devise 3.0.4 → 3.1.0.rc2

data/test/integration/lockable_test.rb

@@ -13,6 +13,7 @@ class LockTest < ActionDispatch::IntegrationTest
     visit new_user_session_path
     click_link "Didn't receive unlock instructions?"
 
+    Devise.stubs(:friendly_token).returns("abcdef")
     fill_in 'email', :with => user.email
     click_button 'Resend unlock instructions'
   end
@@ -22,8 +23,11 @@ class LockTest < ActionDispatch::IntegrationTest
 
     assert_template 'sessions/new'
     assert_contain 'You will receive an email with instructions about how to unlock your account in a few minutes'
+
+    mail = ActionMailer::Base.deliveries.last
     assert_equal 1, ActionMailer::Base.deliveries.size
-    assert_equal ['please-change-me@config-initializers-devise.com'], ActionMailer::Base.deliveries.first.from
+    assert_equal ['please-change-me@config-initializers-devise.com'], mail.from
+    assert_match user_unlock_path(unlock_token: 'abcdef'), mail.body.encoded
   end
 
   test 'user should receive the instructions from a custom mailer' do
@@ -75,23 +79,15 @@ class LockTest < ActionDispatch::IntegrationTest
   end
 
   test "locked user should be able to unlock account" do
-    user = create_user(:locked => true)
-    assert user.access_locked?
-
-    visit_user_unlock_with_token(user.unlock_token)
+    user = create_user
+    raw  = user.lock_access!
+    visit_user_unlock_with_token(raw)
 
     assert_current_url "/users/sign_in"
     assert_contain 'Your account has been unlocked successfully. Please sign in to continue.'
-
     assert_not user.reload.access_locked?
   end
 
-  test "redirect user to sign in page after unlocking its account" do
-    user = create_user(:locked => true)
-    visit_user_unlock_with_token(user.unlock_token)
-    assert_not warden.authenticated?(:user)
-  end
-
   test "user should not send a new e-mail if already locked" do
     user = create_user(:locked => true)
     user.failed_attempts = User.maximum_attempts + 1
@@ -153,9 +149,10 @@ class LockTest < ActionDispatch::IntegrationTest
   end
 
   test 'user with valid unlock token should be able to unlock account via XML request' do
-    user = create_user(:locked => true)
+    user = create_user()
+    raw  = user.lock_access!
     assert user.access_locked?
-    get user_unlock_path(:format => 'xml', :unlock_token => user.unlock_token)
+    get user_unlock_path(:format => 'xml', :unlock_token => raw)
     assert_response :success
     assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
   end

data/test/integration/recoverable_test.rb

@@ -14,12 +14,16 @@ class PasswordTest < ActionDispatch::IntegrationTest
 
     fill_in 'email', :with => 'user@test.com'
     yield if block_given?
+
+    Devise.stubs(:friendly_token).returns("abcdef")
     click_button 'Send me reset password instructions'
   end
 
   def reset_password(options={}, &block)
-    visit edit_user_password_path(:reset_password_token => options[:reset_password_token]) unless options[:visit] == false
-    assert_response :success
+    unless options[:visit] == false
+      visit edit_user_password_path(:reset_password_token => options[:reset_password_token] || "abcdef")
+      assert_response :success
+    end
 
     fill_in 'New password', :with => '987654321'
     fill_in 'Confirm new password', :with => '987654321'
@@ -45,7 +49,10 @@ class PasswordTest < ActionDispatch::IntegrationTest
     request_forgot_password do
       fill_in 'email', :with => 'foo@bar.com'
     end
-    assert_equal ['custom@example.com'], ActionMailer::Base.deliveries.last.from
+
+    mail = ActionMailer::Base.deliveries.last
+    assert_equal ['custom@example.com'], mail.from
+    assert_match edit_user_password_path(reset_password_token: 'abcdef'), mail.body.encoded
   end
 
   test 'reset password with email of different case should fail when email is NOT the list of case insensitive keys' do
@@ -146,7 +153,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'not authenticated user with valid reset password token but invalid password should not be able to change his password' do
     user = create_user
     request_forgot_password
-    reset_password :reset_password_token => user.reload.reset_password_token do
+    reset_password do
       fill_in 'Confirm new password', :with => 'other_password'
     end
 
@@ -161,7 +168,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'not authenticated user with valid data should be able to change his password' do
     user = create_user
     request_forgot_password
-    reset_password :reset_password_token => user.reload.reset_password_token
+    reset_password
 
     assert_current_url '/'
     assert_contain 'Your password was changed successfully. You are now signed in.'
@@ -171,14 +178,13 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'after entering invalid data user should still be able to change his password' do
     user = create_user
     request_forgot_password
-    reset_password :reset_password_token => user.reload.reset_password_token do
-      fill_in 'Confirm new password', :with => 'other_password'
-    end
+
+    reset_password {  fill_in 'Confirm new password', :with => 'other_password' }
     assert_response :success
     assert_have_selector '#error_explanation'
     assert_not user.reload.valid_password?('987654321')
 
