digix_devise_token_auth 0.1.44

data/lib/generators/devise_token_auth/templates/user.rb

@@ -0,0 +1,7 @@
+class <%= user_class.capitalize %> < ActiveRecord::Base
+  # Include default devise modules. Others available are:
+  # :confirmable, :lockable, :timeoutable and :omniauthable
+  devise :database_authenticatable, :registerable,
+         :recoverable, :rememberable, :trackable, :validatable
+  include DeviseTokenAuth::Concerns::User
+end

data/lib/tasks/devise_token_auth_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :devise_token_auth do
+#   # Task goes here
+# end

data/test/controllers/custom/custom_confirmations_controller_test.rb

@@ -0,0 +1,21 @@
+require 'test_helper'
+
+class Custom::ConfirmationsControllerTest < ActionController::TestCase
+  describe Custom::ConfirmationsController do
+    before do
+      @redirect_url = Faker::Internet.url
+      @new_user = users(:unconfirmed_email_user)
+      @new_user.send_confirmation_instructions(redirect_url: @redirect_url)
+      @mail          = ActionMailer::Base.deliveries.last
+      @token         = @mail.body.match(/confirmation_token=([^&]*)&/)[1]
+      @client_config = @mail.body.match(/config=([^&]*)&/)[1]
+
+      get :show,
+          params: { confirmation_token: @token, redirect_url: @redirect_url }
+    end
+
+    test 'yield resource to block on show success' do
+      assert @controller.show_block_called?, 'show failed to yield resource to provided block'
+    end
+  end
+end

data/test/controllers/custom/custom_omniauth_callbacks_controller_test.rb

@@ -0,0 +1,29 @@
+require 'test_helper'
+
+class Custom::OmniauthCallbacksControllerTest < ActionDispatch::IntegrationTest
+  describe Custom::OmniauthCallbacksController do
+    setup do
+      OmniAuth.config.test_mode = true
+      OmniAuth.config.mock_auth[:facebook] = OmniAuth::AuthHash.new(
+        provider: 'facebook',
+        uid: '123545',
+        info: {
+          name: 'swong',
+          email: 'swongsong@yandex.ru'
+        }
+      )
+    end
+
+    test 'yield resource to block on omniauth_success success' do
+      @redirect_url = 'http://ng-token-auth.dev/'
+      get '/nice_user_auth/facebook',
+          params: { auth_origin_url: @redirect_url,
+                    omniauth_window_type: 'newWindow' }
+
+      follow_all_redirects!
+
+      assert @controller.omniauth_success_block_called?,
+             'omniauth_success failed to yield resource to provided block'
+    end
+  end
+end

data/test/controllers/custom/custom_passwords_controller_test.rb

@@ -0,0 +1,75 @@
+require 'test_helper'
+
+class Custom::PasswordsControllerTest < ActionController::TestCase
+  describe Custom::PasswordsController do
+    before do
+      @resource = users(:confirmed_email_user)
+      @redirect_url = 'http://ng-token-auth.dev'
+    end
+
+    test 'yield resource to block on create success' do
+      post :create,
+           params: { email:  @resource.email,
+                     redirect_url: @redirect_url }
+
+      @mail = ActionMailer::Base.deliveries.last
+      @resource.reload
+
+      @mail_config_name  = CGI.unescape(@mail.body.match(/config=([^&]*)&/)[1])
+      @mail_redirect_url = CGI.unescape(@mail.body.match(/redirect_url=([^&]*)&/)[1])
+      @mail_reset_token  = @mail.body.match(/reset_password_token=(.*)\"/)[1]
+
+      assert @controller.create_block_called?,
+             'create failed to yield resource to provided block'
+    end
+
+    test 'yield resource to block on edit success' do
+      @resource = users(:unconfirmed_email_user)
+      @redirect_url = 'http://ng-token-auth.dev'
+
+      post :create,
+           params: { email:  @resource.email,
+                     redirect_url: @redirect_url },
+           xhr: true
+
+      @mail = ActionMailer::Base.deliveries.last
+      @resource.reload
+
+      @mail_config_name  = CGI.unescape(@mail.body.match(/config=([^&]*)&/)[1])
+      @mail_redirect_url = CGI.unescape(@mail.body.match(/redirect_url=([^&]*)&/)[1])
+      @mail_reset_token  = @mail.body.match(/reset_password_token=(.*)\"/)[1]
+
+      get :edit,
+          params: { reset_password_token: @mail_reset_token,
+                    redirect_url: @mail_redirect_url },
+          xhr: true
+      @resource.reload
+      assert @controller.edit_block_called?,
+             'edit failed to yield resource to provided block'
+    end
+
+    test 'yield resource to block on update success' do
+      @auth_headers = @resource.create_new_auth_token
+      request.headers.merge!(@auth_headers)
+      @new_password = Faker::Internet.password
+      put :update,
+          params: { password: @new_password,
+                    password_confirmation: @new_password }
+      assert @controller.update_block_called?, 'update failed to yield resource to provided block'
+    end
+
+    test 'yield resource to block on update success with custom json' do
+      @auth_headers = @resource.create_new_auth_token
+      request.headers.merge!(@auth_headers)
+      @new_password = Faker::Internet.password
+      put :update,
+          params: { password: @new_password,
+                    password_confirmation: @new_password }
+
+      @data = JSON.parse(response.body)
+
+      assert @controller.update_block_called?, 'update failed to yield resource to provided block'
+      assert_equal @data['custom'], 'foo'
+    end
+  end
+end

