devise 1.0.11 → 1.1.0

data/test/integration/http_authenticatable_test.rb

@@ -1,12 +1,11 @@
-require 'test/test_helper'
+require 'test_helper'
 
 class HttpAuthenticationTest < ActionController::IntegrationTest
 
   test 'sign in should authenticate with http' do
     sign_in_as_new_user_with_http
     assert_response :success
-    assert_template 'users/index'
-    assert_contain 'Welcome'
+    assert_match '<email>user@test.com</email>', response.body
     assert warden.authenticated?(:user)
   end
 
@@ -17,11 +16,10 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
   end
 
   test 'uses the request format as response content type' do
-    sign_in_as_new_user_with_http("unknown", "123456", :xml)
+    sign_in_as_new_user_with_http("unknown")
     assert_equal 401, status
-    assert_equal "application/xml", headers["Content-Type"]
-    # Cannot assert this due to a bug between integration tests and rack on 2.3
-    # assert response.body.include?("<error>HTTP Basic: Access denied.</error>")
+    assert_equal "application/xml; charset=utf-8", headers["Content-Type"]
+    assert_match "<error>Invalid email or password.</error>", response.body
   end
 
   test 'returns a custom response with www-authenticate and chosen realm' do
@@ -34,19 +32,18 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
 
   test 'sign in should authenticate with http even with specific authentication keys' do
     swap Devise, :authentication_keys => [:username] do
-      sign_in_as_new_user_with_http "usertest"
+      sign_in_as_new_user_with_http("usertest")
       assert_response :success
-      assert_template 'users/index'
-      assert_contain 'Welcome'
+      assert_match '<email>user@test.com</email>', response.body
       assert warden.authenticated?(:user)
     end
   end
 
   private
 
-    def sign_in_as_new_user_with_http(username="user@test.com", password="123456", format=:html)
+    def sign_in_as_new_user_with_http(username="user@test.com", password="123456")
       user = create_user
-      get users_path(:format => format), {}, :authorization => "Basic #{ActiveSupport::Base64.encode64("#{username}:#{password}")}"
+      get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{username}:#{password}")}"
       user
     end
 end

data/test/integration/lockable_test.rb

@@ -1,4 +1,4 @@
-require 'test/test_helper'
+require 'test_helper'
 
 class LockTest < ActionController::IntegrationTest
   
@@ -11,7 +11,7 @@ class LockTest < ActionController::IntegrationTest
     ActionMailer::Base.deliveries.clear
 
     visit new_user_session_path
-    click_link 'Didn\'t receive unlock instructions?'
+    click_link "Didn't receive unlock instructions?"
 
     fill_in 'email', :with => user.email
     click_button 'Resend unlock instructions'
@@ -26,7 +26,7 @@ class LockTest < ActionController::IntegrationTest
     ActionMailer::Base.deliveries.clear
 
     visit new_user_session_path
-    click_link 'Didn\'t receive unlock instructions?'
+    click_link "Didn't receive unlock instructions?"
 
     fill_in 'email', :with => user.email
     click_button 'Resend unlock instructions'
@@ -37,21 +37,26 @@ class LockTest < ActionController::IntegrationTest
   end
 
   test 'unlocked pages should not be available if email strategy is disabled' do
-    visit new_user_unlock_path
-    assert_response :success
+    visit "/admins/sign_in"
+
+    assert_raise Webrat::NotFoundError do
+      click_link "Didn't receive unlock instructions?"
+    end
 
-    swap Devise, :unlock_strategy => :time do
-      visit new_user_unlock_path
-      assert_response :not_found
+    assert_raise NameError do
+      visit new_admin_unlock_path
     end
+
+    visit "/admins/unlock/new"
+    assert_response :not_found
   end
 
   test 'user with invalid unlock token should not be able to unlock an account' do
     visit_user_unlock_with_token('invalid_token')
 
     assert_response :success
-    assert_template 'unlocks/new'
-    assert_have_selector '#errorExplanation'
+    assert_current_url '/users/unlock?unlock_token=invalid_token'
+    assert_have_selector '#error_explanation'
     assert_contain /Unlock token(.*)invalid/
   end
 
