devise 1.1.3 → 1.2.0

data/test/integration/database_authenticatable_test.rb

@@ -1,6 +1,28 @@
 require 'test_helper'
 
 class DatabaseAuthenticationTest < ActionController::IntegrationTest
+  test 'sign in with email of different case should succeed when email is in the list of case insensitive keys' do
+    create_user(:email => 'Foo@Bar.com')
+    
+    sign_in_as_user do
+      fill_in 'email', :with => 'foo@bar.com'
+    end
+    
+    assert warden.authenticated?(:user)
+  end
+
+  test 'sign in with email of different case should fail when email is NOT the list of case insensitive keys' do
+    swap Devise, :case_insensitive_keys => [] do
+      create_user(:email => 'Foo@Bar.com')
+      
+      sign_in_as_user do
+        fill_in 'email', :with => 'foo@bar.com'
+      end
+      
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
   test 'sign in should not authenticate if not using proper authentication keys' do
     swap Devise, :authentication_keys => [:username] do
       sign_in_as_user

data/test/integration/http_authenticatable_test.rb

@@ -47,6 +47,16 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
     end
   end
 
+  test 'sign in should authenticate with really long token' do
+    token = "token_containing_so_many_characters_that_the_base64_encoding_will_wrap"
+    user = create_user
+    user.update_attribute :authentication_token, token
+    get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{token}:x")}"
+    assert_response :success
+    assert_match "<email>user@test.com</email>", response.body
+    assert warden.authenticated?(:user)
+  end
+
   private
 
     def sign_in_as_new_user_with_http(username="user@test.com", password="123456")
@@ -54,11 +64,11 @@ class HttpAuthenticationTest < ActionController::IntegrationTest
       get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("#{username}:#{password}")}"
       user
     end
-    
+
     # Sign in with oauth2 token. This is just to test that it isn't misinterpreted as basic authentication
     def add_oauth2_header
       user = create_user
       get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => "OAuth #{ActiveSupport::Base64.encode64("#{user.email}:123456")}"
     end
 
-end
+end

data/test/integration/omniauthable_test.rb

@@ -0,0 +1,138 @@
+require 'test_helper'
+
+class OmniauthableIntegrationTest < ActionController::IntegrationTest
+  FACEBOOK_INFO = {
+    "id" => '12345',
+    "link" => 'http://facebook.com/josevalim',
+    "email" => 'user@example.com',
+    "first_name" => 'Jose',
+    "last_name" => 'Valim',
+    "website" => 'http://blog.plataformatec.com.br'
+  }
+
+  setup do
+    OmniAuth.config.test_mode = true
+    stub_facebook!
+  end
+
+  teardown do
+    OmniAuth.config.test_mode = false
+  end
+
+  def stub_facebook!
+    OmniAuth.config.mock_auth[:facebook] = {
+      "uid" => '12345',
+      "provider" => 'facebook',
+      "user_info" => {"nickname" => 'josevalim'},
+      "credentials" => {"token" => 'plataformatec'},
+      "extra" => {"user_hash" => FACEBOOK_INFO}
+    }
+  end
+
+  def stub_action!(name)
+    Users::OmniauthCallbacksController.class_eval do
+      alias_method :__old_facebook, :facebook
+      alias_method :facebook, name
+    end
+    yield
+  ensure
+    Users::OmniauthCallbacksController.class_eval do
+      alias_method :facebook, :__old_facebook
+    end
+  end
+
+  test "can access omniauth.auth in the env hash" do
+    visit "/users/sign_in"
+    click_link "Sign in with Facebook"
+
+    json = ActiveSupport::JSON.decode(response.body)
+
+    assert_equal "12345",         json["uid"]
+    assert_equal "facebook",      json["provider"]
+    assert_equal "josevalim",     json["user_info"]["nickname"]
+    assert_equal FACEBOOK_INFO,   json["extra"]["user_hash"]
+    assert_equal "plataformatec", json["credentials"]["token"]
+  end
+
+  test "cleans up session on sign up" do
+    assert_no_difference "User.count" do
+      visit "/users/sign_in"
+      click_link "Sign in with Facebook"
+    end
+
+    assert session["devise.facebook_data"]
+
+    assert_difference "User.count" do
+      visit "/users/sign_up"
+      fill_in "Password", :with => "123456"
+      fill_in "Password confirmation", :with => "123456"
+      click_button "Sign up"
+    end
+
+    assert_current_url "/"
+    assert_contain "You have signed up successfully."
+    assert_contain "Hello User user@example.com"
+    assert_not session["devise.facebook_data"]
+  end
+
+  test "cleans up session on cancel" do
+    assert_no_difference "User.count" do
+      visit "/users/sign_in"
+      click_link "Sign in with Facebook"
+    end
+
+    assert session["devise.facebook_data"]
+    visit "/users/cancel"
+    assert !session["devise.facebook_data"]
+  end
+
+  test "cleans up session on sign in" do
+    assert_no_difference "User.count" do
+      visit "/users/sign_in"
+      click_link "Sign in with Facebook"
+    end
+
+    assert session["devise.facebook_data"]
+    user = sign_in_as_user
+    assert !session["devise.facebook_data"]
+  end
+
+  test "sign in and send remember token if configured" do
+    visit "/users/sign_in"
+    click_link "Sign in with Facebook"
+    assert_nil warden.cookies["remember_user_token"]
+
+    stub_action!(:sign_in_facebook) do
+      create_user
+      visit "/users/sign_in"
+      click_link "Sign in with Facebook"
+      assert warden.authenticated?(:user)
+      assert warden.cookies["remember_user_token"]
+    end
+  end
+
+  test "generates a proper link when SCRIPT_NAME is set" do
+    header 'SCRIPT_NAME', '/q'
+    visit "/users/sign_in"
+    click_link "Sign in with Facebook"
+
+    assert_equal '/q/users/auth/facebook', current_url
+  end
+
+  test "handles callback error parameter according to the specification" do
+    OmniAuth.config.mock_auth[:facebook] = :access_denied
+    visit "/users/auth/facebook/callback?error=access_denied"
+    assert_current_url "/users/sign_in"
+    assert_contain 'Could not authorize you from Facebook because "Access denied".'
+  end
+
+  test "handles other exceptions from omniauth" do
+    OmniAuth.config.mock_auth[:facebook] = :invalid_credentials
+
+    visit "/users/sign_in"
+    click_link "Sign in with facebook"
+
+    assert_current_url "/users/sign_in"
+    assert_contain 'Could not authorize you from Facebook because "Invalid credentials".'
+  end
+end

