devise 1.1.3 → 1.2.0

data/test/models/rememberable_test.rb

@@ -1,218 +1,279 @@
 require 'test_helper'
 
-class RememberableTest < ActiveSupport::TestCase
-  test 'should respond to remember_me attribute' do
-    user = new_user
-    assert user.respond_to?(:remember_me)
-  end
+module SharedRememberableTest
+  extend ActiveSupport::Testing::Declarative
 
-  test 'remember_me should generate a new token and save the record without validating' do
-    user = create_user
-    user.expects(:valid?).never
-    token = user.remember_token
-    user.remember_me!
-    assert_not_equal token, user.remember_token
-    assert_not user.changed?
-  end
-
-  test 'forget_me should clear remember token and save the record without validating' do
-    user = create_user
-    user.remember_me!
-    assert_not user.remember_token.nil?
-    user.expects(:valid?).never
-    user.forget_me!
-    assert user.remember_token.nil?
-    assert_not user.changed?
+  test 'should respond to remember_me attribute' do
+    assert resource_class.new.respond_to?(:remember_me)
+    assert resource_class.new.respond_to?(:remember_me=)
   end
 
   test 'forget_me should clear remember_created_at' do
-    user = create_user
-    user.remember_me!
-    assert_not user.remember_created_at.nil?
-    user.forget_me!
-    assert user.remember_created_at.nil?
+    resource = create_resource
+    resource.remember_me!
+    assert_not resource.remember_created_at.nil?
+    resource.forget_me!
+    assert resource.remember_created_at.nil?
   end
 
-  test 'forget should do nothing if no remember token exists' do
-    user = create_user
-    user.expects(:save).never
-    user.forget_me!
+  test 'remember is expired if not created at timestamp is set' do
+    assert create_resource.remember_expired?
   end
 
-  test 'serialize into cookie' do
-    user = create_user
-    user.remember_me!
-    assert_equal [user.id, user.remember_token], User.serialize_into_cookie(user)
-  end
-
-  test 'serialize from cookie' do
-    user = create_user
-    user.remember_me!
-    assert_equal user, User.serialize_from_cookie(user.id, user.remember_token)
+  test 'serialize should return nil if no resource is found' do
+    assert_nil resource_class.serialize_from_cookie([0], "123")
   end
 
-  test 'serialize should return nil if no user is found' do
-    assert_nil User.serialize_from_cookie(0, "123")
-  end
-
-  test 'remember me return nil if is a valid user with invalid token' do
-    user = create_user
-    assert_nil User.serialize_from_cookie(user.id, "123")
+  test 'remember me return nil if is a valid resource with invalid token' do
+    resource = create_resource
+    assert_nil resource_class.serialize_from_cookie([resource.id], "123")
   end
 
   test 'remember for should fallback to devise remember for default configuration' do
     swap Devise, :remember_for => 1.day do
-      user = create_user
-      user.remember_me!
-      assert_not user.remember_expired?
+      resource = create_resource
+      resource.remember_me!
+      assert_not resource.remember_expired?
     end
   end
 
   test 'remember expires at should sum date of creation with remember for configuration' do
     swap Devise, :remember_for => 3.days do
-      user = create_user
-      user.remember_me!
-      assert_equal 3.days.from_now.to_date, user.remember_expires_at.to_date
+      resource = create_resource
+      resource.remember_me!
+      assert_equal 3.days.from_now.to_date, resource.remember_expires_at.to_date
 
       Devise.remember_for = 5.days
-      assert_equal 5.days.from_now.to_date, user.remember_expires_at.to_date
+      assert_equal 5.days.from_now.to_date, resource.remember_expires_at.to_date
     end
   end
 
   test 'remember should be expired if remember_for is zero' do
     swap Devise, :remember_for => 0.days do
       Devise.remember_for = 0.days
-      user = create_user
-      user.remember_me!
-      assert user.remember_expired?
+      resource = create_resource
+      resource.remember_me!
+      assert resource.remember_expired?
     end
   end
 
   test 'remember should be expired if it was created before limit time' do
     swap Devise, :remember_for => 1.day do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 2.days.ago
-      user.save
-      assert user.remember_expired?
+      resource = create_resource
+      resource.remember_me!
+      resource.remember_created_at = 2.days.ago
+      resource.save
+      assert resource.remember_expired?
     end
   end
 
