devise 3.2.1 → 4.4.3

data/test/integration/rememberable_test.rb

@@ -1,16 +1,24 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
-class RememberMeTest < ActionDispatch::IntegrationTest
+class RememberMeTest < Devise::IntegrationTest
   def create_user_and_remember(add_to_token='')
     user = create_user
     user.remember_me!
-    raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
+    raw_cookie = User.serialize_into_cookie(user).tap { |a| a[1] << add_to_token }
     cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
     user
   end
 
   def generate_signed_cookie(raw_cookie)
-    request = ActionDispatch::TestRequest.new
+    request = if Devise::Test.rails51? || Devise::Test.rails52?
+      ActionController::TestRequest.create(Class.new) # needs a "controller class"
+    elsif Devise::Test.rails5?
+      ActionController::TestRequest.create
+    else
+      ActionController::TestRequest.new
+    end
     request.cookie_jar.signed['raw_cookie'] = raw_cookie
     request.cookie_jar['raw_cookie']
   end
@@ -25,37 +33,39 @@ class RememberMeTest < ActionDispatch::IntegrationTest
     Time.parse(expires).utc
   end
 
-  test 'do not remember the user if he has not checked remember me option' do
+  test 'do not remember the user if they have not checked remember me option' do
     sign_in_as_user
     assert_nil request.cookies["remember_user_cookie"]
   end
 
   test 'handle unverified requests gets rid of caches' do
-    swap ApplicationController, :allow_forgery_protection => true do
+    swap ApplicationController, allow_forgery_protection: true do
       post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
 
       create_user_and_remember
       post exhibit_user_url(1)
       assert_equal "User is not authenticated", response.body
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
   test 'handle unverified requests does not create cookies on sign in' do
-    swap ApplicationController, :allow_forgery_protection => true do
+    swap ApplicationController, allow_forgery_protection: true do
       get new_user_session_path
       assert request.session[:_csrf_token]
 
-      post user_session_path, :authenticity_token => "oops", :user =>
-           { email: "jose.valim@gmail.com", password: "123456", :remember_me => "1" }
-      assert_not warden.authenticated?(:user)
-      assert_not request.cookies['remember_user_token']
+      post user_session_path, params: {
+          authenticity_token: "oops",
+          user: { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
+        }
+      refute warden.authenticated?(:user)
+      refute request.cookies['remember_user_token']
     end
   end
 
   test 'generate remember token after sign in' do
-    sign_in_as_user :remember_me => true
+    sign_in_as_user remember_me: true
     assert request.cookies['remember_user_token']
   end
 
@@ -63,15 +73,15 @@ class RememberMeTest < ActionDispatch::IntegrationTest
     # We test this by asserting the cookie is not sent after the redirect
     # since we changed the domain. This is the only difference with the
     # previous test.
-    swap Devise, :rememberable_options => { :domain => "omg.somewhere.com" } do
-      sign_in_as_user :remember_me => true
+    swap Devise, rememberable_options: { domain: "omg.somewhere.com" } do
+      sign_in_as_user remember_me: true
       assert_nil request.cookies["remember_user_token"]
     end
   end
 
   test 'generate remember token with a custom key' do
-    swap Devise, :rememberable_options => { :key => "v1lat_token" } do
-      sign_in_as_user :remember_me => true
+    swap Devise, rememberable_options: { key: "v1lat_token" } do
+      sign_in_as_user remember_me: true
       assert request.cookies["v1lat_token"]
     end
   end
@@ -79,7 +89,7 @@ class RememberMeTest < ActionDispatch::IntegrationTest
   test 'generate remember token after sign in setting session options' do
     begin
       Rails.configuration.session_options[:domain] = "omg.somewhere.com"
-      sign_in_as_user :remember_me => true
+      sign_in_as_user remember_me: true
       assert_nil request.cookies["remember_user_token"]
     ensure
       Rails.configuration.session_options.delete(:domain)
@@ -92,10 +102,9 @@ class RememberMeTest < ActionDispatch::IntegrationTest
     assert_response :success
     assert warden.authenticated?(:user)
     assert warden.user(:user) == user
-    assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
   end
 
-  test 'remember the user before sign up and redirect him to his home' do
+  test 'remember the user before sign up and redirect them to their home' do
     create_user_and_remember
     get new_user_registration_path
     assert warden.authenticated?(:user)
@@ -103,14 +112,14 @@ class RememberMeTest < ActionDispatch::IntegrationTest
   end
 
   test 'does not extend remember period through sign in' do
-    swap Devise, :extend_remember_period => true, :remember_for => 1.year do
+    swap Devise, extend_remember_period: true, remember_for: 1.year do
       user = create_user
       user.remember_me!
 
       user.remember_created_at = old = 10.days.ago
       user.save
 
-      sign_in_as_user :remember_me => true
+      sign_in_as_user remember_me: true
       user.reload
 
       assert warden.user(:user) == user
@@ -118,26 +127,60 @@ class RememberMeTest < ActionDispatch::IntegrationTest
     end
   end
 
