devise 3.5.2 → 4.0.0

data/test/parameter_sanitizer_test.rb

@@ -1,81 +1,131 @@
 require 'test_helper'
 require 'devise/parameter_sanitizer'
 
-class BaseSanitizerTest < ActiveSupport::TestCase
+class ParameterSanitizerTest < ActiveSupport::TestCase
   def sanitizer(params)
-    Devise::BaseSanitizer.new(User, :user, params)
+    params = ActionController::Parameters.new(params)
+    Devise::ParameterSanitizer.new(User, :user, params)
   end
 
-  test 'returns chosen params' do
-    sanitizer = sanitizer(user: { "email" => "jose" })
-    assert_equal({ "email" => "jose" }, sanitizer.sanitize(:sign_in))
+  test 'permits the default parameters for sign in' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose' })
+    sanitized = sanitizer.sanitize(:sign_in)
+
+    assert_equal({ 'email' => 'jose' }, sanitized)
   end
-end
 
-if defined?(ActionController::StrongParameters)
-  require 'active_model/forbidden_attributes_protection'
+  test 'permits the default parameters for sign up' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose', 'role' => 'invalid' })
+    sanitized = sanitizer.sanitize(:sign_up)
 
-  class ParameterSanitizerTest < ActiveSupport::TestCase
-    def sanitizer(params)
-      params = ActionController::Parameters.new(params)
-      Devise::ParameterSanitizer.new(User, :user, params)
-    end
+    assert_equal({ 'email' => 'jose' }, sanitized)
+  end
 
-    test 'filters some parameters on sign in by default' do
-      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid", "remember_me" => "1" })
-      assert_equal({ "email" => "jose", "password" => "invalid", "remember_me" => "1" }, sanitizer.sanitize(:sign_in))
-    end
+  test 'permits the default parameters for account update' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose', 'role' => 'invalid' })
+    sanitized = sanitizer.sanitize(:account_update)
 
-    test 'handles auth keys as a hash' do
-      swap Devise, authentication_keys: {email: true} do
-        sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
-        assert_equal({ "email" => "jose", "password" => "invalid" }, sanitizer.sanitize(:sign_in))
-      end
-    end
+    assert_equal({ 'email' => 'jose' }, sanitized)
+  end
 
-    test 'filters some parameters on sign up by default' do
-      sanitizer = sanitizer(user: { "email" => "jose", "role" => "invalid" })
-      assert_equal({ "email" => "jose" }, sanitizer.sanitize(:sign_up))
-    end
+  test 'permits news parameters for an existing action' do
+    sanitizer = sanitizer('user' => { 'username' => 'jose' })
+    sanitizer.permit(:sign_in, keys: [:username])
+    sanitized = sanitizer.sanitize(:sign_in)
+
+    assert_equal({ 'username' => 'jose' }, sanitized)
+  end
 
-    test 'filters some parameters on account update by default' do
-      sanitizer = sanitizer(user: { "email" => "jose", "role" => "invalid" })
-      assert_equal({ "email" => "jose" }, sanitizer.sanitize(:account_update))
+  test 'permits news parameters for an existing action with a block' do
+    sanitizer = sanitizer('user' => { 'username' => 'jose' })
+    sanitizer.permit(:sign_in) do |user|
+      user.permit(:username)
     end
 
-    test 'allows custom hooks' do
-      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
-      sanitizer.for(:sign_in) { |user| user.permit(:email, :password) }
-      assert_equal({ "email" => "jose", "password" => "invalid" }, sanitizer.sanitize(:sign_in))
+    sanitized = sanitizer.sanitize(:sign_in)
+
+    assert_equal({ 'username' => 'jose' }, sanitized)
+  end
+
+  test 'permit parameters for new actions' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose@omglol', 'name' => 'Jose' })
+    sanitizer.permit(:invite_user, keys: [:email, :name])
+
+    sanitized = sanitizer.sanitize(:invite_user)
+
+    assert_equal({ 'email' => 'jose@omglol', 'name' => 'Jose' }, sanitized)
+  end
+
+  test 'fails when we do not have any permitted parameters for the action' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose', 'password' => 'invalid' })
+
+    assert_raise NotImplementedError do
+      sanitizer.sanitize(:unknown)
     end
+  end
+
+  test 'removes permitted parameters' do
+    sanitizer = sanitizer('user' => { 'email' => 'jose@omglol', 'username' => 'jose' })
 