data/test/integration/recoverable_test.rb

@@ -9,9 +9,7 @@ class PasswordTest < ActionController::IntegrationTest
 
   def request_forgot_password(&block)
     visit_new_password_path
-
     assert_response :success
-    assert_template 'passwords/new'
     assert_not warden.authenticated?(:user)
 
     fill_in 'email', :with => 'user@test.com'
@@ -19,19 +17,42 @@ class PasswordTest < ActionController::IntegrationTest
     click_button 'Send me reset password instructions'
   end
 
-  def reset_password(options={}, &block)
-    unless options[:visit] == false
-      visit edit_user_password_path(:reset_password_token => options[:reset_password_token])
-    end
+  def reset_password(options={}, &block)    
+    visit edit_user_password_path(:reset_password_token => options[:reset_password_token]) unless options[:visit] == false
     assert_response :success
-    assert_template 'passwords/edit'
 
-    fill_in 'Password', :with => '987654321'
-    fill_in 'Password confirmation', :with => '987654321'
+    fill_in 'New password', :with => '987654321'
+    fill_in 'Confirm new password', :with => '987654321'
     yield if block_given?
     click_button 'Change my password'
   end
 
+  test 'reset password with email of different case should succeed when email is in the list of case insensitive keys' do
+    create_user(:email => 'Foo@Bar.com')
+    
+    request_forgot_password do
+      fill_in 'email', :with => 'foo@bar.com'
+    end
+    
+    assert_current_url '/users/sign_in'
+    assert_contain 'You will receive an email with instructions about how to reset your password in a few minutes.'
+  end
+
+  test 'reset password with email of different case should fail when email is NOT the list of case insensitive keys' do
+    swap Devise, :case_insensitive_keys => [] do
+      create_user(:email => 'Foo@Bar.com')
+      
+      request_forgot_password do
+        fill_in 'email', :with => 'foo@bar.com'
+      end
+      
+      assert_response :success
+      assert_current_url '/users/password'
+      assert_have_selector "input[type=email][value='foo@bar.com']"
+      assert_contain 'not found'
+    end
+  end
+
   test 'authenticated user should not be able to visit forgot password page' do
     sign_in_as_user
     assert warden.authenticated?(:user)
@@ -46,7 +67,7 @@ class PasswordTest < ActionController::IntegrationTest
     create_user
     request_forgot_password
 
-    assert_template 'sessions/new'
+    assert_current_url '/users/sign_in'
     assert_contain 'You will receive an email with instructions about how to reset your password in a few minutes.'
   end
 
