devise_jwt_auth 0.1.7 → 0.3.0

data/test/controllers/demo_user_controller_test.rb

@@ -15,25 +15,13 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
       before do
         @resource = create(:user, :confirmed)
         @auth_headers = @resource.create_named_token_pair
-
-        # @token     = @auth_headers['access-token']
-        # @client_id = @auth_headers['client']
-        # @expiry    = @auth_headers['expiry']
       end
 
       describe 'successful request' do
         before do
-          # ensure that request is not treated as batch request
-          # age_token(@resource, @client_id)
-
           get '/demo/members_only',
               params: {},
               headers: @auth_headers
-
-          # @resp_token       = response.headers['access-token']
-          # @resp_client_id   = response.headers['client']
-          # @resp_expiry      = response.headers['expiry']
-          # @resp_uid         = response.headers['uid']
         end
 
         describe 'devise mappings' do
@@ -57,42 +45,6 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
         it 'should return success status' do
           assert_equal 200, response.status
         end
-
-        #         it 'should receive new token after successful request' do
-        #           refute_equal @token, @resp_token
-        #         end
-        #
-        #         it 'should preserve the client id from the first request' do
-        #           assert_equal @client_id, @resp_client_id
-        #         end
-        #
-        #         it "should return the user's uid in the auth header" do
-        #           assert_equal @resource.uid, @resp_uid
-        #         end
-        #
-        #         it 'should not treat this request as a batch request' do
-        #           refute assigns(:is_batch_request)
-        #         end
-        #
-        #         describe 'subsequent requests' do
-        #           before do
-        #             @resource.reload
-        #             # ensure that request is not treated as batch request
-        #             # age_token(@resource, @client_id)
-        #
-        #             get '/demo/members_only',
-        #                 params: {},
-        #                 headers: @auth_headers.merge('access-token' => @resp_token)
-        #           end
-        #
-        #           it 'should not treat this request as a batch request' do
-        #             refute assigns(:is_batch_request)
-        #           end
-        #
-        #           it 'should allow a new request to be made using new token' do
-        #             assert_equal 200, response.status
-        #           end
-        #         end
       end
 
