door_mat 0.0.5

data/spec/controllers/door_mat/sign_in_controller_spec.rb

@@ -0,0 +1,211 @@
+require 'spec_helper'
+
+module DoorMat
+  describe SignInController do
+    routes { DoorMat::Engine.routes }
+    let(:user) { {email: 'user@example.com', password: 'k#dkvKfdj38g!'} }
+
+    describe '#create' do
+      render_views
+
+      it 'accepts a submission where email addresss and password correspond to an existing user' do
+        _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+        post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+        expect(response).to have_http_status(302)
+        expect(response).to redirect_to('/session_protected_page')
+      end
+
+      it 'rejects a submission where the email is not valid' do
+        post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>"x", "password"=>user[:password], "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+        expect(response.body).to match(/Email is invalid/)
+        expect(response.body).to match(/Could not sign you in based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'rejects a submission where the password is blank' do
+        post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>"", "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+        expect(response.body).to match(/Password is too short/)
+        expect(response.body).to match(/Could not sign you in based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'rejects a submission where the account does not exist' do
+        post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+        expect(response.body).to match(/Could not sign you in based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'rejects a submission where the password is wrong' do
+        _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+        post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>"wrong_password", "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+        expect(response.body).to match(/Could not sign you in based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'fails if allow forgery protection is true' do
+        _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+        ActionController::Base.allow_forgery_protection = true
+        @request.headers["HTTP_REFERER"] = "/sign_in"
+
+        expect do
+          post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+        end.to raise_error(ActionController::InvalidAuthenticityToken)
+
+        ActionController::Base.allow_forgery_protection = false
+      end
+
+      describe 'the public, private and remember me behavior' do
+
+        describe 'With default config' do
+
+          before(:context) do
+            reset_default_config
+          end
+          after (:context) do
+            reset_default_config
+          end
+
+          it 'requests public_computer without remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.public_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests public_computer with remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"1"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.public_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests private_computer without remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"0", "remember_me"=>"0"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.private_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests private_computer with remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"0", "remember_me"=>"1"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.private_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+        end
+
+        describe 'When remember_me is allowed only on a private computer' do
+
+          before(:context) do
+            reset_default_config
+            DoorMat.configuration.allow_remember_me_feature = true
+          end
+          after (:context) do
+            reset_default_config
+          end
+
+          it 'requests public_computer without remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.public_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests public_computer with remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"1"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.public_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests private_computer without remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"0", "remember_me"=>"0"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.private_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests private_computer with remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"0", "remember_me"=>"1"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.remember_me?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+        end
+
+        describe 'When remember_me is allowed on both public and private computers' do
+
+          before(:context) do
+            reset_default_config
+            DoorMat.configuration.allow_remember_me_feature = true
+            DoorMat.configuration.remember_me_require_private_computer_confirmation = false
+          end
+          after (:context) do
+            reset_default_config
+          end
+
+          it 'requests public_computer without remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"0"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.public_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests public_computer with remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"1", "remember_me"=>"1"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.remember_me?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests private_computer without remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"0", "remember_me"=>"0"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.private_computer?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+          it 'requests private_computer with remember_me' do
+            _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(user[:email], user[:password])
+
+            post :create, {"utf8"=>"✓", "sign_in"=>{"email"=>user[:email], "password"=>user[:password], "is_public"=>"0", "remember_me"=>"1"}, "commit"=>"Sign In"}
+            expect(DoorMat::Session.first.remember_me?).to be true
+            expect(response).to have_http_status(302)
+            expect(response).to redirect_to('/session_protected_page')
+          end
+
+        end
+
+      end
+
+    end
+
+  end
+end

