loyal_devise 2.1.7 → 2.1.10
Sign up to get free protection for your applications and to get access to all the features.
- data/README.md +16 -46
- data/app/controllers/devise/passwords_controller.rb +1 -1
- data/app/controllers/devise/registrations_controller.rb +1 -1
- data/lib/devise/controllers/helpers.rb +3 -6
- data/lib/devise/failure_app.rb +1 -8
- data/lib/devise/hooks/lockable.rb +1 -1
- data/lib/devise/mapping.rb +6 -6
- data/lib/devise/models/authenticatable.rb +4 -4
- data/lib/devise/models/confirmable.rb +4 -12
- data/lib/devise/models/database_authenticatable.rb +1 -1
- data/lib/devise/models/lockable.rb +1 -1
- data/lib/devise/models/recoverable.rb +2 -7
- data/lib/devise/models/rememberable.rb +1 -1
- data/lib/devise/{parameter_filter.rb → param_filter.rb} +1 -1
- data/lib/devise/parameter_sanitizer.rb +3 -3
- data/lib/devise/version.rb +1 -1
- data/lib/devise.rb +1 -1
- data/lib/generators/templates/README +1 -1
- data/lib/loyal_devise.rb +1 -0
- metadata +65 -301
- data/.gitignore +0 -12
- data/.travis.yml +0 -20
- data/.yardopts +0 -9
- data/CHANGELOG.rdoc +0 -936
- data/CONTRIBUTING.md +0 -14
- data/Gemfile +0 -31
- data/Gemfile.lock +0 -160
- data/devise.gemspec +0 -26
- data/devise.png +0 -0
- data/gemfiles/Gemfile.rails-3.2.x +0 -31
- data/gemfiles/Gemfile.rails-3.2.x.lock +0 -156
- data/loyal_devise.gemspec +0 -29
- data/test/controllers/custom_strategy_test.rb +0 -62
- data/test/controllers/helpers_test.rb +0 -253
- data/test/controllers/internal_helpers_test.rb +0 -120
- data/test/controllers/passwords_controller_test.rb +0 -32
- data/test/controllers/sessions_controller_test.rb +0 -85
- data/test/controllers/url_helpers_test.rb +0 -59
- data/test/delegator_test.rb +0 -19
- data/test/devise_test.rb +0 -83
- data/test/failure_app_test.rb +0 -221
- data/test/generators/active_record_generator_test.rb +0 -73
- data/test/generators/devise_generator_test.rb +0 -39
- data/test/generators/install_generator_test.rb +0 -13
- data/test/generators/mongoid_generator_test.rb +0 -23
- data/test/generators/views_generator_test.rb +0 -67
- data/test/helpers/devise_helper_test.rb +0 -51
- data/test/integration/authenticatable_test.rb +0 -699
- data/test/integration/confirmable_test.rb +0 -299
- data/test/integration/database_authenticatable_test.rb +0 -84
- data/test/integration/http_authenticatable_test.rb +0 -115
- data/test/integration/lockable_test.rb +0 -242
- data/test/integration/omniauthable_test.rb +0 -133
- data/test/integration/recoverable_test.rb +0 -335
- data/test/integration/registerable_test.rb +0 -349
- data/test/integration/rememberable_test.rb +0 -165
- data/test/integration/timeoutable_test.rb +0 -150
- data/test/integration/token_authenticatable_test.rb +0 -205
- data/test/integration/trackable_test.rb +0 -92
- data/test/mailers/confirmation_instructions_test.rb +0 -111
- data/test/mailers/reset_password_instructions_test.rb +0 -92
- data/test/mailers/unlock_instructions_test.rb +0 -87
- data/test/mapping_test.rb +0 -127
- data/test/models/authenticatable_test.rb +0 -13
- data/test/models/confirmable_test.rb +0 -443
- data/test/models/database_authenticatable_test.rb +0 -226
- data/test/models/lockable_test.rb +0 -273
- data/test/models/omniauthable_test.rb +0 -7
- data/test/models/recoverable_test.rb +0 -222
- data/test/models/registerable_test.rb +0 -7
- data/test/models/rememberable_test.rb +0 -175
- data/test/models/serializable_test.rb +0 -49
- data/test/models/timeoutable_test.rb +0 -46
- data/test/models/token_authenticatable_test.rb +0 -55
- data/test/models/trackable_test.rb +0 -13
- data/test/models/validatable_test.rb +0 -127
- data/test/models_test.rb +0 -163
- data/test/omniauth/config_test.rb +0 -57
- data/test/omniauth/url_helpers_test.rb +0 -54
- data/test/orm/active_record.rb +0 -10
