devise_token_auth 0.1.43 → 0.2.0

data/lib/devise_token_auth.rb

@@ -1,8 +1,11 @@
+# frozen_string_literal: true
+
 require "devise"
 require "devise_token_auth/engine"
 require "devise_token_auth/controllers/helpers"
 require "devise_token_auth/controllers/url_helpers"
 require "devise_token_auth/url"
+require "devise_token_auth/errors"
 
 module DeviseTokenAuth
 end

data/lib/devise_token_auth/controllers/helpers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   module Controllers
     module Helpers

data/lib/devise_token_auth/controllers/url_helpers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   module Controllers
     module UrlHelpers

data/lib/devise_token_auth/engine.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'devise_token_auth/rails/routes'
 
 module DeviseTokenAuth

data/lib/devise_token_auth/errors.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module DeviseTokenAuth
+  module Errors
+    class NoResourceDefinedError < StandardError ; end
+  end
+end

data/lib/devise_token_auth/rails/routes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module ActionDispatch::Routing
   class Mapper
     def mount_devise_token_auth_for(resource, opts)

data/lib/devise_token_auth/url.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth::Url
 
   def self.generate(url, params = {})

data/lib/devise_token_auth/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
-  VERSION = '0.1.43'
+  VERSION = '0.2.0'
 end

data/lib/generators/devise_token_auth/USAGE

@@ -15,7 +15,7 @@ Example:
 
   This will create:
       config/initializers/devise_token_auth.rb
-      db/migrate/<%= Time.now.utc.strftime("%Y%m%d%H%M%S") %>_create_devise_token_auth_create_users.rb
+      db/migrate/<%= Time.zone.now.utc.strftime("%Y%m%d%H%M%S") %>_create_devise_token_auth_create_users.rb
       app/models/user.rb
 
   If 'app/models/user.rb' already exists, the following line will be inserted

data/lib/generators/devise_token_auth/install_generator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class InstallGenerator < Rails::Generators::Base
     include Rails::Generators::Migration
@@ -12,12 +14,12 @@ module DeviseTokenAuth
     end
 
     def copy_migrations
-      if self.class.migration_exists?("db/migrate", "devise_token_auth_create_#{ user_class.underscore }")
-        say_status("skipped", "Migration 'devise_token_auth_create_#{ user_class.underscore }' already exists")
+      if self.class.migration_exists?("db/migrate", "devise_token_auth_create_#{ user_class.pluralize.gsub("::","").underscore }")
+        say_status("skipped", "Migration 'devise_token_auth_create_#{ user_class.pluralize.gsub("::","").underscore }' already exists")
       else
         migration_template(
           "devise_token_auth_create_users.rb.erb",
-          "db/migrate/devise_token_auth_create_#{ user_class.pluralize.underscore }.rb"
+          "db/migrate/devise_token_auth_create_#{ user_class.pluralize.gsub("::","").underscore }.rb"
         )
       end
     end
@@ -29,7 +31,7 @@ module DeviseTokenAuth
       else
         inclusion = "include DeviseTokenAuth::Concerns::User"
         unless parse_file_for_line(fname, inclusion)
-          
+
           active_record_needle = (Rails::VERSION::MAJOR == 5) ? 'ApplicationRecord' : 'ActiveRecord::Base'
           inject_into_file fname, after: "class #{user_class} < #{active_record_needle}\n" do <<-'RUBY'
   # Include default devise modules.
@@ -101,7 +103,7 @@ module DeviseTokenAuth
     private
 
     def self.next_migration_number(path)
-      Time.now.utc.strftime("%Y%m%d%H%M%S")
+      Time.zone.now.utc.strftime("%Y%m%d%H%M%S")
     end
 
     def insert_after_line(filename, line, str)

data/lib/generators/devise_token_auth/install_views_generator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module DeviseTokenAuth
   class InstallViewsGenerator < Rails::Generators::Base
     source_root File.expand_path('../../../../app/views/devise/mailer', __FILE__)

data/lib/generators/devise_token_auth/templates/devise_token_auth.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 DeviseTokenAuth.setup do |config|
   # By default the authorization headers will change after each request. The
   # client is responsible for keeping track of the changing tokens. Change

data/lib/generators/devise_token_auth/templates/devise_token_auth_create_users.rb.erb

