devise 1.5.3 → 2.0.0

data/test/integration/token_authenticatable_test.rb

@@ -25,7 +25,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
   end
 
   test 'authenticate with valid authentication token key but does not store if stateless' do
-    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true do
+    swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth] do
       sign_in_as_new_user_with_token
       assert warden.authenticated?(:user)
 
@@ -88,7 +88,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
   end
 
   test 'authenticate with valid authentication token key and do not store if stateless and timeoutable are enabled' do
-    swap Devise, :token_authentication_key => :secret_token, :stateless_token => true, :timeout_in => (0.1).second do
+    swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth], :timeout_in => (0.1).second do
       user = sign_in_as_new_user_with_token
       assert warden.authenticated?(:user)
 
@@ -112,7 +112,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
 
       assert_not_equal user1, user2
       visit users_path(Devise.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
-      assert_nil warden.user(:user) 
+      assert_nil warden.user(:user)
     end
   end
 
@@ -125,7 +125,7 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       options[:auth_token]     ||= user.authentication_token
 
       if options[:http_auth]
-        header = "Basic #{ActiveSupport::Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
+        header = "Basic #{Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
         get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
       else
         visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
@@ -145,4 +145,4 @@ class TokenAuthenticationTest < ActionController::IntegrationTest
       sign_in_as_new_user_with_token(:user => user)
     end
 
-end
+end

data/test/integration/trackable_test.rb

@@ -36,11 +36,11 @@ class TrackableHooksTest < ActionController::IntegrationTest
     assert_equal "127.0.0.1", user.current_sign_in_ip
     assert_equal "127.0.0.1", user.last_sign_in_ip
   end
-  
+
   test "current remote ip returns original ip behind a non transparent proxy" do
     user = create_user
-    
-    arbitrary_ip = '192.168.1.69'
+
+    arbitrary_ip = '200.121.1.69'
     sign_in_as_user do
       header 'HTTP_X_FORWARDED_FOR', arbitrary_ip
     end
@@ -63,7 +63,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
   end
 
   test "does not update anything if user has signed out along the way" do
-    swap Devise, :confirm_within => 0 do
+    swap Devise, :allow_unconfirmed_access_for => 0 do
       user = create_user(:confirm => false)
       sign_in_as_user
 
@@ -72,7 +72,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
       assert_nil user.last_sign_in_at
     end
   end
-  
+
   test "do not track if devise.skip_trackable is set" do
     user = create_user
     sign_in_as_user do
@@ -81,7 +81,7 @@ class TrackableHooksTest < ActionController::IntegrationTest
     user.reload
     assert_equal 0, user.sign_in_count
     visit destroy_user_session_path
-    
+
     sign_in_as_user do
       header 'devise.skip_trackable', false
     end

data/test/mapping_test.rb

@@ -51,12 +51,12 @@ class MappingTest < ActiveSupport::TestCase
 
   test 'has strategies depending on the model declaration' do
     assert_equal [:rememberable, :token_authenticatable, :database_authenticatable], Devise.mappings[:user].strategies
-    assert_equal [:rememberable, :database_authenticatable], Devise.mappings[:admin].strategies
+    assert_equal [:database_authenticatable], Devise.mappings[:admin].strategies
   end
 
   test 'has no input strategies depending on the model declaration' do
     assert_equal [:rememberable, :token_authenticatable], Devise.mappings[:user].no_input_strategies
-    assert_equal [:rememberable], Devise.mappings[:admin].no_input_strategies
+    assert_equal [], Devise.mappings[:admin].no_input_strategies
   end
 
   test 'find scope for a given object' do
@@ -108,7 +108,6 @@ class MappingTest < ActiveSupport::TestCase
     assert mapping.authenticatable?
     assert mapping.recoverable?
     assert mapping.lockable?
-    assert_not mapping.confirmable?
     assert_not mapping.omniauthable?
   end
   

data/test/models/confirmable_test.rb

@@ -80,8 +80,8 @@ class ConfirmableTest < ActiveSupport::TestCase
   end
 
   test 'should send confirmation instructions by email' do
-    assert_email_sent do
-      create_user
+    assert_email_sent "mynewuser@example.com" do
+      create_user :email => "mynewuser@example.com"
     end
   end
 
