gravis-clearance 0.3.7

data/lib/clearance/app/models/user.rb

@@ -0,0 +1,93 @@
+require 'digest/sha1'
+
+module Clearance
+  module App
+    module Models
+      module User
+    
+        def self.included(base)
+          base.class_eval do
+        
+            attr_accessible :email, :password, :password_confirmation
+            attr_accessor :password, :password_confirmation
+
+            validates_presence_of     :email
+            validates_presence_of     :password, :if => :password_required?
+            validates_confirmation_of :password, :if => :password_required?
+            validates_uniqueness_of   :email
+            validates_format_of       :email, :with => %r{.+@.+\..+}
+
+            before_save :initialize_salt, :encrypt_password, :downcase_email
+        
+            extend ClassMethods
+            include InstanceMethods
+        
+          protected
+
+            include ProtectedInstanceMethods
+        
+          end
+        end
+    
+        module ClassMethods
+          def authenticate(email, password)
+            user = find_by_email email.downcase
+            user && user.authenticated?(password) ? user : nil
+          end
+        end
+    
+        module InstanceMethods
+          def authenticated?(password)
+            crypted_password == encrypt(password)
+          end
+
+          def encrypt(password)
+            Digest::SHA1.hexdigest "--#{salt}--#{password}--"
+          end
+
+          def remember_token?
+            remember_token_expires_at && Time.now.utc < remember_token_expires_at
+          end
+
+          def remember_me!
+            remember_me_until 2.weeks.from_now.utc
+          end
+
+          def remember_me_until(time)
+            self.update_attribute :remember_token_expires_at, time
+            self.update_attribute :remember_token, encrypt("#{email}--#{remember_token_expires_at}")
+          end
+
+          def forget_me!
+            self.update_attribute :remember_token_expires_at, nil
+            self.update_attribute :remember_token, nil
+          end
+        
+          def confirm!
+            self.update_attribute :confirmed, true
+          end
+        end
+    
+        module ProtectedInstanceMethods
+          def initialize_salt
+            self.salt = Digest::SHA1.hexdigest("--#{Time.now.to_s}--#{email}--") if new_record?
+          end
+
+          def encrypt_password
+            return if password.blank?
+            self.crypted_password = encrypt(password)
+          end
+
+          def password_required?
+            crypted_password.blank? || !password.blank?
+          end
+          
+          def downcase_email
+            self.email.downcase!
+          end
+        end
+  
+      end
+    end
+  end
+end

data/lib/clearance/test/functional/confirmations_controller_test.rb

@@ -0,0 +1,85 @@
+module Clearance
+  module Test
+    module Functional
+      module ConfirmationsControllerTest
+
+        def self.included(base)
+          base.class_eval do
+
+            context 'A GET to #new' do
+              context "with the User with the given id's salt" do
+                setup do
+                  @user = Factory :user
+                  get :new, :user_id => @user.to_param, :salt => @user.salt
+                end
+
+                should 'find the User record with the given id and salt' do
+                  assert_equal @user, assigns(:user)
+                end
+
+                should_respond_with :success
+                should_render_template :new
+              end
+
+              context "without the User with the given id's salt" do
+                setup do
+                  user = Factory :user
+                  salt = ''
+                  assert_not_equal salt, user.salt
+
+                  get :new, :user_id => user.to_param, :salt => ''
+                end
+
+                should_respond_with :not_found
+
+                should 'render nothing' do
+                  assert @response.body.blank?
+                end
+              end
+            end
+
+            context 'A POST to #create' do
+              context "with the User with the given id's salt" do
+                setup do
+                  @user = Factory :user
+                  assert ! @user.confirmed?
+
+                  post :create, :user_id => @user, :salt => @user.salt
+                  @user.reload
+                end
+
+                should 'confirm the User record with the given id' do
+                  assert @user.confirmed?
+                end
+
+                should 'log the User in' do
+                  assert_equal @user.id, session[:user_id]
+                end
+
+                should_redirect_to "@controller.send(:url_after_create)"
+              end
+
+              context "without the User with the given id's salt" do
+                setup do
+                  user = Factory :user
+                  salt = ''
+                  assert_not_equal salt, user.salt
+
+                  post :create, :user_id => user.id, :salt => salt
+                end
+
+                should_respond_with :not_found
+
+                should 'render nothing' do
+                  assert @response.body.blank?
+                end
+              end
+            end
+
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/clearance/test/functional/passwords_controller_test.rb

