devise 3.5.2 → 4.7.1

data/test/integration/registerable_test.rb

@@ -1,359 +0,0 @@
-require 'test_helper'
-
-class RegistrationTest < ActionDispatch::IntegrationTest
-
-  test 'a guest admin should be able to sign in successfully' do
-    get new_admin_session_path
-    click_link 'Sign up'
-
-    assert_template 'registrations/new'
-
-    fill_in 'email', with: 'new_user@test.com'
-    fill_in 'password', with: 'new_user123'
-    fill_in 'password confirmation', with: 'new_user123'
-    click_button 'Sign up'
-
-    assert_contain 'You have signed up successfully'
-    assert warden.authenticated?(:admin)
-    assert_current_url "/admin_area/home"
-
-    admin = Admin.to_adapter.find_first(order: [:id, :desc])
-    assert_equal admin.email, 'new_user@test.com'
-  end
-
-  test 'a guest admin should be able to sign in and be redirected to a custom location' do
-    Devise::RegistrationsController.any_instance.stubs(:after_sign_up_path_for).returns("/?custom=1")
-    get new_admin_session_path
-    click_link 'Sign up'
-
-    fill_in 'email', with: 'new_user@test.com'
-    fill_in 'password', with: 'new_user123'
-    fill_in 'password confirmation', with: 'new_user123'
-    click_button 'Sign up'
-
-    assert_contain 'Welcome! You have signed up successfully.'
-    assert warden.authenticated?(:admin)
-    assert_current_url "/?custom=1"
-  end
-
-  test 'a guest admin should not see a warning about minimum password length' do
-    get new_admin_session_path
-    assert_not_contain 'characters minimum'
-  end
-
-  def user_sign_up
-    ActionMailer::Base.deliveries.clear
-
-    get new_user_registration_path
-
-    fill_in 'email', with: 'new_user@test.com'
-    fill_in 'password', with: 'new_user123'
-    fill_in 'password confirmation', with: 'new_user123'
-    click_button 'Sign up'
-  end
-
-  test 'a guest user should see a warning about minimum password length' do
-    get new_user_registration_path
-    assert_contain '7 characters minimum'
-  end
-
-  test 'a guest user should be able to sign up successfully and be blocked by confirmation' do
-    user_sign_up
-
-    assert_contain 'A message with a confirmation link has been sent to your email address. Please follow the link to activate your account.'
-    assert_not_contain 'You have to confirm your account before continuing'
-    assert_current_url "/"
-
-    assert_not warden.authenticated?(:user)
-
-    user = User.to_adapter.find_first(order: [:id, :desc])
-    assert_equal user.email, 'new_user@test.com'
-    assert_not user.confirmed?
-  end
-
-  test 'a guest user should receive the confirmation instructions from the default mailer' do
-    user_sign_up
-    assert_equal ['please-change-me@config-initializers-devise.com'], ActionMailer::Base.deliveries.first.from
-  end
-
-  test 'a guest user should receive the confirmation instructions from a custom mailer' do
-    User.any_instance.stubs(:devise_mailer).returns(Users::Mailer)
-    user_sign_up
-    assert_equal ['custom@example.com'], ActionMailer::Base.deliveries.first.from
-  end
-
-  test 'a guest user should be blocked by confirmation and redirected to a custom path' do
-    Devise::RegistrationsController.any_instance.stubs(:after_inactive_sign_up_path_for).returns("/?custom=1")
-    get new_user_registration_path
-
-    fill_in 'email', with: 'new_user@test.com'
-    fill_in 'password', with: 'new_user123'
-    fill_in 'password confirmation', with: 'new_user123'
-    click_button 'Sign up'
-
-    assert_current_url "/?custom=1"
-    assert_not warden.authenticated?(:user)
-  end
-
-  test 'a guest user cannot sign up with invalid information' do
-    # Dirty tracking behavior prevents email validations from being applied:
-    #    https://github.com/mongoid/mongoid/issues/756
-    (pending "Fails on Mongoid < 2.1"; break) if defined?(Mongoid) && Mongoid::VERSION.to_f < 2.1
-
-    get new_user_registration_path
-
-    fill_in 'email', with: 'invalid_email'
-    fill_in 'password', with: 'new_user123'
-    fill_in 'password confirmation', with: 'new_user321'
-    click_button 'Sign up'
-
-    assert_template 'registrations/new'
-    assert_have_selector '#error_explanation'
-    assert_contain "Email is invalid"
-    assert_contain Devise.rails4? ?