@@ -61,7 +66,7 @@ class LockTest < ActionController::IntegrationTest
 
     visit_user_unlock_with_token(user.unlock_token)
 
-    assert_template 'home/index'
+    assert_current_url '/'
     assert_contain 'Your account was successfully unlocked.'
 
     assert_not user.reload.access_locked?
@@ -82,19 +87,21 @@ class LockTest < ActionController::IntegrationTest
 
   test "user should not send a new e-mail if already locked" do
     user = create_user(:locked => true)
-    user.update_attribute(:failed_attempts, User.maximum_attempts + 1)
+    user.failed_attempts = User.maximum_attempts + 1
+    user.save!
+
     ActionMailer::Base.deliveries.clear
 
     sign_in_as_user(:password => "invalid")
-    assert_contain 'Invalid email or password.'
+    assert_contain 'Your account is locked.'
     assert ActionMailer::Base.deliveries.empty?
   end
 
   test 'error message is configurable by resource name' do
     store_translations :en, :devise => {
-      :sessions => { :admin => { :locked => "You are locked!" } }
+      :failure => { :user => { :locked => "You are locked!" } }
     } do
-      get new_admin_session_path(:locked => true)
+      user = sign_in_as_user(:locked => true)
       assert_contain 'You are locked!'
     end
   end

data/test/integration/recoverable_test.rb

@@ -1,10 +1,10 @@
-require 'test/test_helper'
+require 'test_helper'
 
 class PasswordTest < ActionController::IntegrationTest
 
   def visit_new_password_path
     visit new_user_session_path
-    click_link 'Forgot password?'
+    click_link 'Forgot your password?'
   end
 
   def request_forgot_password(&block)
@@ -77,7 +77,7 @@ class PasswordTest < ActionController::IntegrationTest
 
     assert_response :success
     assert_template 'passwords/edit'
-    assert_have_selector '#errorExplanation'
+    assert_have_selector '#error_explanation'
     assert_contain /Reset password token(.*)invalid/
     assert_not user.reload.valid_password?('987654321')
   end
@@ -91,7 +91,7 @@ class PasswordTest < ActionController::IntegrationTest
 
     assert_response :success
     assert_template 'passwords/edit'
-    assert_have_selector '#errorExplanation'
+    assert_have_selector '#error_explanation'
     assert_contain 'Password doesn\'t match confirmation'
     assert_not user.reload.valid_password?('987654321')
   end
@@ -113,7 +113,7 @@ class PasswordTest < ActionController::IntegrationTest
       fill_in 'Password confirmation', :with => 'other_password'
     end
     assert_response :success
-    assert_have_selector '#errorExplanation'
+    assert_have_selector '#error_explanation'
     assert_not user.reload.valid_password?('987654321')
 
     reset_password :reset_password_token => user.reload.reset_password_token, :visit => false
@@ -134,7 +134,7 @@ class PasswordTest < ActionController::IntegrationTest
     request_forgot_password
     reset_password :reset_password_token => user.reload.reset_password_token
 
-    assert_redirected_to new_user_session_path(:unconfirmed => true)
+    assert_equal new_user_session_path, @request.path
     assert !warden.authenticated?(:user)
   end
 

data/test/integration/registerable_test.rb

@@ -1,9 +1,9 @@
-require 'test/test_helper'
+require 'test_helper'
 
 class RegistrationTest < ActionController::IntegrationTest
 
   test 'a guest admin should be able to sign in successfully' do
-    visit new_admin_session_path
+    get new_admin_session_path
     click_link 'Sign up'
 
     assert_template 'registrations/new'
@@ -16,38 +16,31 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_contain 'You have signed up successfully.'
     assert warden.authenticated?(:admin)
 