-    test 'adding multiple permitted parameters' do
-      sanitizer = sanitizer(user: { "email" => "jose", "username" => "jose1", "role" => "valid" })
-      sanitizer.for(:sign_in).concat([:username, :role])
-      assert_equal({ "email" => "jose", "username" => "jose1", "role" => "valid" }, sanitizer.sanitize(:sign_in))
+    sanitizer.permit(:sign_in, keys: [:username], except: [:email])
+    sanitized = sanitizer.sanitize(:sign_in)
+
+    assert_equal({ 'username' => 'jose' }, sanitized)
+  end
+end
+
+class DeprecatedParameterSanitizerAPITest < ActiveSupport::TestCase
+  class CustomSanitizer < Devise::ParameterSanitizer
+    def sign_in
+      default_params.permit(:username)
     end
+  end
 
-    test 'removing multiple default parameters' do
-      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid", "remember_me" => "1" })
-      sanitizer.for(:sign_in).delete(:email)
-      sanitizer.for(:sign_in).delete(:password)
-      assert_equal({ "remember_me" => "1" }, sanitizer.sanitize(:sign_in))
+  def sanitizer(params)
+    params = ActionController::Parameters.new(params)
+    Devise::ParameterSanitizer.new(User, :user, params)
+  end
+
+  test 'overriding instance methods have precedence over the default sanitized attributes' do
+    assert_deprecated do
+      params =  ActionController::Parameters.new(user: { "username" => "jose", "name" => "Jose" })
+      sanitizer = CustomSanitizer.new(User, :user, params)
+
+      sanitized = sanitizer.sanitize(:sign_in)
+
+      assert_equal({ "username" => "jose" }, sanitized)
     end
+  end
 
-    test 'raises on unknown hooks' do
-      sanitizer = sanitizer(user: { "email" => "jose", "password" => "invalid" })
-      assert_raise NotImplementedError do
-        sanitizer.sanitize(:unknown)
-      end
+  test 'adding new parameters by mutating the Array' do
+    assert_deprecated do
+      sanitizer = sanitizer('user' => { 'username' => 'jose' })
+      sanitizer.for(:sign_in) << :username
+      sanitized = sanitizer.sanitize(:sign_in)
+
+      assert_equal({ 'username' => 'jose' }, sanitized)
     end
+  end
 
-    test 'passes parameters to filter as arguments to sanitizer' do
-      params = {user: stub}
-      sanitizer = Devise::ParameterSanitizer.new(User, :user, params)
+   test 'adding new parameters with a block' do
+     assert_deprecated do
+       sanitizer = sanitizer('user' => { 'username' => 'jose' })
+       sanitizer.for(:sign_in) { |user| user.permit(:username) }
 
-      params[:user].expects(:permit).with(kind_of(Symbol), kind_of(Symbol), kind_of(Symbol))
+       sanitized = sanitizer.sanitize(:sign_in)
+
+       assert_equal({ 'username' => 'jose' }, sanitized)
+     end
+   end
+
+  test 'removing multiple default parameters' do
+    assert_deprecated do
+      sanitizer = sanitizer('user' => { 'email' => 'jose', 'password' => 'invalid', 'remember_me' => '1' })
+      sanitizer.for(:sign_in).delete(:email)
+      sanitizer.for(:sign_in).delete(:password)
+      sanitized = sanitizer.sanitize(:sign_in)
 
-      sanitizer.sanitize(:sign_in)
+      assert_equal({ 'remember_me' => '1' }, sanitized)
     end
   end
 end

data/test/rails_app/app/active_record/user.rb

@@ -3,4 +3,5 @@ require 'shared_user'
 class User < ActiveRecord::Base
   include Shim
   include SharedUser
+  include ActiveModel::Serializers::Xml if Devise.rails5?
 end

data/test/rails_app/app/active_record/user_without_email.rb

@@ -0,0 +1,8 @@
+require "shared_user_without_email"
+
+class UserWithoutEmail < ActiveRecord::Base
+  self.table_name = 'users'
+  include Shim
+  include SharedUserWithoutEmail
+end
+

data/test/rails_app/app/controllers/admins_controller.rb

@@ -1,5 +1,5 @@
 class AdminsController < ApplicationController
-  before_filter :authenticate_admin!
+  before_action :authenticate_admin!
 
