devise 3.2.1 → 4.4.3

data/test/failure_app_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 require 'ostruct'
 
@@ -8,9 +10,37 @@ class FailureTest < ActiveSupport::TestCase
     end
   end
 
+  class FailureWithSubdomain < RootFailureApp
+    routes = ActionDispatch::Routing::RouteSet.new
+
+    routes.draw do
+      scope subdomain: 'sub' do
+        root to: 'foo#bar'
+      end
+    end
+
+    include routes.url_helpers
+  end
+
   class FailureWithI18nOptions < Devise::FailureApp
     def i18n_options(options)
-      options.merge(:name => 'Steve')
+      options.merge(name: 'Steve')
+    end
+  end
+
+  class FakeEngineApp < Devise::FailureApp
+    class FakeEngine
+      def new_user_on_engine_session_url _
+        '/user_on_engines/sign_in'
+      end
+    end
+
+    def main_app
+      raise 'main_app router called instead of fake_engine'
+    end
+
+    def fake_engine
+      @fake_engine ||= FakeEngine.new
     end
   end
 
@@ -23,13 +53,18 @@ class FailureTest < ActiveSupport::TestCase
       'REQUEST_URI' => 'http://test.host/',
       'HTTP_HOST' => 'test.host',
       'REQUEST_METHOD' => 'GET',
-      'warden.options' => { :scope => :user },
+      'warden.options' => { scope: :user },
       'rack.session' => {},
-      'action_dispatch.request.formats' => Array(env_params.delete('formats') || Mime::HTML),
+      'action_dispatch.request.formats' => Array(env_params.delete('formats') || Mime[:html]),
       'rack.input' => "",
-      'warden' => OpenStruct.new(:message => nil)
+      'warden' => OpenStruct.new(message: nil)
     }.merge!(env_params)
 
+    # Passing nil for action_dispatch.request.formats prevents the default from being used in Rails 5, need to remove it
+    if env.has_key?('action_dispatch.request.formats') && env['action_dispatch.request.formats'].nil?
+      env.delete 'action_dispatch.request.formats' unless env['action_dispatch.request.formats']
+    end
+
     @response = (env.delete(:app) || Devise::FailureApp).call(env).to_a
     @request  = ActionDispatch::Request.new(env)
   end
@@ -42,6 +77,13 @@ class FailureTest < ActiveSupport::TestCase
       assert_equal 'http://test.host/users/sign_in', @response.second['Location']
     end
 
+    test 'returns to the default redirect location considering subdomain' do
+      call_failure('warden.options' => { scope: :subdomain_user })
+      assert_equal 302, @response.first
+      assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
+      assert_equal 'http://sub.test.host/subdomain_users/sign_in', @response.second['Location']
+    end
+
     test 'returns to the default redirect location for wildcard requests' do
       call_failure 'action_dispatch.request.formats' => nil, 'HTTP_ACCEPT' => '*/*'
       assert_equal 302, @response.first
@@ -49,37 +91,86 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'returns to the root path if no session path is available' do
-      swap Devise, :router_name => :fake_app do
-        call_failure :app => RootFailureApp
+      swap Devise, router_name: :fake_app do
+        call_failure app: RootFailureApp
         assert_equal 302, @response.first
         assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
         assert_equal 'http://test.host/', @response.second['Location']
       end
     end
 