-    admin = Admin.last
+    admin = Admin.last :order => "id"
     assert_equal admin.email, 'new_user@test.com'
   end
 
   test 'a guest user should be able to sign up successfully and be blocked by confirmation' do
-    visit new_user_registration_path
+    get new_user_registration_path
 
     fill_in 'email', :with => 'new_user@test.com'
     fill_in 'password', :with => 'new_user123'
     fill_in 'password confirmation', :with => 'new_user123'
     click_button 'Sign up'
 
-    assert_equal "You have signed up successfully. If enabled, a confirmation was sent to your e-mail.", @controller.send(:flash)[:notice]
-
-    # For some reason flash is not being set correctly, so instead of getting the
-    # "signed_up" message we get the unconfirmed one. Seems to be an issue with
-    # the internal redirect by the hook and the tests.
-    # follow_redirect!
-    # assert_contain 'You have signed up successfully.'
-    # assert_not_contain 'confirm your account'
-
-    follow_redirect!
+    assert_contain 'You have signed up successfully'
     assert_contain 'Sign in'
+    assert_not_contain 'You have to confirm your account before continuing'
+
     assert_not warden.authenticated?(:user)
 
-    user = User.last
+    user = User.last :order => "id"
     assert_equal user.email, 'new_user@test.com'
     assert_not user.confirmed?
   end
 
   test 'a guest user cannot sign up with invalid information' do
-    visit new_user_registration_path
+    get new_user_registration_path
 
     fill_in 'email', :with => 'invalid_email'
     fill_in 'password', :with => 'new_user123'
@@ -55,7 +48,7 @@ class RegistrationTest < ActionController::IntegrationTest
     click_button 'Sign up'
 
     assert_template 'registrations/new'
-    assert_have_selector '#errorExplanation'
+    assert_have_selector '#error_explanation'
     assert_contain "Email is invalid"
     assert_contain "Password doesn't match confirmation"
     assert_nil User.first
@@ -65,55 +58,71 @@ class RegistrationTest < ActionController::IntegrationTest
 
   test 'a guest should not sign up with email/password that already exists' do
     user = create_user
-    visit new_user_registration_path
+    get new_user_registration_path
 
     fill_in 'email', :with => 'user@test.com'
     fill_in 'password', :with => '123456'
     fill_in 'password confirmation', :with => '123456'
     click_button 'Sign up'
 
-    assert_template 'registrations/new'
-    assert_contain 'Email has already been taken'
+    assert_current_url '/users'
+    assert_contain(/Email .* already .* taken/)
 
     assert_not warden.authenticated?(:user)
   end
 
   test 'a guest should not be able to change account' do
-    visit edit_user_registration_path
+    get edit_user_registration_path
+    assert_redirected_to new_user_session_path
     follow_redirect!
-    assert_template 'sessions/new'
+    assert_contain 'You need to sign in or sign up before continuing.'
   end
 
   test 'a signed in user should not be able to access sign up' do
     sign_in_as_user
-    visit new_user_registration_path
-    assert_template 'home/index'
+    get new_user_registration_path
+    assert_redirected_to root_path
   end
 
   test 'a signed in user should be able to edit his account' do
     sign_in_as_user
-    visit edit_user_registration_path
+    get edit_user_registration_path
 
     fill_in 'email', :with => 'user.new@email.com'
     fill_in 'current password', :with => '123456'
     click_button 'Update'
 
-    assert_template 'home/index'
+    assert_current_url '/'
     assert_contain 'You updated your account successfully.'
 
