devise_token_auth 1.2.6 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2950da8c6b3eac0a2a3ee2b1659d5e321ca9890e5a9b0a1525dcbf11e95d67dd
-  data.tar.gz: d04830c1c12f69b3537e80fae17d5914b0b22272a52b78d7226a04be560cadea
+  metadata.gz: 0d50f68558fe641e4412661bdd4dfc15ce37b047300353cd4736c7e314c9fed9
+  data.tar.gz: e73de38339a0d663e78bf8e0abbb416b46078440b922a11cf9e49ff7ec2e6bc5
 SHA512:
-  metadata.gz: 0a7e1dcce01dabc1e270926ff05b54c166d861232ef6ecf7547d88442e2d11ab7c104fef833312bf73a69dd5e3dd7df4923f050baf3e4aee877f32df6392d352
-  data.tar.gz: b44b9aa57a43fb58e86a7985957e9a5d425787ae65e898b480d7fefe02bf573433f27af356512ae2a4989c3a6d9f0b91a9cc1a1b3b2ef3f95a4b39557472ffa7
+  metadata.gz: 7b2f6973ffc5ba8b3763f36eeda7581fd698cfe1c6a556e714ec32c94b7f21e9f2da9b5b871c59419c1a3f26249dc1d560cb28b03b228fa9c4e5a81a294c12c4
+  data.tar.gz: 6d14031a8a4269655bd4f0d9c03f39fc360112e331f1e1e14f583127d58effbe32d23d1a5852cdf5bb5b07fce6a8ae05f6391863ccbff4c8cf9020e09773496d

data/app/models/devise_token_auth/concerns/user.rb

@@ -261,8 +261,13 @@ module DeviseTokenAuth::Concerns::User
     return if tokens.blank? || !max_client_tokens_exceeded?
 
     # First, remove any tokens with expiry greater than current max allowed lifespan
-    #   this handles the case where token lifespan was reduced and old tokens exist
-    max_lifespan_expiry = Time.now.to_i + DeviseTokenAuth.token_lifespan.to_i
+    #   this handles the case where token lifespan was reduced and old tokens exist.
+    #   The threshold MUST be computed the same way TokenFactory.expiry writes
+    #   expiries — calendar advance (Time.zone.now + lifespan) — otherwise a
+    #   calendar Duration (e.g. 2.months) and its average-seconds form
+    #   (token_lifespan.to_i) disagree by hours, and the freshly minted token
+    #   gets purged out from under the response.
+    max_lifespan_expiry = (Time.zone.now + DeviseTokenAuth.token_lifespan).to_i
     tokens_to_keep = tokens.select do |_cid, v|
       expiry = (v[:expiry] || v['expiry']).to_i
       expiry <= max_lifespan_expiry

data/lib/devise_token_auth/rails/routes.rb

@@ -76,7 +76,20 @@ module ActionDispatch::Routing
             match "#{full_path}/:provider", to: redirect(status: 307) { |params, request|
               # get the current querystring
               # TODO: deprecate in favor of using params
-              qs = CGI::parse(request.env['QUERY_STRING'].empty? ? request.body.read : request.env['QUERY_STRING'] )
+              # `CGI.parse` is unavailable as of the cgi gem shipped with Ruby 3.5
+              # (pulled in by Rails 8.1). `Rack::Utils.parse_query` returns a bare
+              # value for single occurrences, so normalize to arrays to keep the
+              # shape `CGI.parse` returned.
+              # As of Rails 7.1 the request body may already have been read when
+              # this runs, in which case `read` returns "" and every param is
+              # silently dropped. Rewind first so POSTed params survive.
+              query_string = if request.env['QUERY_STRING'].empty?
+                               request.body.rewind if request.body.respond_to?(:rewind)
+                               request.body.read
+                             else
+                               request.env['QUERY_STRING']
+                             end
+              qs = Rack::Utils.parse_query(query_string).transform_values { |v| Array(v) }
 
               # append name of current resource
               qs['resource_class'] = [resource]

data/lib/devise_token_auth/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module DeviseTokenAuth
-  VERSION = '1.2.6'.freeze
+  VERSION = '1.3.0'.freeze
 end

data/test/controllers/devise_token_auth/confirmations_controller_test.rb

@@ -62,8 +62,8 @@ class DeviseTokenAuth::ConfirmationsControllerTest < ActionController::TestCase
           end
 
           test 'redirect url includes token params' do
-            assert @token_params.all? { |param| response.body.include?(param) }
-            assert response.body.include?('account_confirmation_success')
+            assert @token_params.all? { |param| response.location.include?(param) }
+            assert response.location.include?('account_confirmation_success')
           end
         end
 
@@ -86,8 +86,8 @@ class DeviseTokenAuth::ConfirmationsControllerTest < ActionController::TestCase
           end
 
           test 'redirect url does not include token params' do
-            refute @token_params.any? { |param| response.body.include?(param) }
-            assert response.body.include?('account_confirmation_success')
+            refute @token_params.any? { |param| response.location.include?(param) }
+            assert response.location.include?('account_confirmation_success')
           end
         end
 

data/test/dummy/config/environments/test.rb

@@ -32,7 +32,10 @@ Rails.application.configure do
   config.action_controller.perform_caching = false
 