@@ -56,16 +77,14 @@ class PasswordTest < ActionController::IntegrationTest
     end
 
     assert_response :success
-    assert_template 'passwords/new'
-    assert_have_selector 'input[type=text][value=\'invalid.test@test.com\']'
-    assert_contain 'Email not found'
+    assert_current_url '/users/password'
+    assert_have_selector "input[type=email][value='invalid.test@test.com']"
+    assert_contain 'not found'
   end
 
   test 'authenticated user should not be able to visit edit password page' do
     sign_in_as_user
-
     get edit_user_password_path
-
     assert_response :redirect
     assert_redirected_to root_path
     assert warden.authenticated?(:user)
@@ -76,7 +95,7 @@ class PasswordTest < ActionController::IntegrationTest
     reset_password :reset_password_token => 'invalid_reset_password'
 
     assert_response :success
-    assert_template 'passwords/edit'
+    assert_current_url '/users/password'
     assert_have_selector '#error_explanation'
     assert_contain /Reset password token(.*)invalid/
     assert_not user.reload.valid_password?('987654321')
@@ -86,11 +105,11 @@ class PasswordTest < ActionController::IntegrationTest
     user = create_user
     request_forgot_password
     reset_password :reset_password_token => user.reload.reset_password_token do
-      fill_in 'Password confirmation', :with => 'other_password'
+      fill_in 'Confirm new password', :with => 'other_password'
     end
 
     assert_response :success
-    assert_template 'passwords/edit'
+    assert_current_url '/users/password'
     assert_have_selector '#error_explanation'
     assert_contain 'Password doesn\'t match confirmation'
     assert_not user.reload.valid_password?('987654321')
@@ -101,7 +120,7 @@ class PasswordTest < ActionController::IntegrationTest
     request_forgot_password
     reset_password :reset_password_token => user.reload.reset_password_token
 
-    assert_template 'home/index'
+    assert_current_url '/'
     assert_contain 'Your password was changed successfully.'
     assert user.reload.valid_password?('987654321')
   end
@@ -110,7 +129,7 @@ class PasswordTest < ActionController::IntegrationTest
     user = create_user
     request_forgot_password
     reset_password :reset_password_token => user.reload.reset_password_token do
-      fill_in 'Password confirmation', :with => 'other_password'
+      fill_in 'Confirm new password', :with => 'other_password'
     end
     assert_response :success
     assert_have_selector '#error_explanation'

data/test/integration/registerable_test.rb

@@ -13,13 +13,29 @@ class RegistrationTest < ActionController::IntegrationTest
     fill_in 'password confirmation', :with => 'new_user123'
     click_button 'Sign up'
 
-    assert_contain 'You have signed up successfully.'
+    assert_contain 'Welcome! You have signed up successfully.'
     assert warden.authenticated?(:admin)
+    assert_current_url "/admin_area/home"
 
     admin = Admin.last :order => "id"
     assert_equal admin.email, 'new_user@test.com'
   end
 
+  test 'a guest admin should be able to sign in and be redirected to a custom location' do
+    Devise::RegistrationsController.any_instance.stubs(:after_sign_up_path_for).returns("/?custom=1")
+    get new_admin_session_path
+    click_link 'Sign up'
+
+    fill_in 'email', :with => 'new_user@test.com'
+    fill_in 'password', :with => 'new_user123'
+    fill_in 'password confirmation', :with => 'new_user123'
+    click_button 'Sign up'
+
+    assert_contain 'Welcome! You have signed up successfully.'
+    assert warden.authenticated?(:admin)
+    assert_current_url "/?custom=1"
+  end
+
   test 'a guest user should be able to sign up successfully and be blocked by confirmation' do
     get new_user_registration_path
 
@@ -28,9 +44,9 @@ class RegistrationTest < ActionController::IntegrationTest
     fill_in 'password confirmation', :with => 'new_user123'
     click_button 'Sign up'
 
-    assert_contain 'You have signed up successfully'
-    assert_contain 'Sign in'
+    assert_contain 'You have signed up successfully. However, we could not sign you in because your account is unconfirmed.'
     assert_not_contain 'You have to confirm your account before continuing'
+    assert_current_url "/"
 
     assert_not warden.authenticated?(:user)
 
@@ -39,6 +55,19 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_not user.confirmed?
   end
 
+  test 'a guest user should be blocked by confirmation and redirected to a custom path' do
+    Devise::RegistrationsController.any_instance.stubs(:after_inactive_sign_up_path_for).returns("/?custom=1")
+    get new_user_registration_path
+
+    fill_in 'email', :with => 'new_user@test.com'
+    fill_in 'password', :with => 'new_user123'
+    fill_in 'password confirmation', :with => 'new_user123'
+    click_button 'Sign up'
+
+    assert_current_url "/?custom=1"
+    assert_not warden.authenticated?(:user)
+  end
+
   test 'a guest user cannot sign up with invalid information' do
     get new_user_registration_path
 
