devise_token_auth 1.0.0 → 1.1.1

data/lib/devise_token_auth/token_factory.rb

@@ -0,0 +1,126 @@
+require 'bcrypt'
+
+module DeviseTokenAuth
+  # A token management factory which allow generate token objects and check them.
+  module TokenFactory
+    # For BCrypt::Password class see:
+    # https://github.com/codahale/bcrypt-ruby/blob/master/lib/bcrypt/password.rb
+
+    # Creates a token instance. Takes an optional client, lifespan and cost options.
+    # Example:
+    #   DeviseTokenAuth::TokenFactory.create
+    #   => #<struct DeviseTokenAuth::TokenFactory::Token client="tElcgkdZ7f9XEa0unZhrYQ", token="rAMcWOs0-mGHFMnIgJD2cA", token_hash="$2a$10$wrsdlHVRGlYW11wfImxU..jr0Ux3bHo/qbXcSfgp8zmvVUNHosita", expiry=1518982690>
+    #
+    #   DeviseTokenAuth::TokenFactory.create(lifespan: 10, cost: 4)
+    #   => #<struct DeviseTokenAuth::TokenFactory::Token client="5qleT7_t9JPVcX9xmxkVYA", token="RBXX43u4xXNSO-fr2N_4pA", token_hash="$2a$04$9gpCaoFbu2dUKxU3qiTgluHX7jj9UzS.jq1QW0EkQmoaxARo1WxTy", expiry=1517773268>
+    def self.create(client: nil, lifespan: nil, cost: nil)
+      # obj_client  = client.nil? ? client() : client
+      obj_client  = client || client()
+      obj_token      = token
+      obj_token_hash = token_hash(obj_token, cost)
+      obj_expiry     = expiry(lifespan)
+
+      Token.new(obj_client, obj_token, obj_token_hash, obj_expiry)
+    end
+
+    # Generates a random URL-safe client.
+    # Example:
+    #   DeviseTokenAuth::TokenFactory.client
+    #   => "zNf0pNP5iGfuBItZJGCseQ"
+    def self.client
+      secure_string
+    end
+
+    # Generates a random URL-safe token.
+    # Example:
+    #   DeviseTokenAuth::TokenFactory.token
+    #   => "6Bqs4K9x8ChLmZogvruF3A"
+    def self.token
+      secure_string
+    end
+
+    # Returns token hash for a token with given cost. If no cost value is specified,
+    # the default value is used. The possible cost value is within range from 4 to 31.
+    # It is recommended to not use a value more than 10.
+    # Example:
+    #   DeviseTokenAuth::TokenFactory.token_hash("_qxAxmc-biQLiYRHsmwd5Q")
+    #   => "$2a$10$6/cTAtQ3CBLfpkeHW7dlt.PD2aVCbFRN5vDDJUUhGsZ6pzYFlh4Me"
+    #
+    #   DeviseTokenAuth::TokenFactory.token_hash("_qxAxmc-biQLiYRHsmwd5Q", 4)
+    #   => "$2a$04$RkIrosbdRtuet2eUk3si8eS4ufeNpiPc/rSSsfpniRK8ogM5YFOWS"
+    def self.token_hash(token, cost = nil)
+      cost ||= DeviseTokenAuth.token_cost
+      BCrypt::Password.create(token, cost: cost)
+    end
+
+    # Returns the value of time as an integer number of seconds. Takes one argument.
+    # Example:
+    #   DeviseTokenAuth::TokenFactory.expiry
+    #   => 1518983359
+    #   DeviseTokenAuth::TokenFactory.expiry(10)
+    #   => 1517773781
+    def self.expiry(lifespan = nil)
+      lifespan ||= DeviseTokenAuth.token_lifespan
+      (Time.zone.now + lifespan).to_i
+    end
+
+    # Generates a random URL-safe string.
+    # Example:
+    #   DeviseTokenAuth::TokenFactory.secure_string
+    #   => "ADBoIaqXsEDnxIpOuumrTA"
+    def self.secure_string
+      # https://ruby-doc.org/stdlib-2.5.0/libdoc/securerandom/rdoc/Random/Formatter.html#method-i-urlsafe_base64
+      SecureRandom.urlsafe_base64
+    end
+
+    # Returns true if token hash is a valid token hash.
+    # Example:
+    #   token_hash = "$2a$10$ArjX0tskRIa5Z/Tmapy59OCiAXLStfhrCiaDz.8fCb6hnX1gJ0p/2"
+    #   DeviseTokenAuth::TokenFactory.valid_token_hash?(token_hash)
+    #   => true
+    def self.valid_token_hash?(token_hash)
+      !!BCrypt::Password.valid_hash?(token_hash)
+    end
+
+    # Compares a potential token against the token hash. Returns true if the token is the original token, false otherwise.
+    # Example:
+    #   token = "4wZ9gcc900rMQD1McpcSNA"
+    #   token_hash = "$2a$10$ArjX0tskRIa5Z/Tmapy59OCiAXLStfhrCiaDz.8fCb6hnX1gJ0p/2"
+    #   DeviseTokenAuth::TokenFactory.token_hash_is_token?(token_hash, token)
+    #   => true
+    def self.token_hash_is_token?(token_hash, token)
+      BCrypt::Password.new(token_hash).is_password?(token)
+    rescue StandardError
+      false
+    end
+
+    # Creates a token instance with instance variables equal nil.
+    # Example:
+    #   DeviseTokenAuth::TokenFactory.new
+    #   => #<struct DeviseTokenAuth::TokenFactory::Token client=nil, token=nil, token_hash=nil, expiry=nil>
+    def self.new
+      Token.new
+    end
+
+    Token = Struct.new(:client, :token, :token_hash, :expiry) do
+      # Sets all instance variables of the token to nil. It is faster than creating new empty token.
+      # Example:
+      #   token.clear!
+      #   => true
+      #   token
+      #   => #<struct DeviseTokenAuth::TokenFactory::Token client=nil, token=nil, token_hash=nil, expiry=nil>
+      def clear!
+        size.times { |i| self[i] = nil }
+        true
+      end
+
+      # Checks token attribute presence
+      # Example:
+      #   token.present?
+      #   => true
+      def present?
+        token.present?
+      end
+    end
+  end
+end