   test 'remember should not be expired if it was created whitin the limit time' do
     swap Devise, :remember_for => 30.days do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = (30.days.ago + 2.minutes)
-      user.save
-      assert_not user.remember_expired?
+      resource = create_resource
+      resource.remember_me!
+      resource.remember_created_at = (30.days.ago + 2.minutes)
+      resource.save
+      assert_not resource.remember_expired?
     end
   end
 
   test 'if extend_remember_period is false, remember_me! should generate a new timestamp if expired' do
     swap Devise, :remember_for => 5.minutes do
-      user = create_user
-      user.remember_me!(false)
-      assert user.remember_created_at
+      resource = create_resource
+      resource.remember_me!(false)
+      assert resource.remember_created_at
 
-      user.remember_created_at = old = 10.minutes.ago
-      user.save
+      resource.remember_created_at = old = 10.minutes.ago
+      resource.save
 
-      user.remember_me!(false)
-      assert_not_equal old.to_i, user.remember_created_at.to_i
+      resource.remember_me!(false)
+      assert_not_equal old.to_i, resource.remember_created_at.to_i
     end
   end
 
   test 'if extend_remember_period is false, remember_me! should not generate a new timestamp' do
     swap Devise, :remember_for => 1.year do
-      user = create_user
-      user.remember_me!(false)
-      assert user.remember_created_at
+      resource = create_resource
+      resource.remember_me!(false)
+      assert resource.remember_created_at
 
-      user.remember_created_at = old = 10.minutes.ago.utc
-      user.save
+      resource.remember_created_at = old = 10.minutes.ago.utc
+      resource.save
 
-      user.remember_me!(false)
-      assert_equal old.to_i, user.remember_created_at.to_i
+      resource.remember_me!(false)
+      assert_equal old.to_i, resource.remember_created_at.to_i
     end
   end
 
   test 'if extend_remember_period is true, remember_me! should always generate a new timestamp' do
     swap Devise, :remember_for => 1.year do
-      user = create_user
-      user.remember_me!(true)
-      assert user.remember_created_at
+      resource = create_resource
+      resource.remember_me!(true)
+      assert resource.remember_created_at
 
-      user.remember_created_at = old = 10.minutes.ago
-      user.save
+      resource.remember_created_at = old = 10.minutes.ago
+      resource.save
 
-      user.remember_me!(true)
-      assert_not_equal old, user.remember_created_at
+      resource.remember_me!(true)
+      assert_not_equal old, resource.remember_created_at
     end
   end
+end
+
+class RememberableTest < ActiveSupport::TestCase
+  include SharedRememberableTest
+
+  def resource_class
+    Admin
+  end
+
+  def create_resource
+    create_admin
+  end
+
+  test 'remember_me should generate a new token and save the record without validating' do
+    admin = create_admin
+    admin.expects(:valid?).never
+    token = admin.remember_token
+    admin.remember_me!
+    assert_not_equal token, admin.remember_token
+    assert_not admin.changed?
+  end
+
+  test 'forget_me should clear remember token and save the record without validating' do
+    admin = create_admin
+    admin.remember_me!
+    assert_not admin.remember_token.nil?
+    admin.expects(:valid?).never
+    admin.forget_me!
+    assert admin.remember_token.nil?
+    assert_not admin.changed?
+  end
+
+  test 'serialize into cookie' do
+    admin = create_admin
+    admin.remember_me!
+    assert_equal [admin.to_key, admin.remember_token], Admin.serialize_into_cookie(admin)
+  end
+
+  test 'serialize from cookie' do
+    admin = create_admin
+    admin.remember_me!
+    assert_equal admin, Admin.serialize_from_cookie(admin.to_key, admin.remember_token)
+  end
 