@@ -51,6 +80,7 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_have_selector '#error_explanation'
     assert_contain "Email is invalid"
     assert_contain "Password doesn't match confirmation"
+    assert_contain "2 errors prohibited"
     assert_nil User.first
 
     assert_not warden.authenticated?(:user)
@@ -66,7 +96,7 @@ class RegistrationTest < ActionController::IntegrationTest
     click_button 'Sign up'
 
     assert_current_url '/users'
-    assert_contain(/Email .* already.*taken/)
+    assert_contain(/Email.*already.*taken/)
 
     assert_not warden.authenticated?(:user)
   end
@@ -98,6 +128,20 @@ class RegistrationTest < ActionController::IntegrationTest
     assert_equal "user.new@email.com", User.first.email
   end
 
+  test 'a signed in user should still be able to use the website after changing his password' do
+    sign_in_as_user
+    get edit_user_registration_path
+
+    fill_in 'password', :with => '12345678'
+    fill_in 'password confirmation', :with => '12345678'
+    fill_in 'current password', :with => '123456'
+    click_button 'Update'
+
+    assert_contain 'You updated your account successfully.'
+    get users_path
+    assert warden.authenticated?(:user)
+  end
+
   test 'a signed in user should not change his current user with invalid password' do
     sign_in_as_user
     get edit_user_registration_path
@@ -150,4 +194,16 @@ class RegistrationTest < ActionController::IntegrationTest
 
     assert User.all.empty?
   end
+
+  test 'a user should be able to cancel sign up by deleting data in the session' do
+    get "/set"
+    assert_equal "something", @request.session["devise.foo_bar"]
+
+    get "/users/sign_up"
+    assert_equal "something", @request.session["devise.foo_bar"]
+
+    get "/users/cancel"
+    assert_nil @request.session["devise.foo_bar"]
+    assert_redirected_to new_user_registration_path
+  end
 end

data/test/integration/rememberable_test.rb

@@ -1,7 +1,6 @@
 require 'test_helper'
 
 class RememberMeTest < ActionController::IntegrationTest
-
   def create_user_and_remember(add_to_token='')
     user = create_user
     user.remember_me!
@@ -10,6 +9,14 @@ class RememberMeTest < ActionController::IntegrationTest
     user
   end
 
+  def create_admin_and_remember
+    admin = create_admin
+    admin.remember_me!
+    raw_cookie = Admin.serialize_into_cookie(admin)
+    cookies['remember_admin_token'] = generate_signed_cookie(raw_cookie)
+    admin
+  end
+
   def generate_signed_cookie(raw_cookie)
     request = ActionDispatch::TestRequest.new
     request.cookie_jar.signed['raw_cookie'] = raw_cookie
@@ -21,39 +28,58 @@ class RememberMeTest < ActionController::IntegrationTest
   end
 
   def cookie_expires(key)
-    cookie = response.headers["Set-Cookie"].split("\n").grep(/^#{key}/).first
-    cookie.split(";").map(&:strip).grep(/^expires=/)
-    Time.parse($')
+    cookie  = response.headers["Set-Cookie"].split("\n").grep(/^#{key}/).first
+    expires = cookie.split(";").map(&:strip).grep(/^expires=/).first
+    Time.parse(expires).utc
   end
 
   test 'do not remember the user if he has not checked remember me option' do
     user = sign_in_as_user
     assert_nil request.cookies["remember_user_cookie"]
-    assert_nil user.reload.remember_token
   end
 
   test 'generate remember token after sign in' do
     user = sign_in_as_user :remember_me => true
     assert request.cookies["remember_user_token"]
-    assert user.reload.remember_token
   end
 
-  test 'generate remember token after sign in setting cookie domain' do
+  test 'generate remember token after sign in setting cookie options' do
     # We test this by asserting the cookie is not sent after the redirect
     # since we changed the domain. This is the only difference with the
     # previous test.
-    swap User, :cookie_domain => "omg.somewhere.com" do
+    swap Devise, :cookie_options => { :domain => "omg.somewhere.com" } do
       user = sign_in_as_user :remember_me => true
       assert_nil request.cookies["remember_user_token"]
     end
   end
 
