.need_paranoid_verification?)
+    assert(user.need_paranoid_verification?)
     user.verify_code('abcde')
-    assert_equal(false, user.need_paranoid_verification?)
+    assert_not(user.need_paranoid_verification?)
   end
 
   test 'when code match upon verification code, should set when verification was accepted' do
@@ -57,7 +57,7 @@ class TestParanoidVerification < ActiveSupport::TestCase
   test 'when code not match upon verify code, should still need verification' do
     user = User.new(paranoid_verification_code: 'abcde')
     user.verify_code('wrong')
-    assert_equal(true, user.need_paranoid_verification?)
+    assert(user.need_paranoid_verification?)
   end
 
   test 'when code not match upon verification code, should not set paranoid_verified_at' do

data/test/test_password_expirable.rb

@@ -47,7 +47,7 @@ class TestPasswordArchivable < ActiveSupport::TestCase
 
   test 'saving a record records the time the password was changed' do
     user = User.new email: 'bob@microsoft.com', password: 'Password1', password_confirmation: 'Password1'
-    assert user.password_changed_at.nil?
+    assert_nil user.password_changed_at
     assert_not user.password_change_requested?
     assert_not user.password_expired?
     user.save

data/test/test_secure_validatable.rb

@@ -112,7 +112,7 @@ class TestSecureValidatable < ActiveSupport::TestCase
     user.password_confirmation = nil
 
     assert user.invalid?
-    assert_equal(["Password can't be blank"],user.errors.full_messages)
+    assert_equal(["Password can't be blank"], user.errors.full_messages)
   end
 
   test 'password_confirmation must match password' do
@@ -213,35 +213,27 @@ class TestSecureValidatable < ActiveSupport::TestCase
     options = {
       email: 'bob@microsoft.com',
       password: 'Password1!',
-      password_confirmation: 'Password1!',
+      password_confirmation: 'Password1!'
     }
     User.create!(options)
     user = User.new(options)
 
     assert user.invalid?
-    if DEVISE_ORM == :active_record
-      assert_equal(['Email has already been taken'], user.errors.full_messages)
-    else
-      assert_equal(['Email is already taken'], user.errors.full_messages)
-    end
+    assert_equal(['Email has already been taken'], user.errors.full_messages)
   end
 
   test "new user can't use existing user's email with different casing" do
     options = {
       email: 'bob@microsoft.com',
       password: 'Password1!',
-      password_confirmation: 'Password1!',
+      password_confirmation: 'Password1!'
     }
     User.create!(options)
     options[:email] = 'BOB@MICROSOFT.COM'
     user = User.new(options)
 
     assert user.invalid?
-    if DEVISE_ORM == :active_record
-      assert_equal(['Email has already been taken'], user.errors.full_messages)
-    else
-      assert_equal(['Email is already taken'], user.errors.full_messages)
-    end
+    assert_equal(['Email has already been taken'], user.errors.full_messages)
   end
 
   test 'password cannot equal email for new user' do

data/test/test_session_limitable.rb

@@ -10,13 +10,13 @@ class TestSessionLimitable < ActiveSupport::TestCase
   end
 
   test 'check is not skipped by default' do
-    user = User.create email: 'bob@microsoft.com', password: 'password1', password_confirmation: 'password1'
-    assert_equal(false, user.skip_session_limitable?)
+    user = User.new(email: 'bob@microsoft.com', password: 'password1', password_confirmation: 'password1')
+    assert_not(user.skip_session_limitable?)
   end
 
   test 'default check can be overridden by record instance' do
-    modified_user = ModifiedUser.create email: 'bob2@microsoft.com', password: 'password1', password_confirmation: 'password1'
-    assert_equal(true, modified_user.skip_session_limitable?)
+    modified_user = ModifiedUser.new(email: 'bob2@microsoft.com', password: 'password1', password_confirmation: 'password1')
+    assert(modified_user.skip_session_limitable?)
   end
 
   class SessionLimitableUser < User
@@ -34,7 +34,7 @@ class TestSessionLimitable < ActiveSupport::TestCase
     assert_nil user.unique_session_id
     user.update_unique_session_id!('unique_value')
     user.reload
-    assert_equal user.unique_session_id, 'unique_value'
+    assert_equal('unique_value', user.unique_session_id)
   end
 
   test '#update_unique_session_id!(value) updates invalid record atomically' do
@@ -45,8 +45,8 @@ class TestSessionLimitable < ActiveSupport::TestCase
     assert_nil user.unique_session_id
     user.update_unique_session_id!('unique_value')
     user.reload
-    assert_equal user.email, 'bob@microsoft.com'
-    assert_equal user.unique_session_id, 'unique_value'
+    assert_equal('bob@microsoft.com', user.email)
+    assert_equal('unique_value', user.unique_session_id)
   end
 
