janus 0.5.0

data/lib/janus/strategies/rememberable.rb

@@ -0,0 +1,52 @@
+require 'janus/hooks/rememberable'
+
+module Janus
+  module Strategies
+    class Rememberable < Base
+      def valid?
+        rememberable? && !remember_cookie.nil?
+      end
+
+      def authenticate!
+        user = resource.find_for_remember_authentication(remember_cookie)
+        
+        if user.nil?
+          destroy_remember_cookie
+          pass
+        else
+          success!(user)
+          extend_remember_period if resource.extend_remember_period
+        end
+      end
+
+      def self.remember_cookie_name(scope)
+        "remember_#{scope}_token"
+      end
+
+      private
+        def destroy_remember_cookie
+          request.cookies.delete(remember_cookie_name)
+        end
+
+        def extend_remember_period
+          cookies[remember_cookie_name] = {
+            :value => @user.remember_token,
+            :expires => resource.remember_for.from_now
+          }
+          user.update_attribute(:remember_created_at, Time.now)
+        end
+
+        def remember_cookie_name
+          self.class.remember_cookie_name(scope)
+        end
+
+        def remember_cookie
+          request.cookies[remember_cookie_name]
+        end
+
+        def rememberable?
+          resource.include?(Janus::Models::Rememberable)
+        end
+    end
+  end
+end

data/lib/janus/strategies/remote_authenticatable.rb

@@ -0,0 +1,28 @@
+# IMPROVE: redirect to clean the URL from the auth_token.
+module Janus
+  module Strategies
+    class RemoteAuthenticatable < Base
+      def valid?
+        resource.include?(Janus::Models::RemoteAuthenticatable) && !remote_token.nil?
+      end
+
+      def authenticate!
+        user = resource.find_for_remote_authentication(remote_token)
+        
+        if user
+          success!(user)
+        else
+          pass
+        end
+      end
+
+      def remote_token
+        request.params[resource.remote_authentication_key]
+      end
+
+      def auth_method
+        :set_user
+      end
+    end
+  end
+end

data/lib/janus/strategies.rb

@@ -0,0 +1,33 @@
+module Janus
+  module Strategies
+    extend ActiveSupport::Concern
+
+    # Runs authentication strategies to log a user in.
+    def run_strategies(scope)
+      Janus::Manager.strategies.each { |name| break if run_strategy(name, scope) }
+    end
+
+    # Runs a given strategy and returns true if it succeeded.
+    def run_strategy(name, scope)
+      strategy = "Janus::Strategies::#{name.to_s.camelize}".constantize.new(scope, self)
+      
+      if strategy.valid?
+        strategy.authenticate!
+        
+        if strategy.success?
+          send(strategy.auth_method, strategy.user, :scope => scope)
+          Janus::Manager.run_callbacks(:authenticate, strategy.user, self, :scope => scope)
+        end
+      end
+      
+      strategy.success?
+    end
+
+    module ClassMethods
+      # Returns the list of strategies as underscore symbols.
+      def strategies
+        @strategies ||= [:rememberable, :remote_authenticatable]
+      end
+    end
+  end
+end

data/lib/janus/test_helper.rb

@@ -0,0 +1,25 @@
+module Janus
+  module TestHelper
+    def self.included(klass)
+      klass.class_eval do
+        setup { @janus = Janus::Manager.new(request, cookies) }
+      end
+    end
+
+    def sign_in(user, options = {})
+      @janus.login(user, options)
+    end
+
+    def sign_out(user_or_scope)
+      @janus.logout(Janus.scope_for(user_or_scope))
+    end
+
+    def assert_authenticated(scope)
+      assert @janus.authenticated?(scope), "Expected #{scope} to be authenticated."
+    end
+
+    def assert_not_authenticated(scope)
+      assert !@janus.authenticated?(scope), "Expected #{scope} to not be authenticated."
+    end
+  end
+end

