devise 3.2.4 → 4.0.0
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of devise might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/.gitignore +0 -1
- data/.travis.yml +33 -17
- data/CHANGELOG.md +57 -1033
- data/CODE_OF_CONDUCT.md +22 -0
- data/CONTRIBUTING.md +2 -0
- data/Gemfile +5 -5
- data/Gemfile.lock +138 -115
- data/MIT-LICENSE +1 -1
- data/README.md +124 -65
- data/Rakefile +2 -1
- data/app/controllers/devise/confirmations_controller.rb +7 -3
- data/app/controllers/devise/omniauth_callbacks_controller.rb +8 -4
- data/app/controllers/devise/passwords_controller.rb +16 -6
- data/app/controllers/devise/registrations_controller.rb +22 -10
- data/app/controllers/devise/sessions_controller.rb +42 -14
- data/app/controllers/devise/unlocks_controller.rb +5 -2
- data/app/controllers/devise_controller.rb +63 -29
- data/app/mailers/devise/mailer.rb +4 -0
- data/app/views/devise/confirmations/new.html.erb +7 -3
- data/app/views/devise/mailer/password_change.html.erb +3 -0
- data/app/views/devise/passwords/edit.html.erb +14 -5
- data/app/views/devise/passwords/new.html.erb +7 -3
- data/app/views/devise/registrations/edit.html.erb +19 -9
- data/app/views/devise/registrations/new.html.erb +18 -7
- data/app/views/devise/sessions/new.html.erb +16 -7
- data/app/views/devise/shared/{_links.erb → _links.html.erb} +2 -2
- data/app/views/devise/unlocks/new.html.erb +7 -3
- data/bin/test +13 -0
- data/config/locales/en.yml +19 -16
- data/devise.gemspec +3 -4
- data/gemfiles/{Gemfile.rails-3.2-stable → Gemfile.rails-4.1-stable} +6 -6
- data/gemfiles/Gemfile.rails-4.1-stable.lock +167 -0
- data/gemfiles/{Gemfile.rails-head → Gemfile.rails-4.2-stable} +6 -6
- data/gemfiles/Gemfile.rails-4.2-stable.lock +189 -0
- data/gemfiles/Gemfile.rails-5.0-beta +37 -0
- data/gemfiles/Gemfile.rails-5.0-beta.lock +199 -0
- data/lib/devise/controllers/helpers.rb +94 -27
- data/lib/devise/controllers/rememberable.rb +9 -2
- data/lib/devise/controllers/sign_in_out.rb +2 -9
- data/lib/devise/controllers/store_location.rb +11 -3
- data/lib/devise/controllers/url_helpers.rb +7 -7
- data/lib/devise/encryptor.rb +22 -0
- data/lib/devise/failure_app.rb +72 -23
- data/lib/devise/hooks/activatable.rb +3 -4
- data/lib/devise/hooks/csrf_cleaner.rb +3 -1
- data/lib/devise/hooks/timeoutable.rb +13 -8
- data/lib/devise/mailers/helpers.rb +1 -1
- data/lib/devise/mapping.rb +6 -2
- data/lib/devise/models/authenticatable.rb +32 -28
- data/lib/devise/models/confirmable.rb +55 -22
- data/lib/devise/models/database_authenticatable.rb +32 -19
- data/lib/devise/models/lockable.rb +5 -5
- data/lib/devise/models/recoverable.rb +44 -20
- data/lib/devise/models/rememberable.rb +54 -27
- data/lib/devise/models/timeoutable.rb +0 -6
- data/lib/devise/models/trackable.rb +5 -3
- data/lib/devise/models/validatable.rb +3 -3
- data/lib/devise/models.rb +1 -1
- data/lib/devise/omniauth/url_helpers.rb +62 -4
- data/lib/devise/parameter_sanitizer.rb +176 -61
- data/lib/devise/rails/routes.rb +76 -59
- data/lib/devise/rails/warden_compat.rb +1 -10
- data/lib/devise/rails.rb +2 -11
- data/lib/devise/strategies/authenticatable.rb +15 -6
- data/lib/devise/strategies/database_authenticatable.rb +5 -4
- data/lib/devise/strategies/rememberable.rb +13 -3
- data/lib/devise/test_helpers.rb +12 -7
- data/lib/devise/token_generator.rb +1 -41
- data/lib/devise/version.rb +1 -1
- data/lib/devise.rb +150 -58
- data/lib/generators/active_record/devise_generator.rb +28 -4
- data/lib/generators/active_record/templates/migration.rb +3 -3
- data/lib/generators/active_record/templates/migration_existing.rb +3 -3
- data/lib/generators/devise/controllers_generator.rb +44 -0
- data/lib/generators/devise/install_generator.rb +15 -0
- data/lib/generators/devise/orm_helpers.rb +1 -18
- data/lib/generators/devise/views_generator.rb +14 -3
- data/lib/generators/templates/README +1 -1
- data/lib/generators/templates/controllers/README +14 -0
- data/lib/generators/templates/controllers/confirmations_controller.rb +28 -0
- data/lib/generators/templates/controllers/omniauth_callbacks_controller.rb +28 -0
- data/lib/generators/templates/controllers/passwords_controller.rb +32 -0
- data/lib/generators/templates/controllers/registrations_controller.rb +60 -0
- data/lib/generators/templates/controllers/sessions_controller.rb +25 -0
- data/lib/generators/templates/controllers/unlocks_controller.rb +28 -0