   test 'if remember_across_browsers is true, remember_me! should create a new token if no token exists' do
     swap Devise, :remember_across_browsers => true, :remember_for => 1.year do
-      user = create_user
-      assert_equal nil, user.remember_token
-      user.remember_me!
-      assert_not_equal nil, user.remember_token
+      admin = create_admin
+      assert_equal nil, admin.remember_token
+      admin.remember_me!
+      assert_not_equal nil, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is true, remember_me! should create a new token if a token exists but has expired' do
     swap Devise, :remember_across_browsers => true, :remember_for => 1.day do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 2.days.ago
-      user.save
-      token = user.remember_token
-      user.remember_me!
-      assert_not_equal token, user.remember_token
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 2.days.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is true, remember_me! should not create a new token if a token exists and has not expired' do
     swap Devise, :remember_across_browsers => true, :remember_for => 2.days do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 1.day.ago
-      user.save
-      token = user.remember_token
-      user.remember_me!
-      assert_equal token, user.remember_token
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 1.day.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_equal token, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is false, remember_me! should create a new token if no token exists' do
     swap Devise, :remember_across_browsers => false do
-      user = create_user
-      assert_equal nil, user.remember_token
-      user.remember_me!
-      assert_not_equal nil, user.remember_token
+      admin = create_admin
+      assert_equal nil, admin.remember_token
+      admin.remember_me!
+      assert_not_equal nil, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is false, remember_me! should create a new token if a token exists but has expired' do
     swap Devise, :remember_across_browsers => false, :remember_for => 1.day do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 2.days.ago
-      user.save
-      token = user.remember_token
-      user.remember_me!
-      assert_not_equal token, user.remember_token
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 2.days.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
     end
   end
 
   test 'if remember_across_browsers is false, remember_me! should create a new token if a token exists and has not expired' do
     swap Devise, :remember_across_browsers => false, :remember_for => 2.days do
-      user = create_user
-      user.remember_me!
-      user.remember_created_at = 1.day.ago
-      user.save
-      token = user.remember_token
-      user.remember_me!
-      assert_not_equal token, user.remember_token
+      admin = create_admin
+      admin.remember_me!
+      admin.remember_created_at = 1.day.ago
+      admin.save
+      token = admin.remember_token
+      admin.remember_me!
+      assert_not_equal token, admin.remember_token
+    end
+  end
+end
+
+class WithSaltRememberableTest < ActiveSupport::TestCase
+  include SharedRememberableTest
+
+  setup do
+    assert_not User.new.respond_to?(:remember_token)
+  end
+
+  def resource_class
+    User
+  end
+
+  def create_resource
+    create_user
+  end
+
+  test 'remember_me should not generate a new token if using salt' do
+    user = create_user
+    user.expects(:valid?).never
+    user.remember_me!
+  end
+
+  test 'forget_me should not clear remember token if using salt' do
+    user = create_user
+    user.remember_me!
+    user.expects(:valid?).never
+    user.forget_me!
+  end
+
+  test 'serialize into cookie' do
+    user = create_user
+    user.remember_me!
+    assert_equal [user.to_key, user.authenticatable_salt], User.serialize_into_cookie(user)
+  end
+
+  test 'serialize from cookie' do
+    user = create_user
+    user.remember_me!
+    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt)
+  end
+
+  test 'raises a RuntimeError if authenticatable_salt is nil' do
+    user = User.new
+    user.encrypted_password = nil
+    assert_raise RuntimeError do
+      user.rememberable_value
     end
   end
 end

data/test/models/token_authenticatable_test.rb

@@ -27,6 +27,12 @@ class TokenAuthenticatableTest < ActiveSupport::TestCase
   end
 
   test 'should return nil when authenticating an invalid user by authentication token' do
+    if DEVISE_ORM == :mongoid
+      raise 'There is an incompatibility between Devise and Mongoid'  <<
+            ' that makes this test break. For more information, check' <<
+            ' this issue: https://github.com/mongoid/mongoid/issues/725'
+    end
+
     user = create_user
     user.ensure_authentication_token!
     user.confirm!
@@ -34,4 +40,16 @@ class TokenAuthenticatableTest < ActiveSupport::TestCase
     assert_nil authenticated_user
   end
 
