devise 1.3.4 → 1.4.1

data/lib/generators/templates/devise.rb

@@ -35,6 +35,11 @@ Devise.setup do |config|
   # These keys will be downcased upon creating or modifying a user and when used
   # to authenticate or find a user. Default is :email.
   config.case_insensitive_keys = [ :email ]
+  
+  # Configure which authentication keys should have whitespace stripped.
+  # These keys will have whitespace before and after removed upon creating or
+  # modifying a user and when used to authenticate or find a user. Default is :email.
+  config.strip_whitespace_keys = [ :email ]
 
   # Tell if authentication through request.params is enabled. True by default.
   # config.params_authenticatable = true
@@ -48,13 +53,18 @@ Devise.setup do |config|
   # The realm used in Http Basic Authentication. "Application" by default.
   # config.http_authentication_realm = "Application"
 
+  # It will change confirmation, password recovery and other workflows
+  # to behave the same regardless if the e-mail provided was right or wrong.
+  # Does not affect registerable.
+  # config.paranoid = true
+
   # ==> Configuration for :database_authenticatable
   # For bcrypt, this is the cost for hashing the password and defaults to 10. If
   # using other encryptors, it sets how many times you want the password re-encrypted.
   config.stretches = 10
 
   # Setup a pepper to generate the encrypted password.
-  # config.pepper = <%= ActiveSupport::SecureRandom.hex(64).inspect %>
+  # config.pepper = <%= SecureRandom.hex(64).inspect %>
 
   # ==> Configuration for :confirmable
   # The time you want to give your user to confirm his account. During this time
@@ -174,8 +184,8 @@ Devise.setup do |config|
   # Explorer requests.
   # config.navigational_formats = [:"*/*", "*/*", :html]
 
-  # The default HTTP method used to sign out a resource. Default is :get.
-  # config.sign_out_via = :get
+  # The default HTTP method used to sign out a resource. Default is :delete.
+  config.sign_out_via = :delete
 
   # ==> OmniAuth
   # Add a new OmniAuth provider. Check the wiki for more information on setting

data/test/controllers/internal_helpers_test.rb

@@ -39,14 +39,21 @@ class HelpersTest < ActionController::TestCase
   end
 
   test 'require no authentication tests current mapping' do
-    @mock_warden.expects(:authenticated?).with(:user).returns(true)
+    @mock_warden.expects(:authenticate?).with(:rememberable, :token_authenticatable, :scope => :user).returns(true)
     @mock_warden.expects(:user).with(:user).returns(User.new)
     @controller.expects(:redirect_to).with(root_path)
     @controller.send :require_no_authentication
   end
 
+  test 'require no authentication skips if no inputs are available' do
+    Devise.mappings[:user].expects(:no_input_strategies).returns([])
+    @mock_warden.expects(:authenticate?).never
+    @controller.expects(:redirect_to).never
+    @controller.send :require_no_authentication
+  end
+
   test 'require no authentication sets a flash message' do
-    @mock_warden.expects(:authenticated?).with(:user).returns(true)
+    @mock_warden.expects(:authenticate?).with(:rememberable, :token_authenticatable, :scope => :user).returns(true)
     @mock_warden.expects(:user).with(:user).returns(User.new)
     @controller.expects(:redirect_to).with(root_path)
     @controller.send :require_no_authentication

data/test/generators/views_generator_test.rb

@@ -18,6 +18,16 @@ class ViewsGeneratorTest < Rails::Generators::TestCase
     assert_files "admins"
   end
 
+  test "Assert views with simple form" do
+    run_generator %w(-b simple_form_for)
+    assert_files
+    assert_file "app/views/devise/confirmations/new.html.erb", /simple_form_for/
+
+    run_generator %w(users -b simple_form_for)
+    assert_files "users"
+    assert_file "app/views/users/confirmations/new.html.erb", /simple_form_for/
+  end
+
   def assert_files(scope = nil, template_engine = nil)
     scope = "devise" if scope.nil?
     assert_file "app/views/#{scope}/confirmations/new.html.erb"

