devise_token_auth 1.1.2 → 1.1.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/app/controllers/devise_token_auth/application_controller.rb +2 -2
- data/app/controllers/devise_token_auth/omniauth_callbacks_controller.rb +25 -3
- data/app/controllers/devise_token_auth/passwords_controller.rb +31 -13
- data/app/controllers/devise_token_auth/registrations_controller.rb +1 -1
- data/config/locales/da-DK.yml +2 -0
- data/config/locales/de.yml +2 -0
- data/config/locales/en.yml +2 -0
- data/config/locales/es.yml +2 -0
- data/config/locales/fr.yml +2 -0
- data/config/locales/he.yml +2 -0
- data/config/locales/it.yml +2 -0
- data/config/locales/ja.yml +2 -0
- data/config/locales/nl.yml +2 -0
- data/config/locales/pl.yml +2 -0
- data/config/locales/pt-BR.yml +2 -0
- data/config/locales/pt.yml +2 -0
- data/config/locales/ro.yml +2 -0
- data/config/locales/ru.yml +2 -0
- data/config/locales/sq.yml +2 -0
- data/config/locales/sv.yml +2 -0
- data/config/locales/uk.yml +2 -0
- data/config/locales/vi.yml +2 -0
- data/config/locales/zh-CN.yml +2 -0
- data/config/locales/zh-HK.yml +2 -0
- data/config/locales/zh-TW.yml +2 -0
- data/lib/devise_token_auth/engine.rb +3 -1
- data/lib/devise_token_auth/version.rb +1 -1
- data/test/controllers/devise_token_auth/omniauth_callbacks_controller_test.rb +107 -42
- data/test/controllers/devise_token_auth/passwords_controller_test.rb +112 -8
- data/test/controllers/devise_token_auth/registrations_controller_test.rb +3 -3
- data/test/dummy/tmp/generators/app/models/mang.rb +7 -0
- data/test/dummy/tmp/generators/app/models/user.rb +7 -0
- data/test/dummy/tmp/generators/config/initializers/devise_token_auth.rb +48 -0
- data/test/dummy/tmp/generators/config/routes.rb +9 -0
- data/test/dummy/tmp/generators/db/migrate/20170630171909_devise_token_auth_create_mangs.rb +54 -0
- data/test/dummy/tmp/generators/db/migrate/20170630171909_devise_token_auth_create_users.rb +54 -0
- data/test/factories/users.rb +1 -1
- metadata +15 -8
- data/test/dummy/tmp/generators/app/views/devise/mailer/confirmation_instructions.html.erb +0 -5
- data/test/dummy/tmp/generators/app/views/devise/mailer/reset_password_instructions.html.erb +0 -8
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 9481d98d2610adb862b38d97afadba1d1a58594eab37606522fc0a0700e403b1
|
|
4
|
+
data.tar.gz: c9f1900cbabbffebc8fb84091ec35dda733c18f16537b562962f4274c464d680
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: ea77bdbf1b588b53dfdea504ed37967f3c8dacb7c492a5a741444057de29e2e0443e535a98be60862e2139e6c768389627e438a27838afe2904c77f80c6c31dc
|
|
7
|
+
data.tar.gz: 533ee038f53fb8f63f521522468bbf966577d3ab941c3b689c948d45cb1f11524f8738f1bdcc0e48179a11008f123eea5831f1429d4426e847abddf9b5bbcec7
|
|
@@ -16,8 +16,8 @@ module DeviseTokenAuth
|
|
|
16
16
|
|
|
17
17
|
protected
|
|
18
18
|
|
|
19
|
-
def blacklisted_redirect_url?
|
|
20
|
-
DeviseTokenAuth.redirect_whitelist && !DeviseTokenAuth::Url.whitelisted?(
|
|
19
|
+
def blacklisted_redirect_url?(redirect_url)
|
|
20
|
+
DeviseTokenAuth.redirect_whitelist && !DeviseTokenAuth::Url.whitelisted?(redirect_url)
|
|
21
21
|
end
|
|
22
22
|
|
|
23
23
|
def build_redirect_headers(access_token, client, redirect_header_options = {})
|
|
@@ -3,6 +3,9 @@
|
|
|
3
3
|
module DeviseTokenAuth
|
|
4
4
|
class OmniauthCallbacksController < DeviseTokenAuth::ApplicationController
|
|
5
5
|
attr_reader :auth_params
|
|
6
|
+
|
|
7
|
+
before_action :validate_auth_origin_url_param
|
|
8
|
+
|
|
6
9
|
skip_before_action :set_user_by_token, raise: false
|
|
7
10
|
skip_after_action :update_auth_header
|
|
8
11
|
|
|
@@ -75,6 +78,11 @@ module DeviseTokenAuth
|
|
|
75
78
|
render_data_or_redirect('authFailure', error: @error)
|
|
76
79
|
end
|
|
77
80
|
|
|
81
|
+
def validate_auth_origin_url_param
|
|
82
|
+
return render_error_not_allowed_auth_origin_url if auth_origin_url && blacklisted_redirect_url?(auth_origin_url)
|
|
83
|
+
end
|
|
84
|
+
|
|
85
|
+
|
|
78
86
|
protected
|
|
79
87
|
|
|
80
88
|
# this will be determined differently depending on the action that calls
|
|
@@ -137,10 +145,18 @@ module DeviseTokenAuth
|
|
|
137
145
|
omniauth_params['omniauth_window_type']
|
|
138
146
|
end
|
|
139
147
|
|
|
140
|
-
def
|
|
148
|
+
def unsafe_auth_origin_url
|
|
141
149
|
omniauth_params['auth_origin_url'] || omniauth_params['origin']
|
|
142
150
|
end
|
|
143
151
|
|
|
152
|
+
|
|
153
|
+
def auth_origin_url
|
|
154
|
+
if unsafe_auth_origin_url && blacklisted_redirect_url?(unsafe_auth_origin_url)
