janus 0.7.0 → 0.8.0

data/lib/janus/models/rememberable.rb

@@ -20,6 +20,8 @@ module Janus
       extend ActiveSupport::Concern
 
       included do
+        include Janus::Models::Base unless include?(Janus::Models::Base)
+
         begin
           attr_protected :remember_token, :remember_created_at
         rescue

data/lib/janus/models/remote_authenticatable.rb

@@ -57,6 +57,8 @@ module Janus
       extend ActiveSupport::Concern
 
       included do |klass|
+        include Janus::Models::Base unless include?(Janus::Models::Base)
+
         begin
           attr_protected :session_token
         rescue

data/lib/janus/models/remote_token.rb

@@ -1,11 +1,12 @@
 module Janus
   module Models
     module RemoteToken
-      def self.included(klass)
-        klass.class_eval do
-          include Janus::Models::Base
-          before_save :reset_token
-        end
+      extend ActiveSupport::Concern
+
+      included do
+        include Janus::Models::Base
+
+        before_save :reset_token
       end
 
       # Generates an unique token.

data/lib/janus/models/token_authenticatable.rb

@@ -0,0 +1,79 @@
+module Janus
+  module Models
+    # = TokenAuthenticatable
+    #
+    # Allows to connect through an unique identifier.
+    #
+    # The strategy to generate the authentication token is up to you. You may
+    # either generate a token when a user is created:
+    #
+    #   before_create :reset_authentication_token
+    #
+    # or you may change the token whenever a user is saved:
+    #
+    #   before_save :reset_authentification_token
+    #
+    # or whenever its password is changed:
+    #
+    #   before_save :reset_authentication_token, :if => :encrypted_password_changed?
+    #
+    # The strategy to invalidate the authentication token is also up to you. You
+    # may use a callback or one of the configuration options:
+    #
+    # - +token_authentication_valid_for+ - number of seconds a token will be
+    #   valid once created (defaults to nil);
+    # - +reusable_authentication_token+  - false to destroy the token once it's
+    #   consumed (defaults to true).
+    #
+    module TokenAuthenticatable
+      extend ActiveSupport::Concern
+
+      included do
+        include Janus::Models::Base unless include?(Janus::Models::Base)
+
+        begin
+          attr_protected :authentication_token, :token_authentication_valid_for, :reusable_authentication_token
+        rescue
+        end
+
+        janus_config :token_authentication_key, :token_authentication_valid_for, :reusable_authentication_token
+      end
+
+      # Generates an unique authentication token and saves the model.
+      # Any existing token will be overwritten.
+      def reset_authentication_token!
+        reset_authentication_token
+        save
+      end
+
+      # Generates an unique authentification token.
+      def reset_authentication_token
+        self.authentication_token = self.class.generate_token(:authentication_token)
+        self.authentication_token_created_at = Time.now
+      end
+
+      # Destroys the auth token.
+      def destroy_authentication_token!
+        update_attribute(:authentication_token, nil)
+      end
+
+      module ClassMethods
+        def find_for_token_authentication(token)
+          if record = where(:authentication_token => token).first
+            if expired_authentication_token?(record)
+              record.destroy_authentication_token!
+              return
+            end
+            record.destroy_authentication_token! unless reusable_authentication_token
+            record
+          end
+        end
+
+        def expired_authentication_token?(record)
+          token_authentication_valid_for && record.authentication_token_created_at &&
+            record.authentication_token_created_at < Time.now - token_authentication_valid_for
+        end
+      end
+    end
+  end
+end

data/lib/janus/models/trackable.rb

@@ -18,6 +18,8 @@ module Janus
       extend ActiveSupport::Concern
 
       included do
+        include Janus::Models::Base unless include?(Janus::Models::Base)
+
         begin
           attr_protected :sign_in_count, :current_sign_in_at, :last_sign_in_at, :current_sign_in_ip, :last_sign_in_ip
         rescue

data/lib/janus/strategies.rb

@@ -26,7 +26,7 @@ module Janus
     module ClassMethods
       # Returns the list of strategies as underscore symbols.
       def strategies
-        @strategies ||= [:rememberable, :remote_authenticatable]
+        @strategies ||= [:rememberable, :remote_authenticatable, :token_authenticatable]
       end
     end
   end