- data/test/orm/mongoid.rb +0 -13
- data/test/parameter_sanitizer_test.rb +0 -51
- data/test/rails_app/Rakefile +0 -6
- data/test/rails_app/app/active_record/admin.rb +0 -6
- data/test/rails_app/app/active_record/shim.rb +0 -2
- data/test/rails_app/app/active_record/user.rb +0 -6
- data/test/rails_app/app/controllers/admins/sessions_controller.rb +0 -6
- data/test/rails_app/app/controllers/admins_controller.rb +0 -11
- data/test/rails_app/app/controllers/application_controller.rb +0 -9
- data/test/rails_app/app/controllers/home_controller.rb +0 -25
- data/test/rails_app/app/controllers/publisher/registrations_controller.rb +0 -2
- data/test/rails_app/app/controllers/publisher/sessions_controller.rb +0 -2
- data/test/rails_app/app/controllers/users/omniauth_callbacks_controller.rb +0 -14
- data/test/rails_app/app/controllers/users_controller.rb +0 -31
- data/test/rails_app/app/helpers/application_helper.rb +0 -3
- data/test/rails_app/app/mailers/users/mailer.rb +0 -12
- data/test/rails_app/app/mongoid/admin.rb +0 -29
- data/test/rails_app/app/mongoid/shim.rb +0 -23
- data/test/rails_app/app/mongoid/user.rb +0 -42
- data/test/rails_app/app/views/admins/index.html.erb +0 -1
- data/test/rails_app/app/views/admins/sessions/new.html.erb +0 -2
- data/test/rails_app/app/views/home/admin_dashboard.html.erb +0 -1
- data/test/rails_app/app/views/home/index.html.erb +0 -1
- data/test/rails_app/app/views/home/join.html.erb +0 -1
- data/test/rails_app/app/views/home/private.html.erb +0 -1
- data/test/rails_app/app/views/home/user_dashboard.html.erb +0 -1
- data/test/rails_app/app/views/layouts/application.html.erb +0 -24
- data/test/rails_app/app/views/users/edit_form.html.erb +0 -1
- data/test/rails_app/app/views/users/index.html.erb +0 -1
- data/test/rails_app/app/views/users/mailer/confirmation_instructions.erb +0 -1
- data/test/rails_app/app/views/users/sessions/new.html.erb +0 -1
- data/test/rails_app/bin/bundle +0 -3
- data/test/rails_app/bin/rails +0 -4
- data/test/rails_app/bin/rake +0 -4
- data/test/rails_app/config/application.rb +0 -40
- data/test/rails_app/config/boot.rb +0 -8
- data/test/rails_app/config/database.yml +0 -18
- data/test/rails_app/config/environment.rb +0 -5
- data/test/rails_app/config/environments/development.rb +0 -34
- data/test/rails_app/config/environments/production.rb +0 -84
- data/test/rails_app/config/environments/test.rb +0 -36
- data/test/rails_app/config/initializers/backtrace_silencers.rb +0 -7
- data/test/rails_app/config/initializers/devise.rb +0 -178
- data/test/rails_app/config/initializers/inflections.rb +0 -2
- data/test/rails_app/config/initializers/secret_token.rb +0 -8
- data/test/rails_app/config/initializers/session_store.rb +0 -1
- data/test/rails_app/config/routes.rb +0 -104
- data/test/rails_app/config.ru +0 -4
- data/test/rails_app/db/migrate/20100401102949_create_tables.rb +0 -74
- data/test/rails_app/db/schema.rb +0 -52
- data/test/rails_app/lib/shared_admin.rb +0 -14
- data/test/rails_app/lib/shared_user.rb +0 -25
- data/test/rails_app/public/404.html +0 -26
- data/test/rails_app/public/422.html +0 -26
- data/test/rails_app/public/500.html +0 -26
- data/test/rails_app/public/favicon.ico +0 -0
- data/test/routes_test.rb +0 -250
- data/test/support/assertions.rb +0 -40
- data/test/support/helpers.rb +0 -91
- data/test/support/integration.rb +0 -92
- data/test/support/locale/en.yml +0 -4
- data/test/support/webrat/integrations/rails.rb +0 -24
- data/test/test_helper.rb +0 -34
- data/test/test_helpers_test.rb +0 -151
- data/test/test_models.rb +0 -26
@@ -1,165 +0,0 @@
|
|
1
|
-
require 'test_helper'
|
2
|
-
|
3
|
-
class RememberMeTest < ActionDispatch::IntegrationTest
|
4
|
-
def create_user_and_remember(add_to_token='')
|
5
|
-
user = create_user
|
6
|
-
user.remember_me!
