devise 1.1.3 → 1.2.0

data/test/integration/token_authenticatable_test.rb

@@ -7,12 +7,23 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       sign_in_as_new_user_with_token
 
       assert_response :success
-      assert_template 'users/index'
+      assert_current_url "/users?secret_token=#{VALID_AUTHENTICATION_TOKEN}"
       assert_contain 'Welcome'
       assert warden.authenticated?(:user)
     end
   end
 
+  test 'authenticate with valid authentication token key but does not store if stateless' do
+    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true do
+      sign_in_as_new_user_with_token
+      assert warden.authenticated?(:user)
+
+      get users_path
+      assert_redirected_to new_user_session_path
+      assert_not warden.authenticated?(:user)
+    end
+  end
+
   test 'authenticate with valid authentication token key and value through http' do
     swap Devise, :token_authentication_key => :secret_token do
       sign_in_as_new_user_with_token(:http_auth => true)
@@ -65,15 +76,42 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
     end
   end
 
+  test 'authenticate with valid authentication token key and do not store if stateless and timeoutable are enabled' do
+    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true, :timeout_in => (0.1).second do
+      user = sign_in_as_new_user_with_token
+      assert warden.authenticated?(:user)
+
+      # Expiring does not work because we are setting the session value when accessing it
+      sleep 0.3
+
+      get_users_path_as_existing_user(user)
+      assert warden.authenticated?(:user)
+    end
+  end
+
+  test 'should not be subject to injection' do
+    swap Devise, :token_authentication_key => :secret_token do
+      user1 = create_user_with_authentication_token()
+
+      # Clean up user cache
+      @user = nil
+
+      user2 = create_user_with_authentication_token(:email => "another@test.com")
+      user2.update_attribute(:authentication_token, "ANOTHERTOKEN")
+
+      assert_not_equal user1, user2
+      visit users_path(Devise.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
+      assert_nil warden.user(:user) 
+    end
+  end
+
   private
 
     def sign_in_as_new_user_with_token(options = {})
-      options[:auth_token_key] ||= Devise.token_authentication_key
-      options[:auth_token]     ||= VALID_AUTHENTICATION_TOKEN
+      user = options.delete(:user) || create_user_with_authentication_token(options)
 
-      user = create_user(options)
-      user.authentication_token = VALID_AUTHENTICATION_TOKEN
-      user.save
+      options[:auth_token_key] ||= Devise.token_authentication_key
+      options[:auth_token]     ||= user.authentication_token
 
       if options[:http_auth]
         header = "Basic #{ActiveSupport::Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
@@ -85,4 +123,15 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       user
     end
 
+    def create_user_with_authentication_token(options={})
+      user = create_user(options)
+      user.authentication_token = VALID_AUTHENTICATION_TOKEN
+      user.save
+      user
+    end
+
+    def get_users_path_as_existing_user(user)
+      sign_in_as_new_user_with_token(:user => user)
+    end
+
 end

data/test/mailers/confirmation_instructions_test.rb

@@ -35,6 +35,10 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
     assert_equal ['test@example.com'], mail.from
   end
 
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
   test 'setup subject from I18n' do
     store_translations :en, :devise => { :mailer => { :confirmation_instructions => { :subject => 'Account Confirmation' } } } do
       assert_equal 'Account Confirmation', mail.subject

data/test/mailers/reset_password_instructions_test.rb

@@ -38,6 +38,10 @@ class ResetPasswordInstructionsTest < ActionMailer::TestCase
     assert_equal ['test@example.com'], mail.from
   end
 
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
   test 'setup subject from I18n' do
     store_translations :en, :devise => { :mailer => { :reset_password_instructions => { :subject => 'Reset instructions' } } } do
       assert_equal 'Reset instructions', mail.subject

data/test/mailers/unlock_instructions_test.rb

@@ -38,6 +38,10 @@ class UnlockInstructionsTest < ActionMailer::TestCase
     assert_equal ['test@example.com'], mail.from
   end
 