-      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
-    assert_contain "2 errors prohibited"
-    assert_nil User.to_adapter.find_first
-
-    assert_not warden.authenticated?(:user)
-  end
-
-  test 'a guest should not sign up with email/password that already exists' do
-    # Dirty tracking behavior prevents email validations from being applied:
-    #    https://github.com/mongoid/mongoid/issues/756
-    (pending "Fails on Mongoid < 2.1"; break) if defined?(Mongoid) && Mongoid::VERSION.to_f < 2.1
-
-    create_user
-    get new_user_registration_path
-
-    fill_in 'email', with: 'user@test.com'
-    fill_in 'password', with: '123456'
-    fill_in 'password confirmation', with: '123456'
-    click_button 'Sign up'
-
-    assert_current_url '/users'
-    assert_contain(/Email.*already.*taken/)
-
-    assert_not warden.authenticated?(:user)
-  end
-
-  test 'a guest should not be able to change account' do
-    get edit_user_registration_path
-    assert_redirected_to new_user_session_path
-    follow_redirect!
-    assert_contain 'You need to sign in or sign up before continuing.'
-  end
-
-  test 'a signed in user should not be able to access sign up' do
-    sign_in_as_user
-    get new_user_registration_path
-    assert_redirected_to root_path
-  end
-
-  test 'a signed in user should be able to edit their account' do
-    sign_in_as_user
-    get edit_user_registration_path
-
-    fill_in 'email', with: 'user.new@example.com'
-    fill_in 'current password', with: '12345678'
-    click_button 'Update'
-
-    assert_current_url '/'
-    assert_contain 'Your account has been updated successfully.'
-
-    assert_equal "user.new@example.com", User.to_adapter.find_first.email
-  end
-
-  test 'a signed in user should still be able to use the website after changing their password' do
-    sign_in_as_user
-    get edit_user_registration_path
-
-    fill_in 'password', with: '1234567890'
-    fill_in 'password confirmation', with: '1234567890'
-    fill_in 'current password', with: '12345678'
-    click_button 'Update'
-
-    assert_contain 'Your account has been updated successfully.'
-    get users_path
-    assert warden.authenticated?(:user)
-  end
-
-  test 'a signed in user should not change their current user with invalid password' do
-    sign_in_as_user
-    get edit_user_registration_path
-
-    fill_in 'email', with: 'user.new@example.com'
-    fill_in 'current password', with: 'invalid'
-    click_button 'Update'
-
-    assert_template 'registrations/edit'
-    assert_contain 'user@test.com'
-    assert_have_selector 'form input[value="user.new@example.com"]'
-
-    assert_equal "user@test.com", User.to_adapter.find_first.email
-  end
-
-  test 'a signed in user should be able to edit their password' do
-    sign_in_as_user
-    get edit_user_registration_path
-
-    fill_in 'password', with: 'pass1234'
-    fill_in 'password confirmation', with: 'pass1234'
-    fill_in 'current password', with: '12345678'
-    click_button 'Update'
-
-    assert_current_url '/'
-    assert_contain 'Your account has been updated successfully.'
-
-    assert User.to_adapter.find_first.valid_password?('pass1234')
-  end
-
-  test 'a signed in user should not be able to edit their password with invalid confirmation' do
-    sign_in_as_user
-    get edit_user_registration_path
-
-    fill_in 'password', with: 'pas123'
-    fill_in 'password confirmation', with: ''
-    fill_in 'current password', with: '12345678'
-    click_button 'Update'
-
-    assert_contain Devise.rails4? ?