|
7
|
-
raw_cookie = User.serialize_into_cookie(user).tap { |a| a.last << add_to_token }
|
8
|
-
cookies['remember_user_token'] = generate_signed_cookie(raw_cookie)
|
9
|
-
user
|
10
|
-
end
|
11
|
-
|
12
|
-
def generate_signed_cookie(raw_cookie)
|
13
|
-
request = ActionDispatch::TestRequest.new
|
14
|
-
request.cookie_jar.signed['raw_cookie'] = raw_cookie
|
15
|
-
request.cookie_jar['raw_cookie']
|
16
|
-
end
|
17
|
-
|
18
|
-
def signed_cookie(key)
|
19
|
-
controller.send(:cookies).signed[key]
|
20
|
-
end
|
21
|
-
|
22
|
-
def cookie_expires(key)
|
23
|
-
cookie = response.headers["Set-Cookie"].split("\n").grep(/^#{key}/).first
|
24
|
-
expires = cookie.split(";").map(&:strip).grep(/^expires=/).first
|
25
|
-
Time.parse(expires).utc
|
26
|
-
end
|
27
|
-
|
28
|
-
test 'do not remember the user if he has not checked remember me option' do
|
29
|
-
sign_in_as_user
|
30
|
-
assert_nil request.cookies["remember_user_cookie"]
|
31
|
-
end
|
32
|
-
|
33
|
-
test 'handles unverified requests gets rid of caches' do
|
34
|
-
swap UsersController, :allow_forgery_protection => true do
|
35
|
-
post exhibit_user_url(1)
|
36
|
-
assert_not warden.authenticated?(:user)
|
37
|
-
|
38
|
-
create_user_and_remember
|
39
|
-
post exhibit_user_url(1)
|
40
|
-
assert_equal "User is not authenticated", response.body
|
41
|
-
assert_not warden.authenticated?(:user)
|
42
|
-
end
|
43
|
-
end
|
44
|
-
|
45
|
-
test 'generate remember token after sign in' do
|
46
|
-
sign_in_as_user :remember_me => true
|
47
|
-
assert request.cookies["remember_user_token"]
|
48
|
-
end
|
49
|
-
|
50
|
-
test 'generate remember token after sign in setting cookie options' do
|
51
|
-
# We test this by asserting the cookie is not sent after the redirect
|
52
|
-
# since we changed the domain. This is the only difference with the
|
53
|
-
# previous test.
|
54
|
-
swap Devise, :rememberable_options => { :domain => "omg.somewhere.com" } do
|
55
|
-
user = sign_in_as_user :remember_me => true
|
56
|
-
assert_nil request.cookies["remember_user_token"]
|
57
|
-
end
|
58
|
-
end
|
59
|
-
|
60
|
-
test 'generate remember token with a custom key' do
|
61
|
-
swap Devise, :rememberable_options => { :key => "v1lat_token" } do
|
62
|
-
user = sign_in_as_user :remember_me => true
|
63
|
-
assert request.cookies["v1lat_token"]
|
64
|
-
end
|
65
|
-
end
|
66
|
-
|
67
|
-
test 'generate remember token after sign in setting session options' do
|
68
|
-
begin
|
69
|
-
Rails.configuration.session_options[:domain] = "omg.somewhere.com"
|
70
|
-
user = sign_in_as_user :remember_me => true
|
71
|
-
assert_nil request.cookies["remember_user_token"]
|
72
|
-
ensure
|
73
|
-
Rails.configuration.session_options.delete(:domain)
|
74
|
-
end
|
75
|
-
end
|
76
|
-
|
77
|
-
test 'remember the user before sign in' do
|
78
|
-
user = create_user_and_remember
|
79
|
-
get users_path
|
80
|
-
assert_response :success
|
81
|
-
assert warden.authenticated?(:user)
|
82
|
-
assert warden.user(:user) == user
|
83
|
-
assert_match /remember_user_token[^\n]*HttpOnly/, response.headers["Set-Cookie"], "Expected Set-Cookie header in response to set HttpOnly flag on remember_user_token cookie."