-end
+  test 'should not be subject to injection' do
+    user1 = create_user
+    user1.ensure_authentication_token!
+    user1.confirm!
+
+    user2 = create_user
+    user2.ensure_authentication_token!
+    user2.confirm!
+
+    user = User.find_for_token_authentication(:auth_token => {'$ne' => user1.authentication_token})
+    assert_nil user
+  end
+end

data/test/models_test.rb

@@ -1,7 +1,7 @@
 require 'test_helper'
 
 class Configurable < User
-  devise :database_authenticatable, :confirmable, :rememberable, :timeoutable, :lockable,
+  devise :database_authenticatable, :encryptable, :confirmable, :rememberable, :timeoutable, :lockable,
          :stretches => 15, :pepper => 'abcdef', :confirm_within => 5.days,
          :remember_for => 7.days, :timeout_in => 15.minutes, :unlock_in => 10.days
 end
@@ -26,16 +26,16 @@ class ActiveRecordTest < ActiveSupport::TestCase
   end
 
   test 'can cherry pick modules' do
-    assert_include_modules Admin, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable
+    assert_include_modules Admin, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :rememberable, :encryptable
   end
 
   test 'chosen modules are inheritable' do
-    assert_include_modules Inheritable, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable
+    assert_include_modules Inheritable, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :rememberable, :encryptable
   end
 
   test 'order of module inclusion' do
-    correct_module_order   = [:database_authenticatable, :recoverable, :registerable, :lockable, :timeoutable]
-    incorrect_module_order = [:database_authenticatable, :timeoutable, :registerable, :recoverable, :lockable]
+    correct_module_order   = [:database_authenticatable, :rememberable, :encryptable, :recoverable, :registerable, :lockable, :timeoutable]
+    incorrect_module_order = [:database_authenticatable, :timeoutable, :registerable, :recoverable, :lockable, :encryptable, :rememberable]
 
     assert_include_modules Admin, *incorrect_module_order
 
@@ -47,6 +47,13 @@ class ActiveRecordTest < ActiveSupport::TestCase
     assert_equal module_constants, (Admin.included_modules & module_constants).reverse
   end
 
+  test 'raise error on invalid module' do
+    assert_raise NameError do
+      # Mix valid an invalid modules.
+      Configurable.class_eval { devise :database_authenticatable, :doesnotexit }
+    end
+  end
+
   test 'set a default value for stretches' do
     assert_equal 15, Configurable.stretches
   end

data/test/omniauth/url_helpers_test.rb

@@ -0,0 +1,54 @@
+require 'test_helper'
+
+class OmniAuthRoutesTest < ActionController::TestCase
+  tests ApplicationController
+
+  def assert_path(action, provider, with_param=true)
+    # Resource param
+    assert_equal @controller.send(action, :user, provider),
+                 @controller.send("user_#{action}", provider)
+
+    # With an object
+    assert_equal @controller.send(action, User.new, provider),
+                 @controller.send("user_#{action}", provider)
+
+    if with_param
+      # Default url params
+      assert_equal @controller.send(action, :user, provider, :param => 123),
+                   @controller.send("user_#{action}", provider, :param => 123)
+    end
+  end
+
+  test 'should alias omniauth_callback to mapped user auth_callback' do
+    assert_path :omniauth_callback_path, :facebook
+  end
+
+  test 'should alias omniauth_authorize to mapped user auth_authorize' do
+    assert_path :omniauth_authorize_path, :facebook, false
+  end
+
+  test 'should generate authorization path' do
+    assert_match "/users/auth/facebook", @controller.omniauth_authorize_path(:user, :facebook)
+
+    assert_raise ArgumentError do
+      @controller.omniauth_authorize_path(:user, :github)
+    end
+  end
+
+  test 'should generate authorization path with params' do
+    assert_match "/users/auth/open_id?openid_url=http%3A%2F%2Fyahoo.com",
+                  @controller.omniauth_authorize_path(:user, :open_id, :openid_url => "http://yahoo.com")
+  end
+
+  test 'should not add a "?" if no param was sent' do
+    assert_equal "/users/auth/open_id",
+                  @controller.omniauth_authorize_path(:user, :open_id)
+  end
+
+  test 'should set script name in the path if present' do
+    @request.env['SCRIPT_NAME'] = '/q'
+
+    assert_equal "/q/users/auth/facebook",
+                 @controller.omniauth_authorize_path(:user, :facebook)
+  end
+end