data/spec/controllers/door_mat/sign_up_controller_spec.rb

@@ -0,0 +1,90 @@
+require 'spec_helper'
+
+module DoorMat
+  describe SignUpController do
+    routes { DoorMat::Engine.routes }
+
+    describe '#create' do
+      render_views
+
+      it 'accepts a valid submission for a new user' do
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>"user@example.com", "password"=>"k#dkvKfdj38g!", "password_confirmation"=>"k#dkvKfdj38g!"}, "commit"=>"Sign Up"}
+        expect(response).to have_http_status(302)
+        expect(response).to redirect_to('/session_protected_page')
+      end
+
+      it 'accepts a submission for a new user with the same email and a different password until plausible_deniability_count is reached' do
+        DoorMat::configuration.plausible_deniability_count = 2
+        address = 'user@example.com'
+        _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(address, 'k#dkvKfdj38g!')
+
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>address, "password"=>'_____k#dkvKfdj38g!', "password_confirmation"=>'_____k#dkvKfdj38g!'}, "commit"=>"Sign Up"}
+        expect(response).to have_http_status(302)
+        expect(response).to redirect_to('/session_protected_page')
+        DoorMat::configuration.plausible_deniability_count = 1
+      end
+
+      it 'rejects a submission where password confirmation does not match' do
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>"user1@example.com", "password"=>"x", "password_confirmation"=>"y"}, "commit"=>"Sign Up"}
+        expect(response.body).to match(/Password confirmation doesn't match Password/)
+        expect(response.body).to match(/Could not sign you up based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'rejects a submission where password is blank' do
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>"user1@example.com", "password"=>"", "password_confirmation"=>""}, "commit"=>"Sign Up"}
+        expect(response.body).to match(/Password is too short/)
+        expect(response.body).to match(/Could not sign you up based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'rejects a submission where the email is blank' do
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>"", "password"=>"", "password_confirmation"=>""}, "commit"=>"Sign Up"}
+        expect(response.body).to match(/Email is invalid/)
+        expect(response.body).to match(/Could not sign you up based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'rejects a submission where the email is invalid' do
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>"bob", "password"=>"", "password_confirmation"=>""}, "commit"=>"Sign Up"}
+        expect(response.body).to match(/Email is invalid/)
+        expect(response.body).to match(/Could not sign you up based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'reject a submission for a new user with the same email and password as an existing user' do
+        address = 'user@example.com'
+        password = 'k#dkvKfdj38g!'
+        _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(address, password)
+
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>address, "password"=>password, "password_confirmation"=>password}, "commit"=>"Sign Up"}
+        expect(response.body).to match(/Could not sign you up based on the information provided/)
+        expect(response).to have_http_status(200)
+      end
+
+      it 'lets a user sign in through the sign up form if explicitly allowed' do
+        DoorMat.configuration.allow_sign_in_from_sign_up_form = true
+        address = 'user@example.com'
+        password = 'k#dkvKfdj38g!'
+        _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(address, password)
+
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>address, "password"=>password, "password_confirmation"=>password}, "commit"=>"Sign Up"}
+        expect(response).to have_http_status(302)
+        expect(response).to redirect_to('/session_protected_page')
+        DoorMat.configuration.allow_sign_in_from_sign_up_form = false
+      end
+
+      it 'for a new user with the same email and a different password if the plausible_deniability_count is reached mark the email as not_available' do
+        address = 'user@example.com'
+        _ = TestHelper::create_signed_up_actor_with_confirmed_email_address(address, 'k#dkvKfdj38g!')
+
+        post :create, {"utf8"=>"✓", "sign_up"=>{"email"=>address, "password"=>'_____k#dkvKfdj38g!', "password_confirmation"=>'_____k#dkvKfdj38g!'}, "commit"=>"Sign Up"}
+        expect(Email.last.not_available?).to be true
+        expect(response).to have_http_status(302)
+        expect(response).to redirect_to('/session_protected_page')
+      end
+
+    end
+
+  end
+end

data/spec/factories/door_mat_access_tokens.rb

@@ -0,0 +1,6 @@
+# Read about factories at https://github.com/thoughtbot/factory_girl
+
+FactoryGirl.define do
+  factory :door_mat_access_token, :class => 'AccessToken' do
+  end
+end

data/spec/factories/door_mat_activitiess.rb

@@ -0,0 +1,6 @@
+# Read about factories at https://github.com/thoughtbot/factory_girl
+
+FactoryGirl.define do
+  factory :activity, :class => DoorMat::Activity do
+  end
+end

