devise 3.0.0 → 4.8.0

data/test/integration/rememberable_test.rb

@@ -1,165 +0,0 @@
-require 'test_helper'
-
-class RememberMeTest < ActionDispatch::IntegrationTest
-  def create_user_and_remember(add_to_token='')
-    user = create_user
-    user.remember_me!
-    raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
-    cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
-    user
-  end
-
-  def generate_signed_cookie(raw_cookie)
-    request = ActionDispatch::TestRequest.new
-    request.cookie_jar.signed['raw_cookie'] = raw_cookie
-    request.cookie_jar['raw_cookie']
-  end
-
-  def signed_cookie(key)
-    controller.send(:cookies).signed[key]
-  end
-
-  def cookie_expires(key)
-    cookie  = response.headers["Set-Cookie"].split("\n").grep(/^#{key}/).first
-    expires = cookie.split(";").map(&:strip).grep(/^expires=/).first
-    Time.parse(expires).utc
-  end
-
-  test 'do not remember the user if he has not checked remember me option' do
-    sign_in_as_user
-    assert_nil request.cookies["remember_user_cookie"]
-  end
-
-  test 'handles unverified requests gets rid of caches' do
-    swap UsersController, :allow_forgery_protection => true do
-      post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
-
-      create_user_and_remember
-      post exhibit_user_url(1)
-      assert_equal "User is not authenticated", response.body
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'generate remember token after sign in' do
-    sign_in_as_user :remember_me => true
-    assert request.cookies["remember_user_token"]
-  end
-
-  test 'generate remember token after sign in setting cookie options' do
-    # We test this by asserting the cookie is not sent after the redirect
-    # since we changed the domain. This is the only difference with the
-    # previous test.
-    swap Devise, :rememberable_options => { :domain => "omg.somewhere.com" } do
-      user = sign_in_as_user :remember_me => true
-      assert_nil request.cookies["remember_user_token"]
-    end
-  end
-
-  test 'generate remember token with a custom key' do
-    swap Devise, :rememberable_options => { :key => "v1lat_token" } do
-      user = sign_in_as_user :remember_me => true
-      assert request.cookies["v1lat_token"]
-    end
-  end
-
-  test 'generate remember token after sign in setting session options' do
-    begin
-      Rails.configuration.session_options[:domain] = "omg.somewhere.com"
-      user = sign_in_as_user :remember_me => true
-      assert_nil request.cookies["remember_user_token"]
-    ensure
-      Rails.configuration.session_options.delete(:domain)
-    end
-  end
-
-  test 'remember the user before sign in' do
-    user = create_user_and_remember
-    get users_path
-    assert_response :success
-    assert warden.authenticated?(:user)
-    assert warden.user(:user) == user
-    assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
-  end
-
-  test 'remember the user before sign up and redirect him to his home' do
-    create_user_and_remember
-    get new_user_registration_path
-    assert warden.authenticated?(:user)
-    assert_redirected_to root_path
-  end
-
-  test 'cookies are destroyed on unverified requests' do
-    swap ApplicationController, :allow_forgery_protection => true do
-      create_user_and_remember
-      get users_path
-      assert warden.authenticated?(:user)
-      post root_path, :authenticity_token => 'INVALID'
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'does not extend remember period through sign in' do
-    swap Devise, :extend_remember_period => true, :remember_for => 1.year do
-      user = create_user
-      user.remember_me!
-
-      user.remember_created_at = old = 10.days.ago
-      user.save
-
-      sign_in_as_user :remember_me => true
-      user.reload
-
-      assert warden.user(:user) == user
-      assert_equal old.to_i, user.remember_created_at.to_i
-    end
-  end
-
-  test 'do not remember other scopes' do
-    create_user_and_remember
-    get root_path
-    assert_response :success
-    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
-  end
-
-  test 'do not remember with invalid token' do
-    create_user_and_remember('add')
-    get users_path
-    assert_not warden.authenticated?(:user)
-    assert_redirected_to new_user_session_path
-  end
-
-  test 'do not remember with expired token' do
-    create_user_and_remember
-    swap Devise, :remember_for => 0 do
-      get users_path
-      assert_not warden.authenticated?(:user)
-      assert_redirected_to new_user_session_path
-    end
-  end
-
-  test 'do not remember the user anymore after forget' do
-    create_user_and_remember
-    get users_path
-    assert warden.authenticated?(:user)
-
-    get destroy_user_session_path
-    assert_not warden.authenticated?(:user)
-    assert_nil warden.cookies['remember_user_token']
-
-    get users_path
-    assert_not warden.authenticated?(:user)
-  end
-
-  test 'changing user password expires remember me token' do
-    user = create_user_and_remember
-    user.password = "another_password"
-    user.password_confirmation = "another_password"
-    user.save!
-
-    get users_path
-    assert_not warden.authenticated?(:user)
-  end
-end