   def index
   end

data/test/rails_app/app/controllers/application_controller.rb

@@ -3,8 +3,8 @@
 
 class ApplicationController < ActionController::Base
   protect_from_forgery
-  before_filter :current_user, unless: :devise_controller?
-  before_filter :authenticate_user!, if: :devise_controller?
+  before_action :current_user, unless: :devise_controller?
+  before_action :authenticate_user!, if: :devise_controller?
   respond_to *Mime::SET.map(&:to_sym)
 
   devise_group :commenter, contains: [:user, :admin]

data/test/rails_app/app/controllers/home_controller.rb

@@ -20,6 +20,10 @@ class HomeController < ApplicationController
   end
 
   def unauthenticated
-    render text: "unauthenticated", status: :unauthorized
+    if Devise.rails5?
+      render body: "unauthenticated", status: :unauthorized
+    else
+      render text: "unauthenticated", status: :unauthorized
+    end
   end
 end

data/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb

@@ -1,6 +1,6 @@
 class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
   def facebook
-    data = env["omniauth.auth"]
+    data = request.respond_to?(:get_header) ? request.get_header("omniauth.auth") : env["omniauth.auth"]
     session["devise.facebook_data"] = data["extra"]["user_hash"]
     render json: data
   end
@@ -9,6 +9,6 @@ class Users::OmniauthCallbacksController < Devise::OmniauthCallbacksController
     user = User.to_adapter.find_first(email: 'user@test.com')
     user.remember_me = true
     sign_in user
-    render text: ""
+    render (Devise.rails5? ? :body : :text) => ""
   end
 end

data/test/rails_app/app/controllers/users_controller.rb

@@ -1,6 +1,6 @@
 class UsersController < ApplicationController
-  prepend_before_filter :current_user, only: :exhibit
-  before_filter :authenticate_user!, except: [:accept, :exhibit]
+  prepend_before_action :current_user, only: :exhibit
+  before_action :authenticate_user!, except: [:accept, :exhibit]
   respond_to :html, :xml
 
   def index
@@ -13,7 +13,7 @@ class UsersController < ApplicationController
   end
 
   def update_form
-    render text: 'Update'
+    render (Devise.rails5? ? :body : :text) => 'Update'
   end
 
   def accept
@@ -21,11 +21,11 @@ class UsersController < ApplicationController
   end
 
   def exhibit
-    render text: current_user ? "User is authenticated" : "User is not authenticated"
+    render (Devise.rails5? ? :body : :text) => current_user ? "User is authenticated" : "User is not authenticated"
   end
 
   def expire
     user_session['last_request_at'] = 31.minutes.ago.utc
-    render text: 'User will be expired on next request'
+    render (Devise.rails5? ? :body : :text) => 'User will be expired on next request'
   end
 end

data/test/rails_app/app/mongoid/user_without_email.rb

@@ -0,0 +1,33 @@
+require "shared_user_without_email"
+
+class UserWithoutEmail
+  include Mongoid::Document
+  include Shim
+  include SharedUserWithoutEmail
+
+  field :username, type: String
+  field :facebook_token, type: String
+
+  ## Database authenticatable
+  field :email, type: String, default: ""
+  field :encrypted_password, type: String, default: ""
+
+  ## Recoverable
+  field :reset_password_token, type: String
+  field :reset_password_sent_at, type: Time
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Trackable
+  field :sign_in_count, type: Integer, default: 0
+  field :current_sign_in_at, type: Time
+  field :last_sign_in_at, type: Time
+  field :current_sign_in_ip, type: String
+  field :last_sign_in_ip, type: String
+
+  ## Lockable
+  field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  field :unlock_token, type: String # Only if unlock strategy is :email or :both
+  field :locked_at, type: Time
+end

