devise_token_auth 1.0.0 → 1.1.4

data/test/dummy/config/initializers/devise_token_auth.rb

@@ -5,20 +5,51 @@ DeviseTokenAuth.setup do |config|
   # client is responsible for keeping track of the changing tokens. Change
   # this to false to prevent the Authorization header from changing after
   # each request.
-  #config.change_headers_on_each_request = true
+  # config.change_headers_on_each_request = true
 
   # By default, users will need to re-authenticate after 2 weeks. This setting
   # determines how long tokens will remain valid after they are issued.
-  #config.token_lifespan = 2.weeks
+  # config.token_lifespan = 2.weeks
+
+  # Limiting the token_cost to just 4 in testing will increase the performance of
+  # your test suite dramatically. The possible cost value is within range from 4
+  # to 31. It is recommended to not use a value more than 10 in other environments.
+  config.token_cost = Rails.env.test? ? 4 : 10
+
+  # Sets the max number of concurrent devices per user, which is 10 by default.
+  # After this limit is reached, the oldest tokens will be removed.
+  # config.max_number_of_devices = 10
 
   # Sometimes it's necessary to make several requests to the API at the same
   # time. In this case, each request in the batch will need to share the same
   # auth token. This setting determines how far apart the requests can be while
   # still using the same auth token.
-  #config.batch_request_buffer_throttle = 5.seconds
+  # config.batch_request_buffer_throttle = 5.seconds
 
   # This route will be the prefix for all oauth2 redirect callbacks. For
   # example, using the default '/omniauth', the github oauth2 provider will
   # redirect successful authentications to '/omniauth/github/callback'
-  #config.omniauth_prefix = "/omniauth"
+  # config.omniauth_prefix = "/omniauth"
+
+  # By default sending current password is not needed for the password update.
+  # Uncomment to enforce current_password param to be checked before all
+  # attribute updates. Set it to :password if you want it to be checked only if
+  # password is updated.
+  # config.check_current_password_before_update = :attributes
+
+  # By default we will use callbacks for single omniauth.
+  # It depends on fields like email, provider and uid.
+  # config.default_callbacks = true
+
+  # Makes it possible to change the headers names
+  # config.headers_names = {:'access-token' => 'access-token',
+  #                        :'client' => 'client',
+  #                        :'expiry' => 'expiry',
+  #                        :'uid' => 'uid',
+  #                        :'token-type' => 'token-type' }
+
+  # By default, only Bearer Token authentication is implemented out of the box.
+  # If, however, you wish to integrate with legacy Devise authentication, you can
+  # do so by enabling this flag. NOTE: This feature is highly experimental!
+  # config.enable_standard_devise_support = false
 end

data/test/dummy/config/initializers/figaro.rb

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-#Figaro.require("GITHUB_KEY", "GITHUB_SECRET", "FACEBOOK_KEY", "FACEBOOK_SECRET", "GOOGLE_KEY", "GOOGLE_SECRET")
+#Figaro.require("GITHUB_KEY", "GITHUB_SECRET", "FACEBOOK_KEY", "FACEBOOK_SECRET", "GOOGLE_KEY", "GOOGLE_SECRET", "APPLE_CLIENT_ID", "APPLE_TEAM_ID", "APPLE_KEY", "APPLE_PEM")

data/test/dummy/config/initializers/omniauth.rb

@@ -4,6 +4,7 @@ Rails.application.config.middleware.use OmniAuth::Builder do |b|
   provider :github,        ENV['GITHUB_KEY'],   ENV['GITHUB_SECRET'],   scope: 'email,profile'
   provider :facebook,      ENV['FACEBOOK_KEY'], ENV['FACEBOOK_SECRET']
   provider :google_oauth2, ENV['GOOGLE_KEY'],   ENV['GOOGLE_SECRET']
+  provider :apple,         ENV['APPLE_CLIENT_ID'], '', { scope: 'email name', team_id: ENV['APPLE_TEAM_ID'], key_id: ENV['APPLE_KEY'], pem: ENV['APPLE_PEM'] }
   provider :developer,
            fields: [:first_name, :last_name],
            uid_field: :last_name

data/test/dummy/config/routes.rb

@@ -20,6 +20,8 @@ Rails.application.routes.draw do
 
   mount_devise_token_auth_for 'LockableUser', at: 'lockable_user_auth'
 
