devise_invitable 3.0.4 → 3.1.0

data/test/mailers/invitation_mail_test.rb

@@ -55,11 +55,12 @@ class InvitationMailTest < ActionMailer::TestCase
   test 'body should have link to confirm the account' do
     host = ActionMailer::Base.default_url_options[:host]
     body = mail.html_part.body.decoded
-    invitation_url_regexp = %r{<a href=\"http://#{host}/users/invitation/accept\?invitation_token=#{Thread.current[:token]}">}
+    token = Regexp.escape(ERB::Util.url_encode(Thread.current[:token]))
+    invitation_url_regexp = %r{<a href=\"http://#{host}/users/invitation/accept\?invitation_token=#{token}">}
     assert_match invitation_url_regexp, body
 
     body = mail.text_part.body.decoded
-    invitation_url_regexp = %r{http://#{host}/users/invitation/accept\?invitation_token=#{Thread.current[:token]}}
+    invitation_url_regexp = %r{http://#{host}/users/invitation/accept\?invitation_token=#{token}}
     assert_match invitation_url_regexp, body
   end
 
@@ -68,11 +69,12 @@ class InvitationMailTest < ActionMailer::TestCase
     user
     @user = User.find(user.id).invite!
     body = mail.html_part.body.decoded
-    invitation_url_regexp = %r{<a href=\"http://#{host}/users/invitation/accept\?invitation_token=#{Thread.current[:token]}">}
+    token = Regexp.escape(ERB::Util.url_encode(Thread.current[:token]))
+    invitation_url_regexp = %r{<a href=\"http://#{host}/users/invitation/accept\?invitation_token=#{token}">}
     assert_match invitation_url_regexp, body
 
     body = mail.text_part.body.decoded
-    invitation_url_regexp = %r{http://#{host}/users/invitation/accept\?invitation_token=#{Thread.current[:token]}}
+    invitation_url_regexp = %r{http://#{host}/users/invitation/accept\?invitation_token=#{token}}
     assert_match invitation_url_regexp, body
   end
 
@@ -105,6 +107,8 @@ class InvitationMailTest < ActionMailer::TestCase
     end
     Devise.mailer = 'InvitationMailTest::CustomMailer'
 
-    User.invite!({ email: 'valid@email.com' }, nil, { invited_at: Time.now })
+    assert_nothing_raised do
+      User.invite!({ email: 'valid@email.com' }, nil, { invited_at: Time.now })
+    end
   end
 end

data/test/models/invitable_test.rb

@@ -27,13 +27,13 @@ class InvitableTest < ActiveSupport::TestCase
   end
 
   test 'should update the invitations count counter cache' do
-    if defined?(ActiveRecord)
-      current_user = new_user
-      2.times do |index|
-        User.invite!({ email: "valid#{index}@email.com" }, current_user)
-      end
-      assert_equal current_user.reload.invitations_count, 2
+    skip unless defined?(ActiveRecord)
+
+    current_user = new_user
+    2.times do |index|
+      User.invite!({ email: "valid#{index}@email.com" }, current_user)
     end
+    assert_equal current_user.reload.invitations_count, 2
   end
 
   test 'should not generate the raw invitation token after creating a record' do
@@ -92,7 +92,61 @@ class InvitableTest < ActiveSupport::TestCase
     # stub the generator so the tokens are the same
     Devise.token_generator.stubs(:generate).returns([raw, enc])
     user.invite!
-    assert_equal user.raw_invitation_token, raw
+    payload = DeviseInvitable::AcceptanceToken.decode(user.raw_invitation_token)
+
+    refute_includes user.raw_invitation_token, user.email
+    assert_equal raw, payload[:raw_token]
+    assert_equal({ 'email' => user.email }, payload[:invite_key].to_h.stringify_keys)
+  end
+
+  test 'should reject a tampered encrypted invitation token' do
+    user = User.invite!(email: 'valid@email.com')
+    token = user.raw_invitation_token.dup
+    token[-1] = token[-1] == 'a' ? 'b' : 'a'
+
+    invited_user = User.accept_invitation!(invitation_token: token)
+
+    assert_equal [{ error: :invalid }], invited_user.errors.details[:invitation_token]
+    assert_predicate user.reload.current_invitation, :pending?
+  end
+
+  test 'should accept a legacy raw token with plaintext invite keys' do
+    raw, encrypted = Devise.token_generator.generate(DeviseInvitable::Invitation, :invitation_token)
+    invitation = DeviseInvitable::Invitation.create!(
+      invitable_type: 'User',
+      invitation_token: encrypted,
+      invitation_created_at: Time.now.utc,
+      invitation_sent_at: Time.now.utc,
+      invite_key: { email: 'legacy@email.com' }
+    )
+
+    invited_user = User.accept_invitation!(
+      invitation_token: raw,
+      password: '123456789',
+      password_confirmation: '123456789'
+    )
+
+    assert_predicate invited_user, :persisted?
+    assert_equal 'legacy@email.com', invited_user.email
+    assert_equal invited_user, invitation.reload.invitable
+  end
+
+  test 'should restore placeholder invite keys from the encrypted token' do
+    user = User.invite!(email: 'private@email.com', skip_invitation: true)
+    acceptance_token = user.raw_invitation_token
+    invitation = user.current_invitation
+    invite_key_digest = invitation.invite_key_digest
+    user.update_attribute(:email, nil)
+
+    invited_user = User.accept_invitation!(
+      invitation_token: acceptance_token,
+      password: '123456789',
+      password_confirmation: '123456789'
+    )
+
+    assert_equal 'private@email.com', invited_user.email
+    assert_empty invitation.reload.invite_key
+    assert_equal invite_key_digest, invitation.invite_key_digest
   end
 