+  test 'extends remember period when extend remember period config is true' do
+    swap Devise, extend_remember_period: true, remember_for: 1.year do
+      create_user_and_remember
+      old_remember_token = nil
+
+      travel_to 1.day.ago do
+        get root_path
+        old_remember_token = request.cookies['remember_user_token']
+      end
+
+      get root_path
+      current_remember_token = request.cookies['remember_user_token']
+
+      refute_equal old_remember_token, current_remember_token
+    end
+  end
+
+  test 'does not extend remember period when extend period config is false' do
+    swap Devise, extend_remember_period: false, remember_for: 1.year do
+      create_user_and_remember
+      old_remember_token = nil
+
+      travel_to 1.day.ago do
+        get root_path
+        old_remember_token = request.cookies['remember_user_token']
+      end
+
+      get root_path
+      current_remember_token = request.cookies['remember_user_token']
+
+      assert_equal old_remember_token, current_remember_token
+    end
+  end
+
   test 'do not remember other scopes' do
     create_user_and_remember
     get root_path
     assert_response :success
     assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
+    refute warden.authenticated?(:admin)
   end
 
   test 'do not remember with invalid token' do
     create_user_and_remember('add')
     get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
     assert_redirected_to new_user_session_path
   end
 
   test 'do not remember with expired token' do
     create_user_and_remember
-    swap Devise, :remember_for => 0 do
+    swap Devise, remember_for: 0.days do
       get users_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
       assert_redirected_to new_user_session_path
     end
   end
@@ -147,12 +190,12 @@ class RememberMeTest < ActionDispatch::IntegrationTest
     get users_path
     assert warden.authenticated?(:user)
 
-    get destroy_user_session_path
-    assert_not warden.authenticated?(:user)
+    delete destroy_user_session_path
+    refute warden.authenticated?(:user)
     assert_nil warden.cookies['remember_user_token']
 
     get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'changing user password expires remember me token' do
@@ -162,6 +205,15 @@ class RememberMeTest < ActionDispatch::IntegrationTest
     user.save!
 
     get users_path
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
+  end
+
+  test 'valid sign in calls after_remembered callback' do
+    user = create_user_and_remember
+
+    User.expects(:serialize_from_cookie).returns user
+    user.expects :after_remembered
+
+    get new_user_registration_path
   end
 end

data/test/integration/timeoutable_test.rb

@@ -1,6 +1,8 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
-class SessionTimeoutTest < ActionDispatch::IntegrationTest
+class SessionTimeoutTest < Devise::IntegrationTest
 
   def last_request_at
     @controller.user_session['last_request_at']
@@ -8,12 +10,11 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
 
   test 'set last request at in user session after each request' do
     sign_in_as_user
-    old_last_request = last_request_at
     assert_not_nil last_request_at
 
+    @controller.user_session.delete('last_request_at')
     get users_path
     assert_not_nil last_request_at
-    assert_not_equal old_last_request, last_request_at
   end
 
   test 'set last request at in user session after each request is skipped if tracking is disabled' do
@@ -21,7 +22,19 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
     old_last_request = last_request_at
     assert_not_nil last_request_at
 
-    get users_path, {}, 'devise.skip_trackable' => true
+    get users_path, headers: { 'devise.skip_trackable' => true }
+    assert_equal old_last_request, last_request_at
+  end
+
+  test 'does not set last request at in user session after each request if timeoutable is disabled' do
+    sign_in_as_user
+    old_last_request = last_request_at
+    assert_not_nil last_request_at
+
+    new_time = 2.seconds.from_now
+    Time.stubs(:now).returns(new_time)
+
+    get users_path, headers: { 'devise.skip_timeoutable' => true }
     assert_equal old_last_request, last_request_at
   end
 
@@ -35,14 +48,19 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
     assert warden.authenticated?(:user)
   end
 
-  test 'time out user session after default limit time' do
-    user = sign_in_as_user
-    get expire_user_path(user)
-    assert_not_nil last_request_at
+  test 'time out user session after default limit time when sign_out_all_scopes is false' do
+    swap Devise, sign_out_all_scopes: false do
+      sign_in_as_admin
 
-    get users_path
-    assert_redirected_to users_path
-    assert_not warden.authenticated?(:user)
+      user = sign_in_as_user
+      get expire_user_path(user)
+      assert_not_nil last_request_at
+
+      get users_path
+      assert_redirected_to users_path
+      refute warden.authenticated?(:user)
+      assert warden.authenticated?(:admin)
+    end
   end
 
   test 'time out all sessions after default limit time when sign_out_all_scopes is true' do
@@ -54,8 +72,8 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
       assert_not_nil last_request_at
 
       get root_path
-      assert_not warden.authenticated?(:user)
-      assert_not warden.authenticated?(:admin)
+      refute warden.authenticated?(:user)
+      refute warden.authenticated?(:admin)
     end
   end
 