data/test/orm/mongoid.rb

@@ -1,5 +1,6 @@
 Mongoid.configure do |config|
-  config.master = Mongo::Connection.new('127.0.0.1', 27017).db("devise-test-suite")
+  config.master  = Mongo::Connection.new('127.0.0.1', 27017).db("devise-test-suite")
+  config.use_utc = true
 end
 
 class ActiveSupport::TestCase
@@ -7,4 +8,4 @@ class ActiveSupport::TestCase
     User.delete_all
     Admin.delete_all
   end
-end
+end

data/test/rails_app/Rakefile

@@ -0,0 +1,10 @@
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require File.expand_path('../config/application', __FILE__)
+
+require 'rake'
+require 'rake/testtask'
+require 'rake/rdoctask'
+
+Rails.application.load_tasks

data/test/rails_app/app/active_record/admin.rb

@@ -1,3 +1,6 @@
+require 'shared_admin'
+
 class Admin < ActiveRecord::Base
-  devise :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :unlock_strategy => :time
+  include Shim
+  include SharedAdmin
 end

data/test/rails_app/app/active_record/user.rb

@@ -1,7 +1,8 @@
+require 'shared_user'
+
 class User < ActiveRecord::Base
-  devise :database_authenticatable, :confirmable, :lockable, :recoverable,
-         :registerable, :rememberable, :timeoutable, :token_authenticatable,
-         :trackable, :validatable
+  include Shim
+  include SharedUser
 
-  attr_accessible :username, :email, :password, :password_confirmation
+  attr_accessible :username, :email, :password, :password_confirmation, :remember_me
 end

data/test/rails_app/app/controllers/{sessions_controller.rb → admins/sessions_controller.rb}

@@ -1,4 +1,4 @@
-class SessionsController < Devise::SessionsController
+class Admins::SessionsController < Devise::SessionsController
   def new
     flash[:special] = "Welcome to #{controller_path.inspect} controller!"
     super

data/test/rails_app/app/controllers/application_controller.rb

@@ -3,7 +3,6 @@
 
 class ApplicationController < ActionController::Base
   protect_from_forgery
-
   before_filter :current_user
   before_filter :authenticate_user!, :if => :devise_controller?
 end

data/test/rails_app/app/controllers/home_controller.rb

@@ -4,4 +4,13 @@ class HomeController < ApplicationController
 
   def private
   end
+
+  def set
+    session["devise.foo_bar"] = "something"
+    head :ok
+  end
+
+  def unauthenticated
+    render :text => "unauthenticated", :status => :unauthorized
+  end
 end

data/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb

@@ -0,0 +1,14 @@
+class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
+  def facebook
+    data = env["omniauth.auth"]
+    session["devise.facebook_data"] = data["extra"]["user_hash"]
+    render :json => data
+  end
+
+  def sign_in_facebook
+    user = User.find_by_email('user@test.com')
+    user.remember_me = true
+    sign_in user
+    render :text => ""
+  end
+end

data/test/rails_app/app/mongoid/admin.rb

@@ -1,6 +1,9 @@
+require 'shared_admin'
+
 class Admin
   include Mongoid::Document
   include Shim
+  include SharedAdmin
 
-  devise :database_authenticatable, :timeoutable, :registerable, :recoverable, :lockable, :unlock_strategy => :time
+  field :remember_token, :type => String
 end

data/test/rails_app/app/mongoid/shim.rb

@@ -1,16 +1,29 @@
 module Shim
   extend ::ActiveSupport::Concern
-  include ::Mongoid::Timestamps
+
+  included do
+    include ::Mongoid::Timestamps
+    field :created_at, :type => DateTime
+  end
 
   module ClassMethods
     def last(options={})
       options.delete(:order) if options[:order] == "id"
       super(options)
     end
+
+    def find_by_email(email)
+      first(:conditions => { :email => email })
+    end
   end
-  
-  # overwrite equality (because some devise tests use this for asserting model equality) 
+
+  # overwrite equality (because some devise tests use this for asserting model equality)
   def ==(other)
     other.is_a?(self.class) && _id == other._id
   end
+
+  # Mongoid does not have this method in the current beta version (2.0.0.beta.20)
+  def update_attribute(attribute, value)
+    update_attributes(attribute => value)
+  end
 end