devise 3.2.2 → 4.6.0

data/lib/devise/strategies/database_authenticatable.rb

@@ -1,20 +1,28 @@
+# frozen_string_literal: true
+
 require 'devise/strategies/authenticatable'
 
 module Devise
   module Strategies
-    # Default strategy for signing in a user, based on his email and password in the database.
+    # Default strategy for signing in a user, based on their email and password in the database.
     class DatabaseAuthenticatable < Authenticatable
       def authenticate!
-        resource  = valid_password? && mapping.to.find_for_database_authentication(authentication_hash)
-        encrypted = false
+        resource  = password.present? && mapping.to.find_for_database_authentication(authentication_hash)
+        hashed = false
 
-        if validate(resource){ encrypted = true; resource.valid_password?(password) }
+        if validate(resource){ hashed = true; resource.valid_password?(password) }
+          remember_me(resource)
           resource.after_database_authentication
           success!(resource)
         end
 
-        mapping.to.new.password = password if !encrypted && Devise.paranoid
-        fail(:not_found_in_database) unless resource
+        # In paranoid mode, hash the password even when a resource doesn't exist for the given authentication key.
+        # This is necessary to prevent enumeration attacks - e.g. the request is faster when a resource doesn't
+        # exist in the database if the password hashing algorithm is not called.
+        mapping.to.new.password = password if !hashed && Devise.paranoid
+        unless resource
+          Devise.paranoid ? fail(:invalid) : fail(:not_found_in_database)
+        end
       end
     end
   end

data/lib/devise/strategies/rememberable.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'devise/strategies/authenticatable'
 
 module Devise
@@ -25,15 +27,25 @@ module Devise
         end
 
         if validate(resource)
+          remember_me(resource) if extend_remember_me?(resource)
+          resource.after_remembered
           success!(resource)
         end
       end
 
+      # No need to clean up the CSRF when using rememberable.
+      # In fact, cleaning it up here would be a bug because
+      # rememberable is triggered on GET requests which means
+      # we would render a page on first access with all csrf
+      # tokens expired.
+      def clean_up_csrf?
+        false
+      end
+
     private
 
-      def decorate(resource)
-        super
-        resource.extend_remember_period = mapping.to.extend_remember_period if resource.respond_to?(:extend_remember_period=)
+      def extend_remember_me?(resource)
+        resource.respond_to?(:extend_remember_period) && resource.extend_remember_period
       end
 
       def remember_me?