|
|
155
|
+
return nil
|
|
156
|
+
end
|
|
157
|
+
return unsafe_auth_origin_url
|
|
158
|
+
end
|
|
159
|
+
|
|
144
160
|
# in the success case, omniauth_window_type is in the omniauth_params.
|
|
145
161
|
# in the failure case, it is in a query param. See monkey patch above
|
|
146
162
|
def omniauth_window_type
|
|
@@ -186,8 +202,13 @@ module DeviseTokenAuth
|
|
|
186
202
|
@token = @resource.create_token
|
|
187
203
|
end
|
|
188
204
|
|
|
205
|
+
def render_error_not_allowed_auth_origin_url
|
|
206
|
+
message = I18n.t('devise_token_auth.omniauth.not_allowed_redirect_url', redirect_url: unsafe_auth_origin_url)
|
|
207
|
+
render_data_or_redirect('authFailure', error: message)
|
|
208
|
+
end
|
|
209
|
+
|
|
189
210
|
def render_data(message, data)
|
|
190
|
-
@data = data.merge(message: message)
|
|
211
|
+
@data = data.merge(message: ActionController::Base.helpers.sanitize(message))
|
|
191
212
|
render layout: nil, template: 'devise_token_auth/omniauth_external_window'
|
|
192
213
|
end
|
|
193
214
|
|
|
@@ -224,7 +245,7 @@ module DeviseTokenAuth
|
|
|
224
245
|
<html>
|
|
225
246
|
<head></head>
|
|
226
247
|
<body>
|
|
227
|
-
#{text}
|
|
248
|
+
#{ActionController::Base.helpers.sanitize(text)}
|
|
228
249
|
</body>
|
|
229
250
|
</html>)
|
|
230
251
|
end
|
|
@@ -261,4 +282,5 @@ module DeviseTokenAuth
|
|
|
261
282
|
@resource
|
|
262
283
|
end
|
|
263
284
|
end
|
|
285
|
+
|
|
264
286
|
end
|
|
@@ -2,12 +2,10 @@
|
|
|
2
2
|
|
|
3
3
|
module DeviseTokenAuth
|
|
4
4
|
class PasswordsController < DeviseTokenAuth::ApplicationController
|
|
5
|
-
before_action :set_user_by_token, only: [:update]
|
|
6
5
|
before_action :validate_redirect_url_param, only: [:create, :edit]
|
|
7
6
|
skip_after_action :update_auth_header, only: [:create, :edit]
|
|
8
7
|
|
|
9
|
-
# this action is responsible for generating password reset tokens and
|
|
10
|
-
# sending emails
|
|
8
|
+
# this action is responsible for generating password reset tokens and sending emails
|
|
11
9
|
def create
|
|
12
10
|
return render_create_error_missing_email unless resource_params[:email]
|
|
13
11
|
|
|
@@ -39,11 +37,10 @@ module DeviseTokenAuth
|
|
|
39
37
|
@resource = resource_class.with_reset_password_token(resource_params[:reset_password_token])
|
|
40
38
|
|
|
41
39
|
if @resource && @resource.reset_password_period_valid?
|
|
42
|
-
token = @resource.create_token
|
|
40
|
+
token = @resource.create_token unless require_client_password_reset_token?
|
|
43
41
|
|
|
44
42
|
# ensure that user is confirmed
|
|
45
43
|
@resource.skip_confirmation! if confirmable_enabled? && !@resource.confirmed_at
|
|
46
|
-
|
|
47
44
|
# allow user to change password once without current_password
|
|
48
45
|
@resource.allow_password_change = true if recoverable_enabled?
|
|
49
46
|
|
|
@@ -51,12 +48,16 @@ module DeviseTokenAuth
|
|
|
51
48
|
|
|
52
49
|
yield @resource if block_given?
|
|
53
50
|
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
51
|
+
if require_client_password_reset_token?
|
|
52
|
+
redirect_to DeviseTokenAuth::Url.generate(@redirect_url, reset_password_token: resource_params[:reset_password_token])
|
|
53
|
+
else
|
|
54
|
+
redirect_header_options = { reset_password: true }
|
|
55
|
+
redirect_headers = build_redirect_headers(token.token,
|
|
56
|
+
token.client,
|
|
57
|
+
redirect_header_options)
|
|
58
|
+
redirect_to(@resource.build_auth_url(@redirect_url,
|
|
59
|
+
redirect_headers))
|
|
60
|
+
end
|
|
60
61
|
else
|
|
61
62
|
render_edit_error
|
|
62
63
|
end
|
|
@@ -64,6 +65,15 @@ module DeviseTokenAuth
|
|
|
64
65
|
|
|
65
66
|
def update
|
|
66
67
|
# make sure user is authorized
|
|
68
|
+
if require_client_password_reset_token? && resource_params[:reset_password_token]
|
|
69
|
+
@resource = resource_class.with_reset_password_token(resource_params[:reset_password_token])
|
|
70
|
+
return render_update_error_unauthorized unless @resource
|
|
71
|
+
|
|
72
|
+
@token = @resource.create_token
|
|
73
|
+
else
|
|
74
|
+
@resource = set_user_by_token
|
|
75
|
+
end
|
|
76
|
+
|
|
67
77
|
return render_update_error_unauthorized unless @resource
|
|
68
78
|
|
|
69
79
|
# make sure account doesn't use oauth2 provider
|
|
@@ -90,7 +100,7 @@ module DeviseTokenAuth
|
|
|
90
100
|
protected
|
|
91
101
|
|
|
92
102
|
def resource_update_method
|
|
93
|
-
allow_password_change = recoverable_enabled? && @resource.allow_password_change == true
|
|
103
|
+
allow_password_change = recoverable_enabled? && @resource.allow_password_change == true || require_client_password_reset_token?
|
|
94
104
|
if DeviseTokenAuth.check_current_password_before_update == false || allow_password_change
|
|
95
105
|
'update'
|
|
96
106
|
else
|
|
@@ -182,7 +192,15 @@ module DeviseTokenAuth
|
|
|
182
192
|
)
|
|
183
193
|
|
|
184
194
|
return render_create_error_missing_redirect_url unless @redirect_url
|
|
185
|
-
return render_error_not_allowed_redirect_url if blacklisted_redirect_url?
|
|
195
|
+
return render_error_not_allowed_redirect_url if blacklisted_redirect_url?(@redirect_url)
|
|
196
|
+
end
|
|
197
|
+
|
|
198
|
+
def reset_password_token_as_raw?(recoverable)
|
|
199
|
+
recoverable && recoverable.reset_password_token.present? && !require_client_password_reset_token?
|
|
200
|
+
end
|
|
201
|
+
|
|
202
|
+
def require_client_password_reset_token?
|
|
203
|
+
DeviseTokenAuth.require_client_password_reset_token
|
|
186
204
|
end
|
|
187
205
|
end
|
|
188
206
|
end
|
|
@@ -28,7 +28,7 @@ module DeviseTokenAuth
|
|
|
28
28
|
end
|
|
29
29
|
|
|
30
30
|
# if whitelist is set, validate redirect_url against whitelist
|
|
31
|
-
return render_create_error_redirect_url_not_allowed if blacklisted_redirect_url?
|
|
31
|
+
return render_create_error_redirect_url_not_allowed if blacklisted_redirect_url?(@redirect_url)
|
|
32
32
|
|
|
33
33
|
# override email confirmation, must be sent manually from ctrl
|
|
34
34
|
callback_name = defined?(ActiveRecord) && resource_class < ActiveRecord::Base ? :commit : :create
|
data/config/locales/da-DK.yml
CHANGED
|
@@ -14,6 +14,8 @@ da-DK:
|
|
|
14
14
|
account_with_uid_destroyed: "Kontoen med UID '%{uid}' er slettet."
|
|
15
15
|
account_to_destroy_not_found: "Kan ikke finde kontoen som skal slettes."
|
|
16
16
|
user_not_found: "Brugeren ikke fundet."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Omdirigering til '%{redirect_url}' er ikke tilladt."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Du skal udfylde email feltet."
|
|
19
21
|
missing_redirect_url: "Der er ingen omdirigeringsadresse."
|
data/config/locales/de.yml
CHANGED
|
@@ -14,6 +14,8 @@ de:
|
|
|
14
14
|
account_with_uid_destroyed: "Account mit der uid '%{uid}' wurde gelöscht."
|
|
15
15
|
account_to_destroy_not_found: "Der zu löschende Account kann nicht gefunden werden."