+  mount_devise_token_auth_for 'ConfirmableUser', at: 'confirmable_user_auth'
+
   # test namespacing
   namespace :api do
     scope :v1 do

data/test/dummy/db/migrate/20140715061447_devise_token_auth_create_users.rb

@@ -18,13 +18,6 @@ class DeviseTokenAuthCreateUsers < ActiveRecord::Migration[4.2]
       ## Rememberable
       t.datetime :remember_created_at
 
-      ## Trackable
-      t.integer  :sign_in_count, default: 0, null: false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
       ## Confirmable
       t.string   :confirmation_token
       t.datetime :confirmed_at

data/test/dummy/db/migrate/20140715061805_devise_token_auth_create_mangs.rb

@@ -18,13 +18,6 @@ class DeviseTokenAuthCreateMangs < ActiveRecord::Migration[4.2]
       ## Rememberable
       t.datetime :remember_created_at
 
-      ## Trackable
-      t.integer  :sign_in_count, default: 0, null: false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
       ## Confirmable
       t.string   :confirmation_token
       t.datetime :confirmed_at

data/test/dummy/db/migrate/20141222035835_devise_token_auth_create_only_email_users.rb

@@ -19,13 +19,6 @@ class DeviseTokenAuthCreateOnlyEmailUsers < ActiveRecord::Migration[4.2]
       ## Rememberable
       #t.datetime :remember_created_at
 
-      ## Trackable
-      #t.integer  :sign_in_count, :default => 0, :null => false
-      #t.datetime :current_sign_in_at
-      #t.datetime :last_sign_in_at
-      #t.string   :current_sign_in_ip
-      #t.string   :last_sign_in_ip
-
       ## Confirmable
       #t.string   :confirmation_token
       #t.datetime :confirmed_at

data/test/dummy/db/migrate/20141222053502_devise_token_auth_create_unregisterable_users.rb

@@ -20,13 +20,6 @@ class DeviseTokenAuthCreateUnregisterableUsers < ActiveRecord::Migration[4.2]
       ## Rememberable
       t.datetime :remember_created_at
 
-      ## Trackable
-      t.integer  :sign_in_count, default: 0, null: false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
       ## Confirmable
       t.string   :confirmation_token
       t.datetime :confirmed_at

data/test/dummy/db/migrate/20150708104536_devise_token_auth_create_unconfirmable_users.rb

@@ -20,13 +20,6 @@ class DeviseTokenAuthCreateUnconfirmableUsers < ActiveRecord::Migration[4.2]
       ## Rememberable
       t.datetime :remember_created_at
 
-      ## Trackable
-      t.integer  :sign_in_count, default: 0, null: false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
       ## Confirmable
       # t.string   :confirmation_token
       # t.datetime :confirmed_at

data/test/dummy/db/migrate/20160103235141_devise_token_auth_create_scoped_users.rb

@@ -20,13 +20,6 @@ class DeviseTokenAuthCreateScopedUsers < ActiveRecord::Migration[4.2]
       ## Rememberable
       t.datetime :remember_created_at
 
-      ## Trackable
-      t.integer  :sign_in_count, default: 0, null: false
-      t.datetime :current_sign_in_at
-      t.datetime :last_sign_in_at
-      t.string   :current_sign_in_ip
-      t.string   :last_sign_in_ip
-
       ## Confirmable
       t.string   :confirmation_token
       t.datetime :confirmed_at

data/test/dummy/db/migrate/20160629184441_devise_token_auth_create_lockable_users.rb

@@ -20,13 +20,6 @@ class DeviseTokenAuthCreateLockableUsers < ActiveRecord::Migration[4.2]
       ## Rememberable
       # t.datetime :remember_created_at
 
-      ## Trackable
-      # t.integer  :sign_in_count, :default => 0, :null => false
-      # t.datetime :current_sign_in_at
-      # t.datetime :last_sign_in_at
-      # t.string   :current_sign_in_ip
-      # t.string   :last_sign_in_ip
-
       ## Confirmable
       # t.string   :confirmation_token
       # t.datetime :confirmed_at

data/test/dummy/db/migrate/20190924101113_devise_token_auth_create_confirmable_users.rb