   test 'should set invitation created and sent at each time' do

data/test/models/separate_invitations_test.rb

@@ -4,11 +4,15 @@ require 'model_tests_helper'
 class SeparateInvitationsTest < ActiveSupport::TestCase
   setup do
     @create_resource_on_invitation = User.create_resource_on_invitation
+    @store_invite_keys_until_delivery = User.store_invite_keys_until_delivery
+    @supersede_other_invitations_on_accept = User.supersede_other_invitations_on_accept
     DeviseInvitable::Invitation.delete_all
   end
 
   teardown do
     User.create_resource_on_invitation = @create_resource_on_invitation
+    User.store_invite_keys_until_delivery = @store_invite_keys_until_delivery
+    User.supersede_other_invitations_on_accept = @supersede_other_invitations_on_accept
   end
 
   test 'an invitation can be persisted without creating a resource' do
@@ -20,7 +24,9 @@ class SeparateInvitationsTest < ActiveSupport::TestCase
 
     assert_predicate invited, :new_record?
     assert_equal 0, User.where(email: 'deferred@example.com').count
-    assert_equal({ 'email' => 'deferred@example.com' }, invitation.invite_key.to_h.stringify_keys)
+    assert_empty invitation.invite_key
+    payload = DeviseInvitable::AcceptanceToken.decode(invited.raw_invitation_token)
+    assert_equal({ 'email' => 'deferred@example.com' }, payload[:invite_key].to_h.stringify_keys)
     assert_nil invitation.invitable_id
     assert_nil invitation.resource_created_at
     assert_includes User.no_active_invitation, registered
@@ -28,18 +34,21 @@ class SeparateInvitationsTest < ActiveSupport::TestCase
 
   test 'an unsent resource-less invitation can be delivered later' do
     User.create_resource_on_invitation = false
+    User.store_invite_keys_until_delivery = true
     User.stubs(:invite_for).returns(1.day)
 
     invited = User.invite!(email: 'deferred@example.com', skip_invitation: true)
-    invitation = invited.current_invitation
+    invitation = DeviseInvitable::Invitation.find(invited.current_invitation.id)
     invitation.update!(invitation_created_at: 2.days.ago)
 
     assert_nil invitation.invitation_sent_at
+    assert_equal({ 'email' => 'deferred@example.com' }, invitation.invite_key.to_h.stringify_keys)
     assert_difference('ActionMailer::Base.deliveries.size', 1) do
       invitation.reload.deliver
     end
 
     assert_predicate invitation.reload, :invitation_sent_at
+    assert_empty invitation.invite_key
     assert invitation.invitation_period_valid?(1.day)
     assert_equal ['deferred@example.com'], ActionMailer::Base.deliveries.last.to
 
@@ -64,12 +73,30 @@ class SeparateInvitationsTest < ActiveSupport::TestCase
 
   test 'a failed later delivery remains unsent and can be retried' do
     User.create_resource_on_invitation = false
+    User.store_invite_keys_until_delivery = true
     invited = User.invite!(email: 'retry@example.com', skip_invitation: true)
-    invitation = invited.current_invitation.reload
+    invitation = DeviseInvitable::Invitation.find(invited.current_invitation.id)
     User.any_instance.stubs(:send_devise_notification).raises('delivery failed')
 
     assert_raises(RuntimeError) { invitation.deliver }
     assert_nil invitation.reload.invitation_sent_at
+    assert_equal({ 'email' => 'retry@example.com' }, invitation.invite_key.to_h.stringify_keys)
+  end
+
+  test 'the sent timestamp is available while rendering but saved after delivery' do
+    User.create_resource_on_invitation = false
+    User.store_invite_keys_until_delivery = true
+    invited = User.invite!(email: 'timestamp@example.com', skip_invitation: true)
+    invitation = DeviseInvitable::Invitation.find(invited.current_invitation.id)
+
+    User.any_instance.stubs(:send_devise_notification).with do
+      assert_predicate invitation, :invitation_sent_at
+      assert_nil DeviseInvitable::Invitation.find(invitation.id).invitation_sent_at
+      true
+    end.returns(:delivery)
+
+    assert_equal :delivery, invitation.deliver
+    assert_predicate invitation.reload, :invitation_sent_at
   end
 
   test 'accepting one of multiple invitations creates the resource and supersedes the others' do
@@ -97,6 +124,120 @@ class SeparateInvitationsTest < ActiveSupport::TestCase
     assert_equal user, first.invitable
   end
 