     assert_equal "user.new@email.com", User.first.email
   end
 
+  test 'a signed in user should not change his current user with invalid password' do
+    sign_in_as_user
+    get edit_user_registration_path
+
+    fill_in 'email', :with => 'user.new@email.com'
+    fill_in 'current password', :with => 'invalid'
+    click_button 'Update'
+
+    assert_template 'registrations/edit'
+    assert_contain 'user@test.com'
+    assert_have_selector 'form input[value="user.new@email.com"]'
+
+    assert_equal "user@test.com", User.first.email
+  end
+
   test 'a signed in user should be able to edit his password' do
     sign_in_as_user
-    visit edit_user_registration_path
+    get edit_user_registration_path
 
     fill_in 'password', :with => 'pas123'
     fill_in 'password confirmation', :with => 'pas123'
     fill_in 'current password', :with => '123456'
     click_button 'Update'
 
-    assert_template 'home/index'
+    assert_current_url '/'
     assert_contain 'You updated your account successfully.'
 
     assert User.first.valid_password?('pas123')
@@ -122,23 +131,23 @@ class RegistrationTest < ActionController::IntegrationTest
   test 'a signed in user should not be able to edit his password with invalid confirmation' do
     sign_in_as_user
     get edit_user_registration_path
-  
+
     fill_in 'password', :with => 'pas123'
     fill_in 'password confirmation', :with => ''
     fill_in 'current password', :with => '123456'
     click_button 'Update'
-  
+
     assert_contain "Password doesn't match confirmation"
     assert_not User.first.valid_password?('pas123')
   end
 
   test 'a signed in user should be able to cancel his account' do
     sign_in_as_user
-    visit edit_user_registration_path
+    get edit_user_registration_path
 
-    click_link "Cancel my account"
+    click_link "Cancel my account", :method => :delete
     assert_contain "Bye! Your account was successfully cancelled. We hope to see you again soon."
 
     assert User.all.empty?
   end
-end
+end

data/test/integration/rememberable_test.rb

@@ -1,23 +1,51 @@
-require 'test/test_helper'
+require 'test_helper'
 
 class RememberMeTest < ActionController::IntegrationTest
 
   def create_user_and_remember(add_to_token='')
-    Devise.remember_for = 1
     user = create_user
     user.remember_me!
-    cookies['remember_user_token'] = User.serialize_into_cookie(user) + add_to_token
+    raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
+    cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
     user
   end
 
+  def generate_signed_cookie(raw_cookie)
+    request = ActionDispatch::TestRequest.new
+    request.cookie_jar.signed['raw_cookie'] = raw_cookie
+    request.cookie_jar['raw_cookie']
+  end
+
+  def signed_cookie(key)
+    controller.send(:cookies).signed[key]
+  end
+
+  def cookie_expires(key)
+    cookie = response.headers["Set-Cookie"].split("\n").grep(/^#{key}/).first
+    cookie.split(";").map(&:strip).grep(/^expires=/)
+    Time.parse($')
+  end
+
   test 'do not remember the user if he has not checked remember me option' do
     user = sign_in_as_user
+    assert_nil request.cookies["remember_user_cookie"]
     assert_nil user.reload.remember_token
   end
 
   test 'generate remember token after sign in' do
     user = sign_in_as_user :remember_me => true
-    assert_not_nil user.reload.remember_token
+    assert request.cookies["remember_user_token"]
+    assert user.reload.remember_token
+  end
+
+  test 'generate remember token after sign in setting cookie domain' do
+    # We test this by asserting the cookie is not sent after the redirect
+    # since we changed the domain. This is the only difference with the
+    # previous test.
+    swap User, :cookie_domain => "omg.somewhere.com" do
+      user = sign_in_as_user :remember_me => true
+      assert_nil request.cookies["remember_user_token"]
+    end
   end
 
   test 'remember the user before sign in' do
@@ -28,7 +56,51 @@ class RememberMeTest < ActionController::IntegrationTest
     assert warden.user(:user) == user
   end
 