- data/lib/generators/templates/devise.rb +36 -28
- data/lib/generators/templates/markerb/confirmation_instructions.markerb +1 -1
- data/lib/generators/templates/markerb/password_change.markerb +3 -0
- data/lib/generators/templates/markerb/reset_password_instructions.markerb +1 -1
- data/lib/generators/templates/markerb/unlock_instructions.markerb +1 -1
- data/lib/generators/templates/simple_form_for/passwords/edit.html.erb +1 -1
- data/lib/generators/templates/simple_form_for/registrations/new.html.erb +1 -1
- data/lib/generators/templates/simple_form_for/sessions/new.html.erb +2 -2
- data/test/controllers/custom_registrations_controller_test.rb +40 -0
- data/test/controllers/custom_strategy_test.rb +7 -5
- data/test/controllers/helper_methods_test.rb +22 -0
- data/test/controllers/helpers_test.rb +41 -1
- data/test/controllers/inherited_controller_i18n_messages_test.rb +51 -0
- data/test/controllers/internal_helpers_test.rb +19 -15
- data/test/controllers/load_hooks_controller_test.rb +19 -0
- data/test/controllers/passwords_controller_test.rb +5 -4
- data/test/controllers/sessions_controller_test.rb +24 -21
- data/test/controllers/url_helpers_test.rb +7 -1
- data/test/devise_test.rb +48 -8
- data/test/failure_app_test.rb +107 -19
- data/test/generators/active_record_generator_test.rb +6 -26
- data/test/generators/controllers_generator_test.rb +48 -0
- data/test/generators/install_generator_test.rb +14 -3
- data/test/generators/views_generator_test.rb +8 -1
- data/test/helpers/devise_helper_test.rb +10 -12
- data/test/integration/authenticatable_test.rb +37 -21
- data/test/integration/confirmable_test.rb +54 -14
- data/test/integration/database_authenticatable_test.rb +12 -1
- data/test/integration/http_authenticatable_test.rb +4 -5
- data/test/integration/lockable_test.rb +10 -9
- data/test/integration/omniauthable_test.rb +13 -11
- data/test/integration/recoverable_test.rb +28 -15
- data/test/integration/registerable_test.rb +41 -33
- data/test/integration/rememberable_test.rb +51 -7
- data/test/integration/timeoutable_test.rb +23 -22
- data/test/integration/trackable_test.rb +3 -3
- data/test/mailers/confirmation_instructions_test.rb +10 -10
- data/test/mailers/reset_password_instructions_test.rb +8 -8
- data/test/mailers/unlock_instructions_test.rb +8 -8
- data/test/mapping_test.rb +7 -0
- data/test/models/authenticatable_test.rb +11 -1
- data/test/models/confirmable_test.rb +91 -42
- data/test/models/database_authenticatable_test.rb +26 -6
- data/test/models/lockable_test.rb +29 -17
- data/test/models/recoverable_test.rb +74 -7
- data/test/models/rememberable_test.rb +68 -94
- data/test/models/trackable_test.rb +28 -0
- data/test/models/validatable_test.rb +9 -17
- data/test/models_test.rb +15 -6
- data/test/omniauth/url_helpers_test.rb +4 -7
- data/test/orm/active_record.rb +6 -1
- data/test/parameter_sanitizer_test.rb +103 -53
- data/test/rails_app/app/active_record/user.rb +1 -0
- data/test/rails_app/app/active_record/user_on_engine.rb +7 -0
- data/test/rails_app/app/active_record/user_on_main_app.rb +7 -0
- data/test/rails_app/app/active_record/user_without_email.rb +8 -0
- data/test/rails_app/app/controllers/admins_controller.rb +1 -6
- data/test/rails_app/app/controllers/application_controller.rb +5 -2
- data/test/rails_app/app/controllers/application_with_fake_engine.rb +30 -0
- data/test/rails_app/app/controllers/custom/registrations_controller.rb +31 -0
- data/test/rails_app/app/controllers/home_controller.rb +5 -1
- data/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb +3 -3
- data/test/rails_app/app/controllers/users_controller.rb +6 -6
- data/test/rails_app/app/mailers/users/from_proc_mailer.rb +3 -0
- data/test/rails_app/app/mailers/users/mailer.rb +0 -9
- data/test/rails_app/app/mailers/users/reply_to_mailer.rb +4 -0
- data/test/rails_app/app/mongoid/user_on_engine.rb +39 -0
- data/test/rails_app/app/mongoid/user_on_main_app.rb +39 -0
- data/test/rails_app/app/mongoid/user_without_email.rb +33 -0
- data/test/rails_app/config/application.rb +3 -3
- data/test/rails_app/config/boot.rb +4 -4
- data/test/rails_app/config/environments/production.rb +6 -2
- data/test/rails_app/config/environments/test.rb +13 -3
- data/test/rails_app/config/initializers/devise.rb +15 -16
- data/test/rails_app/config/initializers/secret_token.rb +1 -6
- data/test/rails_app/config/routes.rb +23 -3