+  test 'multiple invitations can be accepted independently without changing the password' do
+    User.create_resource_on_invitation = false
+    User.supersede_other_invitations_on_accept = false
+
+    first_invited = User.invite!(
+      { email: 'multiple@example.com' },
+      nil,
+      invitation_data: { organization_id: 1 }
+    )
+    first_token = first_invited.raw_invitation_token
+    first = DeviseInvitable::Invitation.last
+    second_invited = User.invite!(
+      { email: 'multiple@example.com' },
+      nil,
+      invitation_data: { organization_id: 2 }
+    )
+    second_token = second_invited.raw_invitation_token
+    second = DeviseInvitable::Invitation.last
+
+    user = User.accept_invitation!(
+      invitation_token: first_token,
+      password: '123456789',
+      password_confirmation: '123456789'
+    )
+
+    assert_predicate first.reload, :provisioning?
+    refute_predicate first, :pending?
+    assert_predicate second.reload, :pending?
+    assert_equal user, second.invitable
+    assert_nil second.superseded_at
+    refute_nil second.invitation_token
+
+    found_user = User.find_by_invitation_token(second_token, true)
+    assert_equal({ 'organization_id' => 2 }, found_user.current_invitation.invitation_data.to_h.stringify_keys)
+    encrypted_password = user.encrypted_password
+
+    accepted_again = User.accept_invitation!(
+      invitation_token: second_token,
+      password: 'different-password',
+      password_confirmation: 'different-password'
+    )
+
+    assert_equal user, accepted_again
+    assert_equal encrypted_password, accepted_again.reload.encrypted_password
+    assert accepted_again.valid_password?('123456789')
+    refute accepted_again.valid_password?('different-password')
+    refute_predicate second.reload, :pending?
+    assert_nil second.resource_created_at
+  end
+
+  test 'accepting a later placeholder invitation transfers provisioning to it' do
+    User.create_resource_on_invitation = true
+    User.supersede_other_invitations_on_accept = false
+
+    user = User.invite!(email: 'placeholder@example.com')
+    first = user.current_invitation
+    User.invite!(email: 'placeholder@example.com')
+    second = DeviseInvitable::Invitation.last
+    second_token = Thread.current[:token]
+
+    accepted_user = User.accept_invitation!(
+      invitation_token: second_token,
+      password: '123456789',
+      password_confirmation: '123456789'
+    )
+
+    refute_predicate accepted_user, :invitation_pending?
+    assert_predicate second.reload, :provisioning?
+    refute_predicate second, :pending?
+    assert_predicate first.reload, :pending?
+    refute_predicate first, :provisioning?
+    assert_equal accepted_user, first.invitable
+  end
+
+  test 'invitation data is encrypted into the acceptance token but not persisted' do
+    User.create_resource_on_invitation = false
+
+    invited = User.invite!(
+      { email: 'context@example.com' },
+      nil,
+      invitation_data: { organization_id: 42, role: 'member' }
+    )
+    invitation = invited.current_invitation
+    expected_data = { 'organization_id' => 42, 'role' => 'member' }
+
+    assert_equal expected_data, invited.invitation_data_before_creation.to_h.stringify_keys
+    assert_nil DeviseInvitable::Invitation.find(invitation.id).invitation_data
+
+    found_user = User.find_by_invitation_token(invited.raw_invitation_token, true)
+
+    assert_equal expected_data, found_user.current_invitation.invitation_data.to_h.stringify_keys
+
+    accepted_user = User.accept_invitation!(
+      invitation_token: invited.raw_invitation_token,
+      password: '123456789',
+      password_confirmation: '123456789'
+    )
+
+    assert_equal expected_data, accepted_user.invitation_data_after_acceptance.to_h.stringify_keys
+  end
+
+  test 'invitation data has a bounded serialized size' do
+    error = assert_raises DeviseInvitable::InvitationDataTooLargeError do
+      User.invite!(
+        { email: 'context@example.com' },
+        nil,
+        invitation_data: { value: 'x' * 1_024 }
+      )
+    end
+
+    assert_includes error.message, '1024 serialized bytes'
+    assert_equal 0, DeviseInvitable::Invitation.count
+  end
+
   test 'resending stages the new inviter without changing the previous invitation' do
     User.create_resource_on_invitation = true
     first_inviter = User.create!(email: 'first@example.com', password: '123456789')

data/test/models_test.rb

@@ -36,6 +36,23 @@ class ModelsTest < ActiveSupport::TestCase
     assert_equal false, Devise.create_resource_on_invitation
   end
 