   test '#update_unique_session_id!(value) raises an exception on an unpersisted record' do

data/test/tmp/config/initializers/devise_security.rb

@@ -46,4 +46,7 @@ Devise.setup do |config|
 
   # Allow password to equal the email
   # config.allow_passwords_equal_to_email = false
+
+  # paranoid_verification will regenerate verification code after failed attempt
+  # config.paranoid_code_regenerate_after_attempt = 10
 end

data/test/tmp/config/locales/devise.security_extension.by.yml

@@ -31,6 +31,7 @@ by:
     paranoid_verify:
       code_required: 'Калі ласка, увядзіце код, атрыманы ад нашай каманды падтрымкі'
     paranoid_verification_code:
+      updated: Код спраўджання прыняты
       show:
         submit_verification_code: 'Увод кода пацверджання'
         verification_code: 'Код пацверджання'

data/test/tmp/config/locales/devise.security_extension.cs.yml

@@ -7,15 +7,19 @@ cs:
       password_complexity:
         digit:
           one: musí obsahovat alespoň jednu číslici
+          few: musí obsahovat alespoň %{count} číslice
           other: musí obsahovat alespoň %{count} číslice
         lower:
           one: musí obsahovat alespoň jedno malé písmeno
+          few: musí obsahovat alespoň %{count} malé písmena
           other: musí obsahovat alespoň %{count} malé písmena
         symbol:
           one: musí obsahovat alespoň jedno interpunkční znaménko nebo symbol
+          few: musí obsahovat alespoň %{count} interpunkční znaménka nebo symboly
           other: musí obsahovat alespoň %{count} interpunkční znaménka nebo symboly
         upper:
           one: musí obsahovat alespoň jedno velké písmeno
+          few: musí obsahovat alespoň %{count} velké písmena
           other: musí obsahovat alespoň %{count} velké písmena
   devise:
     invalid_captcha: Chybná captcha.
@@ -23,6 +27,7 @@ cs:
     paranoid_verify:
       code_required: Zadejte kód, který poskytla naše podpora
     paranoid_verification_code:
+      updated: Ověřovací kód přijat
       show:
         submit_verification_code: Odeslat ověřovací kód
         verification_code: Ověřovací kód

data/test/tmp/config/locales/devise.security_extension.de.yml

@@ -23,6 +23,7 @@ de:
     paranoid_verify:
       code_required: 'Bitte geben Sie den Code ein, den unser Support-Team zur Verfügung gestellt hat.'
     paranoid_verification_code:
+      updated: Bestätigungscode akzeptiert
       show:
         submit_verification_code: Bestätigungscode eingeben
         verification_code: Bestätigungscode

data/test/tmp/config/locales/devise.security_extension.es.yml

@@ -22,9 +22,21 @@ es:
     invalid_security_question: 'La respuesta a la pregunta de seguridad fue incorrecta.'
     paranoid_verify:
       code_required: 'Por favor ingrese el código provisto por nuestro equipo de soporte'
+    paranoid_verification_code:
+      updated: Se acepta el código de verificación
+      show:
+        submit_verification_code: Envíe el código de verificación
+        verification_code: Código de verificación
+        submit: Entregar
     password_expired:
       updated: 'Su nueva contraseña ha sido guardada.'
       change_required: 'Su contraseña ha expirado. Por favor renueve su contraseña.'
+      show:
+        renew_your_password: Renueve su contraseña
+        current_password: Actual contraseña
+        new_password: Nueva contraseña
+        new_password_confirmation: Confirmar nueva contraseña
+        change_my_password: Cambiar mi contraseña
     failure:
       session_limited: 'Sus credenciales de inicio de sesión fueron usadas en otro navegador. Por favor inicie sesión nuevamente para continuar en este navegador.'
       expired: 'Su cuenta ha expirado debido a inactividad. Por favor contacte al administrador de la aplicación.'

data/test/tmp/config/locales/devise.security_extension.fa.yml

@@ -23,6 +23,7 @@ fa:
     paranoid_verify:
       code_required: 'لطفاً کدی را که تیم پشتیبانی ما ارائه کرده است وارد کنید'
     paranoid_verification_code:
+      updated: کد تأیید پذیرفته شد
       show:
         submit_verification_code: ارسال کد تاییدیه
         verification_code: کد تاییدیه