       describe 'failed request' do
@@ -110,214 +62,13 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
           assert_equal 401, response.status
         end
       end
-      #       describe 'disable change_headers_on_each_request' do
-      #         before do
-      #           DeviseJwtAuth.change_headers_on_each_request = false
-      #           @resource.reload
-      #           # age_token(@resource, @client_id)
-      #
-      #           get '/demo/members_only',
-      #               params: {},
-      #               headers: @auth_headers
-      #
-      #           @first_is_batch_request = assigns(:is_batch_request)
-      #           @first_user = assigns(:resource).dup
-      #           @first_access_token = response.headers['access-token']
-      #           @first_response_status = response.status
-      #
-      #           @resource.reload
-      #           # age_token(@resource, @client_id)
-      #
-      #           # use expired auth header
-      #           get '/demo/members_only',
-      #               params: {},
-      #               headers: @auth_headers
-      #
-      #           @second_is_batch_request = assigns(:is_batch_request)
-      #           @second_user = assigns(:resource).dup
-      #           @second_access_token = response.headers['access-token']
-      #           @second_response_status = response.status
-      #         end
-      #
-      #         after do
-      #           DeviseJwtAuth.change_headers_on_each_request = true
-      #         end
-      #
-      #         it 'should allow the first request through' do
-      #           assert_equal 200, @first_response_status
-      #         end
-      #
-      #         it 'should allow the second request through' do
-      #           assert_equal 200, @second_response_status
-      #         end
-      #
-      #         it 'should return auth headers from the first request' do
-      #           assert @first_access_token
-      #         end
-      #
-      #         it 'should not treat either requests as batch requests' do
-      #           refute @first_is_batch_request
-      #           refute @second_is_batch_request
-      #         end
-      #
-      #         it 'should return auth headers from the second request' do
-      #           assert @second_access_token
-      #         end
-      #
-      #         it 'should define user during first request' do
-      #           assert @first_user
-      #         end
-      #
-      #         it 'should define user during second request' do
-      #           assert @second_user
-      #         end
-      #       end
-      #
-      #       describe 'batch requests' do
-      #         describe 'success' do
-      #           before do
-      #             # age_token(@resource, @client_id)
-      #
-      #             get '/demo/members_only',
-      #                 params: {},
-      #                 headers: @auth_headers
-      #
-      #             @first_is_batch_request = assigns(:is_batch_request)
-      #             @first_user = assigns(:resource)
-      #             @first_access_token = response.headers['access-token']
-      #
-      #             get '/demo/members_only',
-      #                 params: {},
-      #                 headers: @auth_headers
-      #
-      #             @second_is_batch_request = assigns(:is_batch_request)
-      #             @second_user = assigns(:resource)
-      #             @second_access_token = response.headers['access-token']
-      #           end
-      #
-      #           it 'should allow both requests through' do
-      #             assert_equal 200, response.status
-      #           end
-      #
-      #           it 'should not treat the first request as a batch request' do
-      #             refute @first_is_batch_request
-      #           end
-      #
-      #           it 'should treat the second request as a batch request' do
-      #             assert @second_is_batch_request
-      #           end
-      #
-      #           it 'should return access token for first (non-batch) request' do
-      #             assert @first_access_token
-      #           end
-      #
-      #           it 'should not return auth headers for second (batched) requests' do
-      #             assert_equal ' ', @second_access_token
-      #           end
-      #         end
-      #
-      #         describe 'unbatch' do
-      #           before do
-      #             @resource.reload
-      #             # age_token(@resource, @client_id)
-      #
-      #             get '/demo/members_only',
-      #                 params: {},
-      #                 headers: @auth_headers
-      #
-      #             @first_is_batch_request = assigns(:is_batch_request)
-      #             @first_user = assigns(:resource).dup
-      #             @first_access_token = response.headers['access-token']
-      #             @first_response_status = response.status
-      #
-      #             get '/demo/members_only?unbatch=true',
-      #                 params: {},
-      #                 headers: @auth_headers
-      #
-      #             @second_is_batch_request = assigns(:is_batch_request)
-      #             @second_user = assigns(:resource)
-      #             @second_access_token = response.headers['access-token']
-      #             @second_response_status = response.status
-      #           end
-      #
-      #           it 'should NOT treat the second request as a batch request when "unbatch" param is set' do
-      #             refute @second_is_batch_request
-      #           end
-      #         end
-      #
-      #         describe 'time out' do
-      #           before do
-      #             @resource.reload
-      #             # age_token(@resource, @client_id)
-      #
-      #             get '/demo/members_only',
-      #                 params: {},
-      #                 headers: @auth_headers
-      #
-      #             @first_is_batch_request = assigns(:is_batch_request)
-      #             @first_user = assigns(:resource).dup
-      #             @first_access_token = response.headers['access-token']
-      #             @first_response_status = response.status
-      #
-      #             @resource.reload
-      #             # age_token(@resource, @client_id)
-      #
-      #             # use expired auth header
-      #             get '/demo/members_only',
-      #                 params: {},
-      #                 headers: @auth_headers
-      #
-      #             @second_is_batch_request = assigns(:is_batch_request)
-      #             @second_user = assigns(:resource)
-      #             @second_access_token = response.headers['access-token']
-      #             @second_response_status = response.status
-      #           end
-      #
-      #           it 'should allow the first request through' do
-      #             assert_equal 200, @first_response_status
-      #           end
-      #
-      #           it 'should not allow the second request through' do
-      #             assert_equal 401, @second_response_status
-      #           end
-      #
-      #           it 'should not treat first request as batch request' do
-      #             refute @second_is_batch_request
-      #           end
-      #
-      #           it 'should return auth headers from the first request' do
-      #             assert @first_access_token
-      #           end
-      #
-      #           it 'should not treat second request as batch request' do
-      #             refute @second_is_batch_request
-      #           end
-      #
-      #           it 'should not return auth headers from the second request' do
-      #             refute @second_access_token
-      #           end
-      #
-      #           it 'should define user during first request' do
-      #             assert @first_user
-      #           end
-      #
-      #           it 'should not define user during second request' do
-      #             refute @second_user
-      #           end
-      #         end
-      #       end
 
