devise 2.1.2 → 3.5.10

data/test/integration/rememberable_test.rb

@@ -1,10 +1,15 @@
 require 'test_helper'
 
-class RememberMeTest < ActionController::IntegrationTest
+class RememberMeTest < ActionDispatch::IntegrationTest
+  if (Rails::VERSION::MAJOR < 4) || (Rails::VERSION::MAJOR >= 4 && Rails::VERSION::MINOR < 1)
+    require 'time_helpers'
+    include ActiveSupport::Testing::TimeHelpers
+  end
+
   def create_user_and_remember(add_to_token='')
     user = create_user
     user.remember_me!
-    raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
+    raw_cookie = User.serialize_into_cookie(user).tap { |a| a[1] << add_to_token }
     cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
     user
   end
@@ -25,13 +30,13 @@ class RememberMeTest < ActionController::IntegrationTest
     Time.parse(expires).utc
   end
 
-  test 'do not remember the user if he has not checked remember me option' do
-    user = sign_in_as_user
+  test 'do not remember the user if they have not checked remember me option' do
+    sign_in_as_user
     assert_nil request.cookies["remember_user_cookie"]
   end
 
-  test 'handles unverified requests gets rid of caches' do
-    swap UsersController, :allow_forgery_protection => true do
+  test 'handle unverified requests gets rid of caches' do
+    swap ApplicationController, allow_forgery_protection: true do
       post exhibit_user_url(1)
       assert_not warden.authenticated?(:user)
 
@@ -42,25 +47,44 @@ class RememberMeTest < ActionController::IntegrationTest
     end
   end
 
+  test 'handle unverified requests does not create cookies on sign in' do
+    swap ApplicationController, allow_forgery_protection: true do
+      get new_user_session_path
+      assert request.session[:_csrf_token]
+
+      post user_session_path, authenticity_token: "oops", user:
+           { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
+      assert_not warden.authenticated?(:user)
+      assert_not request.cookies['remember_user_token']
+    end
+  end
+
   test 'generate remember token after sign in' do
-    user = sign_in_as_user :remember_me => true
-    assert request.cookies["remember_user_token"]
+    sign_in_as_user remember_me: true
+    assert request.cookies['remember_user_token']
   end
 
   test 'generate remember token after sign in setting cookie options' do
     # We test this by asserting the cookie is not sent after the redirect
     # since we changed the domain. This is the only difference with the
     # previous test.
-    swap Devise, :rememberable_options => { :domain => "omg.somewhere.com" } do
-      user = sign_in_as_user :remember_me => true
+    swap Devise, rememberable_options: { domain: "omg.somewhere.com" } do
+      sign_in_as_user remember_me: true
       assert_nil request.cookies["remember_user_token"]
     end
   end
 
+  test 'generate remember token with a custom key' do
+    swap Devise, rememberable_options: { key: "v1lat_token" } do
+      sign_in_as_user remember_me: true
+      assert request.cookies["v1lat_token"]
+    end
+  end
+
   test 'generate remember token after sign in setting session options' do
     begin
       Rails.configuration.session_options[:domain] = "omg.somewhere.com"
-      user = sign_in_as_user :remember_me => true
+      sign_in_as_user remember_me: true
       assert_nil request.cookies["remember_user_token"]
     ensure
       Rails.configuration.session_options.delete(:domain)
@@ -73,35 +97,24 @@ class RememberMeTest < ActionController::IntegrationTest
     assert_response :success
     assert warden.authenticated?(:user)
     assert warden.user(:user) == user
-    assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
   end
 
-  test 'remember the user before sign up and redirect him to his home' do
-    user = create_user_and_remember
+  test 'remember the user before sign up and redirect them to their home' do
+    create_user_and_remember
     get new_user_registration_path
     assert warden.authenticated?(:user)
     assert_redirected_to root_path
   end
 
-  test 'cookies are destroyed on unverified requests' do
-    swap ApplicationController, :allow_forgery_protection => true do
-      user = create_user_and_remember
-      get users_path
-      assert warden.authenticated?(:user)
-      post root_path, :authenticity_token => 'INVALID'
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
   test 'does not extend remember period through sign in' do
-    swap Devise, :extend_remember_period => true, :remember_for => 1.year do
+    swap Devise, extend_remember_period: true, remember_for: 1.year do
       user = create_user
       user.remember_me!
 