data/lib/janus.rb

@@ -0,0 +1,60 @@
+require 'janus/config'
+require 'janus/hooks'
+require 'janus/strategies'
+require 'janus/manager'
+require 'janus/routes'
+
+autoload :JanusHelper, 'janus/helper'
+
+module Janus
+  class NotAuthenticated < StandardError
+    cattr_accessor :scope
+
+    def initialize(scope)
+      super("")
+      self.scope = scope
+    end
+  end
+
+  autoload :Mailer,                    'janus/mailer'
+  autoload :TestHelper,                'janus/test_helper'
+
+  autoload :Helpers,                   'janus/controllers/helpers'
+  autoload :UrlHelpers,                'janus/controllers/url_helpers'
+  autoload :InternalHelpers,           'janus/controllers/internal_helpers'
+
+  autoload :SessionsController,        'janus/controllers/sessions_controller'
+  autoload :RegistrationsController,   'janus/controllers/registrations_controller'
+  autoload :ConfirmationsController,   'janus/controllers/confirmations_controller'
+  autoload :PasswordsController,       'janus/controllers/passwords_controller'
+
+  module Models
+    autoload :Base,                    'janus/models/base'
+    autoload :DatabaseAuthenticatable, 'janus/models/database_authenticatable'
+    autoload :Confirmable,             'janus/models/confirmable'
+    autoload :Rememberable,            'janus/models/rememberable'
+    autoload :RemoteAuthenticatable,   'janus/models/remote_authenticatable'
+    autoload :RemoteToken,             'janus/models/remote_token'
+    autoload :Trackable,               'janus/models/trackable'
+  end
+
+  module Strategies
+    autoload :Base,                    'janus/strategies/base'
+    autoload :Rememberable,            'janus/strategies/rememberable'
+    autoload :RemoteAuthenticatable,   'janus/strategies/remote_authenticatable'
+  end
+
+  def self.scope_for(user_or_scope)
+    case user_or_scope
+    when Symbol then user_or_scope
+    when String then user_or_scope.to_sym
+    else user_or_scope.class.name.underscore.to_sym
+    end
+  end
+
+  def self.config
+    yield(Janus::Config) if block_given?
+    Janus::Config
+  end
+end
+

data/test/functional/home_controller_test.rb

@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class HomeControllerTest < ActionController::TestCase
+  test "should get index" do
+    get :index
+    assert_response :ok
+  end
+end

data/test/functional/janus/mailer_test.rb

@@ -0,0 +1,14 @@
+require 'test_helper'
+
+class Janus::MailerTest < ActionMailer::TestCase
+  test "reset_password_instructions" do
+    users(:julien).generate_reset_password_token!
+    
+    mail = JanusMailer.reset_password_instructions(users(:julien)).deliver
+    assert_equal [users(:julien).email], mail.to
+    assert !mail.subject.blank?
+    
+    url = edit_user_password_url(:token => users(:julien).reset_password_token)
+    assert_match Regexp.new(Regexp.escape(url)), mail.encoded
+  end
+end