data/lib/devise/test/controller_helpers.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+module Devise
+  module Test
+    # `Devise::Test::ControllerHelpers` provides a facility to test controllers
+    # in isolation when using `ActionController::TestCase` allowing you to
+    # quickly sign_in or sign_out a user. Do not use
+    # `Devise::Test::ControllerHelpers` in integration tests.
+    #
+    # Examples
+    #
+    #  class PostsTest < ActionController::TestCase
+    #    include Devise::Test::ControllerHelpers
+    #
+    #    test 'authenticated users can GET index' do
+    #      sign_in users(:bob)
+    #
+    #      get :index
+    #      assert_response :success
+    #    end
+    #  end
+    #
+    # Important: you should not test Warden specific behavior (like callbacks)
+    # using `Devise::Test::ControllerHelpers` since it is a stub of the actual
+    # behavior. Such callbacks should be tested in your integration suite instead.
+    module ControllerHelpers
+      extend ActiveSupport::Concern
+
+      included do
+        setup :setup_controller_for_warden, :warden
+      end
+
+      # Override process to consider warden.
+      def process(*)
+        _catch_warden { super }
+
+        @response
+      end
+
+      # We need to set up the environment variables and the response in the controller.
+      def setup_controller_for_warden #:nodoc:
+        @request.env['action_controller.instance'] = @controller
+      end
+
+      # Quick access to Warden::Proxy.
+      def warden #:nodoc:
+        @request.env['warden'] ||= begin
+          manager = Warden::Manager.new(nil) do |config|
+            config.merge! Devise.warden_config
+          end
+          Warden::Proxy.new(@request.env, manager)
+        end
+      end
+
+      # sign_in a given resource by storing its keys in the session.
+      # This method bypass any warden authentication callback.
+      #
+      # * +resource+ - The resource that should be authenticated
+      # * +scope+    - An optional +Symbol+ with the scope where the resource
+      #                should be signed in with.
+      # Examples:
+      #
+      # sign_in users(:alice)
+      # sign_in users(:alice), scope: :admin
+      def sign_in(resource, deprecated = nil, scope: nil)
+        if deprecated.present?
+          scope = resource
+          resource = deprecated
+
+          ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
+            [Devise] sign_in(:#{scope}, resource) on controller tests is deprecated and will be removed from Devise.
+            Please use sign_in(resource, scope: :#{scope}) instead.
+          DEPRECATION
+        end
+
+        scope ||= Devise::Mapping.find_scope!(resource)
+
+        warden.instance_variable_get(:@users).delete(scope)
+        warden.session_serializer.store(resource, scope)
+      end
+
+      # Sign out a given resource or scope by calling logout on Warden.
+      # This method bypass any warden logout callback.
+      #
+      # Examples:
+      #
+      #   sign_out :user     # sign_out(scope)
+      #   sign_out @user     # sign_out(resource)
+      #
+      def sign_out(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+        @controller.instance_variable_set(:"@current_#{scope}", nil)
+        user = warden.instance_variable_get(:@users).delete(scope)
+        warden.session_serializer.delete(scope, user)
+      end
+
+      protected
+
+      # Catch warden continuations and handle like the middleware would.
+      # Returns nil when interrupted, otherwise the normal result of the block.
+      def _catch_warden(&block)
+        result = catch(:warden, &block)
+
+        env = @controller.request.env
+
+        result ||= {}
+
+        # Set the response. In production, the rack result is returned
+        # from Warden::Manager#call, which the following is modelled on.
+        case result
+        when Array
+          if result.first == 401 && intercept_401?(env) # does this happen during testing?
+            _process_unauthenticated(env)
+          else
+            result
+          end
+        when Hash
+          _process_unauthenticated(env, result)
+        else
+          result
+        end
+      end
+
+      def _process_unauthenticated(env, options = {})
+        options[:action] ||= :unauthenticated
+        proxy = request.env['warden']
+        result = options[:result] || proxy.result
+
+        ret = case result
+        when :redirect
+          body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
+          [proxy.status, proxy.headers, [body]]
+        when :custom
+          proxy.custom_response
+        else
+          request.env["PATH_INFO"] = "/#{options[:action]}"
+          request.env["warden.options"] = options
+          Warden::Manager._run_callbacks(:before_failure, env, options)
+
+          status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
+          @controller.response.headers.merge!(headers)
+          @controller.response.content_type = headers["Content-Type"] unless Rails::VERSION::MAJOR >= 5
+          @controller.status = status
+          @controller.response.body = response.body
+          nil # causes process return @response
+        end
+
+        # ensure that the controller response is set up. In production, this is
+        # not necessary since warden returns the results to rack. However, at
+        # testing time, we want the response to be available to the testing
+        # framework to verify what would be returned to rack.
+        if ret.is_a?(Array)
+          status, headers, body = *ret
+          # ensure the controller response is set to our response.
+          @controller.response ||= @response
+          @response.status = status
+          @response.headers.merge!(headers)
+          @response.body = body
+        end
+
+        ret
+      end
+    end
+  end
+end

data/lib/devise/test/integration_helpers.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Devise
+  # Devise::Test::IntegrationHelpers is a helper module for facilitating
+  # authentication on Rails integration tests to bypass the required steps for
+  # signin in or signin out a record.
+  #
+  # Examples
+  #
+  #  class PostsTest < ActionDispatch::IntegrationTest
+  #    include Devise::Test::IntegrationHelpers
+  #
+  #    test 'authenticated users can see posts' do
+  #      sign_in users(:bob)
+  #
+  #      get '/posts'
+  #      assert_response :success
+  #    end
+  #  end
+  module Test
+    module IntegrationHelpers
+      def self.included(base)
+        base.class_eval do
+          include Warden::Test::Helpers
+
+          setup :setup_integration_for_devise
+          teardown :teardown_integration_for_devise
+        end
+      end
+
+      # Signs in a specific resource, mimicking a successfull sign in
+      # operation through +Devise::SessionsController#create+.
+      #
+      # * +resource+ - The resource that should be authenticated
+      # * +scope+    - An optional +Symbol+ with the scope where the resource
+      #                should be signed in with.
+      def sign_in(resource, scope: nil)
+        scope ||= Devise::Mapping.find_scope!(resource)
+
+        login_as(resource, scope: scope)
+      end
+
+      # Signs out a specific scope from the session.
+      #
+      # * +resource_or_scope+ - The resource or scope that should be signed out.
+      def sign_out(resource_or_scope)
+        scope = Devise::Mapping.find_scope!(resource_or_scope)
+
+        logout scope
+      end
+
+      protected
+
+      def setup_integration_for_devise
+        Warden.test_mode!
+      end
+
+      def teardown_integration_for_devise
+        Warden.test_reset!
+      end
+    end
+  end
+end