       describe 'successful password change' do
         before do
-          # DeviseJwtAuth.remove_tokens_after_password_reset = true
-
           # adding one more token to simulate another logged in device
           @old_auth_headers = @auth_headers
           @auth_headers = @resource.create_named_token_pair
 
-          # age_token(@resource, @client_id)
-          # assert @resource.tokens.count > 1
-
           # password changed from new device
           @resource.update(password: 'newsecret123',
                            password_confirmation: 'newsecret123')
@@ -327,14 +78,6 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
               headers: @auth_headers
         end
 
-        after do
-          # DeviseJwtAuth.remove_tokens_after_password_reset = false
-        end
-
-        # it 'should have only one token' do
-        #   assert_equal 1, @resource.tokens.count
-        # end
-
         it 'new request should be successful' do
           assert 200, response.status
         end
@@ -349,132 +92,34 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
         end
       end
 
-      #       describe 'request including destroy of token' do
-      #         describe 'when change_headers_on_each_request is set to false' do
-      #           before do
-      #             DeviseJwtAuth.change_headers_on_each_request = false
-      #             # age_token(@resource, @client_id)
-      #
-      #             get '/demo/members_only_remove_token',
-      #                 params: {},
-      #                 headers: @auth_headers
-      #           end
-      #
-      #           after do
-      #             DeviseJwtAuth.change_headers_on_each_request = true
-      #           end
-      #
-      #           it 'should not return auth-headers' do
-      #             refute response.headers['access-token']
-      #           end
-      #         end
-      #
-      #         describe 'when change_headers_on_each_request is set to true' do
-      #           before do
-      #             # age_token(@resource, @client_id)
-      #             get '/demo/members_only_remove_token',
-      #                 params: {},
-      #                 headers: @auth_headers
-      #           end
-      #
-      #           it 'should not return auth-headers' do
-      #             refute response.headers['access-token']
-      #           end
-      #         end
-      #       end
-
       describe 'when access-token name has been changed' do
         before do
-          # ensure that request is not treated as batch request
-          # DeviseJwtAuth.headers_names[:'access-token'] = 'new-access-token'
           DeviseJwtAuth.access_token_name = 'new-access-token'
 
           auth_headers_modified = @resource.create_named_token_pair
 
-          # client_id = auth_headers_modified['client']
-          # age_token(@resource, client_id)
-
           get '/demo/members_only',
               params: {},
               headers: auth_headers_modified
 