data/lib/janus/strategies/token_authenticatable.rb

@@ -0,0 +1,22 @@
+module Janus
+  module Strategies
+    class TokenAuthenticatable < Base
+      def valid?
+        resource.include?(Janus::Models::TokenAuthenticatable) and !auth_token.nil?
+      end
+
+      def authenticate!
+        user = resource.find_for_token_authentication(auth_token)
+        if user
+          success!(user)
+        else
+          pass
+        end
+      end
+
+      def auth_token
+        request.params[resource.token_authentication_key]
+      end
+    end
+  end
+end

data/lib/janus/version.rb

@@ -0,0 +1,10 @@
+module Janus
+  def self.version
+    Gem::Version.new File.read(File.expand_path('../../../VERSION', __FILE__))
+  end
+
+  module VERSION
+    MAJOR, MINOR, TINY, PRE = Janus.version.segments
+    STRING = Janus.version.to_s
+  end
+end

data/test/fixtures/admins.yml

@@ -0,0 +1,5 @@
+bob:
+  email: "bob@example.com"
+  encrypted_password: "$2a$10$MFILoaQqegEY7swhM1KVeu7f1hls.3YhRRvrhWVX/NULJsqpyTLeO"
+# password: "secret"
+

data/test/fixtures/users.yml

@@ -0,0 +1,10 @@
+julien:
+  email: "julien@example.com"
+  encrypted_password: "$2a$10$MFILoaQqegEY7swhM1KVeu7f1hls.3YhRRvrhWVX/NULJsqpyTLeO"
+# password: "secret"
+
+martha:
+  email: "martha@fai.fr"
+  encrypted_password: "$2a$10$EBsYVyy9rvhC51.5HzQRDet4lh.0hAYwYbM0l6t3x0YfjKFKJNQm6"
+# password: "vacances"
+

data/test/functional/admins/sessions_controller_test.rb

@@ -0,0 +1,13 @@
+require 'test_helper'
+
+class Admins::SessionsControllerTest < ActionController::TestCase
+  setup do
+    @valid = { :email => admins(:bob).email, :password => 'secret' }
+  end
+
+  test "return_to when passwords_controller is missing" do
+    post :create, :admin => @valid
+    assert_redirected_to root_url
+    assert_authenticated(:admin)
+  end
+end

data/test/functional/home_controller_test.rb

@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class HomeControllerTest < ActionController::TestCase
+  test "should get index" do
+    get :index
+    assert_response :ok
+  end
+end

data/test/functional/janus/mailer_test.rb

@@ -0,0 +1,14 @@
+require 'test_helper'
+
+class Janus::MailerTest < ActionMailer::TestCase
+  test "reset_password_instructions" do
+    users(:julien).generate_reset_password_token!
+
+    mail = UserMailer.reset_password_instructions(users(:julien)).deliver
+    assert_equal [users(:julien).email], mail.to
+    assert !mail.subject.blank?
+
+    url = edit_user_password_url(:token => users(:julien).reset_password_token)
+    assert_match Regexp.new(Regexp.escape(url)), mail.encoded
+  end
+end