- data/test/rails_app/db/migrate/20100401102949_create_tables.rb +2 -2
- data/test/rails_app/lib/shared_user.rb +1 -1
- data/test/rails_app/lib/shared_user_without_email.rb +26 -0
- data/test/rails_app/lib/shared_user_without_omniauth.rb +13 -0
- data/test/rails_test.rb +9 -0
- data/test/routes_test.rb +33 -16
- data/test/support/assertions.rb +2 -3
- data/test/support/helpers.rb +13 -6
- data/test/support/http_method_compatibility.rb +51 -0
- data/test/support/integration.rb +4 -4
- data/test/support/webrat/integrations/rails.rb +9 -0
- data/test/test_helper.rb +7 -0
- data/test/test_helpers_test.rb +43 -38
- data/test/test_models.rb +3 -3
- metadata +77 -23
- data/gemfiles/Gemfile.rails-4.0-stable +0 -29
@@ -1,6 +1,6 @@
|
|
1
1
|
require 'test_helper'
|
2
2
|
|
3
|
-
class AuthenticationSanityTest <
|
3
|
+
class AuthenticationSanityTest < Devise::IntegrationTest
|
4
4
|
test 'home should be accessible without sign in' do
|
5
5
|
visit '/'
|
6
6
|
assert_response :success
|
@@ -118,13 +118,13 @@ class AuthenticationSanityTest < ActionDispatch::IntegrationTest
|
|
118
118
|
assert_not warden.authenticated?(:admin)
|
119
119
|
end
|
120
120
|
|
121
|
-
test 'unauthenticated admin
|
121
|
+
test 'unauthenticated admin set message on sign out' do
|
122
122
|
get destroy_admin_session_path
|
123
123
|
assert_response :redirect
|
124
124
|
assert_redirected_to root_path
|
125
125
|
|
126
126
|
get root_path
|
127
|
-
|
127
|
+
assert_contain 'Signed out successfully'
|
128
128
|
end
|
129
129
|
|
130
130
|
test 'scope uses custom failure app' do
|
@@ -134,7 +134,7 @@ class AuthenticationSanityTest < ActionDispatch::IntegrationTest
|
|
134
134
|
end
|
135
135
|
end
|
136
136
|
|
137
|
-
class AuthenticationRoutesRestrictions <
|
137
|
+
class AuthenticationRoutesRestrictions < Devise::IntegrationTest
|
138
138
|
test 'not signed in should not be able to access private route (authenticate denied)' do
|
139
139
|
get private_path
|
140
140
|
assert_redirected_to new_admin_session_path
|
@@ -254,7 +254,7 @@ class AuthenticationRoutesRestrictions < ActionDispatch::IntegrationTest
|
|
254
254
|
end
|
255
255
|
end
|
256
256
|
|
257
|
-
class AuthenticationRedirectTest <
|
257
|
+
class AuthenticationRedirectTest < Devise::IntegrationTest
|
258
258
|
test 'redirect from warden shows sign in or sign up message' do
|
259
259
|
get admins_path
|
260
260
|
|
@@ -300,7 +300,7 @@ class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
|
|
300
300
|
end
|
301
301
|
|
302
302
|
test 'xml http requests does not store urls for redirect' do
|
303
|
-
get users_path, {
|
303
|
+
get users_path, headers: { 'HTTP_X_REQUESTED_WITH' => 'XMLHttpRequest' }
|
304
304
|
assert_equal 401, response.status
|
305
305
|
assert_nil session[:"user_return_to"]
|
306
306
|
end
|
@@ -317,7 +317,7 @@ class AuthenticationRedirectTest < ActionDispatch::IntegrationTest
|
|
317
317
|
end
|
318
318
|
end
|
319
319
|
|
320
|
-
class AuthenticationSessionTest <
|
320
|
+
class AuthenticationSessionTest < Devise::IntegrationTest
|
321
321
|
test 'destroyed account is signed out' do
|
322
322
|
sign_in_as_user
|
323
323
|
get '/users'
|
@@ -390,7 +390,7 @@ class AuthenticationSessionTest < ActionDispatch::IntegrationTest
|
|
390
390
|
end
|
391
391
|
end
|
392
392
|
|
393
|
-
class AuthenticationWithScopedViewsTest <
|
393
|
+
class AuthenticationWithScopedViewsTest < Devise::IntegrationTest
|
394
394
|
test 'renders the scoped view if turned on and view is available' do
|
395
395
|
swap Devise, scoped_views: true do
|
396
396
|
assert_raise Webrat::NotFoundError do
|
@@ -431,7 +431,7 @@ class AuthenticationWithScopedViewsTest < ActionDispatch::IntegrationTest
|
|
431
431
|
end
|
432
432
|
end
|
433
433
|
|
434
|
-
class AuthenticationOthersTest <
|
434
|
+
class AuthenticationOthersTest < Devise::IntegrationTest
|
435
435
|
test 'handles unverified requests gets rid of caches' do
|
436
436
|
swap ApplicationController, allow_forgery_protection: true do
|
437
437
|
post exhibit_user_url(1)
|
@@ -448,7 +448,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
|
|
448
448
|
|
449
449
|
test 'uses the custom controller with the custom controller view' do
|
450
450
|
get '/admin_area/sign_in'
|
451
|
-
assert_contain '
|
451
|
+
assert_contain 'Log in'
|
452
452
|
assert_contain 'Welcome to "admins/sessions" controller!'
|
453
453
|
assert_contain 'Welcome to "sessions/new" view!'