-          # @resp_token = response.headers['new-access-token']
           # TODO: do we want to send access-tokens with every response?
           @data = JSON.parse(response.body)
         end
-        #         it 'should have "new-access-token" in reponse' do
-        #           # assert @resp_token.present?
-        #           # assert @data['new-access-token']
-        #         end
+
         after do
-          # DeviseJwtAuth.headers_names[:'access-token'] = 'access-token'
           DeviseJwtAuth.access_token_name = 'access-token'
         end
       end
-
-      #       describe 'maximum concurrent devices per user' do
-      #         before do
-      #           # Set the max_number_of_devices to a lower number
-      #           #  to expedite tests! (Default is 10)
-      #           DeviseJwtAuth.max_number_of_devices = 5
-      #         end
-      #
-      #         it 'should limit the maximum number of concurrent devices' do
-      #           # increment the number of devices until the maximum is exceeded
-      #           1.upto(DeviseJwtAuth.max_number_of_devices + 1).each do |n|
-      #
-      #             assert_equal(
-      #               [n, DeviseJwtAuth.max_number_of_devices].min,
-      #               @resource.reload.tokens.length
-      #             )
-      #
-      #             # Add a new device (and token) ahead of the next iteration
-      #             # @resource.create_new_auth_token
-      #             create_token_header(@resource)
-      #           end
-      #         end
-      #
-      #         it 'should drop the oldest token when the maximum number of devices is exceeded' do
-      #           # create the maximum number of tokens
-      #           1.upto(DeviseJwtAuth.max_number_of_devices).each do
-      #             # @resource.create_new_auth_token
-      #             create_token_header(@resource)
-      #           end
-      #
-      #           # get the oldest token client_id
-      #           oldest_client_id, = @resource.reload.tokens.min_by do |cid, v|
-      #             v[:expiry] || v['expiry']
-      #           end # => [ 'CLIENT_ID', {token: ...} ]
-      #
-      #           # create another token, thereby dropping the oldest token
-      #           # @resource.create_new_auth_token
-      #           create_token_header(@resource)
-      #
-      #           assert_not_includes @resource.reload.tokens.keys, oldest_client_id
-      #         end
-      #
-      #         after do
-      #           DeviseJwtAuth.max_number_of_devices = 10
-      #         end
-      #       end
     end
 
     describe 'bypass_sign_in' do
       before do
         @resource = create(:user)
         @auth_headers = @resource.create_named_token_pair
-
-        # @token     = @auth_headers['access-token']
-        # @client_id = @auth_headers['client']
-        # @expiry    = @auth_headers['expiry']
       end
       describe 'is default value (true)' do
         before do
-          # age_token(@resource, @client_id)
-
           get '/demo/members_only', params: {}, headers: @auth_headers
-
-          # @access_token = response.headers['access-token']
           @response_status = response.status
         end
 
@@ -482,10 +127,6 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
           assert_equal 200, @response_status
         end
 
-        # it 'should return auth headers' do
-        #   assert @access_token
-        # end
-
         it 'should set current user' do
           assert_equal @controller.current_user, @resource
         end
@@ -493,7 +134,6 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
       describe 'is false' do
         before do
           DeviseJwtAuth.bypass_sign_in = false
-          # age_token(@resource, @client_id)
 
           get '/demo/members_only', params: {}, headers: @auth_headers
 
@@ -530,11 +170,6 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
           get '/demo/members_only',
               params: {},
               headers: nil
-
-          # @resp_token       = response.headers['access-token']
-          # @resp_client_id   = response.headers['client']
-          # @resp_expiry      = response.headers['expiry']
-          # @resp_uid         = response.headers['uid']
         end
 
         describe 'devise mappings' do
@@ -554,22 +189,6 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
         it 'should return success status' do
           assert_equal 200, response.status
         end
-
-        #         it 'should receive new token after successful request' do
-        #           assert @resp_token
-        #         end
-        #
-        #         it 'should set the token expiry in the auth header' do
-        #           assert @resp_expiry
-        #         end
-        #
-        #         it 'should return the client id in the auth header' do
-        #           assert @resp_client_id
-        #         end
-        #
-        #         it "should return the user's uid in the auth header" do
-        #           assert @resp_uid
-        #         end
       end
 
       describe 'existing Warden authentication with ignored token data' do
@@ -580,11 +199,6 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
           get '/demo/members_only',
               params: {},
               headers: @auth_headers
-
-          # @resp_token       = response.headers['access-token']
-          # @resp_client_id   = response.headers['client']
-          # @resp_expiry      = response.headers['expiry']
-          # @resp_uid         = response.headers['uid']
         end
 