data/test/functional/janus/manager_test.rb

@@ -0,0 +1,94 @@
+require 'test_helper'
+
+class Janus::ManagerTest < ActionController::TestCase
+  test "should log user in and out" do
+    @janus.login(users(:julien))
+    assert @janus.authenticated?(:user), "Expected user to be authenticated."
+    assert_equal users(:julien), @janus.user(:user)
+    
+    @janus.logout(:user)
+    assert !@janus.authenticated?(:user), "Expected user to not be authenticated."
+    assert_nil @janus.user(:user)
+  end
+
+  test "should log user in and out with custom scope" do
+    @janus.login(users(:julien), :scope => :custom)
+    assert @janus.authenticated?(:custom), "Expected user to be authenticated."
+    assert_equal users(:julien), @janus.user(:custom)
+    
+    @janus.logout(:custom)
+    assert !@janus.authenticated?(:custom), "Expected user to not be authenticated."
+    assert_nil @janus.user(:custom)
+  end
+
+  test "should log users in different scopes" do
+    @janus.login(users(:julien), :scope => :user)
+    @janus.login(users(:martha), :scope => :admin)
+    assert @janus.authenticated?(:user),  "Expected user to be authenticated."
+    assert @janus.authenticated?(:admin), "Expected admin to be authenticated."
+    assert_equal users(:julien), @janus.user(:user)
+    assert_equal users(:martha), @janus.user(:admin)
+    
+    @janus.logout(:admin)
+    assert  @janus.authenticated?(:user),  "Expected user to still be authenticated."
+    assert !@janus.authenticated?(:admin), "Expected admin to no longer be authenticated."
+    assert_equal users(:julien), @janus.user(:user)
+    assert_nil @janus.user(:admin)
+  end
+
+  test "should logout all scopes at once" do
+    @janus.login(users(:julien), :scope => :user)
+    @janus.login(users(:martha), :scope => :admin)
+    assert @janus.authenticated?(:user),  "Expected user to be authenticated."
+    assert @janus.authenticated?(:admin), "Expected admin to be authenticated."
+    
+    @janus.logout
+    assert !@janus.authenticated?(:user),  "Expected user to no longer be authenticated."
+    assert !@janus.authenticated?(:admin), "Expected admin to no longer be authenticated."
+  end
+
+  test "should reset session after logout from last scope" do
+    @janus.login(users(:julien), :scope => :user)
+    @janus.login(users(:martha), :scope => :admin)
+    
+    @janus.logout(:admin)
+    assert_not_nil session['janus']
+    
+    @janus.logout(:user)
+    assert_nil session['janus']
+  end
+
+  test "should set and unset the user manually" do
+    @janus.set_user(users(:martha))
+    assert @janus.authenticated?(:user), "Expected user to be authenticated."
+    assert_equal users(:martha), @janus.user(:user)
+    
+    @janus.unset_user(:user)
+    assert !@janus.authenticated?(:user), "Expected user to not be authenticated."
+    assert_nil @janus.user(:user)
+  end
+
+  test "should set and unset the user manually in different scopes" do
+    @janus.set_user(users(:martha), :scope => :user)
+    @janus.set_user(users(:julien), :scope => :admin)
+    assert @janus.authenticated?(:user),  "Expected user to be authenticated."
+    assert @janus.authenticated?(:admin), "Expected admin to be authenticated."
+    assert_equal users(:martha), @janus.user(:user)
+    assert_equal users(:julien), @janus.user(:admin)
+    
+    @janus.unset_user(:user)
+    assert !@janus.authenticated?(:user),  "Expected user to no longer be authenticated."
+    assert  @janus.authenticated?(:admin), "Expected admin to still be authenticated."
+    assert_nil @janus.user(:user)
+    assert_equal users(:julien), @janus.user(:admin)
+    
+    @janus.unset_user(:martha)
+  end
+
+  test "authenticate!" do
+    assert_raise(Janus::NotAuthenticated) { @janus.authenticate!(:user) }
+    
+    @janus.set_user(users(:julien))
+    assert_nothing_raised { @janus.authenticate!(:user) }
+  end
+end

data/test/functional/users/confirmations_controller_test.rb

@@ -0,0 +1,59 @@
+require 'test_helper'
+
+class Users::ConfirmationsControllerTest < ActionController::TestCase
+  test "should get show with token" do
+    users(:julien).generate_confirmation_token
+    users(:julien).save!
+    
+    assert_difference('User.count(:confirmed_at)') do
+      get :show, :confirm_token => users(:julien).confirmation_token
+      assert_redirected_to root_url
+      assert flash[:notice]
+    end
+  end
+
+  test "should not get show without token" do
+    assert_no_difference('User.count(:confirmed_at)') do
+      get :show
+      assert_response :ok
+      assert_template 'new'
+      assert_select '#error_explanation'
+    end
+  end
+
+  test "should not get show with bad token" do
+    users(:julien).generate_reset_password_token!
+    
+    assert_no_difference('User.count(:confirmed_at)') do
+      get :show, :token => "aiorujfqptezjsmdguspfofkn"
+      assert_response :ok
+      assert_template 'new'
+      assert_select '#error_explanation'
+    end
+  end
+
+  test "should get new" do
+    get :new
+    assert_response :ok
+    assert_select '#user_email', 1
+  end
+
+  test "should create" do
+    assert_email do
+      post :create, :user => { :email => users(:julien).email }
+    end
+    
+    assert_redirected_to root_url
+    assert flash[:notice]
+  end
+
+  test "should not create" do
+    assert_no_email do
+      post :create, :user => { :email => 'nobody@example.com' }
+    end
+    
+    assert_response :ok
+    assert_template 'new'
+    assert_select '#error_explanation'
+  end
+end