data/test/helpers/devise_helper_test.rb

@@ -0,0 +1,43 @@
+require 'test_helper'
+
+class DeviseHelperTest < ActionController::IntegrationTest
+  setup do
+    I18n.backend.store_translations :fr,
+    {
+      :errors => { :messages => { :not_saved => {
+        :one => "Erreur lors de l'enregistrement de '%{resource}': 1 erreur.",
+        :other => "Erreur lors de l'enregistrement de '%{resource}': %{count} erreurs."
+      } } },
+      :activerecord => { :models => { :user => "utilisateur" } }
+    }
+
+    I18n.locale = 'fr'
+  end
+
+  teardown do
+    I18n.locale = 'en'
+  end
+
+  test 'test errors.messages.not_saved with single error from i18n' do
+    get new_user_registration_path
+
+    fill_in 'password', :with => 'new_user123'
+    fill_in 'password confirmation', :with => 'new_user123'
+    click_button 'Sign up'
+
+    assert_have_selector '#error_explanation'
+    assert_contain "Erreur lors de l'enregistrement de 'utilisateur': 1 erreur"
+  end
+
+  test 'test errors.messages.not_saved with multiple errors from i18n' do
+    get new_user_registration_path
+
+    fill_in 'email', :with => 'invalid_email'
+    fill_in 'password', :with => 'new_user123'
+    fill_in 'password confirmation', :with => 'new_user321'
+    click_button 'Sign up'
+
+    assert_have_selector '#error_explanation'
+    assert_contain "Erreur lors de l'enregistrement de 'utilisateur': 2 erreurs"
+  end
+end

data/test/integration/authenticatable_test.rb

@@ -101,6 +101,54 @@ class AuthenticationSanityTest < ActionController::IntegrationTest
     assert_contain 'Private!'
   end
 
+  test 'signed in as admin should get admin dashboard' do
+    sign_in_as_admin
+    assert warden.authenticated?(:admin)
+    assert_not warden.authenticated?(:user)
+
+    get dashboard_path
+
+    assert_response :success
+    assert_template 'home/admin'
+    assert_contain 'Admin dashboard'
+  end
+
+  test 'signed in as user should get user dashboard' do
+    sign_in_as_user
+    assert warden.authenticated?(:user)
+    assert_not warden.authenticated?(:admin)
+
+    get dashboard_path
+
+    assert_response :success
+    assert_template 'home/user'
+    assert_contain 'User dashboard'
+  end
+
+  test 'not signed in should get no dashboard' do
+    assert_raises ActionController::RoutingError do
+      get dashboard_path
+    end
+  end
+
+  test 'signed in user should not see join page' do
+    sign_in_as_user
+    assert warden.authenticated?(:user)
+    assert_not warden.authenticated?(:admin)
+
+    assert_raises ActionController::RoutingError do
+      get join_path
+    end
+  end
+
+  test 'not signed in should see join page' do
+    get join_path
+
+    assert_response :success
+    assert_template 'home/join'
+    assert_contain 'Join'
+  end
+
   test 'signed in as user should not be able to access admins actions' do
     sign_in_as_user
     assert warden.authenticated?(:user)
@@ -306,6 +354,20 @@ class AuthenticationWithScopesTest < ActionController::IntegrationTest
 end
 
 class AuthenticationOthersTest < ActionController::IntegrationTest
+  test 'handles unverified requests gets rid of caches' do
+    swap UsersController, :allow_forgery_protection => true do
+      post exhibit_user_url(1)
+      assert_not warden.authenticated?(:user)
+
+      sign_in_as_user
+      assert warden.authenticated?(:user)
+
+      post exhibit_user_url(1)
+      assert_not warden.authenticated?(:user)
+      assert_equal "User is not authenticated", response.body
+    end
+  end
+
   test 'uses the custom controller with the custom controller view' do
     get '/admin_area/sign_in'
     assert_contain 'Sign in'
@@ -314,8 +376,9 @@ class AuthenticationOthersTest < ActionController::IntegrationTest
   end
 
   test 'render 404 on roles without routes' do
-    get '/admin_area/password/new'
-    assert_equal 404, response.status
+    assert_raise ActionController::RoutingError do
+      get '/admin_area/password/new'
+    end
   end
 
   test 'does not intercept Rails 401 responses' do
@@ -446,7 +509,9 @@ class AuthenticationSignOutViaTest < ActionController::IntegrationTest
 
   test 'do not allow sign out via get when sign_out_via provides only delete' do
     sign_in!(:sign_out_via_delete)
-    get destroy_sign_out_via_delete_session_path
+    assert_raise ActionController::RoutingError do
+      get destroy_sign_out_via_delete_session_path
+    end
     assert warden.authenticated?(:sign_out_via_delete)
   end
 