@@ -0,0 +1,188 @@
+module Clearance
+  module Test
+    module Functional
+      module PasswordsControllerTest
+
+        def self.included(base)
+          base.class_eval do
+
+            should_route :get, '/users/1/password/edit', :action => 'edit', :user_id => '1'
+
+            context 'with a user' do
+              setup { @user = Factory :user }
+
+              context 'A GET to #new' do
+                setup { get :new, :user_id => @user.to_param }
+
+                should_respond_with :success
+                should_render_template 'new'
+              end
+
+              context 'A POST to #create' do
+                context "with an existing user's email address" do
+                  setup do
+                    ActionMailer::Base.deliveries.clear
+
+                    post :create, :password => { :email => @user.email }
+                    @email = ActionMailer::Base.deliveries[0]
+                  end
+
+                  should 'send an email to the user to edit their password' do
+                    assert @email.subject =~ /change your password/i
+                  end
+
+                  should_redirect_to "@controller.send(:url_after_create)"
+                end
+
+                context 'with a non-existing email address' do
+                  setup do
+                    email = 'user1@example.com'
+                    assert ! User.exists?(['email = ?', email])
+                    ActionMailer::Base.deliveries.clear
+
+                    post :create, :password => { :email => email }
+                  end
+
+                  should 'not send a password reminder email' do
+                    assert ActionMailer::Base.deliveries.empty?
+                  end
+
+                  should 'set a :warning flash' do
+                    assert_not_nil flash.now[:warning]
+                  end
+
+                  should_render_template "new"
+                end
+              end
+
+              context 'A GET to #edit' do
+                context "with an existing user's id and password" do
+                  setup do
+                    get :edit, 
+                      :user_id => @user.to_param, 
+                      :password => @user.crypted_password, 
+                      :email => @user.email
+                  end
+
+                  should 'find the user with the given id and password' do
+                    assert_equal @user, assigns(:user)
+                  end
+
+                  should_respond_with :success
+                  should_render_template "edit"
+
+                  should "have a form for the user's email, password, and password confirm" do
+                    update_path = ERB::Util.h(user_password_path(@user,
+                          :password => @user.crypted_password,
+                          :email    => @user.email))
+
+                    assert_select 'form[action=?]', update_path do
+                      assert_select 'input[name=_method][value=?]', 'put'
+                      assert_select 'input[name=?]', 'user[password]'
+                      assert_select 'input[name=?]', 'user[password_confirmation]'
+                    end
+                  end
+                end
+
+                context "with an existing user's id but not password" do
+                  setup do
+                    get :edit, :user_id => @user.to_param, :password => ''
+                  end
+
+                  should_respond_with :not_found
+
+                  should 'render an empty response' do
+                    assert @response.body.blank?
+                  end
+                end
+              end
+
+              context 'A PUT to #update' do
+                context "with an existing user's id but not password" do
+                  setup do
+                    put :update, :user_id => @user.to_param, :password => ''
+                  end
+
+                  should "not update the user's password" do
+                    assert_not_equal @encrypted_new_password, @user.crypted_password
+                  end
+
+                  should 'not log the user in' do
+                    assert_nil session[:user_id]
+                  end
+
+                  should_respond_with :not_found
+
+                  should 'render an empty response' do
+                    assert @response.body.blank?
+                  end
+                end
+
+                context 'with a matching password and password confirmation' do
+                  setup do
+                    new_password = 'new_password'
+                    encryption_format = "--#{@user.salt}--#{new_password}--"
+                    @encrypted_new_password = Digest::SHA1.hexdigest encryption_format
+                    assert_not_equal @encrypted_new_password, @user.crypted_password
+
+                    put(:update,
+                        :user_id  => @user,
+                        :email    => @user.email,
+                        :password => @user.crypted_password,
+                        :user => {
+                          :password              => new_password,
+                          :password_confirmation => new_password
+                        })
+                    @user.reload
+                  end
+
+                  should "update the user's password" do
+                    assert_equal @encrypted_new_password, @user.crypted_password
+                  end
+
+                  should 'log the user in' do
+                    assert_equal session[:user_id], @user.id
+                  end
+
+                  should_redirect_to "user_path(@user)"
+                end
+
+                context 'with password but blank password confirmation' do
+                  setup do
+                    new_password = 'new_password'
+                    encryption_format = "--#{@user.salt}--#{new_password}--"
+                    @encrypted_new_password = Digest::SHA1.hexdigest encryption_format
+
+                    put(:update,
+                        :user_id => @user.to_param,
+                        :password => @user.crypted_password,
+                        :user => {
+                          :password => new_password,
+                          :password_confirmation => ''
+                        })
+                    @user.reload
+                  end
+
+                  should "not update the user's password" do
+                    assert_not_equal @encrypted_new_password, @user.crypted_password
+                  end
+
+                  should 'not log the user in' do
+                    assert_nil session[:user_id]
+                  end
+
+                  should_respond_with :not_found
+
+                  should 'render an empty response' do
+                    assert @response.body.blank?
+                  end
+                end
+              end
+            end
+          end
+        end
+
+      end
+    end
+  end
+end