+    test 'returns to the root path considering subdomain if no session path is available' do
+      swap Devise, router_name: :fake_app do
+        call_failure app: FailureWithSubdomain
+        assert_equal 302, @response.first
+        assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
+        assert_equal 'http://sub.test.host/', @response.second['Location']
+      end
+    end
+
+    test 'returns to the default redirect location considering the router for supplied scope' do
+      call_failure app: FakeEngineApp, 'warden.options' => { scope: :user_on_engine }
+      assert_equal 302, @response.first
+      assert_equal 'You need to sign in or sign up before continuing.', @request.flash[:alert]
+      assert_equal 'http://test.host/user_on_engines/sign_in', @response.second['Location']
+    end
+
     if Rails.application.config.respond_to?(:relative_url_root)
       test 'returns to the default redirect location considering the relative url root' do
-        swap Rails.application.config, :relative_url_root => "/sample" do
+        swap Rails.application.config, relative_url_root: "/sample" do
+          call_failure
+          assert_equal 302, @response.first
+          assert_equal 'http://test.host/sample/users/sign_in', @response.second['Location']
+        end
+      end
+
+      test 'returns to the default redirect location considering the relative url root and subdomain' do
+        swap Rails.application.config, relative_url_root: "/sample" do
+          call_failure('warden.options' => { scope: :subdomain_user })
+          assert_equal 302, @response.first
+          assert_equal 'http://sub.test.host/sample/subdomain_users/sign_in', @response.second['Location']
+        end
+      end
+    end
+
+    if Rails.application.config.action_controller.respond_to?(:relative_url_root)
+      test "returns to the default redirect location considering action_controller's relative url root" do
+        swap Rails.application.config.action_controller, relative_url_root: "/sample" do
           call_failure
           assert_equal 302, @response.first
           assert_equal 'http://test.host/sample/users/sign_in', @response.second['Location']
         end
       end
+
+      test "returns to the default redirect location considering action_controller's relative url root and subdomain" do
+        swap Rails.application.config.action_controller, relative_url_root: "/sample" do
+          call_failure('warden.options' => { scope: :subdomain_user })
+          assert_equal 302, @response.first
+          assert_equal 'http://sub.test.host/sample/subdomain_users/sign_in', @response.second['Location']
+        end
+      end
     end
 
     test 'uses the proxy failure message as symbol' do
-      call_failure('warden' => OpenStruct.new(:message => :invalid))
-      assert_equal 'Invalid email or password.', @request.flash[:alert]
+      call_failure('warden' => OpenStruct.new(message: :invalid))
+      assert_equal 'Invalid Email or password.', @request.flash[:alert]
       assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
     end
 
+    test 'supports authentication_keys as a Hash for the flash message' do
+      swap Devise, authentication_keys: { email: true, login: true } do
+        call_failure('warden' => OpenStruct.new(message: :invalid))
+        assert_equal 'Invalid Email, Login or password.', @request.flash[:alert]
+      end
+    end
+
     test 'uses custom i18n options' do
-      call_failure('warden' => OpenStruct.new(:message => :does_not_exist), :app => FailureWithI18nOptions)
+      call_failure('warden' => OpenStruct.new(message: :does_not_exist), app: FailureWithI18nOptions)
       assert_equal 'User Steve does not exist', @request.flash[:alert]
     end
 
     test 'uses the proxy failure message as string' do
-      call_failure('warden' => OpenStruct.new(:message => 'Hello world'))
+      call_failure('warden' => OpenStruct.new(message: 'Hello world'))
       assert_equal 'Hello world', @request.flash[:alert]
       assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
     end
@@ -89,7 +180,7 @@ class FailureTest < ActiveSupport::TestCase
       assert_equal 'text/html; charset=utf-8', @response.second['Content-Type']
     end
 
-    test 'setup a default message' do
+    test 'set up a default message' do
       call_failure
       assert_match(/You are being/, @response.last.body)
       assert_match(/redirected/, @response.last.body)
@@ -97,15 +188,15 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'works for any navigational format' do
-      swap Devise, :navigational_formats => [:xml] do
-        call_failure('formats' => Mime::XML)
+      swap Devise, navigational_formats: [:xml] do
+        call_failure('formats' => Mime[:xml])
         assert_equal 302, @response.first
       end
     end
 
     test 'redirects the correct format if it is a non-html format request' do
-      swap Devise, :navigational_formats => [:js] do
-        call_failure('formats' => Mime::JS)
+      swap Devise, navigational_formats: [:js] do
+        call_failure('formats' => Mime[:js])
         assert_equal 'http://test.host/users/sign_in.js', @response.second["Location"]
       end
     end
@@ -113,18 +204,18 @@ class FailureTest < ActiveSupport::TestCase
 