data/lib/devise_token_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeviseTokenAuth
-  VERSION = '1.0.0'.freeze
+  VERSION = '1.1.1'.freeze
 end

data/lib/devise_token_auth.rb

@@ -1,11 +1,14 @@
 # frozen_string_literal: true
 
 require 'devise'
+
+module DeviseTokenAuth
+end
+
 require 'devise_token_auth/engine'
 require 'devise_token_auth/controllers/helpers'
 require 'devise_token_auth/controllers/url_helpers'
 require 'devise_token_auth/url'
 require 'devise_token_auth/errors'
-
-module DeviseTokenAuth
-end
+require 'devise_token_auth/blacklist'
+require 'devise_token_auth/token_factory'

data/lib/generators/devise_token_auth/install_generator.rb

@@ -1,20 +1,14 @@
 # frozen_string_literal: true
 
+require_relative 'install_generator_helpers'
+
 module DeviseTokenAuth
   class InstallGenerator < Rails::Generators::Base
     include Rails::Generators::Migration
+    include DeviseTokenAuth::InstallGeneratorHelpers
 
     class_option :primary_key_type, type: :string, desc: 'The type for primary key'
 
-    source_root File.expand_path('templates', __dir__)
-
-    argument :user_class, type: :string, default: 'User'
-    argument :mount_path, type: :string, default: 'auth'
-
-    def create_initializer_file
-      copy_file('devise_token_auth.rb', 'config/initializers/devise_token_auth.rb')
-    end
-
     def copy_migrations
       if self.class.migration_exists?('db/migrate', "devise_token_auth_create_#{user_class.pluralize.gsub('::','').underscore}")
         say_status('skipped', "Migration 'devise_token_auth_create_#{user_class.pluralize.gsub('::','').underscore}' already exists")
@@ -47,90 +41,12 @@ module DeviseTokenAuth
       end
     end
 