|
84
|
-
end
|
85
|
-
|
86
|
-
test 'remember the user before sign up and redirect him to his home' do
|
87
|
-
create_user_and_remember
|
88
|
-
get new_user_registration_path
|
89
|
-
assert warden.authenticated?(:user)
|
90
|
-
assert_redirected_to root_path
|
91
|
-
end
|
92
|
-
|
93
|
-
test 'cookies are destroyed on unverified requests' do
|
94
|
-
swap ApplicationController, :allow_forgery_protection => true do
|
95
|
-
create_user_and_remember
|
96
|
-
get users_path
|
97
|
-
assert warden.authenticated?(:user)
|
98
|
-
post root_path, :authenticity_token => 'INVALID'
|
99
|
-
assert_not warden.authenticated?(:user)
|
100
|
-
end
|
101
|
-
end
|
102
|
-
|
103
|
-
test 'does not extend remember period through sign in' do
|
104
|
-
swap Devise, :extend_remember_period => true, :remember_for => 1.year do
|
105
|
-
user = create_user
|
106
|
-
user.remember_me!
|
107
|
-
|
108
|
-
user.remember_created_at = old = 10.days.ago
|
109
|
-
user.save
|
110
|
-
|
111
|
-
sign_in_as_user :remember_me => true
|
112
|
-
user.reload
|
113
|
-
|
114
|
-
assert warden.user(:user) == user
|
115
|
-
assert_equal old.to_i, user.remember_created_at.to_i
|
116
|
-
end
|
117
|
-
end
|
118
|
-
|
119
|
-
test 'do not remember other scopes' do
|
120
|
-
create_user_and_remember
|
121
|
-
get root_path
|
122
|
-
assert_response :success
|
123
|
-
assert warden.authenticated?(:user)
|
124
|
-
assert_not warden.authenticated?(:admin)
|
125
|
-
end
|
126
|
-
|
127
|
-
test 'do not remember with invalid token' do
|
128
|
-
create_user_and_remember('add')
|
129
|
-
get users_path
|
130
|
-
assert_not warden.authenticated?(:user)
|
131
|
-
assert_redirected_to new_user_session_path
|
132
|
-
end
|
133
|
-
|
134
|
-
test 'do not remember with expired token' do
|
135
|
-
create_user_and_remember
|
136
|
-
swap Devise, :remember_for => 0 do
|
137
|
-
get users_path
|
138
|
-
assert_not warden.authenticated?(:user)
|
139
|
-
assert_redirected_to new_user_session_path
|
140
|
-
end
|
141
|
-
end
|
142
|
-
|
143
|
-
test 'do not remember the user anymore after forget' do
|
144
|
-
create_user_and_remember
|
145
|
-
get users_path
|
146
|
-
assert warden.authenticated?(:user)
|
147
|
-
|
148
|
-
get destroy_user_session_path
|
149
|
-
assert_not warden.authenticated?(:user)
|
150
|
-
assert_nil warden.cookies['remember_user_token']
|
151
|
-
|
152
|
-
get users_path
|
153
|
-
assert_not warden.authenticated?(:user)
|
154
|
-
end
|
155
|
-
|
156
|
-
test 'changing user password expires remember me token' do
|
157
|
-
user = create_user_and_remember
|
158
|
-
user.password = "another_password"
|
159
|
-
user.password_confirmation = "another_password"
|
160
|
-
user.save!