-  test 'does not remember other scopes' do
+  test 'does not extend remember period through sign in' do
+    swap Devise, :extend_remember_period => true, :remember_for => 1.year do
+      user = create_user
+      user.remember_me!
+
+      user.remember_created_at = old = 10.days.ago
+      user.save
+
+      sign_in_as_user :remember_me => true
+      user.reload
+
+      assert warden.user(:user) == user
+      assert_equal old.to_i, user.remember_created_at.to_i
+    end
+  end
+
+  test 'if both extend_remember_period and remember_across_browsers are true, sends the same token with a new expire date' do
+    swap Devise, :remember_across_browsers => true, :extend_remember_period => true, :remember_for => 1.year do
+      user  = create_user_and_remember
+      token = user.remember_token
+
+      user.remember_created_at = old = 10.minutes.ago
+      user.save!
+
+      get users_path
+      assert (cookie_expires("remember_user_token") - 1.year) > (old + 5.minutes)
+      assert_equal token, signed_cookie("remember_user_token").last
+    end
+  end
+
+  test 'if both extend_remember_period and remember_across_browsers are false, sends a new token with old expire date' do
+    swap Devise, :remember_across_browsers => false, :extend_remember_period => false, :remember_for => 1.year do
+      user  = create_user_and_remember
+      token = user.remember_token
+
+      user.remember_created_at = old = 10.minutes.ago
+      user.save!
+
+      get users_path
+      assert (cookie_expires("remember_user_token") - 1.year) < (old + 5.minutes)
+      assert_not_equal token, signed_cookie("remember_user_token").last
+    end
+  end
+
+  test 'do not remember other scopes' do
     user = create_user_and_remember
     get root_path
     assert_response :success
@@ -39,16 +111,17 @@ class RememberMeTest < ActionController::IntegrationTest
   test 'do not remember with invalid token' do
     user = create_user_and_remember('add')
     get users_path
-    assert_response :success
     assert_not warden.authenticated?(:user)
+    assert_redirected_to new_user_session_path
   end
 
-  test 'do not remember with token expired' do
+  test 'do not remember with expired token' do
     user = create_user_and_remember
-    Devise.remember_for = 0
-    get users_path
-    assert_response :success
-    assert_not warden.authenticated?(:user)
+    swap Devise, :remember_for => 0 do
+      get users_path
+      assert_not warden.authenticated?(:user)
+      assert_redirected_to new_user_session_path
+    end
   end
 
   test 'forget the user before sign out' do
@@ -67,16 +140,5 @@ class RememberMeTest < ActionController::IntegrationTest
     get destroy_user_session_path
     get users_path
     assert_not warden.authenticated?(:user)
-    assert_equal cookies['remember_user_token'], ''
-  end
-
-  test 'cookies are destroyed on unverified requests' do
-    swap HomeController, :allow_forgery_protection => true do
-      user = create_user_and_remember
-      get users_path
-      assert warden.authenticated?(:user)
-      post root_path, :authenticity_token => 'INVALID'
-      assert_not warden.authenticated?(:user)
-    end
   end
 end

data/test/integration/timeoutable_test.rb

@@ -1,4 +1,4 @@
-require 'test/test_helper'
+require 'test_helper'
 
 class SessionTimeoutTest < ActionController::IntegrationTest
 
@@ -32,10 +32,22 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert_not_nil last_request_at
 
     get users_path
-    assert_redirected_to new_user_session_path(:timeout => true)
+    assert_redirected_to new_user_session_path
     assert_not warden.authenticated?(:user)
   end
 