-    reset_password :reset_password_token => user.reload.reset_password_token, :visit => false
+    reset_password :visit => false
     assert_contain 'Your password was changed successfully.'
     assert user.reload.valid_password?('987654321')
   end
@@ -186,7 +192,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'sign in user automatically after changing its password' do
     user = create_user
     request_forgot_password
-    reset_password :reset_password_token => user.reload.reset_password_token
+    reset_password
 
     assert warden.authenticated?(:user)
   end
@@ -196,7 +202,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
       swap Devise, :unlock_strategy => strategy do
         user = create_user(:locked => true)
         request_forgot_password
-        reset_password :reset_password_token => user.reload.reset_password_token
+        reset_password
 
         assert_contain 'Your password was changed successfully.'
         assert_not_contain 'You are now signed in.'
@@ -210,7 +216,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
     swap Devise, :unlock_strategy => :email do
       user = create_user(:locked => true)
       request_forgot_password
-      reset_password :reset_password_token => user.reload.reset_password_token
+      reset_password
 
       assert_contain 'Your password was changed successfully.'
       assert !user.reload.access_locked?
@@ -222,7 +228,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
     swap Devise, :unlock_strategy => :both do
       user = create_user(:locked => true)
       request_forgot_password
-      reset_password :reset_password_token => user.reload.reset_password_token
+      reset_password
 
       assert_contain 'Your password was changed successfully.'
       assert !user.reload.access_locked?
@@ -256,7 +262,9 @@ class PasswordTest < ActionDispatch::IntegrationTest
   test 'change password with valid parameters in XML format should return valid response' do
     user = create_user
     request_forgot_password
-    put user_password_path(:format => 'xml'), :user => {:reset_password_token => user.reload.reset_password_token, :password => '987654321', :password_confirmation => '987654321'}
+    put user_password_path(:format => 'xml'), :user => {
+      :reset_password_token => 'abcdef', :password => '987654321', :password_confirmation => '987654321'
+    }
     assert_response :success
     assert warden.authenticated?(:user)
   end
@@ -317,7 +325,7 @@ class PasswordTest < ActionDispatch::IntegrationTest
 
     assert_equal 10, user.failed_attempts
     request_forgot_password
-    reset_password :reset_password_token => user.reload.reset_password_token
+    reset_password
 
     assert warden.authenticated?(:user)
     user.reload

data/test/mailers/confirmation_instructions_test.rb

@@ -84,8 +84,12 @@ class ConfirmationInstructionsTest < ActionMailer::TestCase
 
   test 'body should have link to confirm the account' do
     host = ActionMailer::Base.default_url_options[:host]
-    confirmation_url_regexp = %r{<a href=\"http://#{host}/users/confirmation\?confirmation_token=#{user.confirmation_token}">}
-    assert_match confirmation_url_regexp, mail.body.encoded
+
+    if mail.body.encoded =~ %r{<a href=\"http://#{host}/users/confirmation\?confirmation_token=([^"]+)">}
+      assert_equal Devise.token_generator.digest(user.class, :confirmation_token, $1), user.confirmation_token
+    else
+      flunk "expected confirmation url regex to match"
+    end
   end
 
   test 'renders a scoped if scoped_views is set to true' do

data/test/mailers/reset_password_instructions_test.rb

@@ -80,8 +80,12 @@ class ResetPasswordInstructionsTest < ActionMailer::TestCase
 
   test 'body should have link to confirm the account' do
     host = ActionMailer::Base.default_url_options[:host]
-    reset_url_regexp = %r{<a href=\"http://#{host}/users/password/edit\?reset_password_token=#{user.reset_password_token}">}
-    assert_match reset_url_regexp, mail.body.encoded
+
+    if mail.body.encoded =~ %r{<a href=\"http://#{host}/users/password/edit\?reset_password_token=([^"]+)">}
+      assert_equal Devise.token_generator.digest(user.class, :reset_password_token, $1), user.reset_password_token
+    else
+      flunk "expected reset password url regex to match"
+    end
   end
 
   test 'mailer sender accepts a proc' do

data/test/mailers/unlock_instructions_test.rb

@@ -81,7 +81,11 @@ class UnlockInstructionsTest < ActionMailer::TestCase
 
   test 'body should have link to unlock the account' do
     host = ActionMailer::Base.default_url_options[:host]
-    unlock_url_regexp = %r{<a href=\"http://#{host}/users/unlock\?unlock_token=#{user.unlock_token}">}
-    assert_match unlock_url_regexp, mail.body.encoded
+
+    if mail.body.encoded =~ %r{<a href=\"http://#{host}/users/unlock\?unlock_token=([^"]+)">}
+      assert_equal Devise.token_generator.digest(user.class, :unlock_token, $1), user.unlock_token
+    else
+      flunk "expected unlock url regex to match"
+    end
   end
 end

data/test/models/confirmable_test.rb

@@ -51,9 +51,19 @@ class ConfirmableTest < ActiveSupport::TestCase
     assert_equal "was already confirmed, please try signing in", user.errors[:email].join
   end
 