   # Raise exceptions instead of rendering exception templates.
-  if Rails::VERSION::MAJOR >= 7 && Rails::VERSION::MINOR > 0
+  # Rails 7.1 turned this into an enum; `false` is no longer recognised and
+  # falls through to the "show everything" default. Note the version check must
+  # not be `MAJOR >= 7 && MINOR > 0`, which is false on Rails 8.0.
+  if Rails.gem_version >= Gem::Version.new('7.1')
     config.action_dispatch.show_exceptions = :none
   else
     config.action_dispatch.show_exceptions = false

data/test/lib/devise_token_auth/rails/custom_routes_test.rb

@@ -7,11 +7,12 @@ class DeviseTokenAuth::CustomRoutesTest < ActiveSupport::TestCase
     Rails.application.reload_routes!
   end
   test 'custom controllers' do
-    class ActionDispatch::Routing::Mapper
-        include Mocha::ParameterMatchers
-    end
     Rails.application.routes.draw do
-      self.expects(:devise_for).with(
+      mapper = self
+      mapper.singleton_class.include(Mocha::API)
+      mapper.singleton_class.include(Mocha::ParameterMatchers)
+
+      mapper.expects(:devise_for).with(
         :users,
         has_entries(
           controllers: has_entries(

data/test/models/user_test.rb

@@ -220,5 +220,32 @@ class UserTest < ActiveSupport::TestCase
       # We should have exactly 2 tokens: the new one and client_3
       assert_equal 2, @resource.tokens.length
     end
+
+    # Regression: with a calendar ActiveSupport::Duration lifespan, the token
+    #   expiry is advanced by calendar (Time.zone.now + 2.months) while the old
+    #   eager purge compared against an average-seconds threshold
+    #   (token_lifespan.to_i). The freshly minted token's expiry sat just past
+    #   that threshold and was silently dropped, leaving a 200 response whose
+    #   advertised access-token no longer existed in user.tokens.
+    test 'keeps the freshly created token at the device cap with a calendar lifespan' do
+      DeviseTokenAuth.max_number_of_devices = 2
+      DeviseTokenAuth.token_lifespan = 2.months
+
+      # Fill the cap with tokens created a few hours ago (calendar expiry).
+      old_time = 4.hours.ago
+      @resource.tokens = {}
+      %w[client_1 client_2].each do |client|
+        @resource.tokens[client] = {
+          'token' => 'x',
+          'expiry' => (old_time + DeviseTokenAuth.token_lifespan).to_i
+        }
+      end
+
+      tok = @resource.create_token
+
+      assert @resource.tokens.key?(tok.client),
+             'Freshly created token must survive clean_old_tokens'
+      assert_equal DeviseTokenAuth.max_number_of_devices, @resource.tokens.length
+    end
   end
 end

data/test/test_helper.rb

@@ -38,7 +38,14 @@ end
 class ActiveSupport::TestCase
   include FactoryBot::Syntax::Methods
 
-  ActiveRecord::Migration.check_pending! if DEVISE_TOKEN_AUTH_ORM == :active_record
+  if DEVISE_TOKEN_AUTH_ORM == :active_record
+    # `check_pending!` was deprecated in Rails 7.1 and removed in Rails 8.0
+    if ActiveRecord::Migration.respond_to?(:check_all_pending!)
+      ActiveRecord::Migration.check_all_pending!
+    else
+      ActiveRecord::Migration.check_pending!
+    end
+  end
 
   strategies = { active_record: :transaction,
                  mongoid: :deletion }

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise_token_auth
 version: !ruby/object:Gem::Version
-  version: 1.2.6
+  version: 1.3.0
 platform: ruby
 authors:
 - Lynn Hurley
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-11-21 00:00:00.000000000 Z
+date: 2026-07-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -19,7 +19,7 @@ dependencies:
         version: 4.2.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.2'
+        version: '8.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -29,7 +29,7 @@ dependencies:
         version: 4.2.0
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8.2'
+        version: '8.3'
 - !ruby/object:Gem::Dependency
   name: devise
   requirement: !ruby/object:Gem::Requirement
@@ -39,7 +39,7 @@ dependencies:
         version: 3.5.2
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '6'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -49,7 +49,7 @@ dependencies:
         version: 3.5.2
     - - "<"
       - !ruby/object:Gem::Version
-        version: '5'
+        version: '6'
 - !ruby/object:Gem::Dependency
   name: bcrypt
   requirement: !ruby/object:Gem::Requirement
@@ -82,16 +82,22 @@ dependencies:
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '1.4'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
 - !ruby/object:Gem::Dependency
   name: pg
   requirement: !ruby/object:Gem::Requirement
@@ -129,7 +135,7 @@ dependencies:
         version: '4'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8'
+        version: '10'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -139,7 +145,7 @@ dependencies:
         version: '4'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '8'
+        version: '10'
 - !ruby/object:Gem::Dependency
   name: mongoid-locker
   requirement: !ruby/object:Gem::Requirement