@@ -0,0 +1,49 @@
+class DeviseTokenAuthCreateConfirmableUsers < ActiveRecord::Migration[5.2]
+  def change
+    
+    create_table(:confirmable_users) do |t|
+      ## Required
+      t.string :provider, :null => false, :default => "email"
+      t.string :uid, :null => false, :default => ""
+
+      ## Database authenticatable
+      t.string :encrypted_password, :null => false, :default => ""
+
+      ## Recoverable
+      t.string   :reset_password_token
+      t.datetime :reset_password_sent_at
+      t.boolean  :allow_password_change, :default => false
+
+      ## Rememberable
+      t.datetime :remember_created_at
+
+      ## Confirmable
+      t.string   :confirmation_token
+      t.datetime :confirmed_at
+      t.datetime :confirmation_sent_at
+      t.string   :unconfirmed_email # Only if using reconfirmable
+
+      ## Lockable
+      # t.integer  :failed_attempts, :default => 0, :null => false # Only if lock strategy is :failed_attempts
+      # t.string   :unlock_token # Only if unlock strategy is :email or :both
+      # t.datetime :locked_at
+
+      ## User Info
+      t.string :name
+      t.string :nickname
+      t.string :image
+      t.string :email
+
+      ## Tokens
+      t.text :tokens
+
+      t.timestamps
+    end
+
+    add_index :confirmable_users, :email,                unique: true
+    add_index :confirmable_users, [:uid, :provider],     unique: true
+    add_index :confirmable_users, :reset_password_token, unique: true
+    add_index :confirmable_users, :confirmation_token,   unique: true
+    # add_index :confirmable_users, :unlock_token,       unique: true
+  end
+end

data/test/dummy/db/schema.rb

@@ -1,5 +1,3 @@
-# frozen_string_literal: true
-
 # This file is auto-generated from the current state of the database. Instead
 # of editing this file, please use the migrations feature of Active Record to
 # incrementally modify your database, and then regenerate this schema definition.
@@ -12,7 +10,32 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20160629184441) do
+ActiveRecord::Schema.define(version: 2019_09_24_101113) do
+
+  create_table "confirmable_users", force: :cascade do |t|
+    t.string "provider", default: "email", null: false
+    t.string "uid", default: "", null: false
+    t.string "encrypted_password", default: "", null: false
+    t.string "reset_password_token"
+    t.datetime "reset_password_sent_at"
+    t.boolean "allow_password_change", default: false
+    t.datetime "remember_created_at"
+    t.string "confirmation_token"
+    t.datetime "confirmed_at"
+    t.datetime "confirmation_sent_at"
+    t.string "unconfirmed_email"
+    t.string "name"
+    t.string "nickname"
+    t.string "image"
+    t.string "email"
+    t.text "tokens"
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.index ["confirmation_token"], name: "index_confirmable_users_on_confirmation_token", unique: true
+    t.index ["email"], name: "index_confirmable_users_on_email", unique: true
+    t.index ["reset_password_token"], name: "index_confirmable_users_on_reset_password_token", unique: true
+    t.index ["uid", "provider"], name: "index_confirmable_users_on_uid_and_provider", unique: true
+  end
 