|
|
16
16
|
user_not_found: "Benutzer kann nicht gefunden werden."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Weiterleitung zu '%{redirect_url}' ist nicht gestattet."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Sie müssen eine E-Mail-Adresse angeben."
|
|
19
21
|
missing_redirect_url: "Es fehlt die URL zu Weiterleitung."
|
data/config/locales/en.yml
CHANGED
|
@@ -14,6 +14,8 @@ en:
|
|
|
14
14
|
account_with_uid_destroyed: "Account with UID '%{uid}' has been destroyed."
|
|
15
15
|
account_to_destroy_not_found: "Unable to locate account for destruction."
|
|
16
16
|
user_not_found: "User not found."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Redirect to '%{redirect_url}' not allowed."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "You must provide an email address."
|
|
19
21
|
missing_redirect_url: "Missing redirect URL."
|
data/config/locales/es.yml
CHANGED
|
@@ -14,6 +14,8 @@ es:
|
|
|
14
14
|
account_with_uid_destroyed: "La cuenta con el identificador '%{uid}' se ha eliminado."
|
|
15
15
|
account_to_destroy_not_found: "No se puede encontrar la cuenta a borrar."
|
|
16
16
|
user_not_found: "Usuario no encontrado."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Redirección hacia '%{redirect_url}' no esta permitida."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Debe incluir un correo electrónico."
|
|
19
21
|
missing_redirect_url: "Falta el Url de redirección."
|
data/config/locales/fr.yml
CHANGED
|
@@ -14,6 +14,8 @@ fr:
|
|
|
14
14
|
account_with_uid_destroyed: "Le compte avec l'identifiant '%{uid}' a été supprimé."
|
|
15
15
|
account_to_destroy_not_found: "Le compte à supprimer est introuvable."
|
|
16
16
|
user_not_found: "Utilisateur introuvable."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Redirection vers '%{redirect_url}' n'est pas autorisée."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Vous devez soumettre un e-mail."
|
|
19
21
|
missing_redirect_url: "URL de redirection manquante."
|
data/config/locales/he.yml
CHANGED
|
@@ -14,6 +14,8 @@ he:
|
|
|
14
14
|
account_with_uid_destroyed: "חשבון עם UID '%{uid}' הושמד."
|
|
15
15
|
account_to_destroy_not_found: "לא ניתן לאתר חשבון להשמדה."
|
|
16
16
|
user_not_found: "המשתמש לא נמצא."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "הפניה אל '%{redirect_url}' אינה מותרת."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "עליך לספק כתובת דוא\"ל."
|
|
19
21
|
missing_redirect_url: "כתובת אתר להפניה מחדש חסרה."
|
data/config/locales/it.yml
CHANGED
|
@@ -14,6 +14,8 @@ it:
|
|
|
14
14
|
account_with_uid_destroyed: "L'account con UID '%{uid}' è stato eliminato."
|
|
15
15
|
account_to_destroy_not_found: "Impossibile trovare l'account da eliminare."
|
|
16
16
|
user_not_found: "Utente non trovato."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Redirezione a '%{redirect_url}' non consentita."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Devi fornire un indirizzo email."
|
|
19
21
|
missing_redirect_url: "Redirect URL mancante."
|
data/config/locales/ja.yml
CHANGED
|
@@ -14,6 +14,8 @@ ja:
|
|
|
14
14
|
account_with_uid_destroyed: "'%{uid}' のアカウントは削除されました。"
|
|
15
15
|
account_to_destroy_not_found: "削除するアカウントが見つかりません。"
|
|
16
16
|
user_not_found: "ユーザーが見つかりません。"
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "'%{redirect_url}' へのリダイレクトは許可されていません。"
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "メールアドレスが与えられていません。"
|
|
19
21
|
missing_redirect_url: "リダイレクト URL が与えられていません。"
|
data/config/locales/nl.yml
CHANGED
|
@@ -14,6 +14,8 @@ nl:
|
|
|
14
14
|
account_with_uid_destroyed: "Account met id '%{uid}' is verwijderd."
|
|
15
15
|
account_to_destroy_not_found: "Te verwijderen account niet gevonden."
|
|
16
16
|
user_not_found: "Gebruiker niet gevonden."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Redirect naar '%{redirect_url}' niet toegestaan."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Je moet een e-mailadres opgeven."
|
|
19
21
|
missing_redirect_url: "Redirect URL ontbreekt."
|
data/config/locales/pl.yml
CHANGED
|
@@ -14,6 +14,8 @@ pl:
|
|
|
14
14
|
account_with_uid_destroyed: "Konto z uid '%{uid}' zostało usunięte."
|
|
15
15
|
account_to_destroy_not_found: "Nie odnaleziono konta do usunięcia."
|
|
16
16
|
user_not_found: "Użytkownik nie został odnaleziony."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Przekierowanie na adres '%{redirect_url}' nie jest dozwolone."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Musisz wprowadzić adres e-mail."
|
|
19
21
|
missing_redirect_url: "Brak adresu zwrotnego."
|
data/config/locales/pt-BR.yml
CHANGED
|
@@ -14,6 +14,8 @@ pt-BR:
|
|
|
14
14
|
account_with_uid_destroyed: "A conta com uid '%{uid}' foi excluída."
|
|
15
15
|
account_to_destroy_not_found: "Não foi possível encontrar a conta para exclusão."
|
|
16
16
|
user_not_found: "Usuário não encontrado."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Redirecionamento para '%{redirect_url}' não permitido."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Informe o endereço de e-mail."
|
|
19
21
|
missing_redirect_url: "URL para redirecionamento não informada."
|
data/config/locales/pt.yml
CHANGED
|
@@ -14,6 +14,8 @@ pt:
|
|
|
14
14
|
account_with_uid_destroyed: "A conta com uid '%{uid}' foi excluída."
|
|
15
15
|
account_to_destroy_not_found: "Não foi possível encontrar a conta para exclusão."
|
|
16
16
|
user_not_found: "Utilizador não encontrado."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Redirecionamento para '%{redirect_url}' não permitido."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Informe o endereço de e-mail."
|
|
19
21
|
missing_redirect_url: "URL para redirecionamento não informada."
|
data/config/locales/ro.yml
CHANGED
|
@@ -14,6 +14,8 @@ ro:
|
|
|
14
14
|
account_with_uid_destroyed: "Contul cu UID '%{uid}' a fost șters."
|
|
15
15
|
account_to_destroy_not_found: "Nu se poate localiza contul pentru ștergere."
|
|
16
16
|
user_not_found: "Utilizatorul nu a fost găsit."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Redirecționarea către '%{redirect_url}' nu este permisă."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Trebuie să introduci o adresă de e-mail."
|
|
19
21
|
missing_redirect_url: "URL-ul pentru redirecționare lipsește."
|
data/config/locales/ru.yml
CHANGED
|
@@ -14,6 +14,8 @@ ru:
|
|
|
14
14
|
account_with_uid_destroyed: "Учетная запись с uid '%{uid}' удалена."
|
|
15
15
|
account_to_destroy_not_found: "Не удается найти учетную запись для удаления."
|
|
16
16
|
user_not_found: "Пользователь не найден."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Переадресация на '%{redirect_url}' не разрешена."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Вы должны указать адрес электронной почты."