+  test 'time out is not triggered on sign out' do
+    user = sign_in_as_user
+    get expire_user_path(user)
+
+    get destroy_user_session_path
+    assert_response :redirect
+    assert_redirected_to root_path
+
+    follow_redirect!
+    assert_contain 'Signed out successfully'
+  end
+
   test 'user configured timeout limit' do
     swap Devise, :timeout_in => 8.minutes do
       user = sign_in_as_user
@@ -47,14 +59,14 @@ class SessionTimeoutTest < ActionController::IntegrationTest
 
       get expire_user_path(user)
       get users_path
-      assert_redirected_to new_user_session_path(:timeout => true)
+      assert_redirected_to new_user_session_path
       assert_not warden.authenticated?(:user)
     end
   end
 
   test 'error message with i18n' do
     store_translations :en, :devise => {
-      :sessions => { :user => { :timeout => 'Session expired!' } }
+      :failure => { :user => { :timeout => 'Session expired!' } }
     } do
       user = sign_in_as_user
 

data/test/integration/token_authenticatable_test.rb

@@ -1,10 +1,10 @@
-require 'test/test_helper'
+require 'test_helper'
 
 class TokenAuthenticationTest < ActionController::IntegrationTest
 
-  test 'sign in should authenticate with valid authentication token and proper authentication token key' do
+  test 'authenticate with valid authentication token key and value through params' do
     swap Devise, :token_authentication_key => :secret_token do
-      sign_in_as_new_user_with_token(:auth_token_key => :secret_token)
+      sign_in_as_new_user_with_token
 
       assert_response :success
       assert_template 'users/index'
@@ -13,11 +13,40 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
     end
   end
 
-  test 'signing in with valid authentication token - but improper authentication token key - return to sign in form with error message' do
+  test 'authenticate with valid authentication token key and value through http' do
+    swap Devise, :token_authentication_key => :secret_token do
+      sign_in_as_new_user_with_token(:http_auth => true)
+
+      assert_response :success
+      assert_match '<email>user@test.com</email>', response.body
+      assert warden.authenticated?(:user)
+    end
+  end
+
+  test 'does authenticate with valid authentication token key and value through params if not configured' do
+    swap Devise, :token_authentication_key => :secret_token, :params_authenticatable => [:database] do
+      sign_in_as_new_user_with_token
+
+      assert_contain 'You need to sign in or sign up before continuing'
+      assert_contain 'Sign in'
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
+  test 'does authenticate with valid authentication token key and value through http if not configured' do
+    swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => [:database] do
+      sign_in_as_new_user_with_token(:http_auth => true)
+
+      assert_response 401
+      assert_contain 'Invalid email or password.'
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
+  test 'does not authenticate with improper authentication token key' do
     swap Devise, :token_authentication_key => :donald_duck_token do
       sign_in_as_new_user_with_token(:auth_token_key => :secret_token)
-      assert_redirected_to new_user_session_path(:unauthenticated => true)
-      follow_redirect!
+      assert_equal new_user_session_path, @request.path
 
       assert_contain 'You need to sign in or sign up before continuing'
       assert_contain 'Sign in'
@@ -25,13 +54,11 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
     end
   end
 
-  test 'signing in with invalid authentication token should return to sign in form with error message' do
-    store_translations :en, :devise => {:sessions => {:invalid_token => 'LOL, that was not a single character correct.'}} do
+  test 'does not authenticate with improper authentication token value' do
+    store_translations :en, :devise => {:failure => {:invalid_token => 'LOL, that was not a single character correct.'}} do
       sign_in_as_new_user_with_token(:auth_token => '*** INVALID TOKEN ***')
-      assert_redirected_to new_user_session_path(:invalid_token => true)
-      follow_redirect!
+      assert_equal new_user_session_path, @request.path
 
-      assert_response :success
       assert_contain 'LOL, that was not a single character correct.'
       assert_contain 'Sign in'
       assert_not warden.authenticated?(:user)
@@ -48,7 +75,13 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       user.authentication_token = VALID_AUTHENTICATION_TOKEN
       user.save
 
-      visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
+      if options[:http_auth]
+        header = "Basic #{ActiveSupport::Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
+        get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
+      else
+        visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
+      end
+
       user
     end
 

data/test/integration/trackable_test.rb

@@ -1,4 +1,4 @@
-require 'test/test_helper'
+require 'test_helper'
 
 class TrackableHooksTest < ActionController::IntegrationTest