   context 'For HTTP request' do
     test 'return 401 status' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
       assert_equal 401, @response.first
     end
 
     test 'return appropriate body for xml' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
       result = %(<?xml version="1.0" encoding="UTF-8"?>\n<errors>\n  <error>You need to sign in or sign up before continuing.</error>\n</errors>\n)
       assert_equal result, @response.last.body
     end
 
     test 'return appropriate body for json' do
-      call_failure('formats' => Mime::JSON)
+      call_failure('formats' => Mime[:json])
       result = %({"error":"You need to sign in or sign up before continuing."})
       assert_equal result, @response.last.body
     end
@@ -135,42 +226,42 @@ class FailureTest < ActiveSupport::TestCase
     end
 
     test 'return WWW-authenticate headers if model allows' do
-      call_failure('formats' => Mime::XML)
+      call_failure('formats' => Mime[:xml])
       assert_equal 'Basic realm="Application"', @response.second["WWW-Authenticate"]
     end
 
     test 'does not return WWW-authenticate headers if model does not allow' do
-      swap Devise, :http_authenticatable => false do
-        call_failure('formats' => Mime::XML)
+      swap Devise, http_authenticatable: false do
+        call_failure('formats' => Mime[:xml])
         assert_nil @response.second["WWW-Authenticate"]
       end
     end
 
     test 'works for any non navigational format' do
-      swap Devise, :navigational_formats => [] do
-        call_failure('formats' => Mime::HTML)
+      swap Devise, navigational_formats: [] do
+        call_failure('formats' => Mime[:html])
         assert_equal 401, @response.first
       end
     end
 
     test 'uses the failure message as response body' do
-      call_failure('formats' => Mime::XML, 'warden' => OpenStruct.new(:message => :invalid))
-      assert_match '<error>Invalid email or password.</error>', @response.third.body
+      call_failure('formats' => Mime[:xml], 'warden' => OpenStruct.new(message: :invalid))
+      assert_match '<error>Invalid Email or password.</error>', @response.third.body
     end
 
     context 'on ajax call' do
       context 'when http_authenticatable_on_xhr is false' do
         test 'dont return 401 with navigational formats' do
-          swap Devise, :http_authenticatable_on_xhr => false do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+          swap Devise, http_authenticatable_on_xhr: false do
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in', @response.second["Location"]
           end
         end
 
         test 'dont return 401 with non navigational formats' do
-          swap Devise, :http_authenticatable_on_xhr => false do
-            call_failure('formats' => Mime::JSON, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+          swap Devise, http_authenticatable_on_xhr: false do
+            call_failure('formats' => Mime[:json], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 302, @response.first
             assert_equal 'http://test.host/users/sign_in.json', @response.second["Location"]
           end
@@ -179,15 +270,15 @@ class FailureTest < ActiveSupport::TestCase
 
       context 'when http_authenticatable_on_xhr is true' do
         test 'return 401' do
-          swap Devise, :http_authenticatable_on_xhr => true do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+          swap Devise, http_authenticatable_on_xhr: true do
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_equal 401, @response.first
           end
         end
 
         test 'skip WWW-Authenticate header' do
-          swap Devise, :http_authenticatable_on_xhr => true do
-            call_failure('formats' => Mime::HTML, 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
+          swap Devise, http_authenticatable_on_xhr: true do
+            call_failure('formats' => Mime[:html], 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest')
             assert_nil @response.second['WWW-Authenticate']
           end
         end
@@ -198,35 +289,52 @@ class FailureTest < ActiveSupport::TestCase
   context 'With recall' do
     test 'calls the original controller if invalid email or password' do
       env = {
-        "warden.options" => { :recall => "devise/sessions#new", :attempted_path => "/users/sign_in" },
+        "warden.options" => { recall: "devise/sessions#new", attempted_path: "/users/sign_in" },
         "devise.mapping" => Devise.mappings[:user],
         "warden" => stub_everything
       }
       call_failure(env)
-      assert @response.third.body.include?('<h2>Sign in</h2>')
-      assert @response.third.body.include?('Invalid email or password.')
+      assert @response.third.body.include?('<h2>Log in</h2>')
+      assert @response.third.body.include?('Invalid Email or password.')
     end
 