-    def include_controller_concerns
-      fname = 'app/controllers/application_controller.rb'
-      line  = 'include DeviseTokenAuth::Concerns::SetUserByToken'
-
-      if File.exist?(File.join(destination_root, fname))
-        if parse_file_for_line(fname, line)
-          say_status('skipped', 'Concern is already included in the application controller.')
-        elsif is_rails_api?
-          inject_into_file fname, after: "class ApplicationController < ActionController::API\n" do <<-'RUBY'
-  include DeviseTokenAuth::Concerns::SetUserByToken
-          RUBY
-          end
-        else
-          inject_into_file fname, after: "class ApplicationController < ActionController::Base\n" do <<-'RUBY'
-  include DeviseTokenAuth::Concerns::SetUserByToken
-          RUBY
-          end
-        end
-      else
-        say_status('skipped', "app/controllers/application_controller.rb not found. Add 'include DeviseTokenAuth::Concerns::SetUserByToken' to any controllers that require authentication.")
-      end
-    end
-
-    def add_route_mount
-      f    = 'config/routes.rb'
-      str  = "mount_devise_token_auth_for '#{user_class}', at: '#{mount_path}'"
-
-      if File.exist?(File.join(destination_root, f))
-        line = parse_file_for_line(f, 'mount_devise_token_auth_for')
-
-        if line
-          existing_user_class = true
-        else
-          line = 'Rails.application.routes.draw do'
-          existing_user_class = false
-        end
-
-        if parse_file_for_line(f, str)
-          say_status('skipped', "Routes already exist for #{user_class} at #{mount_path}")
-        else
-          insert_after_line(f, line, str)
-
-          if existing_user_class
-            scoped_routes = ''\
-              "as :#{user_class.underscore} do\n"\
-              "    # Define routes for #{user_class} within this block.\n"\
-              "  end\n"
-            insert_after_line(f, str, scoped_routes)
-          end
-        end
-      else
-        say_status('skipped', "config/routes.rb not found. Add \"mount_devise_token_auth_for '#{user_class}', at: '#{mount_path}'\" to your routes file.")
-      end
-    end
-
     private
 
     def self.next_migration_number(path)
       Time.zone.now.utc.strftime('%Y%m%d%H%M%S')
     end
 
-    def insert_after_line(filename, line, str)
-      gsub_file filename, /(#{Regexp.escape(line)})/mi do |match|
-        "#{match}\n  #{str}"
-      end
-    end
-
-    def parse_file_for_line(filename, str)
-      match = false
-
-      File.open(File.join(destination_root, filename)) do |f|
-        f.each_line do |line|
-          match = line if line =~ /(#{Regexp.escape(str)})/mi
-        end
-      end
-      match
-    end
-
-    def is_rails_api?
-      fname = 'app/controllers/application_controller.rb'
-      line = 'class ApplicationController < ActionController::API'
-      parse_file_for_line(fname, line)
-    end
-
     def json_supported_database?
       (postgres? && postgres_correct_version?) || (mysql? && mysql_correct_version?)
     end