|
|
19
21
|
missing_redirect_url: "Отсутствует адрес переадресации."
|
data/config/locales/sq.yml
CHANGED
|
@@ -14,6 +14,8 @@ sq:
|
|
|
14
14
|
account_with_uid_destroyed: "Llogaria me UID-në '%{uid}' është fshirë."
|
|
15
15
|
account_to_destroy_not_found: "Nuk u gjet llogaria për fshirje."
|
|
16
16
|
user_not_found: "Përdoruesi nuk u gjet."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Nuk lejohet shkuarja tek URL-ja '%{redirect_url}'."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Ju duhet të jepni një email adresë."
|
|
19
21
|
missing_redirect_url: "Mungon URL-ja për ridërgim."
|
data/config/locales/sv.yml
CHANGED
|
@@ -14,6 +14,8 @@ sv:
|
|
|
14
14
|
account_with_uid_destroyed: "Kontot med UID '%{uid}' har tagits bort."
|
|
15
15
|
account_to_destroy_not_found: "Kunde inte hitta kontot för borttagning."
|
|
16
16
|
user_not_found: "Användaren hittades ej."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Omdirigering till '%{redirect_url}' ej tillåten."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Du måste ange en emailadress."
|
|
19
21
|
missing_redirect_url: "Saknar en omdirigerings-URL."
|
data/config/locales/uk.yml
CHANGED
|
@@ -14,6 +14,8 @@ uk:
|
|
|
14
14
|
account_with_uid_destroyed: "Акаунт з UID '%{uid}' було видалено."
|
|
15
15
|
account_to_destroy_not_found: "Неможливо знайти акаунт для видалення."
|
|
16
16
|
user_not_found: "Користувача не знайдено"
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Перенаправлення до '%{redirect_url}' не дозволено."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Ви маєте ввести email адресу."
|
|
19
21
|
missing_redirect_url: "Немає URL для перенаправлення."
|
data/config/locales/vi.yml
CHANGED
|
@@ -14,6 +14,8 @@ vi:
|
|
|
14
14
|
account_with_uid_destroyed: "Tài khoản với UID '%{uid}' vừa bị phá hủy."
|
|
15
15
|
account_to_destroy_not_found: "Không thể xác định tài khoản cho việc phá hủy."
|
|
16
16
|
user_not_found: "Người dùng không tìm thấy."
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "Chuyển hướng tới '%{redirect_url}' không được phép."
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "Bạn cần cung cấp địa chỉ email."
|
|
19
21
|
missing_redirect_url: "Thiếu đường đẫn URL."
|
data/config/locales/zh-CN.yml
CHANGED
|
@@ -14,6 +14,8 @@ zh-CN:
|
|
|
14
14
|
account_with_uid_destroyed: "账号 '%{uid}' 已被移除。"
|
|
15
15
|
account_to_destroy_not_found: "无法找到目标帐号。"
|
|
16
16
|
user_not_found: "找不到帐号。"
|
|
17
|
+
omniauth:
|
|
18
|
+
not_allowed_redirect_url: "不支持转向到 '%{redirect_url}'"
|
|
17
19
|
passwords:
|
|
18
20
|
missing_email: "必需提供邮箱。"
|
|
19
21
|
missing_redirect_url: "欠缺 redirect URL."
|
data/config/locales/zh-HK.yml
CHANGED
|
@@ -16,6 +16,8 @@ zh-TW:
|
|
|
16
16
|
account_with_uid_destroyed: "帳號 '%{uid}' 已被移除。"
|
|
17
17
|
account_to_destroy_not_found: "無法找到目標帳號。"
|
|
18
18
|
user_not_found: "找不到帳號。"
|
|
19
|
+
omniauth:
|
|
20
|
+
not_allowed_redirect_url: "不支援轉向到 '%{redirect_url}'"
|
|
19
21
|
passwords:
|
|
20
22
|
missing_email: "必需提供電郵。"
|
|
21
23
|
missing_redirect_url: "欠缺 redirect URL."
|
data/config/locales/zh-TW.yml
CHANGED
|
@@ -16,6 +16,8 @@ zh-TW:
|
|
|
16
16
|
account_with_uid_destroyed: "帳號 '%{uid}' 已被移除。"
|
|
17
17
|
account_to_destroy_not_found: "無法找到目標帳號。"
|
|
18
18
|
user_not_found: "找不到帳號。"
|
|
19
|
+
omniauth:
|
|
20
|
+
not_allowed_redirect_url: "不支援轉向到 '%{redirect_url}'"
|
|
19
21
|
passwords:
|
|
20
22
|
missing_email: "必需提供電郵。"
|
|
21
23
|
missing_redirect_url: "欠缺 redirect URL."
|
|
@@ -25,7 +25,8 @@ module DeviseTokenAuth
|
|
|
25
25
|
:remove_tokens_after_password_reset,
|
|
26
26
|
:default_callbacks,
|
|
27
27
|
:headers_names,
|
|
28
|
-
:bypass_sign_in
|
|
28
|
+
:bypass_sign_in,
|
|
29
|
+
:require_client_password_reset_token
|
|
29
30
|
|
|
30
31
|
self.change_headers_on_each_request = true
|
|
31
32
|
self.max_number_of_devices = 10
|
|
@@ -46,6 +47,7 @@ module DeviseTokenAuth
|
|
|
46
47
|
'uid': 'uid',
|
|
47
48
|
'token-type': 'token-type' }
|
|
48
49
|
self.bypass_sign_in = true
|
|
50
|
+
self.require_client_password_reset_token = false
|
|
49
51
|
|
|
50
52
|
def self.setup(&block)
|
|
51
53
|
yield self
|
|
@@ -317,60 +317,125 @@ class OmniauthTest < ActionDispatch::IntegrationTest
|
|
|
317
317
|
end
|
|
318
318
|
|
|
319
319
|
describe 'Using redirect_whitelist' do
|
|
320
|
-
before do
|
|
321
|
-
@user_email = 'slemp.diggler@sillybandz.gov'
|
|
322
|
-
OmniAuth.config.mock_auth[:facebook] = OmniAuth::AuthHash.new(
|
|
323
|
-
provider: 'facebook',
|
|
324
|
-
uid: '123545',
|
|
325
|
-
info: {
|
|
326
|
-
name: 'chong',
|
|
327
|
-
email: @user_email
|
|
328
|
-
}
|
|
329
|
-
)
|
|
330
|
-
@good_redirect_url = Faker::Internet.url
|
|
331
|
-
@bad_redirect_url = Faker::Internet.url
|
|
332
|
-
DeviseTokenAuth.redirect_whitelist = [@good_redirect_url]
|
|
333
|
-
end
|
|
334
320
|
|
|
335
|
-
|
|
336
|
-
|
|
337
|
-
|
|
321
|
+
describe "newWindow" do
|
|
322
|
+
before do
|
|
323
|
+
@user_email = 'slemp.diggler@sillybandz.gov'
|
|
324
|
+
OmniAuth.config.mock_auth[:facebook] = OmniAuth::AuthHash.new(
|
|
325
|
+
provider: 'facebook',
|
|
326
|
+
uid: '123545',
|
|
327
|
+
info: {
|
|
328
|
+
name: 'chong',
|
|
329
|
+
email: @user_email
|
|
330
|
+
}
|
|
331
|
+
)
|
|
332
|
+
@good_redirect_url = Faker::Internet.url
|
|
333
|
+
@bad_redirect_url = Faker::Internet.url
|
|
334
|
+
DeviseTokenAuth.redirect_whitelist = [@good_redirect_url]
|
|
335
|
+
end
|
|
338
336
|
|
|
339
|
-
|
|
340
|
-
|
|
341
|
-
|
|
342
|
-
omniauth_window_type: 'newWindow' }
|
|
337
|
+
teardown do
|
|
338
|
+
DeviseTokenAuth.redirect_whitelist = nil
|
|
339
|
+
end
|
|
343
340
|
|
|
344
|
-
|
|
341
|
+
test 'request using non-whitelisted redirect fail' do
|
|
342
|
+
get '/auth/facebook',
|
|
343
|
+
params: { auth_origin_url: @bad_redirect_url,
|
|
344
|
+
omniauth_window_type: 'newWindow' }
|
|
345
345
|
|
|
346
|
-
|
|
347
|
-
|
|
348
|
-
|
|
346
|
+
follow_all_redirects!