@@ -123,7 +123,7 @@ class ConfirmableTest < ActiveSupport::TestCase
 
   test 'should send email instructions for the user confirm its email' do
     user = create_user
-    assert_email_sent do
+    assert_email_sent user.email do
       User.send_confirmation_instructions(:email => user.email)
     end
   end
@@ -164,19 +164,19 @@ class ConfirmableTest < ActiveSupport::TestCase
   end
 
   test 'confirm time should fallback to devise confirm in default configuration' do
-    swap Devise, :confirm_within => 1.day do
+    swap Devise, :allow_unconfirmed_access_for => 1.day do
       user = new_user
       user.confirmation_sent_at = 2.days.ago
       assert_not user.active_for_authentication?
 
-      Devise.confirm_within = 3.days
+      Devise.allow_unconfirmed_access_for = 3.days
       assert user.active_for_authentication?
     end
   end
 
   test 'should be active when confirmation sent at is not overpast' do
-    swap Devise, :confirm_within => 5.days do
-      Devise.confirm_within = 5.days
+    swap Devise, :allow_unconfirmed_access_for => 5.days do
+      Devise.allow_unconfirmed_access_for = 5.days
       user = create_user
 
       user.confirmation_sent_at = 4.days.ago
@@ -198,7 +198,7 @@ class ConfirmableTest < ActiveSupport::TestCase
   end
 
   test 'should not be active when confirm in is zero' do
-    Devise.confirm_within = 0.days
+    Devise.allow_unconfirmed_access_for = 0.days
     user = create_user
     user.confirmation_sent_at = Date.today
     assert_not user.active_for_authentication?
@@ -236,3 +236,96 @@ class ConfirmableTest < ActiveSupport::TestCase
     end
   end
 end
+
+class ReconfirmableTest < ActiveSupport::TestCase
+  test 'should not worry about validations on confirm even with reconfirmable' do
+    admin = create_admin
+    admin.reset_password_token = "a"
+    assert admin.confirm!
+  end
+
+  test 'should generate confirmation token after changing email' do
+    admin = create_admin
+    assert admin.confirm!
+    assert_nil admin.confirmation_token
+    assert admin.update_attributes(:email => 'new_test@example.com')
+    assert_not_nil admin.confirmation_token
+  end
+
+  test 'should regenerate confirmation token after changing email' do
+    admin = create_admin
+    assert admin.confirm!
+    assert admin.update_attributes(:email => 'old_test@example.com')
+    token = admin.confirmation_token
+    assert admin.update_attributes(:email => 'new_test@example.com')
+    assert_not_equal token, admin.confirmation_token
+  end
+
+  test 'should send confirmation instructions by email after changing email' do
+    admin = create_admin
+    assert admin.confirm!
+    assert_email_sent "new_test@example.com" do
+      assert admin.update_attributes(:email => 'new_test@example.com')
+    end
+  end
+
+  test 'should not send confirmation by email after changing password' do
+    admin = create_admin
+    assert admin.confirm!
+    assert_email_not_sent do
+      assert admin.update_attributes(:password => 'newpass', :password_confirmation => 'newpass')
+    end
+  end
+
+  test 'should stay confirmed when email is changed' do
+    admin = create_admin
+    assert admin.confirm!
+    assert admin.update_attributes(:email => 'new_test@example.com')
+    assert admin.confirmed?
+  end
+
+  test 'should update email only when it is confirmed' do
+    admin = create_admin
+    assert admin.confirm!
+    assert admin.update_attributes(:email => 'new_test@example.com')
+    assert_not_equal 'new_test@example.com', admin.email
+    assert admin.confirm!
+    assert_equal 'new_test@example.com', admin.email
+  end
+
+  test 'should not allow admin to get past confirmation email by resubmitting their new address' do
+    admin = create_admin
+    assert admin.confirm!
+    assert admin.update_attributes(:email => 'new_test@example.com')
+    assert_not_equal 'new_test@example.com', admin.email
+    assert admin.update_attributes(:email => 'new_test@example.com')
+    assert_not_equal 'new_test@example.com', admin.email
+  end
+
+  test 'should find a admin by send confirmation instructions with unconfirmed_email' do
+    admin = create_admin
+    assert admin.confirm!
+    assert admin.update_attributes(:email => 'new_test@example.com')
+    confirmation_admin = Admin.send_confirmation_instructions(:email => admin.unconfirmed_email)
+    assert_equal confirmation_admin, admin
+  end
+
+  test 'should return a new admin if no email or unconfirmed_email was found' do
+    confirmation_admin = Admin.send_confirmation_instructions(:email => "invalid@email.com")
+    assert_not confirmation_admin.persisted?
+  end
+
+  test 'should add error to new admin email if no email or unconfirmed_email was found' do
+    confirmation_admin = Admin.send_confirmation_instructions(:email => "invalid@email.com")
+    assert confirmation_admin.errors[:email]
+    assert_equal "not found", confirmation_admin.errors[:email].join
+  end
+
+  test 'should find admin with email in unconfirmed_emails' do
+    admin = create_admin
+    admin.unconfirmed_email = "new_test@email.com"
+    assert admin.save
+    admin = Admin.find_by_unconfirmed_email_with_errors(:email => "new_test@email.com")
+    assert admin.persisted?
+  end
+end