-      "Password confirmation doesn't match Password" : "Password doesn't match confirmation"
-    assert_not User.to_adapter.find_first.valid_password?('pas123')
-  end
-
-  test 'a signed in user should be able to cancel their account' do
-    sign_in_as_user
-    get edit_user_registration_path
-
-    click_button "Cancel my account"
-    assert_contain "Bye! Your account has been successfully cancelled. We hope to see you again soon."
-
-    assert User.to_adapter.find_all.empty?
-  end
-
-  test 'a user should be able to cancel sign up by deleting data in the session' do
-    get "/set"
-    assert_equal "something", @request.session["devise.foo_bar"]
-
-    get "/users/sign_up"
-    assert_equal "something", @request.session["devise.foo_bar"]
-
-    get "/users/cancel"
-    assert_nil @request.session["devise.foo_bar"]
-    assert_redirected_to new_user_registration_path
-  end
-
-  test 'a user with XML sign up stub' do
-    get new_user_registration_path(format: 'xml')
-    assert_response :success
-    assert_match %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>), response.body
-    assert_no_match(/<confirmation-token/, response.body)
-  end
-
-  test 'a user with JSON sign up stub' do
-    get new_user_registration_path(format: 'json')
-    assert_response :success
-    assert_match %({"user":), response.body
-    assert_no_match(/"confirmation_token"/, response.body)
-  end
-
-  test 'an admin sign up with valid information in XML format should return valid response' do
-    post admin_registration_path(format: 'xml'), admin: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' }
-    assert_response :success
-    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<admin>)
-
-    admin = Admin.to_adapter.find_first(order: [:id, :desc])
-    assert_equal admin.email, 'new_user@test.com'
-  end
-
-  test 'a user sign up with valid information in XML format should return valid response' do
-    post user_registration_path(format: 'xml'), user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'new_user123' }
-    assert_response :success
-    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<user>)
-
-    user = User.to_adapter.find_first(order: [:id, :desc])
-    assert_equal user.email, 'new_user@test.com'
-  end
-
-  test 'a user sign up with invalid information in XML format should return invalid response' do
-    post user_registration_path(format: 'xml'), user: { email: 'new_user@test.com', password: 'new_user123', password_confirmation: 'invalid' }
-    assert_response :unprocessable_entity
-    assert response.body.include? %(<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<errors>)
-  end
-
-  test 'a user update information with valid data in XML format should return valid response' do
-    user = sign_in_as_user
-    put user_registration_path(format: 'xml'), user: { current_password: '12345678', email: 'user.new@test.com' }
-    assert_response :success
-    assert_equal user.reload.email, 'user.new@test.com'
-  end
-
-  test 'a user update information with invalid data in XML format should return invalid response' do
-    user = sign_in_as_user
-    put user_registration_path(format: 'xml'), user: { current_password: 'invalid', email: 'user.new@test.com' }
-    assert_response :unprocessable_entity
-    assert_equal user.reload.email, 'user@test.com'
-  end
-
-  test 'a user cancel their account in XML format should return valid response' do
-    sign_in_as_user
-    delete user_registration_path(format: 'xml')
-    assert_response :success
-    assert_equal User.to_adapter.find_all.size, 0
-  end
-end
-
-class ReconfirmableRegistrationTest < ActionDispatch::IntegrationTest
-  test 'a signed in admin should see a more appropriate flash message when editing their account if reconfirmable is enabled' do
-    sign_in_as_admin
-    get edit_admin_registration_path
-
-    fill_in 'email', with: 'admin.new@example.com'
-    fill_in 'current password', with: '123456'
-    click_button 'Update'
-
-    assert_current_url '/admin_area/home'
-    assert_contain 'but we need to verify your new email address'
-    assert_equal 'admin.new@example.com', Admin.to_adapter.find_first.unconfirmed_email
-
-    get edit_admin_registration_path
-    assert_contain 'Currently waiting confirmation for: admin.new@example.com'
-  end
-
-  test 'a signed in admin should not see a reconfirmation message if they did not change their password' do
-    sign_in_as_admin
-    get edit_admin_registration_path
-
-    fill_in 'password', with: 'pas123'
-    fill_in 'password confirmation', with: 'pas123'
-    fill_in 'current password', with: '123456'
-    click_button 'Update'
-
-    assert_current_url '/admin_area/home'
-    assert_contain 'Your account has been updated successfully.'