data/test/controllers/custom/custom_registrations_controller_test.rb

@@ -0,0 +1,54 @@
+require 'test_helper'
+
+class Custom::RegistrationsControllerTest < ActionDispatch::IntegrationTest
+  describe Custom::RegistrationsController do
+    setup do
+      @create_params = {
+        email: Faker::Internet.email,
+        password: 'secret123',
+        password_confirmation: 'secret123',
+        confirm_success_url: Faker::Internet.url,
+        unpermitted_param: '(x_x)'
+      }
+
+      @existing_user = nice_users(:confirmed_email_user)
+      @auth_headers  = @existing_user.create_new_auth_token
+      @client_id     = @auth_headers['client']
+
+      # ensure request is not treated as batch request
+      age_token(@existing_user, @client_id)
+    end
+
+    test 'yield resource to block on create success' do
+      post '/nice_user_auth', params: @create_params
+      assert @controller.create_block_called?,
+             'create failed to yield resource to provided block'
+    end
+
+    test 'yield resource to block on create success with custom json' do
+      post '/nice_user_auth', params: @create_params
+
+      @data = JSON.parse(response.body)
+
+      assert @controller.create_block_called?,
+             'create failed to yield resource to provided block'
+      assert_equal @data['custom'], 'foo'
+    end
+
+    test 'yield resource to block on update success' do
+      put '/nice_user_auth',
+          params: {
+            nickname: "Ol' Sunshine-face"
+          },
+          headers: @auth_headers
+      assert @controller.update_block_called?,
+             'update failed to yield resource to provided block'
+    end
+
+    test 'yield resource to block on destroy success' do
+      delete '/nice_user_auth', headers: @auth_headers
+      assert @controller.destroy_block_called?,
+             'destroy failed to yield resource to provided block'
+    end
+  end
+end

data/test/controllers/custom/custom_sessions_controller_test.rb

@@ -0,0 +1,37 @@
+require 'test_helper'
+
+class Custom::SessionsControllerTest < ActionController::TestCase
+  describe Custom::SessionsController do
+    before do
+      @existing_user = users(:confirmed_email_user)
+      @existing_user.skip_confirmation!
+      @existing_user.save!
+    end
+
+    test 'yield resource to block on create success' do
+      post :create,
+           params: {
+             email: @existing_user.email,
+             password: 'secret123'
+           }
+      assert @controller.create_block_called?,
+             'create failed to yield resource to provided block'
+    end
+
+    test 'yield resource to block on destroy success' do
+      @auth_headers = @existing_user.create_new_auth_token
+      request.headers.merge!(@auth_headers)
+      delete :destroy, format: :json
+      assert @controller.destroy_block_called?,
+             'destroy failed to yield resource to provided block'
+    end
+
+    test 'render method override' do
+      post :create,
+           params: { email: @existing_user.email,
+                     password: 'secret123' }
+      @data = JSON.parse(response.body)
+      assert_equal @data['custom'], 'foo'
+    end
+  end
+end