data/test/models/database_authenticatable_test.rb

@@ -28,6 +28,12 @@ class DatabaseAuthenticatableTest < ActiveSupport::TestCase
     assert_equal( { 'login' => 'foo@bar.com', "bool1" => true, "bool2" => false, "fixnum" => 123, "will_be_converted" => "1..10" }, conditions)
   end
 
+  test "param filter should not convert regular expressions to strings" do
+    conditions = { "regexp" => /expression/ }
+    conditions = Devise::ParamFilter.new([], []).filter(conditions)
+    assert_equal( { "regexp" => /expression/ }, conditions)
+  end
+
   test 'should respond to password and password confirmation' do
     user = new_user
     assert user.respond_to?(:password)

data/test/models/encryptable_test.rb

@@ -31,7 +31,7 @@ class EncryptableTest < ActiveSupport::TestCase
 
   test 'should generate a base64 hash using SecureRandom for password salt' do
     swap_with_encryptor Admin, :sha1 do
-      SecureRandom.expects(:base64).with(15).returns('01lI')
+      SecureRandom.expects(:base64).with(15).returns('01lI').twice
       salt = create_admin.password_salt
       assert_not_equal '01lI', salt
       assert_equal 4, salt.size

data/test/models/lockable_test.rb

@@ -23,6 +23,19 @@ class LockableTest < ActiveSupport::TestCase
     assert_equal 0, user.reload.failed_attempts
   end
 
+  test "should increment failed_attempts on successfull validation if the user is already locked" do
+    user = create_user
+    user.confirm!
+
+    swap Devise, :maximum_attempts => 2 do
+      3.times { user.valid_for_authentication?{ false } }
+      assert user.reload.access_locked?
+    end
+
+    user.valid_for_authentication?{ true }
+    assert_equal 4, user.reload.failed_attempts
+  end
+
   test "should not touch failed_attempts if lock_strategy is none" do
     user = create_user
     user.confirm!