data/lib/generators/devise_token_auth/install_generator_helpers.rb

@@ -0,0 +1,98 @@
+module DeviseTokenAuth
+  module InstallGeneratorHelpers
+    class << self
+      def included(mod)
+        mod.class_eval do
+          source_root File.expand_path('templates', __dir__)
+
+          argument :user_class, type: :string, default: 'User'
+          argument :mount_path, type: :string, default: 'auth'
+
+          def create_initializer_file
+            copy_file('devise_token_auth.rb', 'config/initializers/devise_token_auth.rb')
+          end
+
+          def include_controller_concerns
+            fname = 'app/controllers/application_controller.rb'
+            line  = 'include DeviseTokenAuth::Concerns::SetUserByToken'
+
+            if File.exist?(File.join(destination_root, fname))
+              if parse_file_for_line(fname, line)
+                say_status('skipped', 'Concern is already included in the application controller.')
+              elsif is_rails_api?
+                inject_into_file fname, after: "class ApplicationController < ActionController::API\n" do <<-'RUBY'
+        include DeviseTokenAuth::Concerns::SetUserByToken
+                RUBY
+                end
+              else
+                inject_into_file fname, after: "class ApplicationController < ActionController::Base\n" do <<-'RUBY'
+        include DeviseTokenAuth::Concerns::SetUserByToken
+                RUBY
+                end
+              end
+            else
+              say_status('skipped', "app/controllers/application_controller.rb not found. Add 'include DeviseTokenAuth::Concerns::SetUserByToken' to any controllers that require authentication.")
+            end
+          end
+
+          def add_route_mount
+            f    = 'config/routes.rb'
+            str  = "mount_devise_token_auth_for '#{user_class}', at: '#{mount_path}'"
+
+            if File.exist?(File.join(destination_root, f))
+              line = parse_file_for_line(f, 'mount_devise_token_auth_for')
+
+              if line
+                existing_user_class = true
+              else
+                line = 'Rails.application.routes.draw do'
+                existing_user_class = false
+              end
+
+              if parse_file_for_line(f, str)
+                say_status('skipped', "Routes already exist for #{user_class} at #{mount_path}")
+              else
+                insert_after_line(f, line, str)
+
+                if existing_user_class
+                  scoped_routes = ''\
+                    "as :#{user_class.underscore} do\n"\
+                    "    # Define routes for #{user_class} within this block.\n"\
+                    "  end\n"
+                  insert_after_line(f, str, scoped_routes)
+                end
+              end
+            else
+              say_status('skipped', "config/routes.rb not found. Add \"mount_devise_token_auth_for '#{user_class}', at: '#{mount_path}'\" to your routes file.")
+            end
+          end
+
+          private
+
+          def insert_after_line(filename, line, str)
+            gsub_file filename, /(#{Regexp.escape(line)})/mi do |match|
+              "#{match}\n  #{str}"
+            end
+          end
+
+          def parse_file_for_line(filename, str)
+            match = false
+
+            File.open(File.join(destination_root, filename)) do |f|
+              f.each_line do |line|
+                match = line if line =~ /(#{Regexp.escape(str)})/mi
+              end
+            end
+            match
+          end
+
+          def is_rails_api?
+            fname = 'app/controllers/application_controller.rb'
+            line = 'class ApplicationController < ActionController::API'
+            parse_file_for_line(fname, line)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/generators/devise_token_auth/install_mongoid_generator.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require_relative 'install_generator_helpers'
+
+module DeviseTokenAuth
+  class InstallMongoidGenerator < Rails::Generators::Base
+    include DeviseTokenAuth::InstallGeneratorHelpers
+
+    def create_user_model
+      fname = "app/models/#{user_class.underscore}.rb"
+      if File.exist?(File.join(destination_root, fname))
+        inclusion = 'include DeviseTokenAuth::Concerns::User'
+        unless parse_file_for_line(fname, inclusion)
+          inject_into_file fname, before: /end\s\z/ do <<-'RUBY'
+
+  include Mongoid::Locker
+
+  field :locker_locked_at, type: Time
+  field :locker_locked_until, type: Time
+
+  locker locked_at_field: :locker_locked_at,
+         locked_until_field: :locker_locked_until
+
+  ## Required
+  field :provider, type: String
+  field :uid,      type: String, default: ''
+
+  ## Tokens
+  field :tokens, type: Hash, default: {}
+
+  # Include default devise modules. Others available are:
+  # :confirmable, :lockable, :timeoutable and :omniauthable
+  devise :database_authenticatable, :registerable,
+         :recoverable, :rememberable, :trackable, :validatable
+  include DeviseTokenAuth::Concerns::User
+
+  index({ uid: 1, provider: 1}, { name: 'uid_provider_index', unique: true, background: true })
+            RUBY
+          end
+        end
+      else
+        template('user_mongoid.rb.erb', fname)
+      end
+    end
+  end
+end

data/lib/generators/devise_token_auth/templates/devise_token_auth.rb

@@ -11,6 +11,11 @@ DeviseTokenAuth.setup do |config|
   # determines how long tokens will remain valid after they are issued.
   # config.token_lifespan = 2.weeks
 