data/test/integration/timeoutable_test.rb

@@ -1,150 +0,0 @@
-require 'test_helper'
-
-class SessionTimeoutTest < ActionDispatch::IntegrationTest
-
-  def last_request_at
-    @controller.user_session['last_request_at']
-  end
-
-  test 'set last request at in user session after each request' do
-    sign_in_as_user
-    old_last_request = last_request_at
-    assert_not_nil last_request_at
-
-    get users_path
-    assert_not_nil last_request_at
-    assert_not_equal old_last_request, last_request_at
-  end
-
-  test 'set last request at in user session after each request is skipped if tracking is disabled' do
-    sign_in_as_user
-    old_last_request = last_request_at
-    assert_not_nil last_request_at
-
-    get users_path, {}, 'devise.skip_trackable' => true
-    assert_equal old_last_request, last_request_at
-  end
-
-  test 'does not time out user session before default limit time' do
-    sign_in_as_user
-    assert_response :success
-    assert warden.authenticated?(:user)
-
-    get users_path
-    assert_response :success
-    assert warden.authenticated?(:user)
-  end
-
-  test 'time out user session after default limit time' do
-    user = sign_in_as_user
-    get expire_user_path(user)
-    assert_not_nil last_request_at
-
-    get users_path
-    assert_redirected_to users_path
-    assert_not warden.authenticated?(:user)
-  end
-
-  test 'time out user session after deault limit time and redirect to latest get request' do
-    user = sign_in_as_user
-    visit edit_form_user_path(user)
-
-    click_button 'Update'
-    sign_in_as_user
-
-    assert_equal edit_form_user_url(user), current_url
-  end
-
-  test 'time out is not triggered on sign out' do
-    user = sign_in_as_user
-    get expire_user_path(user)
-
-    get destroy_user_session_path
-
-    assert_response :redirect
-    assert_redirected_to root_path
-    follow_redirect!
-    assert_contain 'Signed out successfully'
-  end
-
-  test 'time out is not triggered on sign in' do
-    user = sign_in_as_user
-    get expire_user_path(user)
-
-    post "/users/sign_in", :email => user.email, :password => "123456"
-
-    assert_response :redirect
-    follow_redirect!
-    assert_contain 'You are signed in'
-  end
-
-  test 'admin does not explode on time out' do
-    admin = sign_in_as_admin
-    get expire_admin_path(admin)
-
-    Admin.send :define_method, :reset_authentication_token! do
-      nil
-    end
-
-    begin
-      get admins_path
-      assert_redirected_to admins_path
-      assert_not warden.authenticated?(:admin)
-    ensure
-      Admin.send(:remove_method, :reset_authentication_token!)
-    end
-  end
-
-  test 'user configured timeout limit' do
-    swap Devise, :timeout_in => 8.minutes do
-      user = sign_in_as_user
-
-      get users_path
-      assert_not_nil last_request_at
-      assert_response :success
-      assert warden.authenticated?(:user)
-
-      get expire_user_path(user)
-      get users_path
-      assert_redirected_to users_path
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'error message with i18n' do
-    store_translations :en, :devise => {
-      :failure => { :user => { :timeout => 'Session expired!' } }
-    } do
-      user = sign_in_as_user
-
-      get expire_user_path(user)
-      get root_path
-      follow_redirect!
-      assert_contain 'Session expired!'
-    end
-  end
-
-  test 'error message with i18n with double redirect' do
-    store_translations :en, :devise => {
-      :failure => { :user => { :timeout => 'Session expired!' } }
-    } do
-      user = sign_in_as_user
-
-      get expire_user_path(user)
-      get users_path
-      follow_redirect!
-      follow_redirect!
-      assert_contain 'Session expired!'
-    end
-  end
-
-  test 'time out not triggered if remembered' do
-    user = sign_in_as_user :remember_me => true
-    get expire_user_path(user)
-    assert_not_nil last_request_at
-
-    get users_path
-    assert_response :success
-    assert warden.authenticated?(:user)
-  end
-end