data/test/models/recoverable_test.rb

@@ -195,31 +195,4 @@ class RecoverableTest < ActiveSupport::TestCase
       assert_equal "has expired, please request a new one", reset_password_user.errors[:reset_password_token].join
     end
   end
-
-  test 'should save the model when the reset_password_sent_at doesnt exist' do
-    user = create_user
-    def user.respond_to?(meth, *)
-      if meth == :reset_password_sent_at=
-        false
-      else
-        super
-      end
-    end
-    user.send_reset_password_instructions
-    user.reload
-    assert_not_nil user.reset_password_token
-  end
-
-  test 'should have valid period if does not respond to reset_password_sent_at' do
-    user = create_user
-    def user.respond_to?(meth, *)
-      if meth == :reset_password_sent_at
-        false
-      else
-        super
-      end
-    end
-    assert user.reset_password_period_valid?
-  end
-
 end

data/test/models/rememberable_test.rb

@@ -1,7 +1,46 @@
 require 'test_helper'
 
-module SharedRememberableTest
-  extend ActiveSupport::Testing::Declarative
+class RememberableTest < ActiveSupport::TestCase
+  def resource_class
+    User
+  end
+
+  def create_resource
+    create_user
+  end
+
+  test 'remember_me should not generate a new token if using salt' do
+    user = create_user
+    user.expects(:valid?).never
+    user.remember_me!
+  end
+
+  test 'forget_me should not clear remember token if using salt' do
+    user = create_user
+    user.remember_me!
+    user.expects(:valid?).never
+    user.forget_me!
+  end
+
+  test 'serialize into cookie' do
+    user = create_user
+    user.remember_me!
+    assert_equal [user.to_key, user.authenticatable_salt], User.serialize_into_cookie(user)
+  end
+
+  test 'serialize from cookie' do
+    user = create_user
+    user.remember_me!
+    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt)
+  end
+
+  test 'raises a RuntimeError if authenticatable_salt is nil' do
+    user = User.new
+    user.encrypted_password = nil
+    assert_raise RuntimeError do
+      user.rememberable_value
+    end
+  end
 