@@ -1,6 +1,7 @@
-class DeviseTokenAuthCreate<%= user_class.pluralize %> < ActiveRecord::Migration<%= "[#{Rails::VERSION::STRING[0..2]}]" if Rails::VERSION::MAJOR > 4 %>
+class DeviseTokenAuthCreate<%= user_class.pluralize.gsub("::","") %> < ActiveRecord::Migration<%= "[#{Rails::VERSION::STRING[0..2]}]" if Rails::VERSION::MAJOR > 4 %>
   def change
-    create_table(:<%= user_class.pluralize.underscore %>) do |t|
+    <% table_name = @user_class.pluralize.gsub("::","").underscore %>
+    create_table(:<%= table_name %>) do |t|
       ## Required
       t.string :provider, :null => false, :default => "email"
       t.string :uid, :null => false, :default => ""
@@ -46,10 +47,10 @@ class DeviseTokenAuthCreate<%= user_class.pluralize %> < ActiveRecord::Migration
       t.timestamps
     end
 
-    add_index :<%= user_class.pluralize.underscore %>, :email,                unique: true
-    add_index :<%= user_class.pluralize.underscore %>, [:uid, :provider],     unique: true
-    add_index :<%= user_class.pluralize.underscore %>, :reset_password_token, unique: true
-    add_index :<%= user_class.pluralize.underscore %>, :confirmation_token,   unique: true
-    # add_index :<%= user_class.pluralize.underscore %>, :unlock_token,       unique: true
+    add_index :<%= table_name %>, :email,                unique: true
+    add_index :<%= table_name %>, [:uid, :provider],     unique: true
+    add_index :<%= table_name %>, :reset_password_token, unique: true
+    add_index :<%= table_name %>, :confirmation_token,   unique: true
+    # add_index :<%= table_name %>, :unlock_token,       unique: true
   end
 end

data/lib/generators/devise_token_auth/templates/user.rb

@@ -1,4 +1,6 @@
-class <%= user_class.capitalize %> < ActiveRecord::Base
+# frozen_string_literal: true
+
+class <%= user_class %> < ActiveRecord::Base
   # Include default devise modules. Others available are:
   # :confirmable, :lockable, :timeoutable and :omniauthable
   devise :database_authenticatable, :registerable,

data/lib/tasks/devise_token_auth_tasks.rake

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # desc "Explaining what the task does"
 # task :devise_token_auth do
 #   # Task goes here

data/test/controllers/custom/custom_confirmations_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 class Custom::ConfirmationsControllerTest < ActionController::TestCase

data/test/controllers/custom/custom_omniauth_callbacks_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 class Custom::OmniauthCallbacksControllerTest < ActionDispatch::IntegrationTest

data/test/controllers/custom/custom_passwords_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 class Custom::PasswordsControllerTest < ActionController::TestCase

data/test/controllers/custom/custom_registrations_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 class Custom::RegistrationsControllerTest < ActionDispatch::IntegrationTest
@@ -50,5 +52,14 @@ class Custom::RegistrationsControllerTest < ActionDispatch::IntegrationTest
       assert @controller.destroy_block_called?,
              'destroy failed to yield resource to provided block'
     end
+
+    describe 'when overriding #build_resource' do
+      test 'it fails' do
+        Custom::RegistrationsController.any_instance.stubs(:build_resource).returns(nil)
+        assert_raises DeviseTokenAuth::Errors::NoResourceDefinedError do
+          post '/nice_user_auth', params: @create_params
+        end
+      end
+    end
   end
 end

data/test/controllers/custom/custom_sessions_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 class Custom::SessionsControllerTest < ActionController::TestCase

data/test/controllers/custom/custom_token_validations_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 class Custom::TokenValidationsControllerTest < ActionDispatch::IntegrationTest

data/test/controllers/demo_group_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 #  was the web request successful?