+  # Limiting the token_cost to just 4 in testing will increase the performance of
+  # your test suite dramatically. The possible cost value is within range from 4
+  # to 31. It is recommended to not use a value more than 10 in other environments.
+  config.token_cost = Rails.env.test? ? 4 : 10
+
   # Sets the max number of concurrent devices per user, which is 10 by default.
   # After this limit is reached, the oldest tokens will be removed.
   # config.max_number_of_devices = 10

data/lib/generators/devise_token_auth/templates/devise_token_auth_create_users.rb.erb

@@ -17,13 +17,6 @@ class DeviseTokenAuthCreate<%= user_class.pluralize.gsub("::","") %> < ActiveRec
       ## Rememberable
       t.datetime :remember_created_at
 
-      ## Trackable
-      t.integer  :sign_in_count, :default => 0, :null => false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
       ## Confirmable
       t.string   :confirmation_token
       t.datetime :confirmed_at

data/lib/generators/devise_token_auth/templates/user_mongoid.rb.erb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+class <%= user_class %>
+  include Mongoid::Document
+  include Mongoid::Timestamps
+  include Mongoid::Locker
+
+  field :locker_locked_at, type: Time
+  field :locker_locked_until, type: Time
+
+  locker locked_at_field: :locker_locked_at,
+         locked_until_field: :locker_locked_until
+
+  ## Database authenticatable
+  field :email,              type: String, default: ''
+  field :encrypted_password, type: String, default: ''
+
+  ## Recoverable
+  field :reset_password_token,        type: String
+  field :reset_password_sent_at,      type: Time
+  field :reset_password_redirect_url, type: String
+  field :allow_password_change,       type: Boolean, default: false
+
+  ## Rememberable
+  field :remember_created_at, type: Time
+
+  ## Confirmable
+  field :confirmation_token,   type: String
+  field :confirmed_at,         type: Time
+  field :confirmation_sent_at, type: Time
+  field :unconfirmed_email,    type: String # Only if using reconfirmable
+
+  ## Lockable
+  # field :failed_attempts, type: Integer, default: 0 # Only if lock strategy is :failed_attempts
+  # field :unlock_token,    type: String # Only if unlock strategy is :email or :both
+  # field :locked_at,       type: Time
+
+  ## Required
+  field :provider, type: String
+  field :uid,      type: String, default: ''
+
+  ## Tokens
+  field :tokens, type: Hash, default: {}
+
+  # Include default devise modules. Others available are:
+  # :confirmable, :lockable, :timeoutable and :omniauthable
+  devise :database_authenticatable, :registerable,
+         :recoverable, :rememberable, :trackable, :validatable
+  include DeviseTokenAuth::Concerns::User
+
+  index({ email: 1 }, { name: 'email_index', unique: true, background: true })
+  index({ reset_password_token: 1 }, { name: 'reset_password_token_index', unique: true, sparse: true, background: true })
+  index({ confirmation_token: 1 }, { name: 'confirmation_token_index', unique: true, sparse: true, background: true })
+  index({ uid: 1, provider: 1}, { name: 'uid_provider_index', unique: true, background: true })
+  # index({ unlock_token: 1 }, { name: 'unlock_token_index', unique: true, sparse: true, background: true })
+end

data/test/controllers/custom/custom_confirmations_controller_test.rb

@@ -5,7 +5,7 @@ require 'test_helper'
 class Custom::ConfirmationsControllerTest < ActionController::TestCase
   describe Custom::ConfirmationsController do
     include CustomControllersRoutes
-    
+
     before do
       @redirect_url = Faker::Internet.url
       @new_user = create(:user)

data/test/controllers/demo_user_controller_test.rb

@@ -321,8 +321,8 @@ class DemoUserControllerTest < ActionDispatch::IntegrationTest
           assert @resource.tokens.count > 1
 