|
|
347
|
+
|
|
348
|
+
data = get_parsed_data_json
|
|
349
|
+
assert_equal "Redirect to '#{@bad_redirect_url}' not allowed.",
|
|
350
|
+
data['error']
|
|
351
|
+
end
|
|
352
|
+
|
|
353
|
+
test 'request to whitelisted redirect should succeed' do
|
|
354
|
+
get '/auth/facebook',
|
|
355
|
+
params: {
|
|
356
|
+
auth_origin_url: @good_redirect_url,
|
|
357
|
+
omniauth_window_type: 'newWindow'
|
|
358
|
+
}
|
|
359
|
+
|
|
360
|
+
follow_all_redirects!
|
|
361
|
+
|
|
362
|
+
data = get_parsed_data_json
|
|
363
|
+
assert_equal @user_email, data['email']
|
|
364
|
+
end
|
|
365
|
+
|
|
366
|
+
test 'should support wildcards' do
|
|
367
|
+
DeviseTokenAuth.redirect_whitelist = ["#{@good_redirect_url[0..8]}*"]
|
|
368
|
+
get '/auth/facebook',
|
|
369
|
+
params: { auth_origin_url: @good_redirect_url,
|
|
370
|
+
omniauth_window_type: 'newWindow' }
|
|
371
|
+
|
|
372
|
+
follow_all_redirects!
|
|
373
|
+
|
|
374
|
+
data = get_parsed_data_json
|
|
375
|
+
assert_equal @user_email, data['email']
|
|
376
|
+
end
|
|
349
377
|
end
|
|
350
378
|
|
|
351
|
-
|
|
352
|
-
|
|
353
|
-
|
|
354
|
-
|
|
355
|
-
|
|
379
|
+
describe "sameWindow" do
|
|
380
|
+
before do
|
|
381
|
+
@user_email = 'slemp.diggler@sillybandz.gov'
|
|
382
|
+
OmniAuth.config.mock_auth[:facebook] = OmniAuth::AuthHash.new(
|
|
383
|
+
provider: 'facebook',
|
|
384
|
+
uid: '123545',
|
|
385
|
+
info: {
|
|
386
|
+
name: 'chong',
|
|
387
|
+
email: @user_email
|
|
356
388
|
}
|
|
389
|
+
)
|
|
390
|
+
@good_redirect_url = '/auth_origin'
|
|
391
|
+
@bad_redirect_url = Faker::Internet.url
|
|
392
|
+
DeviseTokenAuth.redirect_whitelist = [@good_redirect_url]
|
|
393
|
+
end
|
|
357
394
|
|
|
358
|
-
|
|
395
|
+
teardown do
|
|
396
|
+
DeviseTokenAuth.redirect_whitelist = nil
|
|
397
|
+
end
|
|
359
398
|
|
|
360
|
-
|
|
361
|
-
|
|
362
|
-
|
|
399
|
+
test 'request using non-whitelisted redirect fail' do
|
|
400
|
+
get '/auth/facebook',
|
|
401
|
+
params: { auth_origin_url: @bad_redirect_url,
|
|
402
|
+
omniauth_window_type: 'sameWindow' }
|
|
363
403
|
|
|
364
|
-
|
|
365
|
-
|
|
366
|
-
|
|
367
|
-
|
|
368
|
-
|
|
404
|
+
follow_all_redirects!
|
|
405
|
+
|
|
406
|
+
assert_equal 200, response.status
|
|
407
|
+
assert_equal true, response.body.include?("Redirect to '#{@bad_redirect_url}' not allowed")
|
|
408
|
+
end
|
|
409
|
+
|
|
410
|
+
test 'request to whitelisted redirect should succeed' do
|
|
411
|
+
get '/auth/facebook',
|
|
412
|
+
params: {
|
|
413
|
+
auth_origin_url: '/auth_origin',
|
|
414
|
+
omniauth_window_type: 'sameWindow'
|
|
415
|
+
}
|
|
416
|
+
|
|
417
|
+
follow_all_redirects!
|
|
418
|
+
|
|
419
|
+
assert_equal 200, response.status
|
|
420
|
+
assert_equal false, response.body.include?("Redirect to '#{@good_redirect_url}' not allowed")
|
|
421
|
+
end
|
|
422
|
+
|
|
423
|
+
test 'should support wildcards' do
|
|
424
|
+
DeviseTokenAuth.redirect_whitelist = ["#{@good_redirect_url[0..8]}*"]
|
|
425
|
+
get '/auth/facebook',
|
|
426
|
+
params: {
|
|
427
|
+
auth_origin_url: '/auth_origin',
|
|
428
|
+
omniauth_window_type: 'sameWindow'
|
|
429
|
+
}
|
|
430
|
+
|
|
431
|
+
follow_all_redirects!
|
|
432
|
+
|
|
433
|
+
assert_equal 200, response.status
|
|
434
|
+
assert_equal false, response.body.include?("Redirect to '#{@good_redirect_url}' not allowed")
|
|
435
|
+
end
|
|
369
436
|
|
|
370
|
-
follow_all_redirects!