|
454
454
|
end
|
@@ -472,7 +472,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
|
|
472
472
|
|
473
473
|
test 'sign in with script name' do
|
474
474
|
assert_nothing_raised do
|
475
|
-
get new_user_session_path, {
|
475
|
+
get new_user_session_path, headers: { "SCRIPT_NAME" => "/omg" }
|
476
476
|
fill_in "email", with: "user@test.com"
|
477
477
|
end
|
478
478
|
end
|
@@ -509,7 +509,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
|
|
509
509
|
|
510
510
|
test 'sign in with xml format returns xml response' do
|
511
511
|
create_user
|
512
|
-
post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
|
512
|
+
post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
|
513
513
|
assert_response :success
|
514
514
|
assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
|
515
515
|
end
|
@@ -519,13 +519,13 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
|
|
519
519
|
assert_response :success
|
520
520
|
|
521
521
|
create_user
|
522
|
-
post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
|
522
|
+
post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
|
523
523
|
assert_response :success
|
524
524
|
|
525
525
|
get new_user_session_path(format: 'xml')
|
526
526
|
assert_response :success
|
527
527
|
|
528
|
-
post user_session_path(format: 'xml'), user: {email: "user@test.com", password: '12345678'}
|
528
|
+
post user_session_path(format: 'xml'), params: { user: {email: "user@test.com", password: '12345678'} }
|
529
529
|
assert_response :success
|
530
530
|
assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
|
531
531
|
end
|
@@ -559,7 +559,7 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
|
|
559
559
|
test 'sign out with non-navigational format via XHR does not redirect' do
|
560
560
|
swap Devise, navigational_formats: ['*/*', :html] do
|
561
561
|
sign_in_as_user
|
562
|
-
|
562
|
+
get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "application/json,text/javascript,*/*" } # NOTE: Bug is triggered by combination of XHR and */*.
|
563
563
|
assert_response :no_content
|
564
564
|
assert_not warden.authenticated?(:user)
|
565
565
|
end
|
@@ -569,18 +569,18 @@ class AuthenticationOthersTest < ActionDispatch::IntegrationTest
|
|
569
569
|
test 'sign out with navigational format via XHR does redirect' do
|
570
570
|
swap Devise, navigational_formats: ['*/*', :html] do
|
571
571
|
sign_in_as_user
|
572
|
-
|
572
|
+
get destroy_user_session_path, xhr: true, headers: { "HTTP_ACCEPT" => "text/html,*/*" }
|
573
573
|
assert_response :redirect
|
574
574
|
assert_not warden.authenticated?(:user)
|
575
575
|
end
|
576
576
|
end
|
577
577
|
end
|
578
578
|
|
579
|
-
class AuthenticationKeysTest <
|
579
|
+
class AuthenticationKeysTest < Devise::IntegrationTest
|
580
580
|
test 'missing authentication keys cause authentication to abort' do
|
581
581
|
swap Devise, authentication_keys: [:subdomain] do
|
582
582
|
sign_in_as_user
|
583
|
-
assert_contain "Invalid
|
583
|
+
assert_contain "Invalid subdomain or password."
|
584
584
|
assert_not warden.authenticated?(:user)
|
585
585
|
end
|
586
586
|
end
|
@@ -593,7 +593,7 @@ class AuthenticationKeysTest < ActionDispatch::IntegrationTest
|
|
593
593
|
end
|
594
594
|
end
|
595
595
|
|
596
|
-
class AuthenticationRequestKeysTest <
|
596
|
+
class AuthenticationRequestKeysTest < Devise::IntegrationTest
|
597
597
|
test 'request keys are used on authentication' do
|
598
598
|
host! 'foo.bar.baz'
|
599
599
|
|
@@ -634,7 +634,7 @@ class AuthenticationRequestKeysTest < ActionDispatch::IntegrationTest
|
|
634
634
|
end
|
635
635
|
end
|
636
636
|
|
637
|
-
class AuthenticationSignOutViaTest <
|
637
|
+
class AuthenticationSignOutViaTest < Devise::IntegrationTest
|
638
638
|
def sign_in!(scope)
|
639
639
|
sign_in_as_admin(visit: send("new_#{scope}_session_path"))
|
640
640
|
assert warden.authenticated?(scope)
|
@@ -689,7 +689,7 @@ class AuthenticationSignOutViaTest < ActionDispatch::IntegrationTest
|
|
689
689
|
end
|
690
690
|
end
|
691
691
|
|
692
|
-
class DoubleAuthenticationRedirectTest <
|
692
|
+
class DoubleAuthenticationRedirectTest < Devise::IntegrationTest
|
693
693
|
test 'signed in as user redirects when visiting user sign in page' do
|
694
694
|
sign_in_as_user
|
695
695
|
get new_user_session_path(format: :html)
|
@@ -711,3 +711,19 @@ class DoubleAuthenticationRedirectTest < ActionDispatch::IntegrationTest
|
|
711
711
|
assert_redirected_to '/admin_area/home'
|
712
712
|
end
|
713
713
|
end
|
714
|
+
|
715
|
+
class DoubleSignOutRedirectTest < Devise::IntegrationTest
|
716
|
+
test 'sign out after already having signed out redirects to sign in' do
|
717
|
+
sign_in_as_user
|
718
|
+
|
719
|
+
post destroy_sign_out_via_delete_or_post_session_path
|
720
|
+
|
721
|
+
get root_path
|
722
|
+
assert_contain 'Signed out successfully.'
|
723
|
+
|
724
|
+
post destroy_sign_out_via_delete_or_post_session_path
|
725
|
+
|
726
|
+
get root_path
|
727
|
+
assert_contain 'Signed out successfully.'