-  test 'should find and confirm a user automatically' do
+  test 'DEPRECATED: should find and confirm a user automatically' do
+    swap Devise, allow_insecure_token_lookup: true do
+      user = create_user
+      confirmed_user = User.confirm_by_token(user.confirmation_token)
+      assert_equal confirmed_user, user
+      assert user.reload.confirmed?
+    end
+  end
+
+  test 'should find and confirm a user automatically based on the raw token' do
     user = create_user
-    confirmed_user = User.confirm_by_token(user.confirmation_token)
+    raw  = user.raw_confirmation_token
+    confirmed_user = User.confirm_by_token(raw)
     assert_equal confirmed_user, user
     assert user.reload.confirmed?
   end
@@ -74,7 +84,7 @@ class ConfirmableTest < ActiveSupport::TestCase
     user = create_user
     user.confirmed_at = Time.now
     user.save
-    confirmed_user = User.confirm_by_token(user.confirmation_token)
+    confirmed_user = User.confirm_by_token(user.raw_confirmation_token)
     assert confirmed_user.confirmed?
     assert_equal "was already confirmed, please try signing in", confirmed_user.errors[:email].join
   end
@@ -176,7 +186,7 @@ class ConfirmableTest < ActiveSupport::TestCase
   test 'should not be able to send instructions if the user is already confirmed' do
     user = create_user
     user.confirm!
-    assert_not user.resend_confirmation_token
+    assert_not user.resend_confirmation_instructions
     assert user.confirmed?
     assert_equal 'was already confirmed, please try signing in', user.errors[:email].join
   end
@@ -264,7 +274,7 @@ class ConfirmableTest < ActiveSupport::TestCase
   def confirm_user_by_token_with_confirmation_sent_at(confirmation_sent_at)
     user = create_user
     user.update_attribute(:confirmation_sent_at, confirmation_sent_at)
-    confirmed_user = User.confirm_by_token(user.confirmation_token)
+    confirmed_user = User.confirm_by_token(user.raw_confirmation_token)
     assert_equal confirmed_user, user
     user.reload.confirmed?
   end
@@ -285,32 +295,12 @@ class ConfirmableTest < ActiveSupport::TestCase
     end
   end
 
-  test 'should generate a new token if the previous one has expired' do
-    swap Devise, :confirm_within => 3.days do
-      user = create_user
-      user.update_attribute(:confirmation_sent_at, 4.days.ago)
-      old = user.confirmation_token
-      user.resend_confirmation_token
-      assert_not_equal user.confirmation_token, old
-    end
-  end
-  
-  test 'should generate a new token when a valid one does not exist' do
-    swap Devise, :confirm_within => 3.days do
-      user = create_user
-      user.update_attribute(:confirmation_sent_at, 4.days.ago)
-      old = user.confirmation_token
-      user.ensure_confirmation_token!
-      assert_not_equal user.confirmation_token, old
-    end
-  end
-  
-  test 'should not generate a new token when a valid one exists' do
+  test 'always generate a new token on resend' do
     user = create_user
-    assert_not_nil user.confirmation_token
-    old = user.confirmation_token
-    user.ensure_confirmation_token!
-    assert_equal user.confirmation_token, old
+    old  = user.confirmation_token
+    user = User.find(user.id)
+    user.resend_confirmation_instructions
+    assert_not_equal user.confirmation_token, old
   end
 
   test 'should call after_confirmation if confirmed' do

data/test/models/lockable_test.rb

@@ -139,10 +139,20 @@ class LockableTest < ActiveSupport::TestCase
     end
   end
 
-  test 'should find and unlock a user automatically' do
+  test 'DEPRECATED: should find and unlock a user automatically' do
+    swap Devise, allow_insecure_token_lookup: true do
+      user = create_user
+      user.lock_access!
+      locked_user = User.unlock_access_by_token(user.unlock_token)
+      assert_equal locked_user, user
+      assert_not user.reload.access_locked?
+    end
+  end
+
+  test 'should find and unlock a user automatically based on raw token' do
     user = create_user
-    user.lock_access!
-    locked_user = User.unlock_access_by_token(user.unlock_token)
+    raw  = user.send_unlock_instructions
+    locked_user = User.unlock_access_by_token(raw)
     assert_equal locked_user, user
     assert_not user.reload.access_locked?
   end
@@ -195,7 +205,7 @@ class LockableTest < ActiveSupport::TestCase
 