data/lib/devise/test_helpers.rb

@@ -1,132 +1,15 @@
+# frozen_string_literal: true
+
 module Devise
-  # Devise::TestHelpers provides a facility to test controllers in isolation
-  # when using ActionController::TestCase allowing you to quickly sign_in or
-  # sign_out a user. Do not use Devise::TestHelpers in integration tests.
-  #
-  # Notice you should not test Warden specific behavior (like Warden callbacks)
-  # using Devise::TestHelpers since it is a stub of the actual behavior. Such
-  # callbacks should be tested in your integration suite instead.
   module TestHelpers
     def self.included(base)
       base.class_eval do
-        setup :setup_controller_for_warden, :warden if respond_to?(:setup)
-      end
-    end
-
-    # Override process to consider warden.
-    def process(*)
-      # Make sure we always return @response, a la ActionController::TestCase::Behaviour#process, even if warden interrupts
-      _catch_warden { super } || @response
-    end
-
-    # We need to setup the environment variables and the response in the controller.
-    def setup_controller_for_warden #:nodoc:
-      @request.env['action_controller.instance'] = @controller
-    end
-
-    # Quick access to Warden::Proxy.
-    def warden #:nodoc:
-      @warden ||= begin
-        manager = Warden::Manager.new(nil) do |config|
-          config.merge! Devise.warden_config
-        end
-        @request.env['warden'] = Warden::Proxy.new(@request.env, manager)
+        ActiveSupport::Deprecation.warn <<-DEPRECATION.strip_heredoc
+          [Devise] including `Devise::TestHelpers` is deprecated and will be removed from Devise.
+          For controller tests, please include `Devise::Test::ControllerHelpers` instead.
+        DEPRECATION
+        include Devise::Test::ControllerHelpers
       end
     end
-
-    # sign_in a given resource by storing its keys in the session.
-    # This method bypass any warden authentication callback.
-    #
-    # Examples:
-    #
-    #   sign_in :user, @user   # sign_in(scope, resource)
-    #   sign_in @user          # sign_in(resource)
-    #
-    def sign_in(resource_or_scope, resource=nil)
-      scope    ||= Devise::Mapping.find_scope!(resource_or_scope)
-      resource ||= resource_or_scope
-      warden.instance_variable_get(:@users).delete(scope)
-      warden.session_serializer.store(resource, scope)
-    end
-
-    # Sign out a given resource or scope by calling logout on Warden.
-    # This method bypass any warden logout callback.
-    #
-    # Examples:
-    #
-    #   sign_out :user     # sign_out(scope)
-    #   sign_out @user     # sign_out(resource)
-    #
-    def sign_out(resource_or_scope)
-      scope = Devise::Mapping.find_scope!(resource_or_scope)
-      @controller.instance_variable_set(:"@current_#{scope}", nil)
-      user = warden.instance_variable_get(:@users).delete(scope)
-      warden.session_serializer.delete(scope, user)
-    end
-
-    protected
-
-    # Catch warden continuations and handle like the middleware would.
-    # Returns nil when interrupted, otherwise the normal result of the block.
-    def _catch_warden(&block)
-      result = catch(:warden, &block)
-
-      env = @controller.request.env
-
-      result ||= {}
-
-      # Set the response. In production, the rack result is returned
-      # from Warden::Manager#call, which the following is modelled on.
-      case result
-      when Array
-        if result.first == 401 && intercept_401?(env) # does this happen during testing?
-          _process_unauthenticated(env)
-        else
-          result
-        end
-      when Hash
-        _process_unauthenticated(env, result)
-      else
-        result
-      end
-    end
-
-    def _process_unauthenticated(env, options = {})
-      options[:action] ||= :unauthenticated
-      proxy = env['warden']
-      result = options[:result] || proxy.result
-
-      ret = case result
-      when :redirect
-        body = proxy.message || "You are being redirected to #{proxy.headers['Location']}"
-        [proxy.status, proxy.headers, [body]]
-      when :custom
-        proxy.custom_response
-      else
-        env["PATH_INFO"] = "/#{options[:action]}"
-        env["warden.options"] = options
-        Warden::Manager._run_callbacks(:before_failure, env, options)
-
-        status, headers, response = Devise.warden_config[:failure_app].call(env).to_a
-        @controller.response.headers.merge!(headers)
-        @controller.send :render, :status => status, :text => response.body,
-          :content_type => headers["Content-Type"], :location => headers["Location"]
-        nil # causes process return @response
-      end
-
-      # ensure that the controller response is set up. In production, this is
-      # not necessary since warden returns the results to rack. However, at
-      # testing time, we want the response to be available to the testing
-      # framework to verify what would be returned to rack.
-      if ret.is_a?(Array)
-        # ensure the controller response is set to our response.
-        @controller.response ||= @response
-        @response.status = ret.first
-        @response.headers = ret.second
-        @response.body = ret.third
-      end
-
-      ret
-    end
   end
 end