|
728
|
+
end
|
729
|
+
end
|
@@ -1,6 +1,6 @@
|
|
1
1
|
require 'test_helper'
|
2
2
|
|
3
|
-
class ConfirmationTest <
|
3
|
+
class ConfirmationTest < Devise::IntegrationTest
|
4
4
|
|
5
5
|
def visit_user_confirmation_with_token(confirmation_token)
|
6
6
|
visit user_confirmation_path(confirmation_token: confirmation_token)
|
@@ -21,7 +21,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
21
21
|
resend_confirmation
|
22
22
|
|
23
23
|
assert_current_url '/users/sign_in'
|
24
|
-
assert_contain 'You will receive an email with instructions
|
24
|
+
assert_contain 'You will receive an email with instructions for how to confirm your email address in a few minutes'
|
25
25
|
assert_equal 1, ActionMailer::Base.deliveries.size
|
26
26
|
assert_equal ['please-change-me@config-initializers-devise.com'], ActionMailer::Base.deliveries.first.from
|
27
27
|
end
|
@@ -47,6 +47,37 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
47
47
|
assert_have_selector '#error_explanation'
|
48
48
|
assert_contain /needs to be confirmed within 3 days/
|
49
49
|
assert_not user.reload.confirmed?
|
50
|
+
assert_current_url "/users/confirmation?confirmation_token=#{user.raw_confirmation_token}"
|
51
|
+
end
|
52
|
+
end
|
53
|
+
|
54
|
+
test 'user with valid confirmation token where the token has expired and with application router_name set to a different engine it should raise an error' do
|
55
|
+
user = create_user(confirm: false, confirmation_sent_at: 4.days.ago)
|
56
|
+
|
57
|
+
swap Devise, confirm_within: 3.days, router_name: :fake_engine do
|
58
|
+
assert_raise ActionView::Template::Error do
|
59
|
+
visit_user_confirmation_with_token(user.raw_confirmation_token)
|
60
|
+
end
|
61
|
+
end
|
62
|
+
end
|
63
|
+
|
64
|
+
test 'user with valid confirmation token where the token has expired and with application router_name set to a different engine and route overrides back to main it shows the path' do
|
65
|
+
user = create_user(confirm: false, confirmation_sent_at: 4.days.ago)
|
66
|
+
|
67
|
+
swap Devise, confirm_within: 3.days, router_name: :fake_engine do
|
68
|
+
visit user_on_main_app_confirmation_path(confirmation_token: user.raw_confirmation_token)
|
69
|
+
|
70
|
+
assert_current_url "/user_on_main_apps/confirmation?confirmation_token=#{user.raw_confirmation_token}"
|
71
|
+
end
|
72
|
+
end
|
73
|
+
|
74
|
+
test 'user with valid confirmation token where the token has expired with router overrides different engine it shows the path' do
|
75
|
+
user = create_user(confirm: false, confirmation_sent_at: 4.days.ago)
|
76
|
+
|
77
|
+
swap Devise, confirm_within: 3.days do
|
78
|
+
visit user_on_engine_confirmation_path(confirmation_token: user.raw_confirmation_token)
|
79
|
+
|
80
|
+
assert_current_url "/user_on_engines/confirmation?confirmation_token=#{user.raw_confirmation_token}"
|
50
81
|
end
|
51
82
|
end
|
52
83
|
|
@@ -56,7 +87,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
56
87
|
assert_not user.confirmed?
|
57
88
|
visit_user_confirmation_with_token(user.raw_confirmation_token)
|
58
89
|
|
59
|
-
assert_contain 'Your
|
90
|
+
assert_contain 'Your email address has been successfully confirmed.'
|
60
91
|
assert_current_url '/users/sign_in'
|
61
92
|
assert user.reload.confirmed?
|
62
93
|
end
|
@@ -98,7 +129,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
98
129
|
swap Devise, allow_unconfirmed_access_for: 0.days do
|
99
130
|
sign_in_as_user(confirm: false)
|
100
131
|
|
101
|
-
assert_contain 'You have to confirm your
|
132
|
+
assert_contain 'You have to confirm your email address before continuing'
|
102
133
|
assert_not warden.authenticated?(:user)
|
103
134
|
end
|
104
135
|
end
|
@@ -128,11 +159,20 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
128
159
|
user = sign_in_as_user(confirm: false)
|
129
160
|
|
130
161
|
visit_user_confirmation_with_token(user.raw_confirmation_token)
|
131
|
-
assert_contain 'Your
|
162
|
+
assert_contain 'Your email address has been successfully confirmed.'