data/test/controllers/demo_mang_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 #  was the web request successful?
@@ -214,7 +216,7 @@ class DemoMangControllerTest < ActionDispatch::IntegrationTest
           end
 
           it 'should not return auth headers for second (batched) requests' do
-            assert_equal ' ', @second_access_token
+            refute @second_access_token
           end
         end
 
@@ -282,3 +284,4 @@ class DemoMangControllerTest < ActionDispatch::IntegrationTest
     end
   end
 end
+

data/test/controllers/demo_user_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 #  was the web request successful?
@@ -215,7 +217,7 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
           end
 
           it 'should not return auth headers for second (batched) requests' do
-            assert_equal ' ', @second_access_token
+            refute @second_access_token
           end
         end
 
@@ -407,6 +409,50 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
           DeviseTokenAuth.headers_names[:'access-token'] = 'access-token'
         end
       end
+
+      describe 'maximum concurrent devices per user' do
+        before do
+          # Set the max_number_of_devices to a lower number
+          #  to expedite tests! (Default is 10)
+          DeviseTokenAuth.max_number_of_devices = 5
+        end
+
+        it 'should limit the maximum number of concurrent devices' do
+          # increment the number of devices until the maximum is exceeded
+          1.upto(DeviseTokenAuth.max_number_of_devices + 1).each do |n|
+
+            assert_equal(
+              [n, DeviseTokenAuth.max_number_of_devices].min,
+              @resource.reload.tokens.length
+            )
+
+            # Add a new device (and token) ahead of the next iteration
+            @resource.create_new_auth_token
+
+          end
+        end
+
+        it 'should drop the oldest token when the maximum number of devices is exceeded' do
+          # create the maximum number of tokens
+          1.upto(DeviseTokenAuth.max_number_of_devices).each do
+            @resource.create_new_auth_token
+          end
+
+          # get the oldest token client_id
+          oldest_client_id, = @resource.reload.tokens.min_by do |cid, v|
+                                v[:expiry] || v["expiry"]
+                              end # => [ 'CLIENT_ID', {token: ...} ]
+
+          # create another token, thereby dropping the oldest token
+          @resource.create_new_auth_token
+
+          assert_not_includes @resource.reload.tokens.keys, oldest_client_id
+        end
+
+        after do
+          DeviseTokenAuth.max_number_of_devices = 10
+        end
+      end
     end
 
     describe 'bypass_sign_in' do
@@ -503,17 +549,8 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
             refute_equal @resource, @controller.current_mang
           end
 
-          it 'should increase the number of tokens by a factor of 2 up to 11' do
-            @first_token = @resource.tokens.keys.first
 
-            DeviseTokenAuth.max_number_of_devices = 11
-            (1..10).each do |n|
-              assert_equal [11, 2 * n].min, @resource.reload.tokens.keys.length
-              get '/demo/members_only', params: {}, headers: nil
-            end
 
-            assert_not_includes @resource.reload.tokens.keys, @first_token
-          end
         end
 
         it 'should return success status' do

data/test/controllers/devise_token_auth/confirmations_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 #  was the web request successful?
@@ -55,18 +57,14 @@ class DeviseTokenAuth::ConfirmationsControllerTest < ActionController::TestCase
         test 'the sign_in_count should be 1' do
           assert @resource.sign_in_count == 1
         end
+
         test 'User shoud have the signed in info filled' do
           assert @resource.current_sign_in_at?
         end
+
         test 'User shoud have the Last checkin filled' do
           assert @resource.last_sign_in_at?
         end
-        
-        test 'user already confirmed' do
-          assert @resource.sign_in_count > 0 do
-            assert expiry == (Time.now + Time.now + 1.second).to_i
-          end
-        end
       end
 
       describe 'failure' do

data/test/controllers/devise_token_auth/omniauth_callbacks_controller_test.rb

@@ -1,6 +1,6 @@
-require 'test_helper'
-require 'mocha/test_unit'
+# frozen_string_literal: true
 