+  test 'generate remember token after sign in setting session options' do
+    begin
+      Rails.configuration.session_options[:domain] = "omg.somewhere.com"
+      user = sign_in_as_user :remember_me => true
+      assert_nil request.cookies["remember_user_token"]
+    ensure
+      Rails.configuration.session_options.delete(:domain)
+    end
+  end
+
   test 'remember the user before sign in' do
     user = create_user_and_remember
     get users_path
     assert_response :success
     assert warden.authenticated?(:user)
     assert warden.user(:user) == user
+    assert_match /remember_user_token[^\n]*HttpOnly\n/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
+  end
+
+  test 'cookies are destroyed on unverified requests' do
+    swap ApplicationController, :allow_forgery_protection => true do
+      user = create_user_and_remember
+      get users_path
+      assert warden.authenticated?(:user)
+      post root_path, :authenticity_token => 'INVALID'
+      assert_not warden.authenticated?(:user)
+    end
   end
 
   test 'does not extend remember period through sign in' do
@@ -74,29 +100,29 @@ class RememberMeTest < ActionController::IntegrationTest
 
   test 'if both extend_remember_period and remember_across_browsers are true, sends the same token with a new expire date' do
     swap Devise, :remember_across_browsers => true, :extend_remember_period => true, :remember_for => 1.year do
-      user  = create_user_and_remember
-      token = user.remember_token
+      admin = create_admin_and_remember
+      token = admin.remember_token
 
-      user.remember_created_at = old = 10.minutes.ago
-      user.save!
+      admin.remember_created_at = old = 10.minutes.ago
+      admin.save!
 
-      get users_path
-      assert (cookie_expires("remember_user_token") - 1.year) > (old + 5.minutes)
-      assert_equal token, signed_cookie("remember_user_token").last
+      get root_path
+      assert (cookie_expires("remember_admin_token") - 1.year) > (old + 5.minutes)
+      assert_equal token, signed_cookie("remember_admin_token").last
     end
   end
 
   test 'if both extend_remember_period and remember_across_browsers are false, sends a new token with old expire date' do
     swap Devise, :remember_across_browsers => false, :extend_remember_period => false, :remember_for => 1.year do
-      user  = create_user_and_remember
-      token = user.remember_token
+      admin = create_admin_and_remember
+      token = admin.remember_token
 
-      user.remember_created_at = old = 10.minutes.ago
-      user.save!
+      admin.remember_created_at = old = 10.minutes.ago
+      admin.save!
 
-      get users_path
-      assert (cookie_expires("remember_user_token") - 1.year) < (old + 5.minutes)
-      assert_not_equal token, signed_cookie("remember_user_token").last
+      get root_path
+      assert (cookie_expires("remember_admin_token") - 1.year) < (old + 5.minutes)
+      assert_not_equal token, signed_cookie("remember_admin_token").last
     end
   end
 
@@ -124,23 +150,40 @@ class RememberMeTest < ActionController::IntegrationTest
     end
   end
 
-  test 'forget the user before sign out' do
+  test 'do not remember the user anymore after forget' do
     user = create_user_and_remember
     get users_path
     assert warden.authenticated?(:user)
+
     get destroy_user_session_path
     assert_not warden.authenticated?(:user)
-    assert_nil user.reload.remember_token
     assert_nil warden.cookies['remember_user_token']
+
+    get users_path
+    assert_not warden.authenticated?(:user)
   end
 
-  test 'do not remember the user anymore after forget' do
+  test 'do not remember the admin anymore after forget' do
+    admin = create_admin_and_remember
+    get root_path
+    assert warden.authenticated?(:admin)
+
+    get destroy_admin_session_path
+    assert_not warden.authenticated?(:admin)
+    assert_nil admin.reload.remember_token
+    assert_nil warden.cookies['remember_admin_token']
+
+    get root_path
+    assert_not warden.authenticated?(:admin)
+  end
+
+  test 'changing user password expires remember me token' do
     user = create_user_and_remember
-    get users_path
-    assert warden.authenticated?(:user)
-    get destroy_user_session_path
+    user.password = "another_password"
+    user.password_confirmation = "another_password"
+    user.save!
+
     get users_path
     assert_not warden.authenticated?(:user)
-    assert_nil warden.cookies['remember_user_token']
   end
 end

data/test/integration/timeoutable_test.rb

@@ -76,5 +76,14 @@ class SessionTimeoutTest < ActionController::IntegrationTest
       assert_contain 'Session expired!'
     end
   end
-
+  
+  test 'time out not triggered if remembered' do
+    user = sign_in_as_user :remember_me => true
+    get expire_user_path(user)
+    assert_not_nil last_request_at
+    
+    get users_path
+    assert_response :success
+    assert warden.authenticated?(:user)
+  end
 end