data/test/rails_app/config/application.rb

@@ -28,7 +28,7 @@ module RailsApp
 
     # Configure sensitive parameters which will be filtered from the log file.
     config.filter_parameters << :password
-    config.assets.enabled = false
+    # config.assets.enabled = false
 
     config.action_mailer.default_url_options = { host: "localhost", port: 3000 }
 

data/test/rails_app/config/boot.rb

@@ -3,12 +3,12 @@ unless defined?(DEVISE_ORM)
 end
 
 module Devise
-  # Detection for minor differences between Rails 3.2 and 4 in tests.
-  def self.rails4?
-    Rails.version.start_with? '4'
+  # Detection for minor differences between Rails 4 and 5 in tests.
+  def self.rails5?
+    Rails.version.start_with? '5'
   end
 end
 
 # Set up gems listed in the Gemfile.
 ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../../Gemfile', __FILE__)
-require 'bundler/setup' if File.exists?(ENV['BUNDLE_GEMFILE'])
+require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])

data/test/rails_app/config/environments/test.rb

@@ -19,7 +19,12 @@ RailsApp::Application.configure do
   else
     config.serve_static_assets = true
   end
-  config.static_cache_control = "public, max-age=3600"
+
+  if Rails.version >= "5.0.0"
+    config.public_file_server.headers = {'Cache-Control' => 'public, max-age=3600'}
+  else
+    config.static_cache_control = "public, max-age=3600"
+  end
 
   # Show full error reports and disable caching.
   config.consider_all_requests_local       = true

data/test/rails_app/config/initializers/devise.rb

@@ -135,7 +135,7 @@ Devise.setup do |config|
   # reset. Defaults to true, so a user is signed in automatically after a reset.
   # config.sign_in_after_reset_password = true
 
-  # Setup a pepper to generate the encrypted password.
+  # Set up a pepper to generate the encrypted password.
   config.pepper = "d142367154e5beacca404b1a6a4f8bc52c6fdcfa3ccc3cf8eb49f3458a688ee6ac3b9fae488432a3bfca863b8a90008368a9f3a3dfbe5a962e64b6ab8f3a3a1a"
 
   # ==> Scopes configuration

data/test/rails_app/config/initializers/secret_token.rb

@@ -1,8 +1,3 @@
 config = Rails.application.config
 
-if Devise.rails4?
-  config.secret_key_base = 'd588e99efff13a86461fd6ab82327823ad2f8feb5dc217ce652cdd9f0dfc5eb4b5a62a92d24d2574d7d51dfb1ea8dd453ea54e00cf672159a13104a135422a10'
-else
-  config.secret_token = 'ea942c41850d502f2c8283e26bdc57829f471bb18224ddff0a192c4f32cdf6cb5aa0d82b3a7a7adbeb640c4b06f3aa1cd5f098162d8240f669b39d6b49680571'
-  config.session_store :cookie_store, key: "_my_app"
-end
+config.secret_key_base = 'd588e99efff13a86461fd6ab82327823ad2f8feb5dc217ce652cdd9f0dfc5eb4b5a62a92d24d2574d7d51dfb1ea8dd453ea54e00cf672159a13104a135422a10'

data/test/rails_app/config/routes.rb

@@ -28,6 +28,11 @@ Rails.application.routes.draw do
     router_name: :fake_engine,
     module: :devise
 
+  devise_for :user_without_email,
+    class_name: 'UserWithoutEmail',
+    router_name: :main_app,
+    module: :devise
+
   as :user do
     get "/as/sign_in", to: "devise/sessions#new"
   end

data/test/rails_app/lib/shared_user_without_email.rb

@@ -0,0 +1,26 @@
+module SharedUserWithoutEmail
+  extend ActiveSupport::Concern
+
+  included do
+    # NOTE: This is missing :validatable and :confirmable, as they both require
+    # an email field at the moment. It is also missing :omniauthable because that
+    # adds unnecessary complexity to the setup
+    devise :database_authenticatable, :lockable, :recoverable,
+           :registerable, :rememberable, :timeoutable,
+           :trackable
+  end
+
+  # This test stub is a bit rubbish because it's tied very closely to the
+  # implementation where we care about this one case. However, completely
+  # removing the email field breaks "recoverable" tests completely, so we are
+  # just taking the approach here that "email" is something that is a not an
+  # ActiveRecord field.
+  def email_changed?
+    raise NoMethodError
+  end
+
+  def respond_to?(method_name, include_all=false)
+    return false if method_name.to_sym == :email_changed?
+    super(method_name, include_all)
+  end
+end

data/test/routes_test.rb

@@ -1,6 +1,6 @@
 require 'test_helper'
 