-
-    assert Admin.to_adapter.find_first.valid_password?('pas123')
-  end
-
-  test 'a signed in admin should not see a reconfirmation message if they did not change their email, despite having an unconfirmed email' do
-    sign_in_as_admin
-
-    get edit_admin_registration_path
-    fill_in 'email', with: 'admin.new@example.com'
-    fill_in 'current password', with: '123456'
-    click_button 'Update'
-
-    get edit_admin_registration_path
-    fill_in 'password', with: 'pas123'
-    fill_in 'password confirmation', with: 'pas123'
-    fill_in 'current password', with: '123456'
-    click_button 'Update'
-
-    assert_current_url '/admin_area/home'
-    assert_contain 'Your account has been updated successfully.'
-
-    assert_equal "admin.new@example.com", Admin.to_adapter.find_first.unconfirmed_email
-    assert Admin.to_adapter.find_first.valid_password?('pas123')
-  end
-end

data/test/integration/rememberable_test.rb

@@ -1,176 +0,0 @@
-require 'test_helper'
-
-class RememberMeTest < ActionDispatch::IntegrationTest
-  def create_user_and_remember(add_to_token='')
-    user = create_user
-    user.remember_me!
-    raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
-    cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
-    user
-  end
-
-  def generate_signed_cookie(raw_cookie)
-    request = ActionDispatch::TestRequest.new
-    request.cookie_jar.signed['raw_cookie'] = raw_cookie
-    request.cookie_jar['raw_cookie']
-  end
-
-  def signed_cookie(key)
-    controller.send(:cookies).signed[key]
-  end
-
-  def cookie_expires(key)
-    cookie  = response.headers["Set-Cookie"].split("\n").grep(/^#{key}/).first
-    expires = cookie.split(";").map(&:strip).grep(/^expires=/).first
-    Time.parse(expires).utc
-  end
-
-  test 'do not remember the user if they have not checked remember me option' do
-    sign_in_as_user
-    assert_nil request.cookies["remember_user_cookie"]
-  end
-
-  test 'handle unverified requests gets rid of caches' do
-    swap ApplicationController, allow_forgery_protection: true do
-      post exhibit_user_url(1)
-      assert_not warden.authenticated?(:user)
-
-      create_user_and_remember
-      post exhibit_user_url(1)
-      assert_equal "User is not authenticated", response.body
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'handle unverified requests does not create cookies on sign in' do
-    swap ApplicationController, allow_forgery_protection: true do
-      get new_user_session_path
-      assert request.session[:_csrf_token]
-
-      post user_session_path, authenticity_token: "oops", user:
-           { email: "jose.valim@gmail.com", password: "123456", remember_me: "1" }
-      assert_not warden.authenticated?(:user)
-      assert_not request.cookies['remember_user_token']
-    end
-  end
-
-  test 'generate remember token after sign in' do
-    sign_in_as_user remember_me: true
-    assert request.cookies['remember_user_token']
-  end
-
-  test 'generate remember token after sign in setting cookie options' do
-    # We test this by asserting the cookie is not sent after the redirect
-    # since we changed the domain. This is the only difference with the
-    # previous test.