       user.remember_created_at = old = 10.days.ago
       user.save
 
-      sign_in_as_user :remember_me => true
+      sign_in_as_user remember_me: true
       user.reload
 
       assert warden.user(:user) == user
@@ -109,8 +122,42 @@ class RememberMeTest < ActionController::IntegrationTest
     end
   end
 
+  test 'extends remember period when extend remember period config is true' do
+    swap Devise, extend_remember_period: true, remember_for: 1.year do
+      user = create_user_and_remember
+      old_remember_token = nil
+
+      travel_to 1.day.ago do
+        get root_path
+        old_remember_token = request.cookies['remember_user_token']
+      end
+
+      get root_path
+      current_remember_token = request.cookies['remember_user_token']
+
+      refute_equal old_remember_token, current_remember_token
+    end
+  end
+
+  test 'does not extend remember period when extend period config is false' do
+    swap Devise, extend_remember_period: false, remember_for: 1.year do
+      user = create_user_and_remember
+      old_remember_token = nil
+
+      travel_to 1.day.ago do
+        get root_path
+        old_remember_token = request.cookies['remember_user_token']
+      end
+
+      get root_path
+      current_remember_token = request.cookies['remember_user_token']
+
+      assert_equal old_remember_token, current_remember_token
+    end
+  end
+
   test 'do not remember other scopes' do
-    user = create_user_and_remember
+    create_user_and_remember
     get root_path
     assert_response :success
     assert warden.authenticated?(:user)
@@ -118,15 +165,15 @@ class RememberMeTest < ActionController::IntegrationTest
   end
 
   test 'do not remember with invalid token' do
-    user = create_user_and_remember('add')
+    create_user_and_remember('add')
     get users_path
     assert_not warden.authenticated?(:user)
     assert_redirected_to new_user_session_path
   end
 
   test 'do not remember with expired token' do
-    user = create_user_and_remember
-    swap Devise, :remember_for => 0 do
+    create_user_and_remember
+    swap Devise, remember_for: 0.days do
       get users_path
       assert_not warden.authenticated?(:user)
       assert_redirected_to new_user_session_path
@@ -134,7 +181,7 @@ class RememberMeTest < ActionController::IntegrationTest
   end
 
   test 'do not remember the user anymore after forget' do
-    user = create_user_and_remember
+    create_user_and_remember
     get users_path
     assert warden.authenticated?(:user)
 
@@ -155,4 +202,13 @@ class RememberMeTest < ActionController::IntegrationTest
     get users_path
     assert_not warden.authenticated?(:user)
   end
+
+  test 'valid sign in calls after_remembered callback' do
+    user = create_user_and_remember
+
+    User.expects(:serialize_from_cookie).returns user
+    user.expects :after_remembered
+
+    get new_user_registration_path
+  end
 end

data/test/integration/timeoutable_test.rb

@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class SessionTimeoutTest < ActionController::IntegrationTest
+class SessionTimeoutTest < ActionDispatch::IntegrationTest
 
   def last_request_at
     @controller.user_session['last_request_at']
@@ -8,12 +8,11 @@ class SessionTimeoutTest < ActionController::IntegrationTest
 
   test 'set last request at in user session after each request' do
     sign_in_as_user
-    old_last_request = last_request_at
     assert_not_nil last_request_at
 
+    @controller.user_session.delete('last_request_at')
     get users_path
     assert_not_nil last_request_at
-    assert_not_equal old_last_request, last_request_at
   end
 
   test 'set last request at in user session after each request is skipped if tracking is disabled' do
@@ -25,6 +24,18 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert_equal old_last_request, last_request_at
   end
 
+  test 'does not set last request at in user session after each request if timeoutable is disabled' do
+    sign_in_as_user
+    old_last_request = last_request_at
+    assert_not_nil last_request_at
+
+    new_time = 2.seconds.from_now
+    Time.stubs(:now).returns(new_time)
+
+    get users_path, {}, 'devise.skip_timeoutable' => true
+    assert_equal old_last_request, last_request_at
+  end
+
   test 'does not time out user session before default limit time' do
     sign_in_as_user
     assert_response :success
@@ -35,14 +46,43 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert warden.authenticated?(:user)
   end
 