           # password changed from new device
-          @resource.update_attributes(password: 'newsecret123',
-                                      password_confirmation: 'newsecret123')
+          @resource.update(password: 'newsecret123',
+                           password_confirmation: 'newsecret123')
 
           get '/demo/members_only',
               params: {},

data/test/controllers/devise_token_auth/confirmations_controller_test.rb

@@ -23,6 +23,7 @@ class DeviseTokenAuth::ConfirmationsControllerTest < ActionController::TestCase
         @new_user.send_confirmation_instructions(redirect_url: @redirect_url)
         mail = ActionMailer::Base.deliveries.last
         @token, @client_config = token_and_client_config_from(mail.body)
+        @token_params = %w[access-token client client_id config expiry token uid]
       end
 
       test 'should generate raw token' do
@@ -38,32 +39,79 @@ class DeviseTokenAuth::ConfirmationsControllerTest < ActionController::TestCase
       end
 
       describe 'success' do
-        before do
-          get :show,
-              params: { confirmation_token: @token,
-                        redirect_url: @redirect_url },
-              xhr: true
-          @resource = assigns(:resource)
-        end
+        describe 'when authenticated' do
+          before do
+            sign_in(@new_user)
+            get :show,
+                params: { confirmation_token: @token,
+                          redirect_url: @redirect_url },
+                xhr: true
+            @resource = assigns(:resource)
+          end
 
-        test 'user should now be confirmed' do
-          assert @resource.confirmed?
-        end
+          test 'user should now be confirmed' do
+            assert @resource.confirmed?
+          end
 
-        test 'should redirect to success url' do
-          assert_redirected_to(/^#{@redirect_url}/)
-        end
+          test 'should redirect to success url' do
+            assert_redirected_to(/^#{@redirect_url}/)
+          end
 
-        test 'the sign_in_count should be 1' do
-          assert @resource.sign_in_count == 1
+          test 'redirect url includes token params' do
+            assert @token_params.all? { |param| response.body.include?(param) }
+            assert response.body.include?('account_confirmation_success')
+          end
         end
 
-        test 'User shoud have the signed in info filled' do
-          assert @resource.current_sign_in_at?
+        describe 'when unauthenticated' do
+          before do
+            sign_out(@new_user)
+            get :show,
+                params: { confirmation_token: @token,
+                          redirect_url: @redirect_url },
+                xhr: true
+            @resource = assigns(:resource)
+          end
+
+          test 'user should now be confirmed' do
+            assert @resource.confirmed?
+          end
+
+          test 'should redirect to success url' do
+            assert_redirected_to(/^#{@redirect_url}/)
+          end
+
+          test 'redirect url does not include token params' do
+            refute @token_params.any? { |param| response.body.include?(param) }
+            assert response.body.include?('account_confirmation_success')
+          end
         end
 
-        test 'User shoud have the Last checkin filled' do
-          assert @resource.last_sign_in_at?
+        describe 'resend confirmation' do
+          before do
+            post :create,
+                params: { email: @new_user.email,
+                          redirect_url: @redirect_url },
+                xhr: true
+            @resource = assigns(:resource)
+
+            @mail = ActionMailer::Base.deliveries.last
+            @token, @client_config = token_and_client_config_from(@mail.body)
+          end
+
+          test 'user should not be confirmed' do
+            assert_nil @resource.confirmed_at
+          end
+
+          test 'should generate raw token' do
+            assert @token
+            assert_equal @new_user.confirmation_token, @token
+          end
+
+          test 'user should receive confirmation email' do
+            assert_equal @resource.email, @mail['to'].to_s
+          end
+
         end
       end
 
@@ -75,6 +123,18 @@ class DeviseTokenAuth::ConfirmationsControllerTest < ActionController::TestCase
           @resource = assigns(:resource)
           refute @resource.confirmed?
         end
+
+        test 'request resend confirmation without email' do
+          post :create, params: { email: nil }, xhr: true
+
+          assert_equal 401, response.status
+        end
+
+        test 'user should not be found on resend confirmation request' do
+          post :create, params: { email: 'bogus' }, xhr: true
+
+          assert_equal 404, response.status
+        end
       end
     end
 

data/test/controllers/devise_token_auth/omniauth_callbacks_controller_test.rb

@@ -155,6 +155,8 @@ class OmniauthTest < ActionDispatch::IntegrationTest
       describe 'with new user' do
         before do
           User.any_instance.expects(:new_record?).returns(true).at_least_once
+          # https://docs.mongodb.com/mongoid/master/tutorials/mongoid-documents/#notes-on-persistence
+          User.any_instance.expects(:save!).returns(true)
         end
 
         test 'response contains oauth_registration attr' do