data/test/functional/janus/manager_test.rb

@@ -0,0 +1,94 @@
+require 'test_helper'
+
+class Janus::ManagerTest < ActionController::TestCase
+  test "should log user in and out" do
+    @janus.login(users(:julien))
+    assert @janus.authenticated?(:user), "Expected user to be authenticated."
+    assert_equal users(:julien), @janus.user(:user)
+
+    @janus.logout(:user)
+    assert !@janus.authenticated?(:user), "Expected user to not be authenticated."
+    assert_nil @janus.user(:user)
+  end
+
+  test "should log user in and out with custom scope" do
+    @janus.login(users(:julien), :scope => :custom)
+    assert @janus.authenticated?(:custom), "Expected user to be authenticated."
+    assert_equal users(:julien), @janus.user(:custom)
+
+    @janus.logout(:custom)
+    assert !@janus.authenticated?(:custom), "Expected user to not be authenticated."
+    assert_nil @janus.user(:custom)
+  end
+
+  test "should log users in different scopes" do
+    @janus.login(users(:julien), :scope => :user)
+    @janus.login(users(:martha), :scope => :admin)
+    assert @janus.authenticated?(:user),  "Expected user to be authenticated."
+    assert @janus.authenticated?(:admin), "Expected admin to be authenticated."
+    assert_equal users(:julien), @janus.user(:user)
+    assert_equal users(:martha), @janus.user(:admin)
+
+    @janus.logout(:admin)
+    assert  @janus.authenticated?(:user),  "Expected user to still be authenticated."
+    assert !@janus.authenticated?(:admin), "Expected admin to no longer be authenticated."
+    assert_equal users(:julien), @janus.user(:user)
+    assert_nil @janus.user(:admin)
+  end
+
+  test "should logout all scopes at once" do
+    @janus.login(users(:julien), :scope => :user)
+    @janus.login(users(:martha), :scope => :admin)
+    assert @janus.authenticated?(:user),  "Expected user to be authenticated."
+    assert @janus.authenticated?(:admin), "Expected admin to be authenticated."
+
+    @janus.logout
+    assert !@janus.authenticated?(:user),  "Expected user to no longer be authenticated."
+    assert !@janus.authenticated?(:admin), "Expected admin to no longer be authenticated."
+  end
+
+  test "should reset session after logout from last scope" do
+    @janus.login(users(:julien), :scope => :user)
+    @janus.login(users(:martha), :scope => :admin)
+
+    @janus.logout(:admin)
+    assert_not_nil session['janus']
+
+    @janus.logout(:user)
+    assert_nil session['janus']
+  end
+
+  test "should set and unset the user manually" do
+    @janus.set_user(users(:martha))
+    assert @janus.authenticated?(:user), "Expected user to be authenticated."
+    assert_equal users(:martha), @janus.user(:user)
+
+    @janus.unset_user(:user)
+    assert !@janus.authenticated?(:user), "Expected user to not be authenticated."
+    assert_nil @janus.user(:user)
+  end
+
+  test "should set and unset the user manually in different scopes" do
+    @janus.set_user(users(:martha), :scope => :user)
+    @janus.set_user(users(:julien), :scope => :admin)
+    assert @janus.authenticated?(:user),  "Expected user to be authenticated."
+    assert @janus.authenticated?(:admin), "Expected admin to be authenticated."
+    assert_equal users(:martha), @janus.user(:user)
+    assert_equal users(:julien), @janus.user(:admin)
+
+    @janus.unset_user(:user)
+    assert !@janus.authenticated?(:user),  "Expected user to no longer be authenticated."
+    assert  @janus.authenticated?(:admin), "Expected admin to still be authenticated."
+    assert_nil @janus.user(:user)
+    assert_equal users(:julien), @janus.user(:admin)
+
+    @janus.unset_user(:martha)
+  end
+
+  test "authenticate!" do
+    assert_raise(Janus::NotAuthenticated) { @janus.authenticate!(:user) }
+
+    @janus.set_user(users(:julien))
+    assert_nothing_raised { @janus.authenticate!(:user) }
+  end
+end

data/test/functional/users/confirmations_controller_test.rb

@@ -0,0 +1,68 @@
+require 'test_helper'
+
+class Users::ConfirmationsControllerTest < ActionController::TestCase
+  test "should get show with token" do
+    users(:julien).generate_confirmation_token
+    users(:julien).save!
+
+    assert_difference('User.count(:confirmed_at)') do
+      get :show, :confirm_token => users(:julien).confirmation_token
+      assert_redirected_to root_url
+      assert flash[:notice]
+    end
+  end
+
+  test "should not get show without token" do
+    assert_no_difference('User.count(:confirmed_at)') do
+      get :show
+      assert_response :ok
+      assert_template 'new'
+      assert_select '#error_explanation'
+    end
+  end
+
+  test "should not get show with blank token" do
+    assert_no_difference('User.count(:confirmed_at)') do
+      get :show, :token => ""
+      assert_response :ok
+      assert_template 'new'
+      assert_select '#error_explanation'
+    end
+  end
+
+  test "should not get show with bad token" do
+    users(:julien).generate_reset_password_token!
+
+    assert_no_difference('User.count(:confirmed_at)') do
+      get :show, :token => "aiorujfqptezjsmdguspfofkn"
+      assert_response :ok
+      assert_template 'new'
+      assert_select '#error_explanation'
+    end
+  end
+
+  test "should get new" do
+    get :new
+    assert_response :ok
+    assert_select '#user_email', 1
+  end
+
+  test "should create" do
+    assert_email do
+      post :create, :user => { :email => users(:julien).email }
+    end
+
+    assert_redirected_to root_url
+    assert flash[:notice]
+  end
+
+  test "should not create" do
+    assert_no_email do
+      post :create, :user => { :email => 'nobody@example.com' }
+    end
+
+    assert_response :ok
+    assert_template 'new'
+    assert_select '#error_explanation'
+  end
+end