   test 'should respond to remember_me attribute' do
     assert resource_class.new.respond_to?(:remember_me)
@@ -127,161 +166,3 @@ module SharedRememberableTest
     end
   end
 end
-
-class RememberableTest < ActiveSupport::TestCase
-  include SharedRememberableTest
-
-  def resource_class
-    Admin
-  end
-
-  def create_resource
-    create_admin
-  end
-
-  test 'remember_me should generate a new token and save the record without validating' do
-    admin = create_admin
-    admin.expects(:valid?).never
-    token = admin.remember_token
-    admin.remember_me!
-    assert_not_equal token, admin.remember_token
-    assert_not admin.changed?
-  end
-
-  test 'forget_me should clear remember token and save the record without validating' do
-    admin = create_admin
-    admin.remember_me!
-    assert_not admin.remember_token.nil?
-    admin.expects(:valid?).never
-    admin.forget_me!
-    assert admin.remember_token.nil?
-    assert_not admin.changed?
-  end
-
-  test 'serialize into cookie' do
-    admin = create_admin
-    admin.remember_me!
-    assert_equal [admin.to_key, admin.remember_token], Admin.serialize_into_cookie(admin)
-  end
-
-  test 'serialize from cookie' do
-    admin = create_admin
-    admin.remember_me!
-    assert_equal admin, Admin.serialize_from_cookie(admin.to_key, admin.remember_token)
-  end
-
-  test 'if remember_across_browsers is true, remember_me! should create a new token if no token exists' do
-    swap Devise, :remember_across_browsers => true, :remember_for => 1.year do
-      admin = create_admin
-      assert_equal nil, admin.remember_token
-      admin.remember_me!
-      assert_not_equal nil, admin.remember_token
-    end
-  end
-
-  test 'if remember_across_browsers is true, remember_me! should create a new token if a token exists but has expired' do
-    swap Devise, :remember_across_browsers => true, :remember_for => 1.day do
-      admin = create_admin
-      admin.remember_me!
-      admin.remember_created_at = 2.days.ago
-      admin.save
-      token = admin.remember_token
-      admin.remember_me!
-      assert_not_equal token, admin.remember_token
-    end
-  end
-
-  test 'if remember_across_browsers is true, remember_me! should not create a new token if a token exists and has not expired' do
-    swap Devise, :remember_across_browsers => true, :remember_for => 2.days do
-      admin = create_admin
-      admin.remember_me!
-      admin.remember_created_at = 1.day.ago
-      admin.save
-      token = admin.remember_token
-      admin.remember_me!
-      assert_equal token, admin.remember_token
-    end
-  end
-
-  test 'if remember_across_browsers is false, remember_me! should create a new token if no token exists' do
-    swap Devise, :remember_across_browsers => false do
-      admin = create_admin
-      assert_equal nil, admin.remember_token
-      admin.remember_me!
-      assert_not_equal nil, admin.remember_token
-    end
-  end
-
-  test 'if remember_across_browsers is false, remember_me! should create a new token if a token exists but has expired' do
-    swap Devise, :remember_across_browsers => false, :remember_for => 1.day do
-      admin = create_admin
-      admin.remember_me!
-      admin.remember_created_at = 2.days.ago
-      admin.save
-      token = admin.remember_token
-      admin.remember_me!
-      assert_not_equal token, admin.remember_token
-    end
-  end
-
-  test 'if remember_across_browsers is false, remember_me! should create a new token if a token exists and has not expired' do
-    swap Devise, :remember_across_browsers => false, :remember_for => 2.days do
-      admin = create_admin
-      admin.remember_me!
-      admin.remember_created_at = 1.day.ago
-      admin.save
-      token = admin.remember_token
-      admin.remember_me!
-      assert_not_equal token, admin.remember_token
-    end
-  end
-end
-
-class WithSaltRememberableTest < ActiveSupport::TestCase
-  include SharedRememberableTest
-
-  setup do
-    assert_not User.new.respond_to?(:remember_token)
-  end
-
-  def resource_class
-    User
-  end
-
-  def create_resource
-    create_user
-  end
-
-  test 'remember_me should not generate a new token if using salt' do
-    user = create_user
-    user.expects(:valid?).never
-    user.remember_me!
-  end
-
-  test 'forget_me should not clear remember token if using salt' do
-    user = create_user
-    user.remember_me!
-    user.expects(:valid?).never
-    user.forget_me!
-  end
-
-  test 'serialize into cookie' do
-    user = create_user
-    user.remember_me!
-    assert_equal [user.to_key, user.authenticatable_salt], User.serialize_into_cookie(user)
-  end
-
-  test 'serialize from cookie' do
-    user = create_user
-    user.remember_me!
-    assert_equal user, User.serialize_from_cookie(user.to_key, user.authenticatable_salt)
-  end
-
-  test 'raises a RuntimeError if authenticatable_salt is nil' do
-    user = User.new
-    user.encrypted_password = nil
-    assert_raise RuntimeError do
-      user.rememberable_value
-    end
-  end
-end

data/test/models/serializable_test.rb

@@ -16,7 +16,7 @@ class SerializableTest < ActiveSupport::TestCase
   end
 
   test 'should include unsafe keys on XML if a force_except is provided' do
-    assert_no_match /email/, @user.to_xml(:force_except => :email)
+    assert_no_match /<email/, @user.to_xml(:force_except => :email)
     assert_match /confirmation-token/, @user.to_xml(:force_except => :email)
   end
 

data/test/models_test.rb

@@ -2,7 +2,7 @@ require 'test_helper'
 
 class Configurable < User
   devise :database_authenticatable, :encryptable, :confirmable, :rememberable, :timeoutable, :lockable,
-         :stretches => 15, :pepper => 'abcdef', :confirm_within => 5.days,
+         :stretches => 15, :pepper => 'abcdef', :allow_unconfirmed_access_for => 5.days,
          :remember_for => 7.days, :timeout_in => 15.minutes, :unlock_in => 10.days
 end
 