@@ -458,7 +523,9 @@ class AuthenticationSignOutViaTest < ActionController::IntegrationTest
 
   test 'do not allow sign out via get when sign_out_via provides only post' do
     sign_in!(:sign_out_via_post)
-    get destroy_sign_out_via_delete_session_path
+    assert_raise ActionController::RoutingError do
+      get destroy_sign_out_via_delete_session_path
+    end
     assert warden.authenticated?(:sign_out_via_post)
   end
 
@@ -476,7 +543,9 @@ class AuthenticationSignOutViaTest < ActionController::IntegrationTest
 
   test 'do not allow sign out via get when sign_out_via provides delete and post' do
     sign_in!(:sign_out_via_delete_or_post)
-    get destroy_sign_out_via_delete_or_post_session_path
+    assert_raise ActionController::RoutingError do
+      get destroy_sign_out_via_delete_or_post_session_path
+    end
     assert warden.authenticated?(:sign_out_via_delete_or_post)
   end
 end

data/test/integration/confirmable_test.rb

@@ -106,7 +106,7 @@ class ConfirmationTest < ActionController::IntegrationTest
     user = create_user(:confirm => false)
     post user_confirmation_path(:format => 'xml'), :user => { :email => user.email }
     assert_response :success
-    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
+    assert_equal response.body, {}.to_xml
   end
 
   test 'resent confirmation token with invalid E-Mail in XML format should return invalid response' do
@@ -129,4 +129,42 @@ class ConfirmationTest < ActionController::IntegrationTest
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
+
+  test 'request an account confirmation account with JSON, should return an empty JSON' do
+    user = create_user(:confirm => false)
+
+    post user_confirmation_path, :user => { :email => user.email }, :format => :json
+    assert_response :success
+    assert_equal response.body, {}.to_json
+  end
+
+  test "when in paranoid mode and with a valid e-mail, should not say that the e-mail is valid" do
+    swap Devise, :paranoid => true do
+      user = create_user(:confirm => false)
+      visit new_user_session_path
+
+      click_link "Didn't receive confirmation instructions?"
+      fill_in 'email', :with => user.email
+      click_button 'Resend confirmation instructions'
+
+      assert_contain "If your e-mail exists on our database, you will receive an email with instructions about how to confirm your account in a few minutes."
+      assert_current_url "/users/confirmation"
+    end
+  end
+
+  test "when in paranoid mode and with a invalid e-mail, should not say that the e-mail is invalid" do
+    swap Devise, :paranoid => true do
+      visit new_user_session_path
+
+      click_link "Didn't receive confirmation instructions?"
+      fill_in 'email', :with => "idonthavethisemail@gmail.com"
+      click_button 'Resend confirmation instructions'
+
+      assert_not_contain "1 error prohibited this user from being saved:"
+      assert_not_contain "Email not found"
+
+      assert_contain "If your e-mail exists on our database, you will receive an email with instructions about how to confirm your account in a few minutes."
+      assert_current_url "/users/confirmation"
+    end
+  end
 end

data/test/integration/database_authenticatable_test.rb

@@ -22,6 +22,28 @@ class DatabaseAuthenticationTest < ActionController::IntegrationTest
       assert_not warden.authenticated?(:user)
     end
   end
+  
+  test 'sign in with email including extra spaces should succeed when email is in the list of strip whitespace keys' do
+    create_user(:email => ' foo@bar.com ')
+    
+    sign_in_as_user do
+      fill_in 'email', :with => 'foo@bar.com'
+    end
+    
+    assert warden.authenticated?(:user)
+  end
+
+  test 'sign in with email including extra spaces should fail when email is NOT the list of strip whitespace keys' do
+    swap Devise, :strip_whitespace_keys => [] do
+      create_user(:email => 'foo@bar.com')
+      
+      sign_in_as_user do
+        fill_in 'email', :with => ' foo@bar.com '
+      end
+      
+      assert_not warden.authenticated?(:user)
+    end
+  end
 
   test 'sign in should not authenticate if not using proper authentication keys' do
     swap Devise, :authentication_keys => [:username] do

data/test/integration/http_authenticatable_test.rb

@@ -1,6 +1,14 @@
 require 'test_helper'
 