-ExpectedRoutingError = Devise.rails4? ? MiniTest::Assertion : ActionController::RoutingError
+ExpectedRoutingError = MiniTest::Assertion
 
 class DefaultRoutingTest < ActionController::TestCase
   test 'map new user session' do
@@ -96,12 +96,12 @@ class DefaultRoutingTest < ActionController::TestCase
   test 'map omniauth callbacks' do
     assert_recognizes({controller: 'users/omniauth_callbacks', action: 'facebook'}, {path: 'users/auth/facebook/callback', method: :get})
     assert_recognizes({controller: 'users/omniauth_callbacks', action: 'facebook'}, {path: 'users/auth/facebook/callback', method: :post})
-    assert_named_route "/users/auth/facebook/callback", :user_omniauth_callback_path, :facebook
+    assert_named_route "/users/auth/facebook/callback", :user_facebook_omniauth_callback_path
 
     # named open_id
     assert_recognizes({controller: 'users/omniauth_callbacks', action: 'google'}, {path: 'users/auth/google/callback', method: :get})
     assert_recognizes({controller: 'users/omniauth_callbacks', action: 'google'}, {path: 'users/auth/google/callback', method: :post})
-    assert_named_route "/users/auth/google/callback", :user_omniauth_callback_path, :google
+    assert_named_route "/users/auth/google/callback", :user_google_omniauth_callback_path
 
     assert_raise ExpectedRoutingError do
       assert_recognizes({controller: 'ysers/omniauth_callbacks', action: 'twitter'}, {path: 'users/auth/twitter/callback', method: :get})
@@ -202,37 +202,52 @@ class CustomizedRoutingTest < ActionController::TestCase
   end
 
   test 'map with format false for sessions' do
-    assert_recognizes({controller: 'devise/sessions', action: 'new'}, {path: '/htmlonly_admin/sign_in', method: :get})
+    expected_params = {controller: 'devise/sessions', action: 'new'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_in', method: :get})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/sessions', action: 'new'}, {path: '/htmlonly_admin/sign_in.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_in.xml', method: :get})
     end
   end
 
   test 'map with format false for passwords' do
-    assert_recognizes({controller: 'devise/passwords', action: 'create'}, {path: '/htmlonly_admin/password', method: :post})
+    expected_params = {controller: 'devise/passwords', action: 'create'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/password', method: :post})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/passwords', action: 'create'}, {path: '/htmlonly_admin/password.xml', method: :post})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/password.xml', method: :post})
     end
   end
 
   test 'map with format false for registrations' do
-    assert_recognizes({controller: 'devise/registrations', action: 'new'}, {path: '/htmlonly_admin/sign_up', method: :get})
+    expected_params = {controller: 'devise/registrations', action: 'new'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_up', method: :get})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/registrations', action: 'new'}, {path: '/htmlonly_admin/sign_up.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_admin/sign_up.xml', method: :get})
     end
   end
 
   test 'map with format false for confirmations' do
-    assert_recognizes({controller: 'devise/confirmations', action: 'show'}, {path: '/htmlonly_users/confirmation', method: :get})
+    expected_params = {controller: 'devise/confirmations', action: 'show'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_users/confirmation', method: :get})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/confirmations', action: 'show'}, {path: '/htmlonly_users/confirmation.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_users/confirmation.xml', method: :get})
     end
   end
 
   test 'map with format false for unlocks' do
-    assert_recognizes({controller: 'devise/unlocks', action: 'show'}, {path: '/htmlonly_users/unlock', method: :get})
+    expected_params = {controller: 'devise/unlocks', action: 'show'}
+    expected_params[:format] = false if Devise.rails5?
+
+    assert_recognizes(expected_params, {path: '/htmlonly_users/unlock', method: :get})
     assert_raise ExpectedRoutingError do
-      assert_recognizes({controller: 'devise/unlocks', action: 'show'}, {path: '/htmlonly_users/unlock.xml', method: :get})
+      assert_recognizes(expected_params, {path: '/htmlonly_users/unlock.xml', method: :get})
     end
   end
 

data/test/support/helpers.rb

@@ -46,6 +46,10 @@ class ActiveSupport::TestCase
     Admin.create!(valid_attributes)
   end
 