+  test 'setup reply to as copy from sender' do
+    assert_equal ['test@example.com'], mail.reply_to
+  end
+
   test 'setup subject from I18n' do
     store_translations :en, :devise => { :mailer => { :unlock_instructions =>  { :subject => 'Yo unlock instructions' } } } do
       assert_equal 'Yo unlock instructions', mail.subject

data/test/mapping_test.rb

@@ -12,22 +12,42 @@ class MappingTest < ActiveSupport::TestCase
     mapping = Devise.mappings[:user]
     assert_equal User,                mapping.to
     assert_equal User.devise_modules, mapping.modules
-    assert_equal :users,              mapping.plural
+    assert_equal "users",             mapping.scoped_path
     assert_equal :user,               mapping.singular
     assert_equal "users",             mapping.path
+    assert_equal "/users",            mapping.fullpath
+  end
+
+  test 'store options with namespace' do
+    mapping = Devise.mappings[:publisher_account]
+    assert_equal Admin,                 mapping.to
+    assert_equal "publisher/accounts",  mapping.scoped_path
+    assert_equal :publisher_account,    mapping.singular
+    assert_equal "accounts",            mapping.path
+    assert_equal "/publisher/accounts", mapping.fullpath
   end
 
   test 'allows path to be given' do
     assert_equal "admin_area", Devise.mappings[:admin].path
   end
 
+  test 'sign_out_via defaults to :get' do
+    assert_equal :get, Devise.mappings[:user].sign_out_via
+  end
+
+  test 'allows custom sign_out_via to be given' do
+    assert_equal :delete,          Devise.mappings[:sign_out_via_delete].sign_out_via
+    assert_equal :post,            Devise.mappings[:sign_out_via_post].sign_out_via
+    assert_equal [:delete, :post], Devise.mappings[:sign_out_via_delete_or_post].sign_out_via
+  end
+
   test 'allows custom singular to be given' do
     assert_equal "accounts", Devise.mappings[:manager].path
   end
 
   test 'has strategies depending on the model declaration' do
     assert_equal [:rememberable, :token_authenticatable, :database_authenticatable], Devise.mappings[:user].strategies
-    assert_equal [:database_authenticatable], Devise.mappings[:admin].strategies
+    assert_equal [:rememberable, :database_authenticatable], Devise.mappings[:admin].strategies
   end
 
   test 'find scope for a given object' do
@@ -80,6 +100,20 @@ class MappingTest < ActiveSupport::TestCase
     assert mapping.recoverable?
     assert mapping.lockable?
     assert_not mapping.confirmable?
-    assert_not mapping.rememberable?
+    assert_not mapping.omniauthable?
   end
+  
+  test 'find mapping by path' do
+    assert_raise RuntimeError do
+      Devise::Mapping.find_by_path!('/accounts/facebook/callback')
+    end
+    
+    assert_nothing_raised do
+      Devise::Mapping.find_by_path!('/:locale/accounts/login')
+    end
+
+    assert_nothing_raised do
+      Devise::Mapping.find_by_path!('/accounts/facebook/callback', :path)
+    end
+  end  
 end

data/test/models/confirmable_test.rb

@@ -48,10 +48,10 @@ class ConfirmableTest < ActiveSupport::TestCase
     assert_blank user.errors[:email]
 
     assert_not user.confirm!
-    assert_equal "was already confirmed", user.errors[:email].join
+    assert_equal "was already confirmed, please try signing in", user.errors[:email].join
   end
 
-  test 'should find and confirm an user automatically' do
+  test 'should find and confirm a user automatically' do
     user = create_user
     confirmed_user = User.confirm_by_token(user.confirmation_token)
     assert_equal confirmed_user, user
@@ -76,7 +76,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     user.save
     confirmed_user = User.confirm_by_token(user.confirmation_token)
     assert confirmed_user.confirmed?
-    assert_equal "was already confirmed", confirmed_user.errors[:email].join
+    assert_equal "was already confirmed, please try signing in", confirmed_user.errors[:email].join
   end
 
   test 'should send confirmation instructions by email' do
@@ -127,7 +127,7 @@ class ConfirmableTest < ActiveSupport::TestCase
       User.send_confirmation_instructions(:email => user.email)
     end
   end
-  
+
   test 'should always have confirmation token when email is sent' do
     user = new_user
     user.instance_eval { def confirmation_required?; false end }
@@ -160,17 +160,17 @@ class ConfirmableTest < ActiveSupport::TestCase
     user.confirm!
     assert_not user.resend_confirmation_token
     assert user.confirmed?
-    assert_equal 'was already confirmed', user.errors[:email].join
+    assert_equal 'was already confirmed, please try signing in', user.errors[:email].join
   end
 
   test 'confirm time should fallback to devise confirm in default configuration' do
     swap Devise, :confirm_within => 1.day do
       user = new_user
       user.confirmation_sent_at = 2.days.ago
-      assert_not user.active?
+      assert_not user.active_for_authentication?
 