@@ -39,7 +39,7 @@ class ActiveRecordTest < ActiveSupport::TestCase
   end
 
   test 'can cherry pick modules' do
-    assert_include_modules Admin, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :rememberable, :encryptable
+    assert_include_modules Admin, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :encryptable, :confirmable
   end
 
   test 'validations options are not applied too late' do
@@ -55,12 +55,12 @@ class ActiveRecordTest < ActiveSupport::TestCase
   end
 
   test 'chosen modules are inheritable' do
-    assert_include_modules Inheritable, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :rememberable, :encryptable
+    assert_include_modules Inheritable, :database_authenticatable, :registerable, :timeoutable, :recoverable, :lockable, :encryptable, :confirmable
   end
 
   test 'order of module inclusion' do
-    correct_module_order   = [:database_authenticatable, :rememberable, :encryptable, :recoverable, :registerable, :lockable, :timeoutable]
-    incorrect_module_order = [:database_authenticatable, :timeoutable, :registerable, :recoverable, :lockable, :encryptable, :rememberable]
+    correct_module_order   = [:database_authenticatable, :encryptable, :recoverable, :registerable, :confirmable, :lockable, :timeoutable]
+    incorrect_module_order = [:database_authenticatable, :timeoutable, :registerable, :recoverable, :lockable, :encryptable, :confirmable]
 
     assert_include_modules Admin, *incorrect_module_order
 
@@ -87,8 +87,8 @@ class ActiveRecordTest < ActiveSupport::TestCase
     assert_equal 'abcdef', Configurable.pepper
   end
 
-  test 'set a default value for confirm_within' do
-    assert_equal 5.days, Configurable.confirm_within
+  test 'set a default value for allow_unconfirmed_access_for' do
+    assert_equal 5.days, Configurable.allow_unconfirmed_access_for
   end
 
   test 'set a default value for remember_for' do

data/test/rails_app/app/mongoid/admin.rb

@@ -5,5 +5,26 @@ class Admin
   include Shim
   include SharedAdmin
 
-  field :remember_token, :type => String
+  ## Database authenticatable
+  field :email,              :type => String, :null => true
+  field :encrypted_password, :type => String, :null => true
+
+  ## Recoverable
+  field :reset_password_token,   :type => String
+  field :reset_password_sent_at, :type => Time
+
+  ## Rememberable
+  field :remember_created_at, :type => Time
+
+  ## Confirmable
+  field :confirmation_token,   :type => String
+  field :confirmed_at,         :type => Time
+  field :confirmation_sent_at, :type => Time
+  field :unconfirmed_email,    :type => String # Only if using reconfirmable
+
+  ## Encryptable
+  field :password_salt, :type => String
+
+  ## Lockable
+  field :locked_at, :type => Time
 end

data/test/rails_app/app/mongoid/user.rb

@@ -7,4 +7,39 @@ class User
 
   field :username, :type => String
   field :facebook_token, :type => String
+
+  ## Database authenticatable
+  field :email,              :type => String, :null => false, :default => ""
+  field :encrypted_password, :type => String, :null => false, :default => ""
+
+  ## Recoverable
+  field :reset_password_token,   :type => String
+  field :reset_password_sent_at, :type => Time
+
+  ## Rememberable
+  field :remember_created_at, :type => Time
+
+  ## Trackable
+  field :sign_in_count,      :type => Integer, :default => 0
+  field :current_sign_in_at, :type => Time
+  field :last_sign_in_at,    :type => Time
+  field :current_sign_in_ip, :type => String
+  field :last_sign_in_ip,    :type => String
+
+  ## Encryptable
+  # field :password_salt, :type => String
+
+  ## Confirmable
+  field :confirmation_token,   :type => String
+  field :confirmed_at,         :type => Time
+  field :confirmation_sent_at, :type => Time
+  # field :unconfirmed_email,    :type => String # Only if using reconfirmable
+
+  ## Lockable
+  field :failed_attempts, :type => Integer, :default => 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token,    :type => String # Only if unlock strategy is :email or :both
+  field :locked_at,       :type => Time
+
+  ## Token authenticatable
+  field :authentication_token, :type => String
 end