|
161
|
-
|
162
|
-
get users_path
|
163
|
-
assert_not warden.authenticated?(:user)
|
164
|
-
end
|
165
|
-
end
|
@@ -1,150 +0,0 @@
|
|
1
|
-
require 'test_helper'
|
2
|
-
|
3
|
-
class SessionTimeoutTest < ActionDispatch::IntegrationTest
|
4
|
-
|
5
|
-
def last_request_at
|
6
|
-
@controller.user_session['last_request_at']
|
7
|
-
end
|
8
|
-
|
9
|
-
test 'set last request at in user session after each request' do
|
10
|
-
sign_in_as_user
|
11
|
-
old_last_request = last_request_at
|
12
|
-
assert_not_nil last_request_at
|
13
|
-
|
14
|
-
get users_path
|
15
|
-
assert_not_nil last_request_at
|
16
|
-
assert_not_equal old_last_request, last_request_at
|
17
|
-
end
|
18
|
-
|
19
|
-
test 'set last request at in user session after each request is skipped if tracking is disabled' do
|
20
|
-
sign_in_as_user
|
21
|
-
old_last_request = last_request_at
|
22
|
-
assert_not_nil last_request_at
|
23
|
-
|
24
|
-
get users_path, {}, 'devise.skip_trackable' => true
|
25
|
-
assert_equal old_last_request, last_request_at
|
26
|
-
end
|
27
|
-
|
28
|
-
test 'does not time out user session before default limit time' do
|
29
|
-
sign_in_as_user
|
30
|
-
assert_response :success
|
31
|
-
assert warden.authenticated?(:user)
|
32
|
-
|
33
|
-
get users_path
|
34
|
-
assert_response :success
|
35
|
-
assert warden.authenticated?(:user)
|
36
|
-
end
|
37
|
-
|
38
|
-
test 'time out user session after default limit time' do
|
39
|
-
user = sign_in_as_user
|
40
|
-
get expire_user_path(user)
|
41
|
-
assert_not_nil last_request_at
|
42
|
-
|
43
|
-
get users_path
|
44
|
-
assert_redirected_to users_path
|
45
|
-
assert_not warden.authenticated?(:user)
|
46
|
-
end
|
47
|
-
|
48
|
-
test 'time out user session after deault limit time and redirect to latest get request' do
|
49
|
-
user = sign_in_as_user
|
50
|
-
visit edit_form_user_path(user)
|
51
|
-
|
52
|
-
click_button 'Update'
|
53
|
-
sign_in_as_user
|
54
|
-
|
55
|
-
assert_equal edit_form_user_url(user), current_url
|
56
|
-
end
|
57
|
-
|
58
|
-
test 'time out is not triggered on sign out' do
|
59
|
-
user = sign_in_as_user
|
60
|
-
get expire_user_path(user)
|
61
|
-
|
62
|
-
get destroy_user_session_path
|
63
|
-
|
64
|
-
assert_response :redirect
|
65
|
-
assert_redirected_to root_path
|
66
|
-
follow_redirect!
|
67
|
-
assert_contain 'Signed out successfully'
|
68
|
-
end
|
69
|
-
|
70
|
-
test 'time out is not triggered on sign in' do
|
71
|
-
user = sign_in_as_user
|
72
|
-
get expire_user_path(user)
|
73
|
-
|
74
|
-
post "/users/sign_in", :email => user.email, :password => "123456"
|
75
|
-
|
76
|
-
assert_response :redirect
|
77
|
-
follow_redirect!
|
78
|
-
assert_contain 'You are signed in'
|
79
|
-
end
|
80
|
-
|
81
|
-
test 'admin does not explode on time out' do
|
82
|
-
admin = sign_in_as_admin
|
83
|
-
get expire_admin_path(admin)
|
84
|
-
|
85
|
-
Admin.send :define_method, :reset_authentication_token! do
|
86
|
-
nil
|
87
|
-
end
|
88
|
-
|
89
|
-
begin
|
90
|
-
get admins_path
|
91
|
-
assert_redirected_to admins_path
|
92
|
-
assert_not warden.authenticated?(:admin)
|
93
|
-
ensure
|
94
|
-
Admin.send(:remove_method, :reset_authentication_token!)
|
95
|
-
end
|
96
|
-
end
|
97
|
-
|
98
|
-
test 'user configured timeout limit' do
|
99
|
-
swap Devise, :timeout_in => 8.minutes do
|
100
|
-
user = sign_in_as_user
|
101
|
-
|
102
|
-
get users_path
|
103
|
-
assert_not_nil last_request_at
|
104
|
-
assert_response :success
|
105
|
-
assert warden.authenticated?(:user)
|
106
|
-
|
107
|
-
get expire_user_path(user)
|
108
|
-
get users_path
|
109
|
-
assert_redirected_to users_path
|
110
|
-
assert_not warden.authenticated?(:user)
|
111
|
-
end
|
112
|
-
end
|
113
|
-
|
114
|
-
test 'error message with i18n' do
|
115
|
-
store_translations :en, :devise => {
|
116
|
-
:failure => { :user => { :timeout => 'Session expired!' } }
|
117
|
-
} do
|
118
|
-
user = sign_in_as_user
|
119
|
-
|
120
|
-
get expire_user_path(user)
|
121
|
-
get root_path
|
122
|
-
follow_redirect!
|
123
|
-
assert_contain 'Session expired!'