data/test/functional/users/passwords_controller_test.rb

@@ -0,0 +1,131 @@
+# encoding: utf-8
+require 'test_helper'
+
+class Users::PasswordsControllerTest < ActionController::TestCase
+  setup do
+    @attributes = {
+      :password => "azerty",
+      :password_confirmation => "azerty"
+    }
+  end
+
+  test "should get new" do
+    get :new
+    assert_response :ok
+    assert_select '#user_email', 1
+  end
+
+  test "should get edit with token" do
+    users(:julien).generate_reset_password_token!
+
+    get :edit, :token => users(:julien).reset_password_token
+    assert_response :ok
+    assert_select '#user_reset_password_token', 1
+    assert_select '#user_password', 1
+    assert_select '#user_password_confirmation', 1
+  end
+
+  test "should not get edit without token" do
+    get :edit
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should not get edit with blank token" do
+    get :edit, :token => ''
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should not get edit with expired token" do
+    users(:julien).generate_reset_password_token!
+    users(:julien).update_attribute(:reset_password_sent_at, 1.month.ago)
+    get :edit, :token => "aiorujfqptezjsmdguspfofkn"
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should not get edit with bad token" do
+    users(:julien).generate_reset_password_token!
+
+    get :edit, :token => "aiorujfqptezjsmdguspfofkn"
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should create" do
+    assert_email do
+      post :create, :user => { :email => users(:julien).email }
+    end
+    assert_redirected_to root_url
+    assert flash[:notice]
+  end
+
+  test "should not create" do
+    assert_no_email do
+      post :create, :user => { :email => 'nobody@example.com' }
+    end
+    assert_response :ok
+    assert_template 'new'
+    assert_select '#error_explanation'
+  end
+
+  test "should update" do
+    users(:julien).generate_reset_password_token!
+
+    put :update, :user => @attributes.merge(:reset_password_token => users(:julien).reset_password_token)
+    assert_redirected_to root_url
+    assert flash[:notice]
+
+    users(:julien).reload
+
+    assert_nil users(:julien).reset_password_token
+    assert_nil users(:julien).reset_password_sent_at
+    assert users(:julien).valid_password?(@attributes[:password])
+  end
+
+  test "should not update" do
+    users(:julien).generate_reset_password_token!
+
+    put :update, :user => @attributes.merge(
+      :reset_password_token => users(:julien).reset_password_token,
+      :password_confirmation => "qwerty"
+    )
+    assert_response :ok
+    assert_template 'users/passwords/edit'
+    assert_select '#error_explanation'
+
+    users(:julien).reload
+
+    assert_not_nil users(:julien).reset_password_token
+    assert_not_nil users(:julien).reset_password_sent_at
+    assert !users(:julien).valid_password?(@attributes[:password])
+  end
+
+  test "should not update without token" do
+    put :update, :user => @attributes
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should not update with blank token" do
+    put :update, :user => @attributes.merge(:reset_password_token => "")
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should not update with bad token" do
+    put :update, :user => @attributes.merge(:reset_password_token => "zeouraprsoghpzçtusfgyzmpfojfjbsodifs")
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+
+  test "should not update with expired token" do
+    users(:julien).generate_reset_password_token!
+    users(:julien).update_attribute(:reset_password_sent_at, 1.month.ago)
+
+    put :update, :user => @attributes.merge(:reset_password_token => users(:julien).reset_password_token)
+    assert_redirected_to root_url
+    assert flash[:alert]
+  end
+end