data/spec/factories/door_mat_actors.rb

@@ -0,0 +1,23 @@
+# require 'spec_helper'
+# Read about factories at https://github.com/thoughtbot/factory_girl
+
+FactoryGirl.define do
+  factory :actor, :class => DoorMat::Actor do
+
+    ignore do
+      password "k#dkvKfdj38g!"
+      password_confirmation "k#dkvKfdj38g!"
+    end
+
+    key_salt "MzI=--MTAwMDA=--NIEv2dB/9LoA7pFFSkWB/XkdAYf0gxGV+duTLCZ1oxQ="
+    password_salt "$2a$12$u3g9Rx9D/aq262st.A5pcu"
+    password_hash "$2a$12$u3g9Rx9D/aq262st.A5pcuFnYN8UQTbUozXpETuk5rzCV1k5UGfhy"
+    system_key "3oenvsVf61KOIxHoQrQa6mDgqWlYMaEL2sLe/iCgw0c="
+    recovery_key ""
+
+    # after(:build) do |actor, evaluator|
+    #   allow(actor).to receive(:password).and_return evaluator.password
+    #   allow(actor).to receive(:password_confirmation).and_return evaluator.password_confirmation
+    # end
+  end
+end

data/spec/factories/door_mat_emails.rb

@@ -0,0 +1,14 @@
+# Read about factories at https://github.com/thoughtbot/factory_girl
+
+FactoryGirl.define do
+  factory :email, :class => DoorMat::Email do
+
+    ignore do
+      email "me@example.com"
+    end
+
+    address_hash "B4DnTtSed3O2oJ134yu8sxESi5+jPj5RWDoBM+vWy8Q="
+    address "me@example.com"
+    status :confirmed
+  end
+end

data/spec/factories/door_mat_memberships.rb

@@ -0,0 +1,6 @@
+# Read about factories at https://github.com/thoughtbot/factory_girl
+
+FactoryGirl.define do
+  factory :door_mat_membership, :class => 'Membership' do
+  end
+end

data/spec/factories/door_mat_sessions.rb

@@ -0,0 +1,24 @@
+# Read about factories at https://github.com/thoughtbot/factory_girl
+
+FactoryGirl.define do
+  factory :session, :class => DoorMat::Session do
+
+    ignore do
+      email "me@example.com"
+      password "k#dkvKfdj38g!"
+    end
+
+    token "03137b40-ea48-4780-ba6a-f6abf264cf44"
+    hashed_token "_lQiFJ89fiUU_SpB0bwaQhBrZ73fWfPO2WulCMHecKY="
+    encrypted_symmetric_actor_key "IGUxwZrCW7zSaOLuXS/TCg==--otZoYtoW8m7wJBz6--MWnVkaoVpAigI7lHWSHuh0vLGxwKr1s7y7hqhI2U6xSEf80XaDr8dt9PnSQ="
+    password_authenticated_at DateTime.current
+
+    @symmetric_actor_key
+    @session_key
+
+    after(:build) do |session, evaluator|
+      session.stub(:email).and_return evaluator.email
+      session.stub(:password).and_return evaluator.password
+    end
+  end
+end