|
132
163
|
assert_current_url '/'
|
133
164
|
end
|
134
165
|
end
|
135
166
|
|
167
|
+
test 'user should be redirected to sign in page whenever signed in as another resource at same session already' do
|
168
|
+
sign_in_as_admin
|
169
|
+
|
170
|
+
user = create_user(confirm: false)
|
171
|
+
visit_user_confirmation_with_token(user.raw_confirmation_token)
|
172
|
+
|
173
|
+
assert_current_url '/users/sign_in'
|
174
|
+
end
|
175
|
+
|
136
176
|
test 'error message is configurable by resource name' do
|
137
177
|
store_translations :en, devise: {
|
138
178
|
failure: { user: { unconfirmed: "Not confirmed user" } }
|
@@ -144,14 +184,14 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
144
184
|
|
145
185
|
test 'resent confirmation token with valid E-Mail in XML format should return valid response' do
|
146
186
|
user = create_user(confirm: false)
|
147
|
-
post user_confirmation_path(format: 'xml'), user: { email: user.email }
|
187
|
+
post user_confirmation_path(format: 'xml'), params: { user: { email: user.email } }
|
148
188
|
assert_response :success
|
149
189
|
assert_equal response.body, {}.to_xml
|
150
190
|
end
|
151
191
|
|
152
192
|
test 'resent confirmation token with invalid E-Mail in XML format should return invalid response' do
|
153
193
|
create_user(confirm: false)
|
154
|
-
post user_confirmation_path(format: 'xml'), user: { email: 'invalid.test@test.com' }
|
194
|
+
post user_confirmation_path(format: 'xml'), params: { user: { email: 'invalid.test@test.com' } }
|
155
195
|
assert_response :unprocessable_entity
|
156
196
|
assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
|
157
197
|
end
|
@@ -173,7 +213,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
173
213
|
test 'request an account confirmation account with JSON, should return an empty JSON' do
|
174
214
|
user = create_user(confirm: false)
|
175
215
|
|
176
|
-
post user_confirmation_path, user: { email: user.email }, format: :json
|
216
|
+
post user_confirmation_path, params: { user: { email: user.email }, format: :json }
|
177
217
|
assert_response :success
|
178
218
|
assert_equal response.body, {}.to_json
|
179
219
|
end
|
@@ -187,7 +227,7 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
187
227
|
fill_in 'email', with: user.email
|
188
228
|
click_button 'Resend confirmation instructions'
|
189
229
|
|
190
|
-
assert_contain "If your email address exists in our database, you will receive an email with instructions
|
230
|
+
assert_contain "If your email address exists in our database, you will receive an email with instructions for how to confirm your email address in a few minutes."
|
191
231
|
assert_current_url "/users/sign_in"
|
192
232
|
end
|
193
233
|
end
|
@@ -203,13 +243,13 @@ class ConfirmationTest < ActionDispatch::IntegrationTest
|
|
203
243
|
assert_not_contain "1 error prohibited this user from being saved:"
|
204
244
|
assert_not_contain "Email not found"
|
205
245
|
|
206
|
-
assert_contain "If your email address exists in our database, you will receive an email with instructions
|
246
|
+
assert_contain "If your email address exists in our database, you will receive an email with instructions for how to confirm your email address in a few minutes."
|
207
247
|
assert_current_url "/users/sign_in"
|
208
248
|
end
|
209
249
|
end
|
210
250
|
end
|
211
251
|
|
212
|
-
class ConfirmationOnChangeTest <
|
252
|
+
class ConfirmationOnChangeTest < Devise::IntegrationTest
|
213
253
|
def create_second_admin(options={})
|
214
254
|
@admin = nil
|
215
255
|
create_admin(options)
|
@@ -232,7 +272,7 @@ class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
|
|
232
272
|
end
|
233
273
|
|
234
274
|
assert_current_url '/admin_area/sign_in'
|
235
|
-
assert_contain 'You will receive an email with instructions
|
275
|
+
assert_contain 'You will receive an email with instructions for how to confirm your email address in a few minutes'
|
236
276
|
end
|
237
277
|
|
238
278
|
test 'admin with valid confirmation token should be able to confirm email after email changed' do
|
@@ -241,7 +281,7 @@ class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
|
|
241
281
|
assert_equal 'new_test@example.com', admin.unconfirmed_email
|
242
282
|
visit_admin_confirmation_with_token(admin.raw_confirmation_token)
|
243
283
|
|
244
|
-
assert_contain 'Your
|
284
|
+
assert_contain 'Your email address has been successfully confirmed.'
|
245
285
|
assert_current_url '/admin_area/sign_in'
|
246
286
|
assert admin.reload.confirmed?
|
247
287
|
assert_not admin.reload.pending_reconfirmation?
|
@@ -263,7 +303,7 @@ class ConfirmationOnChangeTest < ActionDispatch::IntegrationTest
|
|
263
303
|
assert_contain(/Confirmation token(.*)invalid/)
|
264
304
|
|
265
305
|
visit_admin_confirmation_with_token(admin.raw_confirmation_token)
|
266
|
-
assert_contain 'Your
|
306
|
+
assert_contain 'Your email address has been successfully confirmed.'
|
267
307
|
assert_current_url '/admin_area/sign_in'
|
268
308
|
assert admin.reload.confirmed?
|
269
309
|
assert_not admin.reload.pending_reconfirmation?