|
|
371
437
|
|
|
372
|
-
data = get_parsed_data_json
|
|
373
|
-
assert_equal @user_email, data['email']
|
|
374
438
|
end
|
|
439
|
+
|
|
375
440
|
end
|
|
376
441
|
end
|
|
@@ -239,10 +239,10 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
|
|
|
239
239
|
end
|
|
240
240
|
end
|
|
241
241
|
|
|
242
|
-
describe '
|
|
242
|
+
describe 'Checking reset_password_token' do
|
|
243
243
|
before do
|
|
244
244
|
post :create, params: {
|
|
245
|
-
email:
|
|
245
|
+
email: @resource.email,
|
|
246
246
|
redirect_url: @redirect_url
|
|
247
247
|
}
|
|
248
248
|
|
|
@@ -440,6 +440,7 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
|
|
|
440
440
|
|
|
441
441
|
describe 'success' do
|
|
442
442
|
before do
|
|
443
|
+
DeviseTokenAuth.require_client_password_reset_token = false
|
|
443
444
|
@auth_headers = @resource.create_new_auth_token
|
|
444
445
|
request.headers.merge!(@auth_headers)
|
|
445
446
|
@new_password = Faker::Internet.password
|
|
@@ -504,6 +505,7 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
|
|
|
504
505
|
|
|
505
506
|
describe 'current password mismatch error' do
|
|
506
507
|
before do
|
|
508
|
+
DeviseTokenAuth.require_client_password_reset_token = false
|
|
507
509
|
@auth_headers = @resource.create_new_auth_token
|
|
508
510
|
request.headers.merge!(@auth_headers)
|
|
509
511
|
@new_password = Faker::Internet.password
|
|
@@ -520,7 +522,35 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
|
|
|
520
522
|
end
|
|
521
523
|
|
|
522
524
|
describe 'change password' do
|
|
523
|
-
describe '
|
|
525
|
+
describe 'using reset token' do
|
|
526
|
+
before do
|
|
527
|
+
DeviseTokenAuth.require_client_password_reset_token = true
|
|
528
|
+
@redirect_url = 'http://client-app.dev'
|
|
529
|
+
get_reset_token
|
|
530
|
+
edit_url = CGI.unescape(@mail.body.match(/href=\"(.+)\"/)[1])
|
|
531
|
+
query_parts = Rack::Utils.parse_nested_query(URI.parse(edit_url).query)
|
|
532
|
+
get :edit, params: query_parts
|
|
533
|
+
end
|
|
534
|
+
|
|
535
|
+
test 'request should be redirect' do
|
|
536
|
+
assert_equal 302, response.status
|
|
537
|
+
end
|
|
538
|
+
|
|
539
|
+
test 'request should redirect to correct redirect url' do
|
|
540
|
+
host = URI.parse(response.location).host
|
|
541
|
+
query_parts = Rack::Utils.parse_nested_query(URI.parse(response.location).query)
|
|
542
|
+
|
|
543
|
+
assert_equal 'client-app.dev', host
|
|
544
|
+
assert_equal @mail_reset_token, query_parts['reset_password_token']
|
|
545
|
+
assert_equal 1, query_parts.keys.size
|
|
546
|
+
end
|
|
547
|
+
|
|
548
|
+
teardown do
|
|
549
|
+
DeviseTokenAuth.require_client_password_reset_token = false
|
|
550
|
+
end
|
|
551
|
+
end
|
|
552
|
+
|
|
553
|
+
describe 'with valid headers' do
|
|
524
554
|
before do
|
|
525
555
|
@auth_headers = @resource.create_new_auth_token
|
|
526
556
|
request.headers.merge!(@auth_headers)
|
|
@@ -567,19 +597,93 @@ class DeviseTokenAuth::PasswordsControllerTest < ActionController::TestCase
|
|
|
567
597
|
end
|
|
568
598
|
end
|
|
569
599
|
|
|
570
|
-
describe '
|
|
600
|
+
describe 'without valid headers' do
|
|
571
601
|
before do
|
|
572
|
-
@
|
|
573
|
-
|
|
602
|
+
@resource.create_new_auth_token
|
|
603
|
+
new_password = Faker::Internet.password
|
|
574
604
|
|
|
575
|
-
put :update, params: { password:
|
|
576
|
-
password_confirmation:
|
|
605
|
+
put :update, params: { password: new_password,
|
|
606
|
+
password_confirmation: new_password }
|
|
577
607
|
end
|
|
578
608
|
|
|
579
609
|
test 'response should fail' do
|
|
580
610
|
assert_equal 401, response.status
|
|
581
611
|
end
|
|
582
612
|
end
|
|
613
|
+
|
|
614
|
+
describe 'with valid reset password token' do
|
|
615
|
+
before do
|
|
616
|
+
reset_password_token = @resource.send_reset_password_instructions
|
|
617
|
+
@new_password = Faker::Internet.password
|
|
618
|
+
@params = { password: @new_password,
|
|
619
|
+
password_confirmation: @new_password,
|
|
620
|
+
reset_password_token: reset_password_token }
|
|
621
|
+
end
|
|
622
|
+
|
|
623
|
+
describe 'with require_client_password_reset_token disabled' do
|
|
624
|
+
before do
|
|
625
|
+
DeviseTokenAuth.require_client_password_reset_token = false
|
|
626
|
+
put :update, params: @params
|
|
627
|
+
|
|
628
|
+
@data = JSON.parse(response.body)
|
|
629
|
+
@resource.reload
|
|
630
|
+
end
|
|
631
|
+
|
|
632
|
+
test 'request should be not be successful' do
|
|
633
|
+
assert_equal 401, response.status
|
|
634
|
+
end
|
|
635
|
+
end
|
|
636
|
+
|
|
637
|
+
describe 'with require_client_password_reset_token enabled' do
|
|
638
|
+
before do
|
|
639
|
+
DeviseTokenAuth.require_client_password_reset_token = true
|
|
640
|
+
put :update, params: @params
|
|
641
|
+
|
|
642
|
+
@data = JSON.parse(response.body)
|
|
643
|
+
@resource.reload
|
|
644
|
+
end
|
|
645
|
+
|
|
646
|
+
test 'request should be successful' do
|
|
647
|
+
assert_equal 200, response.status
|
|
648
|
+
end
|
|
649
|
+
|
|
650
|
+
test 'request should return success message' do
|
|
651
|
+
assert @data['message']
|
|
652
|
+
assert_equal @data['message'],
|
|
653
|
+
I18n.t('devise_token_auth.passwords.successfully_updated')
|
|
654
|
+
end
|
|
655
|
+
|
|
656
|
+
test 'new password should authenticate user' do
|
|
657
|
+
assert @resource.valid_password?(@new_password)
|
|
658
|
+
end
|
|
659
|
+
|
|
660
|
+
teardown do
|
|
661
|
+
DeviseTokenAuth.require_client_password_reset_token = false
|
|
662
|
+
end
|
|
663
|
+
end
|
|
664
|
+
end
|
|
665
|
+
|
|
666
|
+
describe 'with invalid reset password token' do
|
|
667
|
+
before do
|
|
668
|
+
DeviseTokenAuth.require_client_password_reset_token = true
|
|
669
|
+
@resource.update reset_password_token: 'koskoskoskos'
|
|
670
|
+
put :update, params: @params
|
|
671
|
+
@data = JSON.parse(response.body)
|
|
672
|
+
@resource.reload
|
|
673
|
+
end
|
|
674
|
+
|
|
675
|
+
test 'request should fail' do
|
|
676
|
+
assert_equal 401, response.status
|
|
677
|
+
end
|
|
678
|
+
|
|
679
|
+
test 'new password should not authenticate user' do
|
|
680
|
+
assert !@resource.valid_password?(@new_password)
|
|
681
|
+
end
|
|
682
|
+
|
|
683
|
+
teardown do
|
|
684
|
+
DeviseTokenAuth.require_client_password_reset_token = false
|
|
685
|
+
end
|
|
686
|
+
end
|
|
583
687
|
end
|
|
584
688
|
end
|
|
585
689
|
|
|
@@ -492,7 +492,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
|
|
|
492
492
|
# test valid update param
|
|
493
493
|
@resource_class = User
|
|
494
494
|
@new_operating_thetan = 1_000_000
|
|
495
|
-
@email =
|
|
495
|
+
@email = Faker::Internet.safe_email
|
|
496
496
|
@request_params = {
|
|
497
497
|
operating_thetan: @new_operating_thetan,
|
|
498
498
|
email: @email
|
|
@@ -599,7 +599,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
|
|
|
599
599
|
# test valid update param
|
|
600
600
|
@resource_class = User
|
|
601
601
|
@new_operating_thetan = 1_000_000
|
|
602
|
-
@email =
|
|
602
|
+
@email = Faker::Internet.safe_email
|
|
603
603
|
@request_params = {
|
|
604
604
|
operating_thetan: @new_operating_thetan,
|
|
605
605
|
email: @email
|
|
@@ -650,7 +650,7 @@ class DeviseTokenAuth::RegistrationsControllerTest < ActionDispatch::Integration