+require 'test_helper'
 #  was the web request successful?
 #  was the user redirected to the right page?
 #  was the user successfully authenticated?
@@ -57,7 +57,7 @@ class OmniauthTest < ActionDispatch::IntegrationTest
       expiry = controller.auth_params[:expiry]
 
       # the expiry should have been set
-      assert_equal expiry, @resource.tokens[client_id]['expiry']
+      assert_equal expiry, @resource.tokens[client_id]['expiry'] || @resource.tokens[client_id][:expiry]
 
       # the token sent down to the client should now be valid
       assert @resource.valid_token?(token, client_id)
@@ -70,7 +70,10 @@ class OmniauthTest < ActionDispatch::IntegrationTest
     end
 
     test 'sign_in was called' do
-      User.any_instance.expects(:sign_in)
+      DeviseTokenAuth::OmniauthCallbacksController.any_instance\
+        .expects(:sign_in).with(
+          :user, instance_of(User), has_entries(store: false, bypass: false)
+        )
       get_success
     end
 

data/test/controllers/devise_token_auth/passwords_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 #  was the web request successful?

data/test/controllers/devise_token_auth/registrations_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 #  was the web request successful?
@@ -177,7 +179,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
         @resource = assigns(:resource)
         @data = JSON.parse(response.body)
         @mail = ActionMailer::Base.deliveries.last
-        @sent_redirect_url = URI.decode(@mail.body.match(/redirect_url=([^&]*)(&|\")/)[1])
+        @sent_redirect_url = CGI.unescape(@mail.body.match(/redirect_url=([^&]*)(&|\")/)[1])
       end
 
       teardown do

data/test/controllers/devise_token_auth/sessions_controller_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'test_helper'
 
 #  was the web request successful?
@@ -72,6 +74,56 @@ class DeviseTokenAuth::SessionsControllerTest < ActionController::TestCase
             assert_equal '0.0.0.0', @new_last_sign_in_ip
           end
         end
+
+        describe "with multiple clients and headers don't change in each request" do
+          before do
+            # Set the max_number_of_devices to a lower number
+            #  to expedite tests! (Default is 10)
+            DeviseTokenAuth.max_number_of_devices = 2
+            DeviseTokenAuth.change_headers_on_each_request = false
+
+            @user_session_params = {
+              email: @existing_user.email,
+              password: 'secret123'
+            }
+          end
+
+          test 'should limit the maximum number of concurrent devices' do
+            # increment the number of devices until the maximum is exceeded
+            1.upto(DeviseTokenAuth.max_number_of_devices + 1).each do |n|
+              initial_tokens = @existing_user.reload.tokens
+
+              assert_equal(
+                [n, DeviseTokenAuth.max_number_of_devices].min,
+                @existing_user.reload.tokens.length
+              )
+
+              # Already have the max number of devices
+              post :create, params: @user_session_params
+
+              # A session for a new device maintains the max number of concurrent devices
+              refute_equal initial_tokens, @existing_user.reload.tokens
+            end
+          end
+
+          test 'should drop old tokens when max number of devices is exceeded' do
+            1.upto(DeviseTokenAuth.max_number_of_devices).each do |n|
+              post :create, params: @user_session_params
+            end
+
+            oldest_token, _ = @existing_user.reload.tokens \
+                                .min_by { |cid, v| v[:expiry] || v["expiry"] }
+
+            post :create, params: @user_session_params
+
+            assert_not_includes @existing_user.reload.tokens.keys, oldest_token
+          end
+
+          after do
+            DeviseTokenAuth.max_number_of_devices = 10
+            DeviseTokenAuth.change_headers_on_each_request = true
+          end
+        end
       end
 
       describe 'get sign_in is not supported' do