|
@@ -1,6 +1,6 @@
|
|
1
1
|
require 'test_helper'
|
2
2
|
|
3
|
-
class DatabaseAuthenticationTest <
|
3
|
+
class DatabaseAuthenticationTest < Devise::IntegrationTest
|
4
4
|
test 'sign in with email of different case should succeed when email is in the list of case insensitive keys' do
|
5
5
|
create_user(email: 'Foo@Bar.com')
|
6
6
|
|
@@ -81,4 +81,15 @@ class DatabaseAuthenticationTest < ActionDispatch::IntegrationTest
|
|
81
81
|
assert_contain 'Invalid credentials'
|
82
82
|
end
|
83
83
|
end
|
84
|
+
|
85
|
+
test 'valid sign in calls after_database_authentication callback' do
|
86
|
+
user = create_user(email: ' foo@bar.com ')
|
87
|
+
|
88
|
+
User.expects(:find_for_database_authentication).returns user
|
89
|
+
user.expects :after_database_authentication
|
90
|
+
|
91
|
+
sign_in_as_user do
|
92
|
+
fill_in 'email', with: 'foo@bar.com'
|
93
|
+
end
|
94
|
+
end
|
84
95
|
end
|
@@ -1,10 +1,10 @@
|
|
1
1
|
require 'test_helper'
|
2
2
|
|
3
|
-
class HttpAuthenticationTest <
|
3
|
+
class HttpAuthenticationTest < Devise::IntegrationTest
|
4
4
|
test 'handles unverified requests gets rid of caches but continues signed in' do
|
5
5
|
swap ApplicationController, allow_forgery_protection: true do
|
6
6
|
create_user
|
7
|
-
post exhibit_user_url(1), {
|
7
|
+
post exhibit_user_url(1), headers: { "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("user@test.com:12345678")}" }
|
8
8
|
assert warden.authenticated?(:user)
|
9
9
|
assert_equal "User is authenticated", response.body
|
10
10
|
end
|
@@ -89,17 +89,16 @@ class HttpAuthenticationTest < ActionDispatch::IntegrationTest
|
|
89
89
|
end
|
90
90
|
|
91
91
|
private
|
92
|
-
|
93
92
|
def sign_in_as_new_user_with_http(username="user@test.com", password="12345678")
|
94
93
|
user = create_user
|
95
|
-
get users_path(format: :xml), {
|
94
|
+
get users_path(format: :xml), headers: { "HTTP_AUTHORIZATION" => "Basic #{Base64.encode64("#{username}:#{password}")}" }
|
96
95
|
user
|
97
96
|
end
|
98
97
|
|
99
98
|
# Sign in with oauth2 token. This is just to test that it isn't misinterpreted as basic authentication
|
100
99
|
def add_oauth2_header
|
101
100
|
user = create_user
|
102
|
-
get users_path(format: :xml), {
|
101
|
+
get users_path(format: :xml), headers: { "HTTP_AUTHORIZATION" => "OAuth #{Base64.encode64("#{user.email}:12345678")}" }
|
103
102
|
end
|
104
103
|
|
105
104
|
end
|
@@ -1,6 +1,6 @@
|
|
1
1
|
require 'test_helper'
|
2
2
|
|
3
|
-
class LockTest <
|
3
|
+
class LockTest < Devise::IntegrationTest
|
4
4
|
|
5
5
|
def visit_user_unlock_with_token(unlock_token)
|
6
6
|
visit user_unlock_path(unlock_token: unlock_token)
|
@@ -22,7 +22,7 @@ class LockTest < ActionDispatch::IntegrationTest
|
|
22
22
|
send_unlock_request
|
23
23
|
|
24
24
|
assert_template 'sessions/new'
|
25
|
-
assert_contain 'You will receive an email with instructions
|
25
|
+
assert_contain 'You will receive an email with instructions for how to unlock your account in a few minutes'
|
26
26
|
|
27
27
|
mail = ActionMailer::Base.deliveries.last
|
28
28
|
assert_equal 1, ActionMailer::Base.deliveries.size
|
@@ -132,9 +132,10 @@ class LockTest < ActionDispatch::IntegrationTest
|
|
132
132
|
user = create_user(locked: true)
|
133
133
|
ActionMailer::Base.deliveries.clear
|
134
134
|
|
135
|
-
post user_unlock_path(format: 'xml'), user: {email: user.email}
|
135
|
+
post user_unlock_path(format: 'xml'), params: { user: {email: user.email} }
|
136
136
|
assert_response :success
|
137
137
|
assert_equal response.body, {}.to_xml
|
138
|
+
|
138
139
|
assert_equal 1, ActionMailer::Base.deliveries.size
|
139
140
|
end
|
140
141
|
|
@@ -142,7 +143,7 @@ class LockTest < ActionDispatch::IntegrationTest
|
|
142
143
|
user = create_user(locked: false)
|
143
144
|
ActionMailer::Base.deliveries.clear
|
144
145
|
|
145
|
-
post user_unlock_path(format: 'xml'), user: {email: user.email}
|
146
|
+
post user_unlock_path(format: 'xml'), params: { user: {email: user.email} }
|
146
147
|
assert_response :unprocessable_entity
|
147
148
|
assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
|
148
149
|
assert_equal 0, ActionMailer::Base.deliveries.size
|
@@ -182,7 +183,7 @@ class LockTest < ActionDispatch::IntegrationTest
|
|
182
183
|
click_button 'Resend unlock instructions'
|
183
184
|
|
184
185
|
assert_current_url "/users/sign_in"
|
185
|
-
assert_contain "If your account exists, you will receive an email with instructions
|
186
|
+
assert_contain "If your account exists, you will receive an email with instructions for how to unlock it in a few minutes."
|
186
187
|
end
|
187
188
|
end
|
188
189
|
|
@@ -197,7 +198,7 @@ class LockTest < ActionDispatch::IntegrationTest
|
|
197
198
|
click_button 'Resend unlock instructions'
|
198
199
|
|
199
200
|
assert_current_url "/users/sign_in"
|
200
|
-
assert_contain "If your account exists, you will receive an email with instructions
|
201
|
+
assert_contain "If your account exists, you will receive an email with instructions for how to unlock it in a few minutes."
|
201
202
|
end
|
202
203
|
end
|
203
204
|
|
@@ -213,7 +214,7 @@ class LockTest < ActionDispatch::IntegrationTest
|
|
213
214
|
assert_not_contain "Email not found"
|
214
215
|
assert_current_url "/users/sign_in"
|
215
216
|
|
216
|
-
assert_contain "If your account exists, you will receive an email with instructions
|
217
|
+
assert_contain "If your account exists, you will receive an email with instructions for how to unlock it in a few minutes."