data/spec/features/password_less_session_spec.rb

@@ -0,0 +1,165 @@
+require 'spec_helper'
+
+module DoorMat
+
+  RSpec.describe 'Actor lifecycle', :type => :feature do
+    include EmailSpec::Helpers
+    include EmailSpec::Matchers
+
+    let(:admin) { {email: Rails.application.secrets.admin_account_email, password: Rails.application.secrets.admin_account_pwd} }
+
+    it 'Request token to access resource without creating an account' do
+
+      DoorMat::TestHelper.create_signed_up_actor_with_confirmed_email_address(admin[:email], admin[:password])
+
+      visit '/draw_results'
+      expect(page.current_url).to match(/big_ticket/)
+
+      visit '/big_ticket'
+      expect(page.body).to match(/Enter your email address twice in the form below/)
+
+      address = 'user@example.com'
+      manage_list_url = fill_access_token_form('User', address)
+
+      visit manage_list_url
+
+      expect(page.body).to match(/Would you like to/)
+      click_link 'Play a game?'
+
+      select '5', :from => 'door'
+      click_button 'Next'
+
+      select '5', :from => 'door'
+      click_button 'Next'
+
+      expect(page.body).to match(/the winning door/)
+
+      visit '/final_result'
+      expect(page.current_path).to match(/big_ticket/)
+
+      visit '/show_loosing_door'
+      expect(page.current_path).to match(/big_ticket/)
+
+      visit '/play_game'
+      expect(page.current_path).to match(/big_ticket/)
+    end
+
+    it 'Ensure previous session gets terminated if user request a new one' do
+      DoorMat::TestHelper.create_signed_up_actor_with_confirmed_email_address(admin[:email], admin[:password])
+
+      visit '/draw_results'
+      expect(page.current_url).to match(/big_ticket/)
+
+      email = 'user@example.com'
+      expect(unread_emails_for(email).size).to eq(parse_email_count(0))
+
+      manage_list_url = fill_access_token_form('User', email)
+
+      visit manage_list_url
+
+      expect(page.current_url).to match(/draw_results/)
+      visit '/draw_results'
+      expect(page.current_url).to match(/draw_results/)
+
+      # Steal the current cookie
+      cookie_token = get_me_the_cookie('token')
+      visit '/big_ticket'
+
+      # Get a new cookie
+      manage_list_url = fill_access_token_form('User', email)
+      visit manage_list_url
+
+      expect(page.current_url).to match(/draw_results/)
+      visit '/draw_results'
+      expect(page.current_url).to match(/draw_results/)
+
+      # Trying to reuse the old cookie fails
+      create_cookie('token', cookie_token[:value])
+      visit '/draw_results'
+      expect(page.current_url).not_to match(/draw_results/)
+    end
+
+
+    it 'fails the multipass email validation for user@example.com' do
+      DoorMat::TestHelper.create_signed_up_actor_with_confirmed_email_address(admin[:email], admin[:password])
+
+      visit '/multipass'
+      expect(page.current_url).to match(/multipass/)
+      expect(page.body).to match(/Enter your email address twice in the form below/)
+
+      address = 'user@example.com'
+      manage_list_url = fill_access_token_form('User', address)
+
+      visit manage_list_url
+
+      expect(page.body).to match(/Something looks wrong with your access token/)
+    end
+
+
+
+    it 'gives Leeloo a multipass' do
+      DoorMat::TestHelper.create_signed_up_actor_with_confirmed_email_address(admin[:email], admin[:password])
+
+      visit '/multipass'
+      expect(page.current_url).to match(/multipass/)
+      expect(page.body).to match(/Enter your email address twice in the form below/)
+
+      address = 'leeloo@example.com'
+      manage_list_url = fill_access_token_form('Leeloo', address)
+
+      visit manage_list_url
+
+      expect(page.body).to match(/Would you like to/)
+      click_link 'Play a game?'
+
+      select '5', :from => 'door'
+      click_button 'Next'
+
+      select '5', :from => 'door'
+      click_button 'Next'
+
+      expect(page.body).to match(/the winning door/)
+
+      visit '/final_result'
+      expect(page.current_path).to match(/big_ticket/)
+
+      visit '/show_loosing_door'
+      expect(page.current_path).to match(/big_ticket/)
+
+      visit '/play_game'
+      expect(page.current_path).to match(/big_ticket/)
+
+      visit '/draw_results'
+      expect(page.current_path).to match(/big_ticket/)
+
+
+      visit manage_list_url
+
+      expect(page.body).to match(/Would you like to/)
+      click_link 'Play a game?'
+
+      select '5', :from => 'door'
+      click_button 'Next'
+
+      select '5', :from => 'door'
+      click_button 'Next'
+
+      expect(page.body).to match(/the winning door/)
+
+
+      visit manage_list_url
+
+      expect(page.body).to match(/Would you like to/)
+      click_link 'Play a game?'
+
+      select '5', :from => 'door'
+      click_button 'Next'
+
+      select '5', :from => 'door'
+      click_button 'Next'
+
+      expect(page.body).to match(/the winning door/)
+    end
+
+  end
+end