       Devise.confirm_within = 3.days
-      assert user.active?
+      assert user.active_for_authentication?
     end
   end
 
@@ -180,42 +180,59 @@ class ConfirmableTest < ActiveSupport::TestCase
       user = create_user
 
       user.confirmation_sent_at = 4.days.ago
-      assert user.active?
+      assert user.active_for_authentication?
 
       user.confirmation_sent_at = 5.days.ago
-      assert_not user.active?
+      assert_not user.active_for_authentication?
     end
   end
 
   test 'should be active when already confirmed' do
     user = create_user
     assert_not user.confirmed?
-    assert_not user.active?
+    assert_not user.active_for_authentication?
 
     user.confirm!
     assert user.confirmed?
-    assert user.active?
+    assert user.active_for_authentication?
   end
 
   test 'should not be active when confirm in is zero' do
     Devise.confirm_within = 0.days
     user = create_user
     user.confirmation_sent_at = Date.today
-    assert_not user.active?
+    assert_not user.active_for_authentication?
   end
 
   test 'should not be active without confirmation' do
     user = create_user
     user.confirmation_sent_at = nil
     user.save
-    assert_not user.reload.active?
+    assert_not user.reload.active_for_authentication?
   end
-  
+
   test 'should be active without confirmation when confirmation is not required' do
     user = create_user
     user.instance_eval { def confirmation_required?; false end }
     user.confirmation_sent_at = nil
     user.save
-    assert user.reload.active?
+    assert user.reload.active_for_authentication?
+  end
+
+  test 'should find a user to send email instructions for the user confirm it\'s email by authentication_keys' do
+    swap Devise, :authentication_keys => [:username, :email] do
+      user = create_user
+      confirm_user = User.send_confirmation_instructions(:email => user.email, :username => user.username)
+      assert_equal confirm_user, user
+    end
+  end
+
+  test 'should require all confirmation_keys' do
+    swap Devise, :confirmation_keys => [:username, :email] do
+      user = create_user
+      confirm_user = User.send_confirmation_instructions(:email => user.email)
+      assert_not confirm_user.persisted?
+      assert_equal "can't be blank", confirm_user.errors[:username].join
+    end
   end
 end

data/test/models/database_authenticatable_test.rb

@@ -2,53 +2,31 @@ require 'test_helper'
 require 'digest/sha1'
 
 class DatabaseAuthenticatableTest < ActiveSupport::TestCase
-
-  def encrypt_password(user, pepper=User.pepper, stretches=User.stretches, encryptor=User.encryptor_class)
-    encryptor.digest('123456', stretches, user.password_salt, pepper)
-  end
-
-  def swap_with_encryptor(klass, encryptor, options={})
-    klass.instance_variable_set(:@encryptor_class, nil)
-
-    swap klass, options.merge(:encryptor => encryptor) do
-      begin
-        yield
-      ensure
-        klass.instance_variable_set(:@encryptor_class, nil)
-      end
-    end
+  test 'should downcase case insensitive keys when saving' do
+    # case_insensitive_keys is set to :email by default.
+    email = 'Foo@Bar.com'
+    user = new_user(:email => email)
+    
+    assert_equal email, user.email
+    user.save!
+    assert_equal email.downcase, user.email
   end
-
+  
   test 'should respond to password and password confirmation' do
     user = new_user
     assert user.respond_to?(:password)
     assert user.respond_to?(:password_confirmation)
   end
 
-  test 'should generate encrypted password and salt while setting password' do
+  test 'should generate encrypted password while setting password' do
     user = new_user
-    assert_present user.password_salt
     assert_present user.encrypted_password
   end
 
-  test 'should not change password salt when updating' do
-    user = create_user
-    salt = user.password_salt
-    user.expects(:password_salt=).never
-    user.save!
-    assert_equal salt, user.password_salt
-  end
-
-  test 'should generate a base64 hash using SecureRandom for password salt' do
-    swap_with_encryptor User, :sha1 do
-      ActiveSupport::SecureRandom.expects(:base64).with(15).returns('friendly_token')
-      assert_equal 'friendly_token', new_user.password_salt
-    end
-  end
-
-  test 'should not generate salt if password is blank' do
-    assert_blank new_user(:password => nil).password_salt
-    assert_blank new_user(:password => '').password_salt
+  test 'allow authenticatable_salt to work even with nil encrypted password' do
+    user = User.new
+    user.encrypted_password = nil
+    assert_nil user.authenticatable_salt
   end
 
   test 'should not generate encrypted password if password is blank' do
@@ -64,47 +42,12 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     assert_not_equal encrypted_password, user.encrypted_password
   end
 