data/test/controllers/custom/custom_token_validations_controller_test.rb

@@ -0,0 +1,40 @@
+require 'test_helper'
+
+class Custom::TokenValidationsControllerTest < ActionDispatch::IntegrationTest
+  describe Custom::TokenValidationsController do
+    before do
+      @resource = nice_users(:confirmed_email_user)
+      @resource.skip_confirmation!
+      @resource.save!
+
+      @auth_headers = @resource.create_new_auth_token
+
+      @token     = @auth_headers['access-token']
+      @client_id = @auth_headers['client']
+      @expiry    = @auth_headers['expiry']
+
+      # ensure that request is not treated as batch request
+      age_token(@resource, @client_id)
+    end
+
+    test 'yield resource to block on validate_token success' do
+      get '/nice_user_auth/validate_token',
+          params: {},
+          headers: @auth_headers
+      assert @controller.validate_token_block_called?,
+             'validate_token failed to yield resource to provided block'
+    end
+
+    test 'yield resource to block on validate_token success with custom json' do
+      get '/nice_user_auth/validate_token',
+          params: {},
+          headers: @auth_headers
+
+      @data = JSON.parse(response.body)
+
+      assert @controller.validate_token_block_called?,
+             'validate_token failed to yield resource to provided block'
+      assert_equal @data['custom'], 'foo'
+    end
+  end
+end

data/test/controllers/demo_group_controller_test.rb

@@ -0,0 +1,153 @@
+require 'test_helper'
+
+#  was the web request successful?
+#  was the user redirected to the right page?
+#  was the user successfully authenticated?
+#  was the correct object stored in the response?
+#  was the appropriate message delivered in the json payload?
+
+class DemoGroupControllerTest < ActionDispatch::IntegrationTest
+  describe DemoGroupController do
+    describe 'Token access' do
+      before do
+        # user
+        @resource = users(:confirmed_email_user)
+        @resource.skip_confirmation!
+        @resource.save!
+
+        @resource_auth_headers = @resource.create_new_auth_token
+
+        @resource_token     = @resource_auth_headers['access-token']
+        @resource_client_id = @resource_auth_headers['client']
+        @resource_expiry    = @resource_auth_headers['expiry']
+
+        # mang
+        @mang = mangs(:confirmed_email_user)
+        @mang.skip_confirmation!
+        @mang.save!
+
+        @mang_auth_headers = @mang.create_new_auth_token
+
+        @mang_token     = @mang_auth_headers['access-token']
+        @mang_client_id = @mang_auth_headers['client']
+        @mang_expiry    = @mang_auth_headers['expiry']
+      end
+
+      describe 'user access' do
+        before do
+          # ensure that request is not treated as batch request
+          age_token(@resource, @resource_client_id)
+
+          get '/demo/members_only_group',
+              params: {},
+              headers: @resource_auth_headers
+
+          @resp_token       = response.headers['access-token']
+          @resp_client_id   = response.headers['client']
+          @resp_expiry      = response.headers['expiry']
+          @resp_uid         = response.headers['uid']
+        end
+
+        test 'request is successful' do
+          assert_equal 200, response.status
+        end
+
+        describe 'devise mappings' do
+          it 'should define current_user' do
+            assert_equal @resource, @controller.current_user
+          end
+
+          it 'should define user_signed_in?' do
+            assert @controller.user_signed_in?
+          end
+
+          it 'should not define current_mang' do
+            refute_equal @resource, @controller.current_mang
+          end
+
+          it 'should define current_member' do
+            assert_equal @resource, @controller.current_member
+          end
+
+          it 'should define current_members' do
+            assert @controller.current_members.include? @resource
+          end
+
+          it 'should define member_signed_in?' do
+            assert @controller.current_members.include? @resource
+          end
+
+          it 'should define render_authenticate_error' do
+            assert @controller.methods.include?(:render_authenticate_error)
+          end
+        end
+      end
+
+      describe 'mang access' do
+        before do
+          # ensure that request is not treated as batch request
+          age_token(@mang, @mang_client_id)
+
+          get '/demo/members_only_group',
+              params: {},
+              headers: @mang_auth_headers
+
+          @resp_token       = response.headers['access-token']
+          @resp_client_id   = response.headers['client']
+          @resp_expiry      = response.headers['expiry']
+          @resp_uid         = response.headers['uid']
+        end
+
+        test 'request is successful' do
+          assert_equal 200, response.status
+        end
+
+        describe 'devise mappings' do
+          it 'should define current_mang' do
+            assert_equal @mang, @controller.current_mang
+          end
+
+          it 'should define mang_signed_in?' do
+            assert @controller.mang_signed_in?
+          end
+
+          it 'should not define current_mang' do
+            refute_equal @mang, @controller.current_user
+          end
+
+          it 'should define current_member' do
+            assert_equal @mang, @controller.current_member
+          end
+
+          it 'should define current_members' do
+            assert @controller.current_members.include? @mang
+          end
+
+          it 'should define member_signed_in?' do
+            assert @controller.current_members.include? @mang
+          end
+
+          it 'should define render_authenticate_error' do
+            assert @controller.methods.include?(:render_authenticate_error)
+          end
+        end
+      end
+
+      describe 'failed access' do
+        before do
+          get '/demo/members_only_group',
+              params: {},
+              headers: @mang_auth_headers.merge('access-token' => 'bogus')
+        end
+
+        it 'should not return any auth headers' do
+          refute response.headers['access-token']
+        end
+
+        it 'should return error: unauthorized status' do
+          assert_equal 401, response.status
+        end
+      end
+    end
+  end
+end