 class HttpAuthenticationTest < ActionController::IntegrationTest
+  test 'handles unverified requests gets rid of caches but continues signed in' do
+    swap UsersController, :allow_forgery_protection => true do
+      create_user
+      post exhibit_user_url(1), {}, "HTTP_AUTHORIZATION" => "Basic #{ActiveSupport::Base64.encode64("user@test.com:123456")}"
+      assert warden.authenticated?(:user)
+      assert_equal "User is authenticated", response.body
+    end
+  end
 
   test 'sign in should authenticate with http' do
     sign_in_as_new_user_with_http

data/test/integration/lockable_test.rb

@@ -37,7 +37,7 @@ class LockTest < ActionController::IntegrationTest
   end
 
   test 'unlocked pages should not be available if email strategy is disabled' do
-    visit "/admins/sign_in"
+    visit "/admin_area/sign_in"
 
     assert_raise Webrat::NotFoundError do
       click_link "Didn't receive unlock instructions?"
@@ -47,8 +47,9 @@ class LockTest < ActionController::IntegrationTest
       visit new_admin_unlock_path
     end
 
-    visit "/admins/unlock/new"
-    assert_response :not_found
+    assert_raise ActionController::RoutingError do
+      visit "/admin_area/unlock/new"
+    end
   end
 
   test 'user with invalid unlock token should not be able to unlock an account' do
@@ -112,7 +113,7 @@ class LockTest < ActionController::IntegrationTest
 
     post user_unlock_path(:format => 'xml'), :user => {:email => user.email}
     assert_response :success
-    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
+    assert_equal response.body, {}.to_xml
     assert_equal 1, ActionMailer::Base.deliveries.size
   end
 
@@ -140,4 +141,61 @@ class LockTest < ActionController::IntegrationTest
     assert_response :unprocessable_entity
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
   end
+
+  test "when using json to ask a unlock request, should not return the user" do
+    user = create_user(:locked => true)
+    post  user_unlock_path(:format => "json", :user => {:email => user.email})
+    assert_response :success
+    assert_equal response.body, {}.to_json
+  end
+
+  test "in paranoid mode, when trying to unlock an user that exists it should not say that it exists if it is locked" do
+    swap Devise, :paranoid => true do
+      user = create_user(:locked => true)
+
+      visit new_user_session_path
+      click_link "Didn't receive unlock instructions?"
+
+      fill_in 'email', :with => user.email
+      click_button 'Resend unlock instructions'
+
+      assert_current_url "/users/unlock"
+
+      assert_contain "If your account exists, you will receive an email with instructions about how to unlock it in a few minutes."
+    end
+  end
+
+  test "in paranoid mode, when trying to unlock an user that exists it should not say that it exists if it is not locked" do
+    swap Devise, :paranoid => true do
+      user = create_user(:locked => false)
+
+      visit new_user_session_path
+      click_link "Didn't receive unlock instructions?"
+
+      fill_in 'email', :with => user.email
+      click_button 'Resend unlock instructions'
+
+      assert_current_url "/users/unlock"
+
+      assert_contain "If your account exists, you will receive an email with instructions about how to unlock it in a few minutes."
+    end
+  end
+
+  test "in paranoid mode, when trying to unlock an user that does not exists it should not say that it does not exists" do
+    swap Devise, :paranoid => true do
+      visit new_user_session_path
+      click_link "Didn't receive unlock instructions?"
+
+      fill_in 'email', :with => "arandomemail@hotmail.com"
+      click_button 'Resend unlock instructions'
+
+      assert_not_contain "1 error prohibited this user from being saved:"
+      assert_not_contain "Email not found"
+      assert_current_url "/users/unlock"
+
+      assert_contain "If your account exists, you will receive an email with instructions about how to unlock it in a few minutes."
+
+    end
+  end
+
 end

data/test/integration/omniauthable_test.rb

@@ -114,9 +114,7 @@ class OmniauthableIntegrationTest < ActionController::IntegrationTest
   test "generates a proper link when SCRIPT_NAME is set" do
     header 'SCRIPT_NAME', '/q'
     visit "/users/sign_in"
-    click_link "Sign in with Facebook"
-
-    assert_equal '/q/users/auth/facebook', current_url
+    assert_select "a", :href => "/q/users/auth/facebook"
   end
 
   test "handles callback error parameter according to the specification" do