     test 'calls the original controller if not confirmed email' do
       env = {
-        "warden.options" => { :recall => "devise/sessions#new", :attempted_path => "/users/sign_in", :message => :unconfirmed },
+        "warden.options" => { recall: "devise/sessions#new", attempted_path: "/users/sign_in", message: :unconfirmed },
         "devise.mapping" => Devise.mappings[:user],
         "warden" => stub_everything
       }
       call_failure(env)
-      assert @response.third.body.include?('<h2>Sign in</h2>')
-      assert @response.third.body.include?('You have to confirm your account before continuing.')
+      assert @response.third.body.include?('<h2>Log in</h2>')
+      assert @response.third.body.include?('You have to confirm your email address before continuing.')
     end
 
     test 'calls the original controller if inactive account' do
       env = {
-        "warden.options" => { :recall => "devise/sessions#new", :attempted_path => "/users/sign_in", :message => :inactive },
+        "warden.options" => { recall: "devise/sessions#new", attempted_path: "/users/sign_in", message: :inactive },
         "devise.mapping" => Devise.mappings[:user],
         "warden" => stub_everything
       }
       call_failure(env)
-      assert @response.third.body.include?('<h2>Sign in</h2>')
+      assert @response.third.body.include?('<h2>Log in</h2>')
       assert @response.third.body.include?('Your account is not activated yet.')
     end
+
+    if Rails.application.config.respond_to?(:relative_url_root)
+      test 'calls the original controller with the proper environment considering the relative url root' do
+        swap Rails.application.config, relative_url_root: "/sample" do
+          env = {
+            "warden.options" => { recall: "devise/sessions#new", attempted_path: "/sample/users/sign_in"},
+            "devise.mapping" => Devise.mappings[:user],
+            "warden" => stub_everything
+          }
+          call_failure(env)
+          assert @response.third.body.include?('<h2>Log in</h2>')
+          assert @response.third.body.include?('Invalid Email or password.')
+          assert_equal @request.env["SCRIPT_NAME"], '/sample'
+          assert_equal @request.env["PATH_INFO"], '/users/sign_in'
+        end
+      end
+    end
   end
 end

data/test/generators/active_record_generator_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "test_helper"
 
 if DEVISE_ORM == :active_record
@@ -13,6 +15,20 @@ if DEVISE_ORM == :active_record
       assert_migration "db/migrate/devise_create_monsters.rb", /def change/
     end
 
+    test "all files are properly created with changed db/migrate path in application configuration" do
+      old_paths = Rails.application.config.paths["db/migrate"]
+      Rails.application.config.paths.add "db/migrate", with: "db2/migrate"
+
+      run_generator %w(monster)
+      if Rails.version >= '5.0.3'
+        assert_migration "db2/migrate/devise_create_monsters.rb", /def change/
+      else
+        assert_migration "db/migrate/devise_create_monsters.rb", /def change/
+      end
+
+      Rails.application.config.paths["db/migrate"] = old_paths
+    end
+
     test "all files for namespaced model are properly created" do
       run_generator %w(admin/monster)
       assert_migration "db/migrate/devise_create_admin_monsters.rb", /def change/
@@ -25,18 +41,55 @@ if DEVISE_ORM == :active_record
       assert_migration "db/migrate/add_devise_to_monsters.rb"
     end
 