data/test/controllers/demo_mang_controller_test.rb

@@ -0,0 +1,284 @@
+require 'test_helper'
+
+#  was the web request successful?
+#  was the user redirected to the right page?
+#  was the user successfully authenticated?
+#  was the correct object stored in the response?
+#  was the appropriate message delivered in the json payload?
+
+class DemoMangControllerTest < ActionDispatch::IntegrationTest
+  describe DemoMangController do
+    describe 'Token access' do
+      before do
+        @resource = mangs(:confirmed_email_user)
+        @resource.skip_confirmation!
+        @resource.save!
+
+        @auth_headers = @resource.create_new_auth_token
+
+        @token     = @auth_headers['access-token']
+        @client_id = @auth_headers['client']
+        @expiry    = @auth_headers['expiry']
+      end
+
+      describe 'successful request' do
+        before do
+          # ensure that request is not treated as batch request
+          age_token(@resource, @client_id)
+
+          get '/demo/members_only_mang',
+              params: {},
+              headers: @auth_headers
+
+          @resp_token       = response.headers['access-token']
+          @resp_client_id   = response.headers['client']
+          @resp_expiry      = response.headers['expiry']
+          @resp_uid         = response.headers['uid']
+        end
+
+        describe 'devise mappings' do
+          it 'should define current_mang' do
+            assert_equal @resource, @controller.current_mang
+          end
+
+          it 'should define mang_signed_in?' do
+            assert @controller.mang_signed_in?
+          end
+
+          it 'should not define current_user' do
+            refute_equal @resource, @controller.current_user
+          end
+
+          it 'should define render_authenticate_error' do
+            assert @controller.methods.include?(:render_authenticate_error)
+          end
+        end
+
+        it 'should return success status' do
+          assert_equal 200, response.status
+        end
+
+        it 'should receive new token after successful request' do
+          refute_equal @token, @resp_token
+        end
+
+        it 'should preserve the client id from the first request' do
+          assert_equal @client_id, @resp_client_id
+        end
+
+        it "should return the user's uid in the auth header" do
+          assert_equal @resource.uid, @resp_uid
+        end
+
+        it 'should not treat this request as a batch request' do
+          refute assigns(:is_batch_request)
+        end
+
+        describe 'subsequent requests' do
+          before do
+            @resource.reload
+            # ensure that request is not treated as batch request
+            age_token(@resource, @client_id)
+
+            get '/demo/members_only_mang',
+                params: {},
+                headers: @auth_headers.merge('access-token' => @resp_token)
+          end
+
+          it 'should not treat this request as a batch request' do
+            refute assigns(:is_batch_request)
+          end
+
+          it 'should allow a new request to be made using new token' do
+            assert_equal 200, response.status
+          end
+        end
+      end
+
+      describe 'failed request' do
+        before do
+          get '/demo/members_only_mang',
+              params: {},
+              headers: @auth_headers.merge('access-token' => 'bogus')
+        end
+
+        it 'should not return any auth headers' do
+          refute response.headers['access-token']
+        end
+
+        it 'should return error: unauthorized status' do
+          assert_equal 401, response.status
+        end
+      end
+
+      describe 'disable change_headers_on_each_request' do
+        before do
+          DeviseTokenAuth.change_headers_on_each_request = false
+          @resource.reload
+          age_token(@resource, @client_id)
+
+          get '/demo/members_only_mang',
+              params: {},
+              headers: @auth_headers
+
+          @first_is_batch_request = assigns(:is_batch_request)
+          @first_user = assigns(:resource).dup
+          @first_access_token = response.headers['access-token']
+          @first_response_status = response.status
+
+          @resource.reload
+          age_token(@resource, @client_id)
+
+          # use expired auth header
+          get '/demo/members_only_mang',
+              params: {},
+              headers: @auth_headers
+
+          @second_is_batch_request = assigns(:is_batch_request)
+          @second_user = assigns(:resource).dup