data/test/functional/users/passwords_controller_test.rb

@@ -0,0 +1,101 @@
+require 'test_helper'
+
+class Users::PasswordsControllerTest < ActionController::TestCase
+  setup do
+    @attributes = {
+      :password => "azerty",
+      :password_confirmation => "azerty"
+    }
+  end
+
+  test "should get new" do
+    get :new
+    assert_response :ok
+    assert_select '#user_email', 1
+  end
+
+  test "should get edit with token" do
+    users(:julien).generate_reset_password_token!
+    
+    get :edit, :token => users(:julien).reset_password_token
+    assert_response :ok
+    assert_select '#user_reset_password_token', 1
+    assert_select '#user_password', 1
+    assert_select '#user_password_confirmation', 1
+  end
+
+  test "should not get edit without token" do
+    get :edit
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should not get edit with bad token" do
+    users(:julien).generate_reset_password_token!
+    
+    get :edit, :token => "aiorujfqptezjsmdguspfofkn"
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should create" do
+    assert_email do
+      post :create, :user => { :email => users(:julien).email }
+    end
+    assert_redirected_to root_url
+    assert flash[:notice]
+  end
+
+  test "should not create" do
+    assert_no_email do
+      post :create, :user => { :email => 'nobody@example.com' }
+    end
+    assert_response :ok
+    assert_template 'new'
+    assert_select '#error_explanation'
+  end
+
+  test "should update" do
+    users(:julien).generate_reset_password_token!
+    
+    put :update, :user => @attributes.merge(:reset_password_token => users(:julien).reset_password_token)
+    assert_redirected_to root_url
+    assert flash[:notice]
+    
+    users(:julien).reload
+    
+    assert_nil users(:julien).reset_password_token
+    assert_nil users(:julien).reset_password_sent_at
+    assert users(:julien).valid_password?(@attributes[:password])
+  end
+
+  test "should not update" do
+    users(:julien).generate_reset_password_token!
+    
+    put :update, :user => @attributes.merge(
+      :reset_password_token => users(:julien).reset_password_token,
+      :password_confirmation => "qwerty"
+    )
+    assert_response :ok
+    assert_template 'users/passwords/edit'
+    assert_select '#error_explanation'
+    
+    users(:julien).reload
+    
+    assert_not_nil users(:julien).reset_password_token
+    assert_not_nil users(:julien).reset_password_sent_at
+    assert !users(:julien).valid_password?(@attributes[:password])
+  end
+
+  test "should not update without token" do
+    put :update, :user => @attributes
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should not update with bad token" do
+    put :update, :user => @attributes.merge(:reset_password_token => "zeouraprsoghpzçtusfgyzmpfojfjbsodifs")
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+end

data/test/functional/users/registrations_controller_test.rb

@@ -0,0 +1,112 @@
+require 'test_helper'
+
+class Users::RegistrationsControllerTest < ActionController::TestCase
+  test "should get new" do
+    get :new
+    assert_response :ok
+    assert_select '#user_email'
+    assert_select '#user_password'
+    assert_select '#user_password_confirmation'
+  end
+
+  test "should create" do
+    assert_email do
+      post :create, :user => { :email => 'toto@example.com', :password => 'my secret' }
+      assert_redirected_to user_url
+      assert_authenticated(:user)
+    end
+  end
+
+  test "should create with password confirmation" do
+    assert_email do
+      post :create, :user => { :email => 'toto@example.com', :password => 'my secret', :password_confirmation => 'my secret' }
+      assert_redirected_to user_url
+      assert_authenticated(:user)
+    end
+  end
+
+  test "should not create with bad confirmation" do
+    assert_no_email do
+      post :create, :user => { :email => 'toto@example.com', :password => 'my secret', :password_confirmation => 'blah' }
+      assert_response :ok
+      assert_template 'users/registrations/new'
+    end
+    
+    assert_select   '#error_explanation'
+    assert_select   "#user_password", 1
+    assert_select   "#user_password[value]", 0
+    assert_select   "#user_password_confirmation", 1
+    assert_select   "#user_password_confirmation[value]", 0
+  end
+
+  test "should get edit" do
+    sign_in users(:julien)
+    get :edit
+    assert_response :ok
+    assert_select '#user_email'
+    assert_select '#user_current_password'
+    assert_select '#user_password'
+    assert_select '#user_password_confirmation'
+  end
+
+  test "should update" do
+    sign_in users(:julien)
+    
+#    assert_email do
+      put :update, :user => { :email => 'toto@example.com', :current_password => 'secret' }
+      assert_redirected_to user_url
+#    end
+  end
+
+  test "should update with blank passwords" do
+    sign_in users(:julien)
+    put :update, :user => { :email => 'toto@example.com', :current_password => 'secret',
+      :password => "", :password_confirmation => "" }
+    assert_redirected_to user_url
+    assert users(:julien).valid_password?('secret')
+  end
+
+  test "should not update without current_password" do
+    sign_in users(:julien)
+    put :update, :user => { :email => 'toto@example.com' }
+    assert_response :ok
+    assert_template 'users/registrations/edit'
+    assert_select   '#error_explanation'
+  end
+
+  test "should not update with bad current_password" do
+    sign_in users(:julien)
+    put :update, :user => { :email => 'toto@example.com', :current_password => 'bad secret',
+      :password => "azerty", :password_confirmation => "azerty" }
+    assert_response :ok
+    assert_template 'users/registrations/edit'
+    assert_select   '#error_explanation'
+    assert_select   '#user_current_password'
+    assert_select   '#user_current_password[value]', 0
+    assert_select   '#user_password'
+    assert_select   '#user_password[value]', 0
+    assert_select   '#user_password_confirmation'
+    assert_select   '#user_password_confirmation[value]', 0
+  end
+
+  test "should destroy" do
+    sign_in users(:julien)
+    delete :destroy
+    assert_redirected_to root_url
+  end
+
+  test "anonymous should not get edit" do
+    get :edit
+    assert_redirected_to new_user_session_url
+  end
+
+  test "anonymous should not update" do
+    put :update, :user => { :email => 'toto@example.com', :current_password => 'bad secret' }
+    assert_redirected_to new_user_session_url
+  end
+
+  test "anonymous should not destroy" do
+    delete :destroy
+    assert_redirected_to new_user_session_url
+  end
+end