data/test/integration/token_authenticatable_test.rb

@@ -1,205 +0,0 @@
-require 'test_helper'
-
-class TokenAuthenticationTest < ActionDispatch::IntegrationTest
-
-  test 'authenticate with valid authentication token key and value through params' do
-    swap Devise, :token_authentication_key => :secret_token do
-      sign_in_as_new_user_with_token
-
-      assert_response :success
-      assert_current_url "/users?secret_token=#{VALID_AUTHENTICATION_TOKEN}"
-      assert_contain 'Welcome'
-      assert warden.authenticated?(:user)
-    end
-  end
-
-  test 'authenticate with valid authentication token key and value through params, when params with the same key as scope exist' do
-    swap Devise, :token_authentication_key => :secret_token do
-      user = create_user_with_authentication_token
-      post exhibit_user_path(user), Devise.token_authentication_key => user.authentication_token, :user => { :some => "data" }
-
-      assert_response :success
-      assert_contain 'User is authenticated'
-      assert warden.authenticated?(:user)
-    end
-  end
-
-  test 'authenticate with valid authentication token key but does not store if stateless' do
-    swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth] do
-      sign_in_as_new_user_with_token
-      assert warden.authenticated?(:user)
-
-      get users_path
-      assert_redirected_to new_user_session_path
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'authenticate with valid authentication token key and value through http' do
-    swap Devise, :token_authentication_key => :secret_token do
-      sign_in_as_new_user_with_token(:http_auth => true)
-
-      assert_response :success
-      assert_match '<email>user@test.com</email>', response.body
-      assert warden.authenticated?(:user)
-    end
-  end
-
-  test 'does authenticate with valid authentication token key and value through params if not configured' do
-    swap Devise, :token_authentication_key => :secret_token, :params_authenticatable => [:database] do
-      sign_in_as_new_user_with_token
-
-      assert_contain 'You need to sign in or sign up before continuing'
-      assert_contain 'Sign in'
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'does authenticate with valid authentication token key and value through http if not configured' do
-    swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => [:database] do
-      sign_in_as_new_user_with_token(:http_auth => true)
-
-      assert_response 401
-      assert_contain 'Invalid email or password.'
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'does not authenticate with improper authentication token key' do
-    swap Devise, :token_authentication_key => :donald_duck_token do
-      sign_in_as_new_user_with_token(:auth_token_key => :secret_token)
-      assert_equal new_user_session_path, @request.path
-
-      assert_contain 'You need to sign in or sign up before continuing'
-      assert_contain 'Sign in'
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'does not authenticate with improper authentication token value' do
-    store_translations :en, :devise => {:failure => {:invalid_token => 'LOL, that was not a single character correct.'}} do
-      sign_in_as_new_user_with_token(:auth_token => '*** INVALID TOKEN ***')
-      assert_equal new_user_session_path, @request.path
-
-      assert_contain 'LOL, that was not a single character correct.'
-      assert_contain 'Sign in'
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'authenticate with valid authentication token key and do not store if stateless and timeoutable are enabled' do
-    swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth], :timeout_in => (0.1).second do
-      user = sign_in_as_new_user_with_token
-      assert warden.authenticated?(:user)
-
-      # Expiring does not work because we are setting the session value when accessing it
-      sleep 0.3
-
-      get_users_path_as_existing_user(user)
-      assert warden.authenticated?(:user)
-    end
-  end
-
-  test 'should reset token and not authenticate when expire_auth_token_on_timeout is set to true, timeoutable is enabled and we have a timed out session' do
-    swap Devise, :token_authentication_key => :secret_token, :expire_auth_token_on_timeout => true, :timeout_in => (-1).minute do
-      user = sign_in_as_new_user_with_token
-      assert warden.authenticated?(:user)
-      token = user.authentication_token
-
-      get_users_path_as_existing_user(user)
-      assert_not warden.authenticated?(:user)
-      user.reload
-      assert_not_equal token, user.authentication_token
-    end
-  end
-
-  test 'should not be subject to injection' do
-    swap Devise, :token_authentication_key => :secret_token do
-      user1 = create_user_with_authentication_token()
-
-      # Clean up user cache
-      @user = nil
-
-      user2 = create_user_with_authentication_token(:email => "another@test.com")
-      user2.update_attribute(:authentication_token, "ANOTHERTOKEN")
-
-      assert_not_equal user1, user2
-      visit users_path(Devise.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
-      assert_nil warden.user(:user)
-    end
-  end
-
-  test 'authenticate with valid authentication token key and value through http header' do
-    swap Devise, :token_authentication_key => :secret_token do
-      sign_in_as_new_user_with_token(:token_auth => true)
-
-      assert_response :success
-      assert_match '<email>user@test.com</email>', response.body
-      assert_equal request.env['devise.token_options'], {}
-      assert warden.authenticated?(:user)
-    end
-  end
-
-  test 'authenticate with valid authentication token key and value through http header, with options' do
-    swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => [:token_options] do
-      signature = "**TESTSIGNATURE**"
-      sign_in_as_new_user_with_token(:token_auth => true, :token_options => {:signature => signature, :nonce => 'def'})
-
-      assert_response :success
-      assert_match '<email>user@test.com</email>', response.body
-      assert_equal request.env['devise.token_options'][:signature], signature
-      assert_equal request.env['devise.token_options'][:nonce], 'def'
-      assert warden.authenticated?(:user)
-    end
-  end
-
-  test 'authenticate with valid authentication token key and value through http header without allowing token authorization setting is denied' do
-    swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => false do
-      sign_in_as_new_user_with_token(:token_auth => true)
-
-      assert_response :unauthorized
-      assert_nil warden.user(:user)
-    end
-  end
-
-  test 'does not authenticate with improper authentication token value in header' do
-    sign_in_as_new_user_with_token(:token_auth => true, :auth_token => '*** INVALID TOKEN ***')
-
-    assert_response :unauthorized
-    assert_nil warden.user(:user)
-  end
-
-  private
-
-    def sign_in_as_new_user_with_token(options = {})
-      user = options.delete(:user) || create_user_with_authentication_token(options)
-
-      options[:auth_token_key] ||= Devise.token_authentication_key
-      options[:auth_token]     ||= user.authentication_token
-
-      if options[:http_auth]
-        header = "Basic #{Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
-        get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
-      elsif options[:token_auth]
-        token_options = options[:token_options] || {}
-        header = ActionController::HttpAuthentication::Token.encode_credentials(options[:auth_token], token_options)
-        get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
-      else
-        visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
-      end
-
-      user
-    end
-
-    def create_user_with_authentication_token(options={})
-      user = create_user(options)
-      user.authentication_token = VALID_AUTHENTICATION_TOKEN
-      user.save
-      user
-    end
-
-    def get_users_path_as_existing_user(user)
-      sign_in_as_new_user_with_token(:user => user)
-    end
-
-end