-  test 'time out user session after default limit time' do
+  test 'time out user session after default limit time when sign_out_all_scopes is false' do
+    swap Devise, sign_out_all_scopes: false do
+      sign_in_as_admin
+
+      user = sign_in_as_user
+      get expire_user_path(user)
+      assert_not_nil last_request_at
+
+      get users_path
+      assert_redirected_to users_path
+      assert_not warden.authenticated?(:user)
+      assert warden.authenticated?(:admin)
+    end
+  end
+
+  test 'time out all sessions after default limit time when sign_out_all_scopes is true' do
+    swap Devise, sign_out_all_scopes: true do
+      sign_in_as_admin
+
+      user = sign_in_as_user
+      get expire_user_path(user)
+      assert_not_nil last_request_at
+
+      get root_path
+      assert_not warden.authenticated?(:user)
+      assert_not warden.authenticated?(:admin)
+    end
+  end
+
+  test 'time out user session after deault limit time and redirect to latest get request' do
     user = sign_in_as_user
-    get expire_user_path(user)
-    assert_not_nil last_request_at
+    visit edit_form_user_path(user)
 
-    get users_path
-    assert_redirected_to users_path
-    assert_not warden.authenticated?(:user)
+    click_button 'Update'
+    sign_in_as_user
+
+    assert_equal edit_form_user_url(user), current_url
   end
 
   test 'time out is not triggered on sign out' do
@@ -57,36 +97,33 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert_contain 'Signed out successfully'
   end
 
-  test 'time out is not triggered on sign in' do
+  test 'expired session is not extended by sign in page' do
     user = sign_in_as_user
     get expire_user_path(user)
+    assert warden.authenticated?(:user)
 
-    post "/users/sign_in", :email => user.email, :password => "123456"
-
-    assert_response :redirect
+    get "/users/sign_in"
+    assert_redirected_to "/users/sign_in"
     follow_redirect!
-    assert_contain 'You are signed in'
+
+    assert_response :success
+    assert_contain 'Sign in'
+    assert_not warden.authenticated?(:user)
   end
 
-  test 'admin does not explode on time out' do
-    admin = sign_in_as_admin
-    get expire_admin_path(admin)
+  test 'time out is not triggered on sign in' do
+    user = sign_in_as_user
+    get expire_user_path(user)
 
-    Admin.send :define_method, :reset_authentication_token! do
-      nil
-    end
+    post "/users/sign_in", email: user.email, password: "123456"
 
-    begin
-      get admins_path
-      assert_redirected_to admins_path
-      assert_not warden.authenticated?(:admin)
-    ensure
-      Admin.send(:remove_method, :reset_authentication_token!)
-    end
+    assert_response :redirect
+    follow_redirect!
+    assert_contain 'You are signed in'
   end
 
   test 'user configured timeout limit' do
-    swap Devise, :timeout_in => 8.minutes do
+    swap Devise, timeout_in: 8.minutes do
       user = sign_in_as_user
 
       get users_path
@@ -102,8 +139,8 @@ class SessionTimeoutTest < ActionController::IntegrationTest
   end
 
   test 'error message with i18n' do
-    store_translations :en, :devise => {
-      :failure => { :user => { :timeout => 'Session expired!' } }
+    store_translations :en, devise: {
+      failure: { user: { timeout: 'Session expired!' } }
     } do
       user = sign_in_as_user
 
@@ -115,8 +152,8 @@ class SessionTimeoutTest < ActionController::IntegrationTest
   end
 
   test 'error message with i18n with double redirect' do
-    store_translations :en, :devise => {
-      :failure => { :user => { :timeout => 'Session expired!' } }
+    store_translations :en, devise: {
+      failure: { user: { timeout: 'Session expired!' } }
     } do
       user = sign_in_as_user
 
@@ -129,7 +166,7 @@ class SessionTimeoutTest < ActionController::IntegrationTest
   end
 
   test 'time out not triggered if remembered' do
-    user = sign_in_as_user :remember_me => true
+    user = sign_in_as_user remember_me: true
     get expire_user_path(user)
     assert_not_nil last_request_at
 