-  test 'should fallback to sha1 as default encryption' do
-    user = new_user
-    assert_equal encrypt_password(user), user.encrypted_password
-  end
-
-  test 'should fallback to devise pepper default configuration' do
-    begin
-      Devise.pepper = ''
-      user = new_user
-      assert_equal encrypt_password(user), user.encrypted_password
-      assert_not_equal encrypt_password(user, 'another_pepper'), user.encrypted_password
-
-      Devise.pepper = 'new_pepper'
-      user = new_user
-      assert_equal encrypt_password(user, 'new_pepper'), user.encrypted_password
-      assert_not_equal encrypt_password(user, 'another_pepper'), user.encrypted_password
-    ensure
-      Devise.pepper = nil
-    end
-  end
-
-  test 'should respect encryptor configuration' do
-    swap_with_encryptor User, :sha512 do
-      user = create_user
-      assert_equal user.encrypted_password, encrypt_password(user, User.pepper, User.stretches, ::Devise::Encryptors::Sha512)
-    end
-  end
-
   test 'should test for a valid password' do
     user = create_user
     assert user.valid_password?('123456')
     assert_not user.valid_password?('654321')
   end
 
-  test 'should not validate password when salt is nil' do
-    admin = create_admin
-    admin.password_salt = nil
-    admin.save
-    assert_not admin.valid_password?('123456')
-  end
-
   test 'should respond to current password' do
     assert new_user.respond_to?(:current_password)
   end

data/test/models/encryptable_test.rb

@@ -0,0 +1,65 @@
+require 'test_helper'
+
+class EncryptableTest < ActiveSupport::TestCase
+  def encrypt_password(admin, pepper=Admin.pepper, stretches=Admin.stretches, encryptor=Admin.encryptor_class)
+    encryptor.digest('123456', stretches, admin.password_salt, pepper)
+  end
+
+  def swap_with_encryptor(klass, encryptor, options={})
+    klass.instance_variable_set(:@encryptor_class, nil)
+
+    swap klass, options.merge(:encryptor => encryptor) do
+      begin
+        yield
+      ensure
+        klass.instance_variable_set(:@encryptor_class, nil)
+      end
+    end
+  end
+
+  test 'should generate salt while setting password' do
+    assert_present create_admin.password_salt
+  end
+
+  test 'should not change password salt when updating' do
+    admin = create_admin
+    salt = admin.password_salt
+    admin.expects(:password_salt=).never
+    admin.save!
+    assert_equal salt, admin.password_salt
+  end
+
+  test 'should generate a base64 hash using SecureRandom for password salt' do
+    swap_with_encryptor Admin, :sha1 do
+      ActiveSupport::SecureRandom.expects(:base64).with(15).returns('friendly_token')
+      assert_equal 'friendly_token', create_admin.password_salt
+    end
+  end
+
+  test 'should not generate salt if password is blank' do
+    assert_blank create_admin(:password => nil).password_salt
+    assert_blank create_admin(:password => '').password_salt
+  end
+
+  test 'should encrypt password again if password has changed' do
+    admin = create_admin
+    encrypted_password = admin.encrypted_password
+    admin.password = admin.password_confirmation = 'new_password'
+    admin.save!
+    assert_not_equal encrypted_password, admin.encrypted_password
+  end
+
+  test 'should respect encryptor configuration' do
+    swap_with_encryptor Admin, :sha512 do
+      admin = create_admin
+      assert_equal admin.encrypted_password, encrypt_password(admin, Admin.pepper, Admin.stretches, ::Devise::Encryptors::Sha512)
+    end
+  end
+
+  test 'should not validate password when salt is nil' do
+    admin = create_admin
+    admin.password_salt = nil
+    admin.save
+    assert_not admin.valid_password?('123456')
+  end
+end

data/test/models/lockable_test.rb

@@ -47,15 +47,15 @@ class LockableTest < ActiveSupport::TestCase
     assert user.access_locked?
   end
 
-  test "active? should be the opposite of locked?" do
+  test "active_for_authentication? should be the opposite of locked?" do
     user = create_user
     user.confirm!
-    assert user.active?
+    assert user.active_for_authentication?
     user.lock_access!
-    assert_not user.active?
+    assert_not user.active_for_authentication?
   end
 
-  test "should unlock an user by cleaning locked_at, falied_attempts and unlock_token" do
+  test "should unlock a user by cleaning locked_at, falied_attempts and unlock_token" do
     user = create_user
     user.lock_access!
     assert_not_nil user.reload.locked_at
@@ -67,12 +67,6 @@ class LockableTest < ActiveSupport::TestCase
     assert_equal 0, user.reload.failed_attempts
   end
 