+  def create_user_without_email(attributes={})
+    UserWithoutEmail.create!(valid_attributes(attributes))
+  end
+
   # Execute the block setting the given values and restoring old values after
   # the block is executed.
   def swap(object, new_values)

data/test/support/http_method_compatibility.rb

@@ -0,0 +1,51 @@
+module Devise
+  class IntegrationTest < ActionDispatch::IntegrationTest
+    # %w( get post patch put head delete xml_http_request
+    #           xhr get_via_redirect post_via_redirect
+    #         ).each do |method|
+    %w( get post put ).each do |method|
+      if Rails.version >= '5.0.0'
+        define_method(method) do |url, options={}|
+          if options.empty?
+            super url
+          else
+            super url, options
+          end
+        end
+      else
+        define_method(method) do |url, options={}|
+          if options[:xhr]==true
+            xml_http_request  __method__, url, options[:params] || {}, options[:headers]
+          else
+            super url, options[:params] || {}, options[:headers]
+          end
+        end
+      end
+    end
+  end
+
+  class ControllerTestCase < ActionController::TestCase
+    # %w( get post patch put head delete xml_http_request
+    #           xhr get_via_redirect post_via_redirect
+    #         ).each do |method|
+    %w( get post put ).each do |method|
+      if Rails.version >= '5.0.0'
+        define_method(method) do |action, options={}|
+          if options.empty?
+            super action
+          else
+            super action, options
+          end
+        end
+      else
+        define_method(method) do |action, options={}|
+          if options[:xhr]==true
+            xml_http_request  __method__, action, options[:params] || {}, options[:headers]
+          else
+            super action, options[:params] || {}, options[:headers]
+          end
+        end
+      end
+    end
+  end
+end

data/test/support/webrat/integrations/rails.rb

@@ -14,6 +14,15 @@ module Webrat
       ::Rails.logger
     end
   end
+
+  class RailsAdapter
+    protected
+
+    def do_request(http_method, url, data, headers)
+      update_protocol(url)
+      integration_session.send(http_method, normalize_url(url), params: data, headers: headers)
+    end
+  end
 end
 
 module ActionDispatch #:nodoc:

data/test/test_helpers_test.rb

@@ -1,6 +1,6 @@
 require 'test_helper'
 
-class TestHelpersTest < ActionController::TestCase
+class TestHelpersTest < Devise::ControllerTestCase
   tests UsersController
   include Devise::TestHelpers
 
@@ -27,7 +27,7 @@ class TestHelpersTest < ActionController::TestCase
       assert !user.active_for_authentication?
 
       sign_in user
-      get :accept, id: user
+      get :accept, params: { id: user }
       assert_nil assigns(:current_user)
     end
   end
@@ -68,13 +68,13 @@ class TestHelpersTest < ActionController::TestCase
   test "respects custom failure app" do
     custom_failure_app = Class.new(Devise::FailureApp) do
       def redirect
-        self.status = 306
+        self.status = 300
       end
     end
 
     swap Devise.warden_config, failure_app: custom_failure_app do
       get :index
-      assert_response 306
+      assert_response 300
     end
   end
 
@@ -163,7 +163,7 @@ class TestHelpersTest < ActionController::TestCase
 
   test "creates a new warden proxy if the request object has changed" do
     old_warden_proxy = warden
-    @request = ActionController::TestRequest.new
+    @request = Devise.rails5? ? ActionController::TestRequest.create : ActionController::TestRequest.new
     new_warden_proxy = warden
 
     assert_not_equal old_warden_proxy, new_warden_proxy

data/test/test_models.rb

@@ -12,7 +12,7 @@ class UserWithValidation < User
   validates_presence_of :username
 end
 
-class UserWithCustomEncryption < User
+class UserWithCustomHashing < User
   protected
   def password_digest(password)
     password.reverse