+          @second_access_token = response.headers['access-token']
+          @second_response_status = response.status
+        end
+
+        after do
+          DeviseTokenAuth.change_headers_on_each_request = true
+        end
+
+        it 'should allow the first request through' do
+          assert_equal 200, @first_response_status
+        end
+
+        it 'should allow the second request through' do
+          assert_equal 200, @second_response_status
+        end
+
+        it 'should return auth headers from the first request' do
+          assert @first_access_token
+        end
+
+        it 'should not treat either requests as batch requests' do
+          refute @first_is_batch_request
+          refute @second_is_batch_request
+        end
+
+        it 'should return auth headers from the second request' do
+          assert @second_access_token
+        end
+
+        it 'should define user during first request' do
+          assert @first_user
+        end
+
+        it 'should define user during second request' do
+          assert @second_user
+        end
+      end
+
+      describe 'batch requests' do
+        describe 'success' do
+          before do
+            age_token(@resource, @client_id)
+            # request.headers.merge!(@auth_headers)
+
+            get '/demo/members_only_mang',
+                params: {},
+                headers: @auth_headers
+
+            @first_is_batch_request = assigns(:is_batch_request)
+            @first_user = assigns(:resource)
+            @first_access_token = response.headers['access-token']
+
+            get '/demo/members_only_mang',
+                params: {},
+                headers: @auth_headers
+
+            @second_is_batch_request = assigns(:is_batch_request)
+            @second_user = assigns(:resource)
+            @second_access_token = response.headers['access-token']
+          end
+
+          it 'should allow both requests through' do
+            assert_equal 200, response.status
+          end
+
+          it 'should not treat the first request as a batch request' do
+            refute @first_is_batch_request
+          end
+
+          it 'should treat the second request as a batch request' do
+            assert @second_is_batch_request
+          end
+
+          it 'should return access token for first (non-batch) request' do
+            assert @first_access_token
+          end
+
+          it 'should not return auth headers for second (batched) requests' do
+            assert_equal ' ', @second_access_token
+          end
+        end
+
+        describe 'time out' do
+          before do
+            @resource.reload
+            age_token(@resource, @client_id)
+
+            get '/demo/members_only_mang',
+                params: {},
+                headers: @auth_headers
+
+            @first_is_batch_request = assigns(:is_batch_request)
+            @first_user = assigns(:resource).dup
+            @first_access_token = response.headers['access-token']
+            @first_response_status = response.status
+
+            @resource.reload
+            age_token(@resource, @client_id)
+
+            # use expired auth header
+            get '/demo/members_only_mang',
+                params: {},
+                headers: @auth_headers
+
+            @second_is_batch_request = assigns(:is_batch_request)
+            @second_user = assigns(:resource)
+            @second_access_token = response.headers['access-token']
+            @second_response_status = response.status
+          end
+
+          it 'should allow the first request through' do
+            assert_equal 200, @first_response_status
+          end
+
+          it 'should not allow the second request through' do
+            assert_equal 401, @second_response_status
+          end
+
+          it 'should not treat first request as batch request' do
+            refute @second_is_batch_request
+          end
+
+          it 'should return auth headers from the first request' do
+            assert @first_access_token
+          end
+
+          it 'should not treat second request as batch request' do
+            refute @second_is_batch_request
+          end
+
+          it 'should not return auth headers from the second request' do
+            refute @second_access_token
+          end
+
+          it 'should define user during first request' do
+            assert @first_user
+          end
+
+          it 'should not define user during second request' do
+            refute @second_user
+          end
+        end
+      end
+    end
+  end
+end