-  test 'should not unlock an unlocked user' do
-    user = create_user
-    assert_not user.unlock_access!
-    assert_match "was not locked", user.errors[:email].join
-  end
-
   test "new user should not be locked and should have zero failed_attempts" do
     assert_not new_user.access_locked?
     assert_equal 0, create_user.failed_attempts
@@ -141,7 +135,7 @@ class LockableTest < ActiveSupport::TestCase
     end
   end
 
-  test 'should find and unlock an user automatically' do
+  test 'should find and unlock a user automatically' do
     user = create_user
     user.lock_access!
     locked_user = User.unlock_access_by_token(user.unlock_token)
@@ -178,6 +172,23 @@ class LockableTest < ActiveSupport::TestCase
     assert_equal 'not found', unlock_user.errors[:email].join
   end
 
+  test 'should find a user to send unlock instructions by authentication_keys' do
+    swap Devise, :authentication_keys => [:username, :email] do
+      user = create_user
+      unlock_user = User.send_unlock_instructions(:email => user.email, :username => user.username)
+      assert_equal unlock_user, user
+    end
+  end
+
+  test 'should require all unlock_keys' do
+      swap Devise, :unlock_keys => [:username, :email] do
+          user = create_user
+          unlock_user = User.send_unlock_instructions(:email => user.email)
+          assert_not unlock_user.persisted?
+          assert_equal "can't be blank", unlock_user.errors[:username].join
+      end
+  end
+
   test 'should not be able to send instructions if the user is not locked' do
     user = create_user
     assert_not user.resend_unlock_token
@@ -185,4 +196,30 @@ class LockableTest < ActiveSupport::TestCase
     assert_equal 'was not locked', user.errors[:email].join
   end
 
+  test 'should unlock account if lock has expired and increase attempts on failure' do
+    swap Devise, :unlock_in => 1.minute do
+      user = create_user
+      user.confirm!
+
+      user.failed_attempts = 2
+      user.locked_at = 2.minutes.ago
+
+      user.valid_for_authentication? { false }
+      assert_equal 1, user.failed_attempts
+    end
+  end
+
+  test 'should unlock account if lock has expired on success' do
+    swap Devise, :unlock_in => 1.minute do
+      user = create_user
+      user.confirm!
+
+      user.failed_attempts = 2
+      user.locked_at = 2.minutes.ago
+
+      user.valid_for_authentication? { true }
+      assert_equal 0, user.failed_attempts
+      assert_nil user.locked_at
+    end
+  end
 end

data/test/models/recoverable_test.rb

@@ -86,6 +86,23 @@ class RecoverableTest < ActiveSupport::TestCase
     assert_equal "not found", reset_password_user.errors[:email].join
   end
 
+  test 'should find a user to send instructions by authentication_keys' do
+    swap Devise, :authentication_keys => [:username, :email] do
+      user = create_user
+      reset_password_user = User.send_reset_password_instructions(:email => user.email, :username => user.username)
+      assert_equal reset_password_user, user
+    end
+  end
+
+  test 'should require all reset_password_keys' do
+      swap Devise, :reset_password_keys => [:username, :email] do
+          user = create_user
+          reset_password_user = User.send_reset_password_instructions(:email => user.email)
+          assert_not reset_password_user.persisted?
+          assert_equal "can't be blank", reset_password_user.errors[:username].join
+      end
+  end
+
   test 'should reset reset_password_token before send the reset instructions email' do
     user = create_user
     token = user.reset_password_token
@@ -108,18 +125,27 @@ class RecoverableTest < ActiveSupport::TestCase
     assert_equal reset_password_user, user
   end
 
-  test 'should a new record with errors if no reset_password_token is found' do
+  test 'should return a new record with errors if no reset_password_token is found' do
     reset_password_user = User.reset_password_by_token(:reset_password_token => 'invalid_token')
     assert_not reset_password_user.persisted?
     assert_equal "is invalid", reset_password_user.errors[:reset_password_token].join
   end
 
-  test 'should a new record with errors if reset_password_token is blank' do
+  test 'should return a new record with errors if reset_password_token is blank' do
     reset_password_user = User.reset_password_by_token(:reset_password_token => '')
     assert_not reset_password_user.persisted?
     assert_match "can't be blank", reset_password_user.errors[:reset_password_token].join
   end
 
+  test 'should return a new record with errors if password is blank' do
+    user = create_user
+    user.send :generate_reset_password_token!
+
+    reset_password_user = User.reset_password_by_token(:reset_password_token => user.reset_password_token, :password => '')
+    assert_not reset_password_user.errors.empty?
+    assert_match "can't be blank", reset_password_user.errors[:password].join
+  end
+
   test 'should reset successfully user password given the new password and confirmation' do
     user = create_user
     old_password = user.password