|
124
|
-
end
|
125
|
-
end
|
126
|
-
|
127
|
-
test 'error message with i18n with double redirect' do
|
128
|
-
store_translations :en, :devise => {
|
129
|
-
:failure => { :user => { :timeout => 'Session expired!' } }
|
130
|
-
} do
|
131
|
-
user = sign_in_as_user
|
132
|
-
|
133
|
-
get expire_user_path(user)
|
134
|
-
get users_path
|
135
|
-
follow_redirect!
|
136
|
-
follow_redirect!
|
137
|
-
assert_contain 'Session expired!'
|
138
|
-
end
|
139
|
-
end
|
140
|
-
|
141
|
-
test 'time out not triggered if remembered' do
|
142
|
-
user = sign_in_as_user :remember_me => true
|
143
|
-
get expire_user_path(user)
|
144
|
-
assert_not_nil last_request_at
|
145
|
-
|
146
|
-
get users_path
|
147
|
-
assert_response :success
|
148
|
-
assert warden.authenticated?(:user)
|
149
|
-
end
|
150
|
-
end
|
@@ -1,205 +0,0 @@
|
|
1
|
-
require 'test_helper'
|
2
|
-
|
3
|
-
class TokenAuthenticationTest < ActionDispatch::IntegrationTest
|
4
|
-
|
5
|
-
test 'authenticate with valid authentication token key and value through params' do
|
6
|
-
swap Devise, :token_authentication_key => :secret_token do
|
7
|
-
sign_in_as_new_user_with_token
|
8
|
-
|
9
|
-
assert_response :success
|
10
|
-
assert_current_url "/users?secret_token=#{VALID_AUTHENTICATION_TOKEN}"
|
11
|
-
assert_contain 'Welcome'
|
12
|
-
assert warden.authenticated?(:user)
|
13
|
-
end
|
14
|
-
end
|
15
|
-
|
16
|
-
test 'authenticate with valid authentication token key and value through params, when params with the same key as scope exist' do
|
17
|
-
swap Devise, :token_authentication_key => :secret_token do
|
18
|
-
user = create_user_with_authentication_token
|
19
|
-
post exhibit_user_path(user), Devise.token_authentication_key => user.authentication_token, :user => { :some => "data" }
|
20
|
-
|
21
|
-
assert_response :success
|
22
|
-
assert_contain 'User is authenticated'
|
23
|
-
assert warden.authenticated?(:user)
|
24
|
-
end
|
25
|
-
end
|
26
|
-
|
27
|
-
test 'authenticate with valid authentication token key but does not store if stateless' do
|
28
|
-
swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth] do
|
29
|
-
sign_in_as_new_user_with_token
|
30
|
-
assert warden.authenticated?(:user)
|
31
|
-
|
32
|
-
get users_path
|
33
|
-
assert_redirected_to new_user_session_path
|
34
|
-
assert_not warden.authenticated?(:user)
|
35
|
-
end
|
36
|
-
end
|
37
|
-
|
38
|
-
test 'authenticate with valid authentication token key and value through http' do
|
39
|
-
swap Devise, :token_authentication_key => :secret_token do
|
40
|
-
sign_in_as_new_user_with_token(:http_auth => true)
|
41
|
-
|
42
|
-
assert_response :success
|
43
|
-
assert_match '<email>user@test.com</email>', response.body
|
44
|
-
assert warden.authenticated?(:user)
|
45
|
-
end
|
46
|
-
end
|
47
|
-
|
48
|
-
test 'does authenticate with valid authentication token key and value through params if not configured' do
|
49
|
-
swap Devise, :token_authentication_key => :secret_token, :params_authenticatable => [:database] do
|
50
|
-
sign_in_as_new_user_with_token
|
51
|
-
|
52
|
-
assert_contain 'You need to sign in or sign up before continuing'
|
53
|
-
assert_contain 'Sign in'
|
54
|
-
assert_not warden.authenticated?(:user)
|
55
|
-
end
|
56
|
-
end
|
57
|
-
|
58
|
-
test 'does authenticate with valid authentication token key and value through http if not configured' do
|
59
|
-
swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => [:database] do
|
60
|
-
sign_in_as_new_user_with_token(:http_auth => true)
|
61
|
-
|
62
|
-
assert_response 401
|
63
|
-
assert_contain 'Invalid email or password.'