-    swap Devise, rememberable_options: { domain: "omg.somewhere.com" } do
-      sign_in_as_user remember_me: true
-      assert_nil request.cookies["remember_user_token"]
-    end
-  end
-
-  test 'generate remember token with a custom key' do
-    swap Devise, rememberable_options: { key: "v1lat_token" } do
-      sign_in_as_user remember_me: true
-      assert request.cookies["v1lat_token"]
-    end
-  end
-
-  test 'generate remember token after sign in setting session options' do
-    begin
-      Rails.configuration.session_options[:domain] = "omg.somewhere.com"
-      sign_in_as_user remember_me: true
-      assert_nil request.cookies["remember_user_token"]
-    ensure
-      Rails.configuration.session_options.delete(:domain)
-    end
-  end
-
-  test 'remember the user before sign in' do
-    user = create_user_and_remember
-    get users_path
-    assert_response :success
-    assert warden.authenticated?(:user)
-    assert warden.user(:user) == user
-    assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
-  end
-
-  test 'remember the user before sign up and redirect them to their home' do
-    create_user_and_remember
-    get new_user_registration_path
-    assert warden.authenticated?(:user)
-    assert_redirected_to root_path
-  end
-
-  test 'does not extend remember period through sign in' do
-    swap Devise, extend_remember_period: true, remember_for: 1.year do
-      user = create_user
-      user.remember_me!
-
-      user.remember_created_at = old = 10.days.ago
-      user.save
-
-      sign_in_as_user remember_me: true
-      user.reload
-
-      assert warden.user(:user) == user
-      assert_equal old.to_i, user.remember_created_at.to_i
-    end
-  end
-
-  test 'do not remember other scopes' do
-    create_user_and_remember
-    get root_path
-    assert_response :success
-    assert warden.authenticated?(:user)
-    assert_not warden.authenticated?(:admin)
-  end
-
-  test 'do not remember with invalid token' do
-    create_user_and_remember('add')
-    get users_path
-    assert_not warden.authenticated?(:user)
-    assert_redirected_to new_user_session_path
-  end
-
-  test 'do not remember with expired token' do
-    create_user_and_remember
-    swap Devise, remember_for: 0 do
-      get users_path
-      assert_not warden.authenticated?(:user)
-      assert_redirected_to new_user_session_path
-    end
-  end
-
-  test 'do not remember the user anymore after forget' do
-    create_user_and_remember
-    get users_path
-    assert warden.authenticated?(:user)
-
-    get destroy_user_session_path
-    assert_not warden.authenticated?(:user)
-    assert_nil warden.cookies['remember_user_token']
-
-    get users_path
-    assert_not warden.authenticated?(:user)
-  end
-
-  test 'changing user password expires remember me token' do
-    user = create_user_and_remember
-    user.password = "another_password"
-    user.password_confirmation = "another_password"
-    user.save!
-
-    get users_path
-    assert_not warden.authenticated?(:user)
-  end
-
-  test 'valid sign in calls after_remembered callback' do
-    user = create_user_and_remember
-
-    User.expects(:serialize_from_cookie).returns user
-    user.expects :after_remembered
-
-    get new_user_registration_path
-  end
-end

data/test/integration/timeoutable_test.rb

@@ -1,172 +0,0 @@
-require 'test_helper'
-
-class SessionTimeoutTest < ActionDispatch::IntegrationTest
-
-  def last_request_at
-    @controller.user_session['last_request_at']
-  end
-
-  test 'set last request at in user session after each request' do
-    sign_in_as_user
-    assert_not_nil last_request_at
-
-    @controller.user_session.delete('last_request_at')
-    get users_path
-    assert_not_nil last_request_at
-  end
-
-  test 'set last request at in user session after each request is skipped if tracking is disabled' do
-    sign_in_as_user
-    old_last_request = last_request_at
-    assert_not_nil last_request_at
-