   test 'should not be able to send instructions if the user is not locked' do
     user = create_user
-    assert_not user.resend_unlock_token
+    assert_not user.resend_unlock_instructions
     assert_not user.access_locked?
     assert_equal 'was not locked', user.errors[:email].join
   end
@@ -203,7 +213,7 @@ class LockableTest < ActiveSupport::TestCase
   test 'should not be able to send instructions if the user if not locked and have username as unlock key' do
     swap Devise, :unlock_keys => [:username] do
       user = create_user
-      assert_not user.resend_unlock_token
+      assert_not user.resend_unlock_instructions
       assert_not user.access_locked?
       assert_equal 'was not locked', user.errors[:username].join
     end

data/test/models/recoverable_test.rb

@@ -108,11 +108,21 @@ class RecoverableTest < ActiveSupport::TestCase
     end
   end
 
-  test 'should find a user to reset his password based on reset_password_token' do
+  test 'DEPRECATED: should find a user to reset his password based on reset_password_token' do
+    swap Devise, allow_insecure_token_lookup: true do
+      user = create_user
+      user.send_reset_password_instructions
+
+      reset_password_user = User.reset_password_by_token(:reset_password_token => user.reset_password_token)
+      assert_equal reset_password_user, user
+    end
+  end
+
+  test 'should find a user to reset his password based on the raw token' do
     user = create_user
-    user.ensure_reset_password_token!
+    raw  = user.send_reset_password_instructions
 
-    reset_password_user = User.reset_password_by_token(:reset_password_token => user.reset_password_token)
+    reset_password_user = User.reset_password_by_token(:reset_password_token => raw)
     assert_equal reset_password_user, user
   end
 
@@ -130,9 +140,9 @@ class RecoverableTest < ActiveSupport::TestCase
 
   test 'should return a new record with errors if password is blank' do
     user = create_user
-    user.ensure_reset_password_token!
+    raw  = user.send_reset_password_instructions
 
-    reset_password_user = User.reset_password_by_token(:reset_password_token => user.reset_password_token, :password => '')
+    reset_password_user = User.reset_password_by_token(:reset_password_token => raw, :password => '')
     assert_not reset_password_user.errors.empty?
     assert_match "can't be blank", reset_password_user.errors[:password].join
   end
@@ -140,10 +150,10 @@ class RecoverableTest < ActiveSupport::TestCase
   test 'should reset successfully user password given the new password and confirmation' do
     user = create_user
     old_password = user.password
-    user.ensure_reset_password_token!
+    raw  = user.send_reset_password_instructions
 
     User.reset_password_by_token(
-      :reset_password_token => user.reset_password_token,
+      :reset_password_token => raw,
       :password => 'new_password',
       :password_confirmation => 'new_password'
     )
@@ -153,38 +163,17 @@ class RecoverableTest < ActiveSupport::TestCase
     assert user.valid_password?('new_password')
   end
 
-  test 'should not reset reset password token during reset_password_within time' do
-    swap Devise, :reset_password_within => 1.hour do
-      user = create_user
-      user.send_reset_password_instructions
-      3.times do
-        token = user.reset_password_token
-        user.send_reset_password_instructions
-        assert_equal token, user.reset_password_token
-      end
-    end
-  end
-
-  test 'should reset reset password token after reset_password_within time' do
-    swap Devise, :reset_password_within => 1.hour do
-      user = create_user
-      user.reset_password_sent_at = 2.days.ago
-      token = user.reset_password_token
-      user.send_reset_password_instructions
-      assert_not_equal token, user.reset_password_token
-    end
-  end
-
   test 'should not reset password after reset_password_within time' do
     swap Devise, :reset_password_within => 1.hour do
       user = create_user
+      raw  = user.send_reset_password_instructions
+
       old_password = user.password
-      user.ensure_reset_password_token!
       user.reset_password_sent_at = 2.days.ago
       user.save!
 
       reset_password_user = User.reset_password_by_token(
-        :reset_password_token => user.reset_password_token,
+        :reset_password_token => raw,
         :password => 'new_password',
         :password_confirmation => 'new_password'
       )
@@ -201,22 +190,5 @@ class RecoverableTest < ActiveSupport::TestCase
       :reset_password_sent_at,
       :reset_password_token
     ]
-  end
-  
-  test 'should generate a new token when a valid one does not exist' do
-    user = create_user
-    assert_nil user.reset_password_token
-    
-    user.ensure_reset_password_token!
-    assert_not_nil user.reset_password_token
-  end
-  
-  test 'should not generate a new token when a valid one exists' do
-    user = create_user
-    user.send :generate_reset_password_token!
-    assert_not_nil user.reset_password_token
-    old = user.reset_password_token
-    user.ensure_reset_password_token!
-    assert_equal user.reset_password_token, old
   end  
 end