|
64
|
-
assert_not warden.authenticated?(:user)
|
65
|
-
end
|
66
|
-
end
|
67
|
-
|
68
|
-
test 'does not authenticate with improper authentication token key' do
|
69
|
-
swap Devise, :token_authentication_key => :donald_duck_token do
|
70
|
-
sign_in_as_new_user_with_token(:auth_token_key => :secret_token)
|
71
|
-
assert_equal new_user_session_path, @request.path
|
72
|
-
|
73
|
-
assert_contain 'You need to sign in or sign up before continuing'
|
74
|
-
assert_contain 'Sign in'
|
75
|
-
assert_not warden.authenticated?(:user)
|
76
|
-
end
|
77
|
-
end
|
78
|
-
|
79
|
-
test 'does not authenticate with improper authentication token value' do
|
80
|
-
store_translations :en, :devise => {:failure => {:invalid_token => 'LOL, that was not a single character correct.'}} do
|
81
|
-
sign_in_as_new_user_with_token(:auth_token => '*** INVALID TOKEN ***')
|
82
|
-
assert_equal new_user_session_path, @request.path
|
83
|
-
|
84
|
-
assert_contain 'LOL, that was not a single character correct.'
|
85
|
-
assert_contain 'Sign in'
|
86
|
-
assert_not warden.authenticated?(:user)
|
87
|
-
end
|
88
|
-
end
|
89
|
-
|
90
|
-
test 'authenticate with valid authentication token key and do not store if stateless and timeoutable are enabled' do
|
91
|
-
swap Devise, :token_authentication_key => :secret_token, :skip_session_storage => [:token_auth], :timeout_in => (0.1).second do
|
92
|
-
user = sign_in_as_new_user_with_token
|
93
|
-
assert warden.authenticated?(:user)
|
94
|
-
|
95
|
-
# Expiring does not work because we are setting the session value when accessing it
|
96
|
-
sleep 0.3
|
97
|
-
|
98
|
-
get_users_path_as_existing_user(user)
|
99
|
-
assert warden.authenticated?(:user)
|
100
|
-
end
|
101
|
-
end
|
102
|
-
|
103
|
-
test 'should reset token and not authenticate when expire_auth_token_on_timeout is set to true, timeoutable is enabled and we have a timed out session' do
|
104
|
-
swap Devise, :token_authentication_key => :secret_token, :expire_auth_token_on_timeout => true, :timeout_in => (-1).minute do
|
105
|
-
user = sign_in_as_new_user_with_token
|
106
|
-
assert warden.authenticated?(:user)
|
107
|
-
token = user.authentication_token
|
108
|
-
|
109
|
-
get_users_path_as_existing_user(user)
|
110
|
-
assert_not warden.authenticated?(:user)
|
111
|
-
user.reload
|
112
|
-
assert_not_equal token, user.authentication_token
|
113
|
-
end
|
114
|
-
end
|
115
|
-
|
116
|
-
test 'should not be subject to injection' do
|
117
|
-
swap Devise, :token_authentication_key => :secret_token do
|
118
|
-
user1 = create_user_with_authentication_token()
|
119
|
-
|
120
|
-
# Clean up user cache
|
121
|
-
@user = nil
|
122
|
-
|
123
|
-
user2 = create_user_with_authentication_token(:email => "another@test.com")
|
124
|
-
user2.update_attribute(:authentication_token, "ANOTHERTOKEN")
|
125
|
-
|
126
|
-
assert_not_equal user1, user2
|
127
|
-
visit users_path(Devise.token_authentication_key.to_s + '[$ne]' => user1.authentication_token)
|
128
|
-
assert_nil warden.user(:user)
|
129
|
-
end
|
130
|
-
end
|
131
|
-
|
132
|
-
test 'authenticate with valid authentication token key and value through http header' do
|
133
|
-
swap Devise, :token_authentication_key => :secret_token do
|
134
|
-
sign_in_as_new_user_with_token(:token_auth => true)
|
135
|
-
|
136
|
-
assert_response :success
|
137
|
-
assert_match '<email>user@test.com</email>', response.body
|
138
|
-
assert_equal request.env['devise.token_options'], {}
|
139
|
-
assert warden.authenticated?(:user)
|
140
|
-
end
|
141
|
-
end
|
142
|
-
|
143
|
-
test 'authenticate with valid authentication token key and value through http header, with options' do
|
144
|
-
swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => [:token_options] do