   create_table "lockable_users", force: :cascade do |t|
     t.string "provider", null: false
@@ -41,11 +64,6 @@ ActiveRecord::Schema.define(version: 20160629184441) do
     t.string "reset_password_redirect_url"
     t.boolean "allow_password_change", default: false
     t.datetime "remember_created_at"
-    t.integer "sign_in_count", default: 0, null: false
-    t.datetime "current_sign_in_at"
-    t.datetime "last_sign_in_at"
-    t.string "current_sign_in_ip"
-    t.string "last_sign_in_ip"
     t.string "confirmation_token"
     t.datetime "confirmed_at"
     t.datetime "confirmation_sent_at"
@@ -88,11 +106,6 @@ ActiveRecord::Schema.define(version: 20160629184441) do
     t.datetime "reset_password_sent_at"
     t.boolean "allow_password_change", default: false
     t.datetime "remember_created_at"
-    t.integer "sign_in_count", default: 0, null: false
-    t.datetime "current_sign_in_at"
-    t.datetime "last_sign_in_at"
-    t.string "current_sign_in_ip"
-    t.string "last_sign_in_ip"
     t.string "confirmation_token"
     t.datetime "confirmed_at"
     t.datetime "confirmation_sent_at"
@@ -117,11 +130,6 @@ ActiveRecord::Schema.define(version: 20160629184441) do
     t.datetime "reset_password_sent_at"
     t.boolean "allow_password_change", default: false
     t.datetime "remember_created_at"
-    t.integer "sign_in_count", default: 0, null: false
-    t.datetime "current_sign_in_at"
-    t.datetime "last_sign_in_at"
-    t.string "current_sign_in_ip"
-    t.string "last_sign_in_ip"
     t.string "name"
     t.string "nickname"
     t.string "image"
@@ -142,11 +150,6 @@ ActiveRecord::Schema.define(version: 20160629184441) do
     t.datetime "reset_password_sent_at"
     t.boolean "allow_password_change", default: false
     t.datetime "remember_created_at"
-    t.integer "sign_in_count", default: 0, null: false
-    t.datetime "current_sign_in_at"
-    t.datetime "last_sign_in_at"
-    t.string "current_sign_in_ip"
-    t.string "last_sign_in_ip"
     t.string "confirmation_token"
     t.datetime "confirmed_at"
     t.datetime "confirmation_sent_at"
@@ -171,11 +174,6 @@ ActiveRecord::Schema.define(version: 20160629184441) do
     t.string "reset_password_redirect_url"
     t.boolean "allow_password_change", default: false
     t.datetime "remember_created_at"
-    t.integer "sign_in_count", default: 0, null: false
-    t.datetime "current_sign_in_at"
-    t.datetime "last_sign_in_at"
-    t.string "current_sign_in_ip"
-    t.string "last_sign_in_ip"
     t.string "confirmation_token"
     t.datetime "confirmed_at"
     t.datetime "confirmation_sent_at"

data/test/factories/users.rb

@@ -1,6 +1,6 @@
 FactoryBot.define do
   factory :user do
-    email { Faker::Internet.safe_email }
+    email { Faker::Internet.unique.safe_email }
     password { Faker::Internet.password }
     provider { 'email' }
 
@@ -24,7 +24,7 @@ FactoryBot.define do
     end
 
     trait :facebook do
-      uid { Faker::Number.number(10) }
+      uid { Faker::Number.number }
       provider { 'facebook' }
     end
 
@@ -36,5 +36,6 @@ FactoryBot.define do
     factory :mang_user, class: 'Mang'
     factory :only_email_user, class: 'OnlyEmailUser'
     factory :scoped_user, class: 'ScopedUser'
+    factory :confirmable_user, class: 'ConfirmableUser'
   end
 end

data/test/lib/devise_token_auth/blacklist_test.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'test_helper'
+
+class DeviseTokenAuth::BlacklistTest < ActiveSupport::TestCase
+  describe Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION do
+    test 'should include :tokens' do
+      assert Devise::Models::Authenticatable::BLACKLIST_FOR_SERIALIZATION.include?(:tokens)
+    end
+  end
+end