@@ -137,4 +174,11 @@ class SessionTimeoutTest < ActionController::IntegrationTest
     assert_response :success
     assert warden.authenticated?(:user)
   end
+
+  test 'does not crash when the last_request_at is a String' do
+    user = sign_in_as_user
+
+    get edit_form_user_path(user, last_request_at: Time.now.utc.to_s)
+    get users_path
+  end
 end

data/test/integration/trackable_test.rb

@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class TrackableHooksTest < ActionController::IntegrationTest
+class TrackableHooksTest < ActionDispatch::IntegrationTest
 
   test "current and last sign in timestamps are updated on each sign in" do
     user = create_user
@@ -10,8 +10,8 @@ class TrackableHooksTest < ActionController::IntegrationTest
     sign_in_as_user
     user.reload
 
-    assert_kind_of Time, user.current_sign_in_at
-    assert_kind_of Time, user.last_sign_in_at
+    assert user.current_sign_in_at.acts_like?(:time)
+    assert user.last_sign_in_at.acts_like?(:time)
 
     assert_equal user.current_sign_in_at, user.last_sign_in_at
     assert user.current_sign_in_at >= user.created_at
@@ -63,8 +63,8 @@ class TrackableHooksTest < ActionController::IntegrationTest
   end
 
   test "does not update anything if user has signed out along the way" do
-    swap Devise, :allow_unconfirmed_access_for => 0 do
-      user = create_user(:confirm => false)
+    swap Devise, allow_unconfirmed_access_for: 0.days do
+      user = create_user(confirm: false)
       sign_in_as_user
 
       user.reload

data/test/mailers/confirmation_instructions_test.rb

@@ -46,34 +46,54 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
     assert_equal ['custom@example.com'], mail.from
   end
 
+  test 'setup sender from custom mailer defaults with proc' do
+    Devise.mailer = 'Users::FromProcMailer'
+    assert_equal ['custom@example.com'], mail.from
+  end
+
+  test 'custom mailer renders parent mailer template' do
+    Devise.mailer = 'Users::Mailer'
+    assert_present mail.body.encoded
+  end
+
   test 'setup reply to as copy from sender' do
     assert_equal ['test@example.com'], mail.reply_to
   end
 
+  test 'setup reply to as different if set in defaults' do
+    Devise.mailer = 'Users::ReplyToMailer'
+    assert_equal ['custom@example.com'], mail.from
+    assert_equal ['custom_reply_to@example.com'], mail.reply_to
+  end
+
   test 'setup subject from I18n' do
-    store_translations :en, :devise => { :mailer => { :confirmation_instructions => { :subject => 'Account Confirmation' } } } do
+    store_translations :en, devise: { mailer: { confirmation_instructions: { subject: 'Account Confirmation' } } } do
       assert_equal 'Account Confirmation', mail.subject
     end
   end
 
   test 'subject namespaced by model' do
-    store_translations :en, :devise => { :mailer => { :confirmation_instructions => { :user_subject => 'User Account Confirmation' } } } do
+    store_translations :en, devise: { mailer: { confirmation_instructions: { user_subject: 'User Account Confirmation' } } } do
       assert_equal 'User Account Confirmation', mail.subject
     end
   end
 
   test 'body should have user info' do
-    assert_match /#{user.email}/, mail.body.encoded
+    assert_match user.email, mail.body.encoded
   end
 
   test 'body should have link to confirm the account' do
-    host = ActionMailer::Base.default_url_options[:host]
-    confirmation_url_regexp = %r{<a href=\"http://#{host}/users/confirmation\?confirmation_token=#{user.confirmation_token}">}
-    assert_match confirmation_url_regexp, mail.body.encoded
+    host, port = ActionMailer::Base.default_url_options.values_at :host, :port
+
+    if mail.body.encoded =~ %r{<a href=\"http://#{host}:#{port}/users/confirmation\?confirmation_token=([^"]+)">}
+      assert_equal $1, user.confirmation_token
+    else
+      flunk "expected confirmation url regex to match"
+    end
   end
 
   test 'renders a scoped if scoped_views is set to true' do
-    swap Devise, :scoped_views => true do
+    swap Devise, scoped_views: true do
       assert_equal user.email, mail.body.decoded
     end
   end
@@ -88,7 +108,7 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
   end
 
   test 'mailer sender accepts a proc' do
-    swap Devise, :mailer_sender => proc { "another@example.com" } do
+    swap Devise, mailer_sender: proc { "another@example.com" } do
       assert_equal ['another@example.com'], mail.from
     end
   end