data/test/functional/users/sessions_controller_test.rb

@@ -0,0 +1,100 @@
+require 'test_helper'
+
+class Users::SessionsControllerTest < ActionController::TestCase
+  setup do
+    @valid = { :email => users(:julien).email, :password => 'secret' }
+  end
+
+  test "should get new" do
+    get :new
+    assert_response :ok
+    assert_select '#user_email', 1
+    assert_select '#user_password', 1
+    assert_select 'input[name=return_to]', 0
+  end
+
+  test "new should define return_to to referer by default" do
+    request.env['HTTP_REFERER'] = "/some/path"
+    get :new
+    assert_response :ok
+    assert_select '#user_email', 1
+    assert_select '#user_password', 1
+    assert_select 'input[name=return_to][value=/some/path]', 1
+  end
+
+  test "new should pass return_to" do
+    get :new, :return_to => root_path
+    assert_response :ok
+    assert_select '#user_email', 1
+    assert_select '#user_password', 1
+    assert_select 'input[name=return_to][value=' + root_path + ']', 1
+  end
+
+  test "should create" do
+    post :create, :user => @valid
+    assert_redirected_to user_url
+    assert_authenticated(:user)
+  end
+
+  test "should create and redirect to given path" do
+    post :create, :user => @valid, :return_to => blog_path
+    assert_redirected_to blog_path
+    assert_authenticated(:user)
+  end
+
+  test "should create and redirect to given URL" do
+    post :create, :user => @valid, :return_to => root_url
+    assert_redirected_to root_url
+    assert_authenticated(:user)
+  end
+
+  test "create should not redirect to unknown host" do
+    post :create, :user => @valid, :return_to => root_url(:host => 'www.bad-host.com')
+    assert_redirected_to user_url
+    assert_authenticated(:user)
+  end
+
+  test "should fail to create without password" do
+    post :create, :user => { :email => users(:julien).email, :password => '' }
+    assert_response :unauthorized
+    assert_template 'users/sessions/new'
+    assert_select "#user_email[value='" + users(:julien).email + "']"
+    assert_select "#user_password[value='secret']", 0
+    assert_select '#error_explanation'
+    assert_not_authenticated(:user)
+  end
+
+  test "should fail to create with bad password" do
+    post :create, :user => { :email => users(:martha).email, :password => 'force me in' }
+    assert_response :unauthorized
+    assert_template 'users/sessions/new'
+    assert_select "#user_email[value='" + users(:martha).email + "']"
+    assert_select "#user_password[value='force me in']", 0
+    assert_select '#error_explanation'
+    assert_not_authenticated(:user)
+  end
+
+  test "should fail to create with unknown user" do
+    post :create, :user => { :email => 'nobody@localhost', :password => 'secret' }
+    assert_response :unauthorized
+    assert_template 'users/sessions/new'
+    assert_select "#user_email[value='nobody@localhost']"
+    assert_select "#user_password[value='secret']", 0
+    assert_select '#error_explanation'
+    assert_not_authenticated(:user)
+  end
+
+  test "should destroy" do
+    sign_in users(:julien)
+    
+    get :destroy
+    assert_redirected_to root_url
+    assert_not_authenticated(:user)
+  end
+
+  test "destroy should silently logout anonymous" do
+    get :destroy
+    assert_redirected_to root_url
+    assert_not_authenticated(:user)
+  end
+end