@@ -73,7 +91,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
     user = sign_in_as_user
     get expire_user_path(user)
 
-    get destroy_user_session_path
+    delete destroy_user_session_path
 
     assert_response :redirect
     assert_redirected_to root_path
@@ -92,39 +110,22 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
 
     assert_response :success
     assert_contain 'Sign in'
-    assert_not warden.authenticated?(:user)
+    refute warden.authenticated?(:user)
   end
 
   test 'time out is not triggered on sign in' do
     user = sign_in_as_user
     get expire_user_path(user)
 
-    post "/users/sign_in", :email => user.email, :password => "123456"
+    post "/users/sign_in", params: { email: user.email, password: "123456" }
 
     assert_response :redirect
     follow_redirect!
     assert_contain 'You are signed in'
   end
 
-  test 'admin does not explode on time out' do
-    admin = sign_in_as_admin
-    get expire_admin_path(admin)
-
-    Admin.send :define_method, :reset_authentication_token! do
-      nil
-    end
-
-    begin
-      get admins_path
-      assert_redirected_to admins_path
-      assert_not warden.authenticated?(:admin)
-    ensure
-      Admin.send(:remove_method, :reset_authentication_token!)
-    end
-  end
-
   test 'user configured timeout limit' do
-    swap Devise, :timeout_in => 8.minutes do
+    swap Devise, timeout_in: 8.minutes do
       user = sign_in_as_user
 
       get users_path
@@ -135,13 +136,13 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
       get expire_user_path(user)
       get users_path
       assert_redirected_to users_path
-      assert_not warden.authenticated?(:user)
+      refute warden.authenticated?(:user)
     end
   end
 
   test 'error message with i18n' do
-    store_translations :en, :devise => {
-      :failure => { :user => { :timeout => 'Session expired!' } }
+    store_translations :en, devise: {
+      failure: { user: { timeout: 'Session expired!' } }
     } do
       user = sign_in_as_user
 
@@ -153,8 +154,8 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
   end
 
   test 'error message with i18n with double redirect' do
-    store_translations :en, :devise => {
-      :failure => { :user => { :timeout => 'Session expired!' } }
+    store_translations :en, devise: {
+      failure: { user: { timeout: 'Session expired!' } }
     } do
       user = sign_in_as_user
 
@@ -167,7 +168,7 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
   end
 
   test 'time out not triggered if remembered' do
-    user = sign_in_as_user :remember_me => true
+    user = sign_in_as_user remember_me: true
     get expire_user_path(user)
     assert_not_nil last_request_at
 
@@ -175,4 +176,11 @@ class SessionTimeoutTest < ActionDispatch::IntegrationTest
     assert_response :success
     assert warden.authenticated?(:user)
   end
+
+  test 'does not crash when the last_request_at is a String' do
+    user = sign_in_as_user
+
+    get edit_form_user_path(user, last_request_at: Time.now.utc.to_s)
+    get users_path
+  end
 end

data/test/integration/trackable_test.rb

@@ -1,6 +1,13 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
-class TrackableHooksTest < ActionDispatch::IntegrationTest
+class TrackableHooksTest < Devise::IntegrationTest
+  test "trackable should not run model validations" do
+    sign_in_as_user
+
+    refute User.validations_performed
+  end
 
   test "current and last sign in timestamps are updated on each sign in" do
     user = create_user
@@ -10,13 +17,13 @@ class TrackableHooksTest < ActionDispatch::IntegrationTest
     sign_in_as_user
     user.reload
 
-    assert_kind_of Time, user.current_sign_in_at
-    assert_kind_of Time, user.last_sign_in_at
+    assert user.current_sign_in_at.acts_like?(:time)
+    assert user.last_sign_in_at.acts_like?(:time)
 
     assert_equal user.current_sign_in_at, user.last_sign_in_at
     assert user.current_sign_in_at >= user.created_at
 
-    visit destroy_user_session_path
+    delete destroy_user_session_path
     new_time = 2.seconds.from_now
     Time.stubs(:now).returns(new_time)
 
@@ -56,15 +63,15 @@ class TrackableHooksTest < ActionDispatch::IntegrationTest
     user.reload
     assert_equal 1, user.sign_in_count
 
-    visit destroy_user_session_path
+    delete destroy_user_session_path
     sign_in_as_user
     user.reload
     assert_equal 2, user.sign_in_count
   end
 
   test "does not update anything if user has signed out along the way" do
-    swap Devise, :allow_unconfirmed_access_for => 0 do
-      user = create_user(:confirm => false)
+    swap Devise, allow_unconfirmed_access_for: 0.days do
+      user = create_user(confirm: false)
       sign_in_as_user
 
       user.reload
@@ -80,7 +87,7 @@ class TrackableHooksTest < ActionDispatch::IntegrationTest
     end
     user.reload
     assert_equal 0, user.sign_in_count
-    visit destroy_user_session_path
+    delete destroy_user_session_path
 
     sign_in_as_user do
       header 'devise.skip_trackable', false