+    test "update model migration when model exists with changed db/migrate path in application configuration" do
+      old_paths = Rails.application.config.paths["db/migrate"]
+      Rails.application.config.paths.add "db/migrate", with: "db2/migrate"
+
+      run_generator %w(monster)
+      assert_file "app/models/monster.rb"
+      run_generator %w(monster)
+
+      if Rails.version >= '5.0.3'
+        assert_migration "db2/migrate/add_devise_to_monsters.rb"
+      else
+        assert_migration "db/migrate/add_devise_to_monsters.rb"
+      end
+
+      Rails.application.config.paths["db/migrate"] = old_paths
+    end
+
     test "all files are properly deleted" do
       run_generator %w(monster)
       run_generator %w(monster)
       assert_migration "db/migrate/devise_create_monsters.rb"
       assert_migration "db/migrate/add_devise_to_monsters.rb"
-      run_generator %w(monster), :behavior => :revoke
+      run_generator %w(monster), behavior: :revoke
       assert_no_migration "db/migrate/add_devise_to_monsters.rb"
       assert_migration "db/migrate/devise_create_monsters.rb"
-      run_generator %w(monster), :behavior => :revoke
+      run_generator %w(monster), behavior: :revoke
       assert_no_file "app/models/monster.rb"
       assert_no_migration "db/migrate/devise_create_monsters.rb"
     end
+
+    test "use string column type for ip addresses" do
+      run_generator %w(monster)
+      assert_migration "db/migrate/devise_create_monsters.rb", /t.string   :current_sign_in_ip/
+      assert_migration "db/migrate/devise_create_monsters.rb", /t.string   :last_sign_in_ip/
+    end
+
+    test "do NOT add primary key type when NOT specified in rails generator" do
+      run_generator %w(monster)
+      assert_migration "db/migrate/devise_create_monsters.rb", /create_table :monsters do/
+    end
+
+    test "add primary key type with rails 5 when specified in rails generator" do
+      run_generator ["monster", "--primary_key_type=uuid"]
+      if Rails.version.start_with? '5'
+        assert_migration "db/migrate/devise_create_monsters.rb", /create_table :monsters, id: :uuid do/
+      else
+        assert_migration "db/migrate/devise_create_monsters.rb", /create_table :monsters do/
+      end
+    end
   end
 
   module RailsEngine
@@ -47,11 +100,11 @@ if DEVISE_ORM == :active_record
 
   def simulate_inside_engine(engine, namespace)
     if Rails::Generators.respond_to?(:namespace=)
-      swap Rails::Generators, :namespace => namespace do
+      swap Rails::Generators, namespace: namespace do
         yield
       end
     else
-      swap Rails, :application => engine.instance do
+      swap Rails, application: engine.instance do
         yield
       end
     end
@@ -63,41 +116,15 @@ if DEVISE_ORM == :active_record
     setup :prepare_destination
 
     test "all files are properly created in rails 4.0" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(false)
       simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
         run_generator ["monster"]
 
         assert_file "app/models/rails_engine/monster.rb", /devise/
         assert_file "app/models/rails_engine/monster.rb" do |content|
-          assert_no_match /attr_accessible :email/, content
+          assert_no_match %r{attr_accessible :email}, content
         end
       end
     end
 
-    test "all files are properly created in rails 3.2 when strong_parameters gem is not installed" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(true)
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:strong_parameters_enabled?).returns(false)
-      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
-        run_generator ["monster"]
-
-        assert_file "app/models/rails_engine/monster.rb", /devise/
-        assert_file "app/models/rails_engine/monster.rb" do |content|
-          assert_match /attr_accessible :email/, content
-        end
-      end
-    end
-
-    test "all files are properly created in rails 3.2 when strong_parameters gem is installed" do
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:rails_3?).returns(true)
-      ActiveRecord::Generators::DeviseGenerator.any_instance.stubs(:strong_parameters_enabled?).returns(true)
-      simulate_inside_engine(RailsEngine::Engine, RailsEngine) do
-        run_generator ["monster"]
-
-        assert_file "app/models/rails_engine/monster.rb", /devise/
-        assert_file "app/models/rails_engine/monster.rb" do |content|
-          assert_no_match /attr_accessible :email/, content
-        end
-      end
-    end
   end
 end