|
217
218
|
|
218
219
|
end
|
219
220
|
end
|
@@ -225,11 +226,11 @@ class LockTest < ActionDispatch::IntegrationTest
|
|
225
226
|
visit new_user_session_path
|
226
227
|
fill_in 'email', with: user.email
|
227
228
|
fill_in 'password', with: "abadpassword"
|
228
|
-
click_button '
|
229
|
+
click_button 'Log in'
|
229
230
|
|
230
231
|
fill_in 'email', with: user.email
|
231
232
|
fill_in 'password', with: "abadpassword"
|
232
|
-
click_button '
|
233
|
+
click_button 'Log in'
|
233
234
|
|
234
235
|
assert_current_url "/users/sign_in"
|
235
236
|
assert_not_contain "locked"
|
@@ -1,7 +1,7 @@
|
|
1
1
|
require 'test_helper'
|
2
2
|
|
3
3
|
|
4
|
-
class OmniauthableIntegrationTest <
|
4
|
+
class OmniauthableIntegrationTest < Devise::IntegrationTest
|
5
5
|
FACEBOOK_INFO = {
|
6
6
|
"id" => '12345',
|
7
7
|
"link" => 'http://facebook.com/josevalim',
|
@@ -20,9 +20,11 @@ class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
|
|
20
20
|
"credentials" => {"token" => 'plataformatec'},
|
21
21
|
"extra" => {"user_hash" => FACEBOOK_INFO}
|
22
22
|
}
|
23
|
+
OmniAuth.config.add_camelization 'facebook', 'FaceBook'
|
23
24
|
end
|
24
25
|
|
25
26
|
teardown do
|
27
|
+
OmniAuth.config.camelizations.delete('facebook')
|
26
28
|
OmniAuth.config.test_mode = false
|
27
29
|
end
|
28
30
|
|
@@ -40,7 +42,7 @@ class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
|
|
40
42
|
|
41
43
|
test "can access omniauth.auth in the env hash" do
|
42
44
|
visit "/users/sign_in"
|
43
|
-
click_link "Sign in with
|
45
|
+
click_link "Sign in with FaceBook"
|
44
46
|
|
45
47
|
json = ActiveSupport::JSON.decode(response.body)
|
46
48
|
|
@@ -54,7 +56,7 @@ class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
|
|
54
56
|
test "cleans up session on sign up" do
|
55
57
|
assert_no_difference "User.count" do
|
56
58
|
visit "/users/sign_in"
|
57
|
-
click_link "Sign in with
|
59
|
+
click_link "Sign in with FaceBook"
|
58
60
|
end
|
59
61
|
|
60
62
|
assert session["devise.facebook_data"]
|
@@ -75,7 +77,7 @@ class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
|
|
75
77
|
test "cleans up session on cancel" do
|
76
78
|
assert_no_difference "User.count" do
|
77
79
|
visit "/users/sign_in"
|
78
|
-
click_link "Sign in with
|
80
|
+
click_link "Sign in with FaceBook"
|
79
81
|
end
|
80
82
|
|
81
83
|
assert session["devise.facebook_data"]
|
@@ -86,7 +88,7 @@ class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
|
|
86
88
|
test "cleans up session on sign in" do
|
87
89
|
assert_no_difference "User.count" do
|
88
90
|
visit "/users/sign_in"
|
89
|
-
click_link "Sign in with
|
91
|
+
click_link "Sign in with FaceBook"
|
90
92
|
end
|
91
93
|
|
92
94
|
assert session["devise.facebook_data"]
|
@@ -96,13 +98,13 @@ class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
|
|
96
98
|
|
97
99
|
test "sign in and send remember token if configured" do
|
98
100
|
visit "/users/sign_in"
|
99
|
-
click_link "Sign in with
|
101
|
+
click_link "Sign in with FaceBook"
|
100
102
|
assert_nil warden.cookies["remember_user_token"]
|
101
103
|
|
102
104
|
stub_action!(:sign_in_facebook) do
|
103
105
|
create_user
|
104
106
|
visit "/users/sign_in"
|
105
|
-
click_link "Sign in with
|
107
|
+
click_link "Sign in with FaceBook"
|
106
108
|
assert warden.authenticated?(:user)
|
107
109
|
assert warden.cookies["remember_user_token"]
|
108
110
|
end
|
@@ -118,16 +120,16 @@ class OmniauthableIntegrationTest < ActionDispatch::IntegrationTest
|
|
118
120
|
OmniAuth.config.mock_auth[:facebook] = :access_denied
|
119
121
|
visit "/users/auth/facebook/callback?error=access_denied"
|
120
122
|
assert_current_url "/users/sign_in"
|
121
|
-
assert_contain 'Could not authenticate you from
|
123
|
+
assert_contain 'Could not authenticate you from FaceBook because "Access denied".'
|
122
124
|
end
|
123
125
|
|
124
|
-
test "handles other exceptions from
|
126
|
+
test "handles other exceptions from OmniAuth" do
|
125
127
|
OmniAuth.config.mock_auth[:facebook] = :invalid_credentials
|
126
128
|
|
127
129
|
visit "/users/sign_in"
|
128
|
-
click_link "Sign in with
|
130
|
+
click_link "Sign in with FaceBook"
|
129
131
|
|
130
132
|
assert_current_url "/users/sign_in"
|
131
|
-
assert_contain 'Could not authenticate you from
|
133
|
+
assert_contain 'Could not authenticate you from FaceBook because "Invalid credentials".'
|
132
134
|
end
|
133
135
|
end
|