-    get users_path, {}, 'devise.skip_trackable' => true
-    assert_equal old_last_request, last_request_at
-  end
-
-  test 'does not time out user session before default limit time' do
-    sign_in_as_user
-    assert_response :success
-    assert warden.authenticated?(:user)
-
-    get users_path
-    assert_response :success
-    assert warden.authenticated?(:user)
-  end
-
-  test 'time out user session after default limit time when sign_out_all_scopes is false' do
-    swap Devise, sign_out_all_scopes: false do
-      sign_in_as_admin
-
-      user = sign_in_as_user
-      get expire_user_path(user)
-      assert_not_nil last_request_at
-
-      get users_path
-      assert_redirected_to users_path
-      assert_not warden.authenticated?(:user)
-      assert warden.authenticated?(:admin)
-    end
-  end
-
-  test 'time out all sessions after default limit time when sign_out_all_scopes is true' do
-    swap Devise, sign_out_all_scopes: true do
-      sign_in_as_admin
-
-      user = sign_in_as_user
-      get expire_user_path(user)
-      assert_not_nil last_request_at
-
-      get root_path
-      assert_not warden.authenticated?(:user)
-      assert_not warden.authenticated?(:admin)
-    end
-  end
-
-  test 'time out user session after deault limit time and redirect to latest get request' do
-    user = sign_in_as_user
-    visit edit_form_user_path(user)
-
-    click_button 'Update'
-    sign_in_as_user
-
-    assert_equal edit_form_user_url(user), current_url
-  end
-
-  test 'time out is not triggered on sign out' do
-    user = sign_in_as_user
-    get expire_user_path(user)
-
-    get destroy_user_session_path
-
-    assert_response :redirect
-    assert_redirected_to root_path
-    follow_redirect!
-    assert_contain 'Signed out successfully'
-  end
-
-  test 'expired session is not extended by sign in page' do
-    user = sign_in_as_user
-    get expire_user_path(user)
-    assert warden.authenticated?(:user)
-
-    get "/users/sign_in"
-    assert_redirected_to "/users/sign_in"
-    follow_redirect!
-
-    assert_response :success
-    assert_contain 'Sign in'
-    assert_not warden.authenticated?(:user)
-  end
-
-  test 'time out is not triggered on sign in' do
-    user = sign_in_as_user
-    get expire_user_path(user)
-
-    post "/users/sign_in", email: user.email, password: "123456"
-
-    assert_response :redirect
-    follow_redirect!
-    assert_contain 'You are signed in'
-  end
-
-  test 'user configured timeout limit' do
-    swap Devise, timeout_in: 8.minutes do
-      user = sign_in_as_user
-
-      get users_path
-      assert_not_nil last_request_at
-      assert_response :success
-      assert warden.authenticated?(:user)
-
-      get expire_user_path(user)
-      get users_path
-      assert_redirected_to users_path
-      assert_not warden.authenticated?(:user)
-    end
-  end
-
-  test 'error message with i18n' do
-    store_translations :en, devise: {
-      failure: { user: { timeout: 'Session expired!' } }
-    } do
-      user = sign_in_as_user
-
-      get expire_user_path(user)
-      get root_path
-      follow_redirect!
-      assert_contain 'Session expired!'
-    end
-  end
-
-  test 'error message with i18n with double redirect' do
-    store_translations :en, devise: {
-      failure: { user: { timeout: 'Session expired!' } }
-    } do
-      user = sign_in_as_user
-
-      get expire_user_path(user)
-      get users_path
-      follow_redirect!
-      follow_redirect!
-      assert_contain 'Session expired!'
-    end
-  end
-
-  test 'time out not triggered if remembered' do
-    user = sign_in_as_user remember_me: true
-    get expire_user_path(user)
-    assert_not_nil last_request_at
-
-    get users_path
-    assert_response :success
-    assert warden.authenticated?(:user)
-  end
-
-  test 'does not crashes when the last_request_at is a String' do
-    user = sign_in_as_user
-
-    get edit_form_user_path(user, last_request_at: Time.now.utc.to_s)
-    get users_path
-  end
-end