|
|
|
650
650
|
before do
|
|
651
651
|
DeviseTokenAuth.check_current_password_before_update = :password
|
|
652
652
|
@new_operating_thetan = 1_000_000
|
|
653
|
-
@email =
|
|
653
|
+
@email = Faker::Internet.safe_email
|
|
654
654
|
end
|
|
655
655
|
|
|
656
656
|
after do
|
|
@@ -0,0 +1,48 @@
|
|
|
1
|
+
DeviseTokenAuth.setup do |config|
|
|
2
|
+
# By default the authorization headers will change after each request. The
|
|
3
|
+
# client is responsible for keeping track of the changing tokens. Change
|
|
4
|
+
# this to false to prevent the Authorization header from changing after
|
|
5
|
+
# each request.
|
|
6
|
+
# config.change_headers_on_each_request = true
|
|
7
|
+
|
|
8
|
+
# By default, users will need to re-authenticate after 2 weeks. This setting
|
|
9
|
+
# determines how long tokens will remain valid after they are issued.
|
|
10
|
+
# config.token_lifespan = 2.weeks
|
|
11
|
+
|
|
12
|
+
# Sets the max number of concurrent devices per user, which is 10 by default.
|
|
13
|
+
# After this limit is reached, the oldest tokens will be removed.
|
|
14
|
+
# config.max_number_of_devices = 10
|
|
15
|
+
|
|
16
|
+
# Sometimes it's necessary to make several requests to the API at the same
|
|
17
|
+
# time. In this case, each request in the batch will need to share the same
|
|
18
|
+
# auth token. This setting determines how far apart the requests can be while
|
|
19
|
+
# still using the same auth token.
|
|
20
|
+
# config.batch_request_buffer_throttle = 5.seconds
|
|
21
|
+
|
|
22
|
+
# This route will be the prefix for all oauth2 redirect callbacks. For
|
|
23
|
+
# example, using the default '/omniauth', the github oauth2 provider will
|
|
24
|
+
# redirect successful authentications to '/omniauth/github/callback'
|
|
25
|
+
# config.omniauth_prefix = "/omniauth"
|
|
26
|
+
|
|
27
|
+
# By default sending current password is not needed for the password update.
|
|
28
|
+
# Uncomment to enforce current_password param to be checked before all
|
|
29
|
+
# attribute updates. Set it to :password if you want it to be checked only if
|
|
30
|
+
# password is updated.
|
|
31
|
+
# config.check_current_password_before_update = :attributes
|
|
32
|
+
|
|
33
|
+
# By default we will use callbacks for single omniauth.
|
|
34
|
+
# It depends on fields like email, provider and uid.
|
|
35
|
+
# config.default_callbacks = true
|
|
36
|
+
|
|
37
|
+
# Makes it possible to change the headers names
|
|
38
|
+
# config.headers_names = {:'access-token' => 'access-token',
|
|
39
|
+
# :'client' => 'client',
|
|
40
|
+
# :'expiry' => 'expiry',
|
|
41
|
+
# :'uid' => 'uid',
|
|
42
|
+
# :'token-type' => 'token-type' }
|
|
43
|
+
|
|
44
|
+
# By default, only Bearer Token authentication is implemented out of the box.
|
|
45
|
+
# If, however, you wish to integrate with legacy Devise authentication, you can
|
|
46
|
+
# do so by enabling this flag. NOTE: This feature is highly experimental!
|
|
47
|
+
# config.enable_standard_devise_support = false
|
|
48
|
+
end
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
class DeviseTokenAuthCreateMangs < ActiveRecord::Migration[4.2]
|
|
2
|
+
def change
|
|
3
|
+
create_table(:mangs) do |t|
|
|
4
|
+
## Required
|
|
5
|
+
t.string :provider, :null => false, :default => "email"
|
|
6
|
+
t.string :uid, :null => false, :default => ""
|
|
7
|
+
|
|
8
|
+
## Database authenticatable
|
|
9
|
+
t.string :encrypted_password, :null => false, :default => ""
|
|
10
|
+
|
|
11
|
+
## Recoverable
|
|
12
|
+
t.string :reset_password_token
|
|
13
|
+
t.datetime :reset_password_sent_at
|
|
14
|
+
|
|
15
|
+
## Rememberable
|
|
16
|
+
t.datetime :remember_created_at
|
|
17
|
+
|
|
18
|
+
## Trackable
|
|
19
|
+
t.integer :sign_in_count, :default => 0, :null => false
|
|
20
|
+
t.datetime :current_sign_in_at
|
|
21
|
+
t.datetime :last_sign_in_at
|
|
22
|
+
t.string :current_sign_in_ip
|
|
23
|
+
t.string :last_sign_in_ip
|
|
24
|
+
|
|
25
|
+
## Confirmable
|
|
26
|
+
t.string :confirmation_token
|
|
27
|
+
t.datetime :confirmed_at
|
|
28
|
+
t.datetime :confirmation_sent_at
|
|
29
|
+
t.string :unconfirmed_email # Only if using reconfirmable
|
|
30
|
+
|
|
31
|
+
## Lockable
|
|
32
|
+
# t.integer :failed_attempts, :default => 0, :null => false # Only if lock strategy is :failed_attempts
|
|
33
|
+
# t.string :unlock_token # Only if unlock strategy is :email or :both
|
|
34
|
+
# t.datetime :locked_at
|
|
35
|
+
|
|
36
|
+
## User Info
|
|
37
|
+
t.string :name
|
|
38
|
+
t.string :nickname
|
|
39
|
+
t.string :image
|
|
40
|
+
t.string :email
|
|
41
|
+
|
|
42
|
+
## Tokens
|
|
43
|
+
t.text :tokens
|
|
44
|
+
|
|
45
|
+
t.timestamps
|
|
46
|
+
end
|
|
47
|
+
|
|
48
|
+
add_index :mangs, :email, unique: true
|
|
49
|
+
add_index :mangs, [:uid, :provider], unique: true
|
|
50
|
+
add_index :mangs, :reset_password_token, unique: true
|
|
51
|
+
add_index :mangs, :confirmation_token, unique: true
|
|
52
|
+
# add_index :mangs, :unlock_token, unique: true
|
|
53
|
+
end
|
|
54
|
+
end
|
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
class DeviseTokenAuthCreateUsers < ActiveRecord::Migration[4.2]
|
|
2
|
+
def change
|
|
3
|
+
create_table(:users) do |t|
|
|
4
|
+
## Required
|
|
5
|
+
t.string :provider, :null => false, :default => "email"
|
|
6
|
+
t.string :uid, :null => false, :default => ""