         describe 'devise mappings' do
@@ -604,30 +218,6 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
         it 'should return success status' do
           assert_equal 200, response.status
         end
-
-        #         it 'should receive new token after successful request' do
-        #           assert @resp_token
-        #         end
-        #
-        #         it 'should set the token expiry in the auth header' do
-        #           assert @resp_expiry
-        #         end
-        #
-        #         it 'should return the client id in the auth header' do
-        #           assert @resp_client_id
-        #         end
-        #
-        #         it "should not use the existing token's client" do
-        #           refute_equal @auth_headers['client'], @resp_client_id
-        #         end
-        #
-        #         it "should return the user's uid in the auth header" do
-        #           assert @resp_uid
-        #         end
-        #
-        #         it "should not return the token user's uid in the auth header" do
-        #           refute_equal @resp_uid, @auth_headers['uid']
-        #         end
       end
     end
   end

data/test/controllers/devise_jwt_auth/confirmations_controller_test.rb

@@ -11,7 +11,7 @@ require 'test_helper'
 class DeviseJwtAuth::ConfirmationsControllerTest < ActionController::TestCase
   describe DeviseJwtAuth::ConfirmationsController do
     def token_and_client_config_from(body)
-      token         = body.match(/confirmation_token=([^&]*)&/)[1]
+      token         = body.match(/confirmation_token=([^&]*)(&|")/)[1]
       client_config = body.match(/config=([^&]*)&/)[1]
       [token, client_config]
     end

data/test/controllers/devise_jwt_auth/omniauth_callbacks_controller_test.rb

@@ -8,13 +8,15 @@ require 'test_helper'
 #  was the correct object stored in the response?
 #  was the appropriate message delivered in the json payload?
 
+# Disabling OmniAuth tests for now. Will come back to fixing these later.
+=begin
 class OmniauthTest < ActionDispatch::IntegrationTest
   setup do
     OmniAuth.config.test_mode = true
   end
 
   before do
-    @redirect_url = 'http://ng-token-auth.dev/'
+    @redirect_url = 'http://ng-jwt-auth.dev/'
   end
 
   def get_parsed_data_json
@@ -58,8 +60,8 @@ class OmniauthTest < ActionDispatch::IntegrationTest
 
     test 'session vars have been cleared' do
       get_success
-      refute request.session['dta.omniauth.auth']
-      refute request.session['dta.omniauth.params']
+      refute request.session['dja.omniauth.auth']
+      refute request.session['dja.omniauth.params']
     end
 
     test 'sign_in was called' do
@@ -459,3 +461,4 @@ class OmniauthTest < ActionDispatch::IntegrationTest
     end
   end
 end
+=end

data/test/controllers/devise_jwt_auth/passwords_controller_test.rb

@@ -13,7 +13,7 @@ class DeviseJwtAuth::PasswordsControllerTest < ActionController::TestCase
     describe 'Password reset' do
       before do
         @resource = create(:user, :confirmed)
-        @redirect_url = 'http://ng-token-auth.dev'
+        @redirect_url = 'http://ng-jwt-auth.dev'
       end
 
       describe 'not email should return 401' do
@@ -340,7 +340,7 @@ class DeviseJwtAuth::PasswordsControllerTest < ActionController::TestCase
       describe 'Using default_password_reset_url' do
         before do
           @resource = create(:user, :confirmed)
-          @redirect_url = 'http://ng-token-auth.dev'
+          @redirect_url = 'http://ng-jwt-auth.dev'
 
           DeviseJwtAuth.default_password_reset_url = @redirect_url
 
@@ -798,7 +798,7 @@ class DeviseJwtAuth::PasswordsControllerTest < ActionController::TestCase
 
       before do
         @resource = create(:mang_user, :confirmed)
-        @redirect_url = 'http://ng-token-auth.dev'
+        @redirect_url = 'http://ng-jwt-auth.dev'
         get_reset_token
       end
 