+  test 'does not store invite keys until delivery by default' do
+    assert_equal false, Devise.store_invite_keys_until_delivery
+  end
+
+  test 'does not deliver invitations later by default' do
+    assert_equal false, Devise.deliver_invitation_later
+  end
+
+  test 'uses the default invitation delivery job and queue' do
+    assert_equal 'DeviseInvitable::InvitationDeliveryJob', Devise.invitation_delivery_job
+    assert_equal :mailers, Devise.invitation_delivery_queue_name
+  end
+
+  test 'supersedes other invitations on acceptance by default' do
+    assert_equal true, Devise.supersede_other_invitations_on_accept
+  end
+
   test 'should have a default value for invite_key' do
     assert !User.invite_key.nil?
   end

data/test/rails_app/app/models/user.rb

@@ -32,7 +32,8 @@ class User < PARENT_MODEL_CLASS
     create_resource_on_invitation: true
 
   attr_accessor :before_invitation_created_callback_works, :after_invitation_created_callback_works,
-    :after_invitation_accepted_callback_works, :bio, :token
+    :after_invitation_accepted_callback_works, :bio, :invitation_data_after_acceptance,
+    :invitation_data_before_creation, :token
   validates :username, length: { maximum: 20 }
 
   attr_accessor :testing_accepted_or_not_invited
@@ -50,10 +51,12 @@ class User < PARENT_MODEL_CLASS
 
   before_invitation_created do |object|
     object.before_invitation_created_callback_works = true
+    object.invitation_data_before_creation = object.current_invitation.invitation_data
   end
 
   after_invitation_accepted do |object|
     object.after_invitation_accepted_callback_works = true
+    object.invitation_data_after_acceptance = object.current_invitation.invitation_data
   end
 
   def send_devise_notification(method, raw = nil, *args)

data/test/rails_app/db/migrate/20261103170000_add_options_to_users.rb

@@ -0,0 +1,5 @@
+class AddOptionsToUsers < ActiveRecord::Migration[7.0]
+  def change
+    add_column :users, :options, :json
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: devise_invitable
 version: !ruby/object:Gem::Version
-  version: 3.0.4
+  version: 3.1.0
 platform: ruby
 authors:
 - Sergio Cambra
@@ -94,8 +94,11 @@ files:
 - config/locales/zh-HK.yml
 - config/locales/zh-TW.yml
 - lib/devise_invitable.rb
+- lib/devise_invitable/acceptance_token.rb
 - lib/devise_invitable/controllers/helpers.rb
 - lib/devise_invitable/invitation.rb
+- lib/devise_invitable/invitation_delivery.rb
+- lib/devise_invitable/invitation_delivery_job.rb
 - lib/devise_invitable/inviter.rb
 - lib/devise_invitable/mailer.rb
 - lib/devise_invitable/mapping.rb
@@ -126,6 +129,8 @@ files:
 - test/integration/invitation_remove_test.rb
 - test/integration/invitation_test.rb
 - test/integration_tests_helper.rb
+- test/jobs/invitation_delivery_job_test.rb
+- test/lazy_loading_test.rb
 - test/mailers/invitation_mail_test.rb
 - test/mailers/parent_mailer_test.rb
 - test/model_tests_helper.rb
@@ -174,6 +179,7 @@ files:
 - test/rails_app/config/master.key
 - test/rails_app/config/routes.rb
 - test/rails_app/db/migrate/20100401102949_create_tables.rb
+- test/rails_app/db/migrate/20261103170000_add_options_to_users.rb
 - test/rails_app/mongoid.yml
 - test/rails_app/script/rails
 - test/routes_test.rb
@@ -210,6 +216,8 @@ test_files:
 - test/integration/invitation_remove_test.rb
 - test/integration/invitation_test.rb
 - test/integration_tests_helper.rb
+- test/jobs/invitation_delivery_job_test.rb
+- test/lazy_loading_test.rb
 - test/mailers/invitation_mail_test.rb
 - test/mailers/parent_mailer_test.rb
 - test/model_tests_helper.rb
@@ -258,6 +266,7 @@ test_files:
 - test/rails_app/config/master.key
 - test/rails_app/config/routes.rb
 - test/rails_app/db/migrate/20100401102949_create_tables.rb
+- test/rails_app/db/migrate/20261103170000_add_options_to_users.rb
 - test/rails_app/mongoid.yml
 - test/rails_app/script/rails
 - test/routes_test.rb