data/test/lib/devise_token_auth/token_factory_test.rb

@@ -0,0 +1,191 @@
+require 'test_helper'
+
+class DeviseTokenAuth::TokenFactoryTest < ActiveSupport::TestCase
+  describe 'TokenFactory module' do
+    let(:tf) { DeviseTokenAuth::TokenFactory }
+    let(:token_regexp) { /^[-_A-Za-z0-9]{22}$/ }
+
+    it 'should be defined' do
+      assert_equal(tf.present?, true)
+      assert_kind_of(Module, tf)
+    end
+
+    describe 'interface' do
+      let(:token_hash_cost_regexp) { /\$[\w]+\$([\d]+)\$/ }
+      let(:lifespan) { 10 }
+      let(:cost) { DeviseTokenAuth.token_cost }
+
+      it '::secure_string' do
+        assert_respond_to(tf, :secure_string)
+
+        secure_string = tf.secure_string
+        assert_equal(secure_string.size, 22)
+        assert_match(token_regexp, secure_string)
+
+        SecureRandom.stub(:urlsafe_base64, secure_string) do
+          assert_equal(tf.secure_string, secure_string)
+        end
+      end
+
+      it '::client' do
+        assert_respond_to(tf, :client)
+
+        client = tf.client
+        assert_equal(client.size, 22)
+        assert_match(token_regexp, client)
+
+        secure_string = tf.secure_string
+        tf.stub(:secure_string, secure_string) do
+          assert_equal(tf.client, secure_string)
+        end
+      end
+
+      it '::token' do
+        assert_respond_to(tf, :token)
+
+        token = tf.token
+        assert_kind_of(String, token)
+        assert_equal(token.size, 22)
+        assert_match(token_regexp, token)
+
+        secure_string = tf.secure_string
+        tf.stub(:secure_string, secure_string) do
+          assert_equal(tf.token, secure_string)
+        end
+      end
+
+      it '::token_hash(args)' do
+        assert_respond_to(tf, :token_hash)
+
+        token_hash = tf.token_hash(tf.token)
+        assert_equal(token_hash.size, 60)
+        assert_kind_of(String, token_hash)
+
+        token_cost = token_hash_cost_regexp.match(token_hash)[1].to_i
+        assert_equal(token_cost, cost)
+
+        cost = DeviseTokenAuth.token_cost == 4 ? 10 : 4
+        token_hash = tf.token_hash(tf.token, cost)
+        token_cost = token_hash_cost_regexp.match(token_hash)[1].to_i
+        assert_equal(token_cost, cost)
+
+        cost = nil
+        token_hash = tf.token_hash(tf.token, cost)
+        token_cost = token_hash_cost_regexp.match(token_hash)[1].to_i
+        assert_equal(token_cost, DeviseTokenAuth.token_cost)
+      end
+
+      it '::expiry' do
+        assert_respond_to(tf, :expiry)
+
+        assert_kind_of(Integer, tf.expiry)
+        assert tf.expiry > Time.now.to_i
+      end
+
+      it '::expiry(args)' do
+        time = Time.now
+        Time.stub(:now, time) do
+          assert_equal(tf.expiry(lifespan), (time + lifespan).to_i)
+
+          lifespan = nil
+          assert_equal(tf.expiry(lifespan), (time + DeviseTokenAuth.token_lifespan).to_i)
+        end
+      end
+
+      it '::create' do
+        assert_respond_to(tf, :create)
+
+        token = tf.create
+        assert token
+        token.members.each { |m| refute_nil token[m] }
+      end
+
+      it '::create(args)' do
+        client = tf.client
+        token = tf.create(client: client)
+        assert_equal(token.client, client)
+
+        time = Time.now
+        Time.stub(:now, time) do
+          token = tf.create(lifespan: lifespan)
+          assert_equal(token.expiry, (time + lifespan).to_i)
+        end
+
+        token = tf.create(cost: cost)
+        token_cost = token_hash_cost_regexp.match(token.token_hash)[1].to_i
+        assert_equal(token_cost, cost)
+      end
+
+      it '::new' do
+        assert_respond_to(tf, :new)
+
+        token = tf.new
+        token.each { |v| assert_nil v }
+      end
+
+      it '::valid_token_hash?' do
+        assert_respond_to(tf, :valid_token_hash?)
+
+        refute tf.valid_token_hash?('koskoskos')
+        assert tf.valid_token_hash?(tf.create.token_hash)
+      end
+
+      it '::token_hash_is_token?' do
+        assert_respond_to(tf, :token_hash_is_token?)
+
+        token = tf.create
+        refute tf.token_hash_is_token?(token.token_hash, 'koskoskos')
+        refute tf.token_hash_is_token?('koskoskos', token.token)
+        assert tf.token_hash_is_token?(token.token_hash, token.token)
+      end
+    end
+
+    describe 'token object implements' do
+      let(:object) { tf.create }
+
+      it '#client' do
+        assert_respond_to(object, :client)
+
+        assert_kind_of(String, object.client)
+        assert_equal(object.client.size, 22)
+        assert_match(token_regexp, object.client)
+      end
+
+      it '#token' do
+        assert_respond_to(object, :token)
+
+        assert_kind_of(String, object.token)
+        assert_equal(object.token.size, 22)
+        assert_match(token_regexp, object.token)
+      end
+
+      it '#token_hash' do
+        assert_respond_to(object, :token_hash)
+
+        assert_kind_of(String, object.token_hash)
+        assert_equal(object.token_hash.size, 60)
+      end
+
+      it '#expiry' do
+        assert_respond_to(object, :expiry)
+        assert_kind_of(Integer, object.expiry)
+      end
+
+      it '#clear!' do
+        assert_respond_to(object, :clear!)
+
+        assert object.clear!
+        object.each { |v| assert_nil v }
+      end
+
+      it '#present?' do
+        assert_respond_to(object, :present?)
+
+        assert object.present?
+
+        object.token = nil
+        refute object.present?
+      end
+    end
+  end
+end