@@ -816,7 +816,7 @@ class DeviseJwtAuth::PasswordsControllerTest < ActionController::TestCase
     describe 'unconfirmed user' do
       before do
         @resource = create(:user)
-        @redirect_url = 'http://ng-token-auth.dev'
+        @redirect_url = 'http://ng-jwt-auth.dev'
 
         get_reset_token
 
@@ -850,7 +850,7 @@ class DeviseJwtAuth::PasswordsControllerTest < ActionController::TestCase
     describe 'alternate user type' do
       before do
         @resource = create(:user, :confirmed)
-        @redirect_url = 'http://ng-token-auth.dev'
+        @redirect_url = 'http://ng-jwt-auth.dev'
         # @config_name  = 'altUser'
 
         params = { email: @resource.email,

data/test/controllers/devise_jwt_auth/refresh_token_controller_test.rb

@@ -9,7 +9,7 @@ class DeviseJwtAuth::RefreshTokenControllerTest < ActionDispatch::IntegrationTes
         @resource = create(:user, :confirmed)
         @auth_headers = get_cookie_header(DeviseJwtAuth.refresh_token_name,
                                           @resource.create_refresh_token)
-        get '/auth/refresh_token', params: {}, headers: @auth_headers
+        get DeviseJwtAuth.default_refresh_token_path, params: {}, headers: @auth_headers
         @resp = JSON.parse(response.body)
       end
 
@@ -27,7 +27,7 @@ class DeviseJwtAuth::RefreshTokenControllerTest < ActionDispatch::IntegrationTes
         @resource = create(:user)
         @auth_headers = get_cookie_header(DeviseJwtAuth.refresh_token_name,
                                           @resource.create_refresh_token)
-        get '/auth/refresh_token', params: {}, headers: @auth_headers
+        get DeviseJwtAuth.default_refresh_token_path, params: {}, headers: @auth_headers
         @resp = JSON.parse(response.body)
       end
 
@@ -47,7 +47,7 @@ class DeviseJwtAuth::RefreshTokenControllerTest < ActionDispatch::IntegrationTes
         @expired_token = @resource.create_refresh_token(exp: @exp)
         @auth_headers = get_cookie_header(DeviseJwtAuth.refresh_token_name,
                                           @expired_token)
-        get '/auth/refresh_token', params: {}, headers: @auth_headers
+        get DeviseJwtAuth.default_refresh_token_path, params: {}, headers: @auth_headers
         @resp = JSON.parse(response.body)
       end
 
@@ -62,9 +62,8 @@ class DeviseJwtAuth::RefreshTokenControllerTest < ActionDispatch::IntegrationTes
 
     describe 'an invalid refresh token' do
       before do
-        @auth_headers = get_cookie_header(DeviseJwtAuth.refresh_token_name,
-                                          'invalid-token')
-        get '/auth/refresh_token', params: {}, headers: @auth_headers
+        @auth_headers = get_cookie_header(DeviseJwtAuth.refresh_token_name, 'invalid-token')
+        get DeviseJwtAuth.default_refresh_token_path, params: {}, headers: @auth_headers
         @resp = JSON.parse(response.body)
       end
 

data/test/controllers/devise_jwt_auth/registrations_controller_test.rb

@@ -879,18 +879,6 @@ class DeviseJwtAuth::RegistrationsControllerTest < ActionDispatch::IntegrationTe
       test 'user was confirmed' do
         assert @resource.confirmed?
       end
-
-      #       test 'auth headers were returned in response' do
-      #         assert response.headers['access-token']
-      #         assert response.headers['token-type']
-      #         assert response.headers['client']
-      #         assert response.headers['expiry']
-      #         assert response.headers['uid']
-      #       end
-      #
-      #       test 'response token is valid' do
-      #         assert @resource.valid_token?(@token, @client_id)
-      #       end
     end
 
     describe 'User with only :database_authenticatable and :registerable included' do

data/test/controllers/overrides/confirmations_controller_test.rb

@@ -38,7 +38,7 @@ class Overrides::ConfirmationsControllerTest < ActionDispatch::IntegrationTest
       override_proof_str = '(^^,)'
 
       # ensure present in redirect URL
-      override_proof_param = URI.unescape(response.headers['Location']
+      override_proof_param = URI.decode_www_form_component(response.headers['Location']
                                 .match(/override_proof=([^&]*)/)[1])
 
       assert_equal override_proof_str, override_proof_param