data/test/integration/trackable_test.rb

@@ -1,92 +0,0 @@
-require 'test_helper'
-
-class TrackableHooksTest < ActionDispatch::IntegrationTest
-
-  test "current and last sign in timestamps are updated on each sign in" do
-    user = create_user
-    assert_nil user.current_sign_in_at
-    assert_nil user.last_sign_in_at
-
-    sign_in_as_user
-    user.reload
-
-    assert_kind_of Time, user.current_sign_in_at
-    assert_kind_of Time, user.last_sign_in_at
-
-    assert_equal user.current_sign_in_at, user.last_sign_in_at
-    assert user.current_sign_in_at >= user.created_at
-
-    visit destroy_user_session_path
-    new_time = 2.seconds.from_now
-    Time.stubs(:now).returns(new_time)
-
-    sign_in_as_user
-    user.reload
-    assert user.current_sign_in_at > user.last_sign_in_at
-  end
-
-  test "current and last sign in remote ip are updated on each sign in" do
-    user = create_user
-    assert_nil user.current_sign_in_ip
-    assert_nil user.last_sign_in_ip
-
-    sign_in_as_user
-    user.reload
-
-    assert_equal "127.0.0.1", user.current_sign_in_ip
-    assert_equal "127.0.0.1", user.last_sign_in_ip
-  end
-
-  test "current remote ip returns original ip behind a non transparent proxy" do
-    user = create_user
-
-    arbitrary_ip = '200.121.1.69'
-    sign_in_as_user do
-      header 'HTTP_X_FORWARDED_FOR', arbitrary_ip
-    end
-    user.reload
-    assert_equal arbitrary_ip, user.current_sign_in_ip
-  end
-
-  test "increase sign in count" do
-    user = create_user
-    assert_equal 0, user.sign_in_count
-
-    sign_in_as_user
-    user.reload
-    assert_equal 1, user.sign_in_count
-
-    visit destroy_user_session_path
-    sign_in_as_user
-    user.reload
-    assert_equal 2, user.sign_in_count
-  end
-
-  test "does not update anything if user has signed out along the way" do
-    swap Devise, :allow_unconfirmed_access_for => 0 do
-      user = create_user(:confirm => false)
-      sign_in_as_user
-
-      user.reload
-      assert_nil user.current_sign_in_at
-      assert_nil user.last_sign_in_at
-    end
-  end
-
-  test "do not track if devise.skip_trackable is set" do
-    user = create_user
-    sign_in_as_user do
-      header 'devise.skip_trackable', '1'
-    end
-    user.reload
-    assert_equal 0, user.sign_in_count
-    visit destroy_user_session_path
-
-    sign_in_as_user do
-      header 'devise.skip_trackable', false
-    end
-    user.reload
-    assert_equal 1, user.sign_in_count
-  end
-
-end