data/lib/devise/time_inflector.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/module/delegation"
 
 module Devise
@@ -6,9 +8,9 @@ module Devise
 
     class << self
       attr_reader :instance
-      delegate :time_ago_in_words, :to => :instance
+      delegate :time_ago_in_words, to: :instance
     end
 
     @instance = new
   end
-end
+end

data/lib/devise/token_generator.rb

@@ -1,11 +1,10 @@
-# Deprecate: Copied verbatim from Rails source, remove once we move to Rails 4 only.
-require 'thread_safe'
+# frozen_string_literal: true
+
 require 'openssl'
-require 'securerandom'
 
 module Devise
   class TokenGenerator
-    def initialize(key_generator, digest="SHA256")
+    def initialize(key_generator, digest = "SHA256")
       @key_generator = key_generator
       @digest = digest
     end
@@ -30,41 +29,4 @@ module Devise
       @key_generator.generate_key("Devise #{column}")
     end
   end
-
-  # KeyGenerator is a simple wrapper around OpenSSL's implementation of PBKDF2
-  # It can be used to derive a number of keys for various purposes from a given secret.
-  # This lets Rails applications have a single secure secret, but avoid reusing that
-  # key in multiple incompatible contexts.
-  class KeyGenerator
-    def initialize(secret, options = {})
-      @secret = secret
-      # The default iterations are higher than required for our key derivation uses
-      # on the off chance someone uses this for password storage
-      @iterations = options[:iterations] || 2**16
-    end
-
-    # Returns a derived key suitable for use.  The default key_size is chosen
-    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
-    # i.e. OpenSSL::Digest::SHA1#block_length
-    def generate_key(salt, key_size=64)
-      OpenSSL::PKCS5.pbkdf2_hmac_sha1(@secret, salt, @iterations, key_size)
-    end
-  end
-
-  # CachingKeyGenerator is a wrapper around KeyGenerator which allows users to avoid
-  # re-executing the key generation process when it's called using the same salt and
-  # key_size
-  class CachingKeyGenerator
-    def initialize(key_generator)
-      @key_generator = key_generator
-      @cache_keys = ThreadSafe::Cache.new
-    end
-
-    # Returns a derived key suitable for use.  The default key_size is chosen
-    # to be compatible with the default settings of ActiveSupport::MessageVerifier.
-    # i.e. OpenSSL::Digest::SHA1#block_length
-    def generate_key(salt, key_size=64)
-      @cache_keys["#{salt}#{key_size}"] ||= @key_generator.generate_key(salt, key_size)
-    end
-  end
 end

data/lib/devise/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Devise
-  VERSION = "3.2.2".freeze
+  VERSION = "4.6.0".freeze
 end