data/lib/clearance/test/functional/sessions_controller_test.rb

@@ -0,0 +1,148 @@
+module Clearance
+  module Test
+    module Functional
+      module SessionsControllerTest
+    
+        def self.included(base)
+          base.class_eval do
+            should_filter_params :password
+
+            context "on GET to /sessions/new" do
+              setup { get :new }
+        
+              should_respond_with :success
+              should_render_template :new
+              should_not_set_the_flash
+              should_have_form :action => "session_path",
+                :fields => { "session[email]" => :text,
+                  "session[password]" => :password,
+                  "session[remember_me]" => :checkbox }
+            end
+
+            context "Given an unconfirmed user" do
+              setup do
+                @user = Factory(:user, :confirmed => false)
+              end
+
+              context "a POST to #create with good credentials" do
+                setup do
+                  ActionMailer::Base.deliveries.clear
+                  post :create, :session => {
+                                  :email => @user.email,
+                                  :password => @user.password
+                  }
+                end
+
+                should_deny_access(:flash => /confirm/i)
+
+                should "send the confirmation email" do
+                  assert_not_nil email = ActionMailer::Base.deliveries[0]
+                  assert_match /account confirmation/i, email.subject
+                end
+              end
+            end
+
+            context "Given a confirmed user" do
+              setup { @user = Factory(:user, :confirmed => true) }
+
+              context "a POST to #create with good credentials" do
+                setup do
+                  post :create, :session => { :email => @user.email, 
+                    :password => @user.password }
+                end
+
+                should_set_the_flash_to /success/i
+                should_redirect_to '@controller.send(:url_after_create)'
+                should_return_from_session :user_id, "@user.id"
+              end
+
+              context "a POST to #create with bad credentials" do
+                setup do
+                  post :create, :session => { :email => @user.email, 
+                    :password => "bad value" }
+                end
+
+                should_set_the_flash_to /bad/i
+                should_render_template :new
+                should_return_from_session :user_id, "nil"
+              end
+          
+              context "a POST to #create with good credentials and remember me" do
+                setup do
+                  post :create, :session => { :email => @user.email, 
+                    :password => @user.password, :remember_me => '1' }
+                end
+
+                should_set_the_flash_to /success/i
+                should_redirect_to "@controller.send(:url_after_create)"
+                should_return_from_session :user_id, "@user.id"
+                
+                should 'set the cookie' do
+                  assert ! cookies['auth_token'].empty?
+                end
+
+                should 'set the remember me token in users table' do
+                  assert_not_nil @user.reload.remember_token
+                  assert_not_nil @user.reload.remember_token_expires_at
+                end
+              end
+              
+              context "a POST to #create with bad credentials and remember me" do
+                setup do
+                  post :create, :session => { :email => @user.email, 
+                    :password => "bad value", :remember_me => '1' }
+                end
+
+                should_set_the_flash_to /bad/i
+                should_render_template :new
+                should_return_from_session :user_id, "nil"
+                
+                should 'not create the cookie' do
+                  assert_nil cookies['auth_token']
+                end
+
+                should 'not set the remember me token in users table' do
+                  assert_nil @user.reload.remember_token
+                  assert_nil @user.reload.remember_token_expires_at
+                end
+              end
+            end
+
+            public_context do
+              context "logging out again" do
+                setup { delete :destroy }
+                should_redirect_to '@controller.send(:url_after_destroy)'
+              end
+            end
+
+            logged_in_user_context do
+              context "a DELETE to #destroy without a cookie" do
+                setup { delete :destroy }
+
+                should_set_the_flash_to(/logged out/i)
+                should_redirect_to '@controller.send(:url_after_destroy)'
+              end
+
+              context 'a DELETE to #destroy with a cookie' do
+                setup do
+                  cookies['auth_token'] = CGI::Cookie.new 'token', 'value'
+                  delete :destroy
+                end
+
+                should 'delete the cookie' do
+                  assert cookies['auth_token'].empty?
+                end
+
+                should 'delete the remember me token in users table' do
+                  assert_nil @user.reload.remember_token
+                  assert_nil @user.reload.remember_token_expires_at
+                end
+              end
+            end
+          end
+        end
+
+      end
+    end
+  end
+end