|
|
7
|
+
|
|
8
|
+
## Database authenticatable
|
|
9
|
+
t.string :encrypted_password, :null => false, :default => ""
|
|
10
|
+
|
|
11
|
+
## Recoverable
|
|
12
|
+
t.string :reset_password_token
|
|
13
|
+
t.datetime :reset_password_sent_at
|
|
14
|
+
|
|
15
|
+
## Rememberable
|
|
16
|
+
t.datetime :remember_created_at
|
|
17
|
+
|
|
18
|
+
## Trackable
|
|
19
|
+
t.integer :sign_in_count, :default => 0, :null => false
|
|
20
|
+
t.datetime :current_sign_in_at
|
|
21
|
+
t.datetime :last_sign_in_at
|
|
22
|
+
t.string :current_sign_in_ip
|
|
23
|
+
t.string :last_sign_in_ip
|
|
24
|
+
|
|
25
|
+
## Confirmable
|
|
26
|
+
t.string :confirmation_token
|
|
27
|
+
t.datetime :confirmed_at
|
|
28
|
+
t.datetime :confirmation_sent_at
|
|
29
|
+
t.string :unconfirmed_email # Only if using reconfirmable
|
|
30
|
+
|
|
31
|
+
## Lockable
|
|
32
|
+
# t.integer :failed_attempts, :default => 0, :null => false # Only if lock strategy is :failed_attempts
|
|
33
|
+
# t.string :unlock_token # Only if unlock strategy is :email or :both
|
|
34
|
+
# t.datetime :locked_at
|
|
35
|
+
|
|
36
|
+
## User Info
|
|
37
|
+
t.string :name
|
|
38
|
+
t.string :nickname
|
|
39
|
+
t.string :image
|
|
40
|
+
t.string :email
|
|
41
|
+
|
|
42
|
+
## Tokens
|
|
43
|
+
t.text :tokens
|
|
44
|
+
|
|
45
|
+
t.timestamps
|
|
46
|
+
end
|
|
47
|
+
|
|
48
|
+
add_index :users, :email, unique: true
|
|
49
|
+
add_index :users, [:uid, :provider], unique: true
|
|
50
|
+
add_index :users, :reset_password_token, unique: true
|
|
51
|
+
add_index :users, :confirmation_token, unique: true
|
|
52
|
+
# add_index :users, :unlock_token, unique: true
|
|
53
|
+
end
|
|
54
|
+
end
|
data/test/factories/users.rb
CHANGED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: devise_token_auth
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 1.1.
|
|
4
|
+
version: 1.1.3
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Lynn Hurley
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: bin
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2019-09-
|
|
11
|
+
date: 2019-09-26 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: rails
|
|
@@ -315,8 +315,12 @@ files:
|
|
|
315
315
|
- test/dummy/db/migrate/20160629184441_devise_token_auth_create_lockable_users.rb
|
|
316
316
|
- test/dummy/db/schema.rb
|
|
317
317
|
- test/dummy/lib/migration_database_helper.rb
|
|
318
|
-
- test/dummy/tmp/generators/app/
|
|
319
|
-
- test/dummy/tmp/generators/app/
|
|
318
|
+
- test/dummy/tmp/generators/app/models/mang.rb
|
|
319
|
+
- test/dummy/tmp/generators/app/models/user.rb
|
|
320
|
+
- test/dummy/tmp/generators/config/initializers/devise_token_auth.rb
|
|
321
|
+
- test/dummy/tmp/generators/config/routes.rb
|
|
322
|
+
- test/dummy/tmp/generators/db/migrate/20170630171909_devise_token_auth_create_mangs.rb
|
|
323
|
+
- test/dummy/tmp/generators/db/migrate/20170630171909_devise_token_auth_create_users.rb
|
|
320
324
|
- test/factories/users.rb
|
|
321
325
|
- test/lib/devise_token_auth/blacklist_test.rb
|
|
322
326
|
- test/lib/devise_token_auth/token_factory_test.rb
|
|
@@ -349,8 +353,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
349
353
|
- !ruby/object:Gem::Version
|
|
350
354
|
version: '0'
|
|
351
355
|
requirements: []
|
|
352
|
-
|
|
353
|
-
rubygems_version: 2.7.9
|
|
356
|
+
rubygems_version: 3.0.3
|
|
354
357
|
signing_key:
|
|
355
358
|
specification_version: 4
|
|
356
359
|
summary: Token based authentication for rails. Uses Devise + OmniAuth.
|
|
@@ -422,8 +425,12 @@ test_files:
|
|
|
422
425
|
- test/dummy/db/migrate/20160103235141_devise_token_auth_create_scoped_users.rb
|
|
423
426
|
- test/dummy/db/migrate/20140715061447_devise_token_auth_create_users.rb
|
|
424
427
|
- test/dummy/db/migrate/20140715061805_devise_token_auth_create_mangs.rb
|
|
425
|
-
- test/dummy/tmp/generators/app/
|
|
426
|
-
- test/dummy/tmp/generators/app/
|
|
428
|
+
- test/dummy/tmp/generators/app/models/mang.rb
|
|
429
|
+
- test/dummy/tmp/generators/app/models/user.rb
|
|
430
|
+
- test/dummy/tmp/generators/config/routes.rb
|
|
431
|
+
- test/dummy/tmp/generators/config/initializers/devise_token_auth.rb
|
|
432
|
+
- test/dummy/tmp/generators/db/migrate/20170630171909_devise_token_auth_create_mangs.rb
|
|
433
|
+
- test/dummy/tmp/generators/db/migrate/20170630171909_devise_token_auth_create_users.rb
|
|
427
434
|
- test/dummy/README.rdoc
|
|
428
435
|
- test/models/only_email_user_test.rb
|
|
429
436
|
- test/models/concerns/mongoid_support_test.rb
|
|
@@ -1,5 +0,0 @@
|
|
|
1
|
-
<p><%= t(:welcome).capitalize + ' ' + @email %>!</p>
|
|
2
|
-
|
|
3
|
-
<p><%= t '.confirm_link_msg' %> </p>
|
|
4
|
-
|
|
5
|
-
<p><%= link_to t('.confirm_account_link'), confirmation_url(@resource, {confirmation_token: @token, config: message['client-config'].to_s, redirect_url: message['redirect-url']}).html_safe %></p>
|
|
@@ -1,8 +0,0 @@
|
|
|
1
|
-
<p><%= t(:hello).capitalize %> <%= @resource.email %>!</p>
|
|
2
|
-
|
|
3
|
-
<p><%= t '.request_reset_link_msg' %></p>
|
|
4
|
-
|
|
5
|
-
<p><%= link_to t('.password_change_link'), edit_password_url(@resource, reset_password_token: @token, config: message['client-config'].to_s, redirect_url: message['redirect-url'].to_s).html_safe %></p>
|
|
6
|
-
|
|
7
|
-
<p><%= t '.ignore_mail_msg' %></p>
|
|
8
|
-
<p><%= t '.no_changes_msg' %></p>
|