|
145
|
-
signature = "**TESTSIGNATURE**"
|
146
|
-
sign_in_as_new_user_with_token(:token_auth => true, :token_options => {:signature => signature, :nonce => 'def'})
|
147
|
-
|
148
|
-
assert_response :success
|
149
|
-
assert_match '<email>user@test.com</email>', response.body
|
150
|
-
assert_equal request.env['devise.token_options'][:signature], signature
|
151
|
-
assert_equal request.env['devise.token_options'][:nonce], 'def'
|
152
|
-
assert warden.authenticated?(:user)
|
153
|
-
end
|
154
|
-
end
|
155
|
-
|
156
|
-
test 'authenticate with valid authentication token key and value through http header without allowing token authorization setting is denied' do
|
157
|
-
swap Devise, :token_authentication_key => :secret_token, :http_authenticatable => false do
|
158
|
-
sign_in_as_new_user_with_token(:token_auth => true)
|
159
|
-
|
160
|
-
assert_response :unauthorized
|
161
|
-
assert_nil warden.user(:user)
|
162
|
-
end
|
163
|
-
end
|
164
|
-
|
165
|
-
test 'does not authenticate with improper authentication token value in header' do
|
166
|
-
sign_in_as_new_user_with_token(:token_auth => true, :auth_token => '*** INVALID TOKEN ***')
|
167
|
-
|
168
|
-
assert_response :unauthorized
|
169
|
-
assert_nil warden.user(:user)
|
170
|
-
end
|
171
|
-
|
172
|
-
private
|
173
|
-
|
174
|
-
def sign_in_as_new_user_with_token(options = {})
|
175
|
-
user = options.delete(:user) || create_user_with_authentication_token(options)
|
176
|
-
|
177
|
-
options[:auth_token_key] ||= Devise.token_authentication_key
|
178
|
-
options[:auth_token] ||= user.authentication_token
|
179
|
-
|
180
|
-
if options[:http_auth]
|
181
|
-
header = "Basic #{Base64.encode64("#{VALID_AUTHENTICATION_TOKEN}:X")}"
|
182
|
-
get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
|
183
|
-
elsif options[:token_auth]
|
184
|
-
token_options = options[:token_options] || {}
|
185
|
-
header = ActionController::HttpAuthentication::Token.encode_credentials(options[:auth_token], token_options)
|
186
|
-
get users_path(:format => :xml), {}, "HTTP_AUTHORIZATION" => header
|
187
|
-
else
|
188
|
-
visit users_path(options[:auth_token_key].to_sym => options[:auth_token])
|
189
|
-
end
|
190
|
-
|
191
|
-
user
|
192
|
-
end
|
193
|
-
|
194
|
-
def create_user_with_authentication_token(options={})
|
195
|
-
user = create_user(options)
|
196
|
-
user.authentication_token = VALID_AUTHENTICATION_TOKEN
|
197
|
-
user.save
|
198
|
-
user
|
199
|
-
end
|
200
|
-
|
201
|
-
def get_users_path_as_existing_user(user)
|
202
|
-
sign_in_as_new_user_with_token(:user => user)
|
203
|
-
end
|
204
|
-
|
205
|
-
end
|
@@ -1,92 +0,0 @@
|
|
1
|
-
require 'test_helper'
|
2
|
-
|
3
|
-
class TrackableHooksTest < ActionDispatch::IntegrationTest
|
4
|
-
|
5
|
-
test "current and last sign in timestamps are updated on each sign in" do
|
6
|
-
user = create_user
|
7
|
-
assert_nil user.current_sign_in_at
|
8
|
-
assert_nil user.last_sign_in_at
|
9
|
-
|
10
|
-
sign_in_as_user
|
11
|
-
user.reload
|
12
|
-
|
13
|
-
assert_kind_of Time, user.current_sign_in_at
|
14
|
-
assert_kind_of Time, user.last_sign_in_at
|
15
|
-
|
16
|
-
assert_equal user.current_sign_in_at, user.last_sign_in_at
|
17
|
-
assert user.current_sign_in_at >= user.created_at
|
18
|
-
|
19
|
-
visit destroy_user_session_path
|
20
|
-
new_time = 2.seconds.from_now
|
21
|
-
Time.stubs(:now).returns(new_time)
|
22
|
-
|
23
|
-
sign_in_as_user
|
24
|
-
user.reload
|
25
|
-
assert user.current_sign_in_at > user.last_sign_in_at
|
26
|
-
end
|
27
|
-
|
28
|
-
test "current and last sign in remote ip are updated on each sign in" do
|
29
|
-
user = create_user
|
30
|
-
assert_nil user.current_sign_in_ip
|
31
|
-
assert_nil user.last_sign_in_ip
|
32
|
-
|
33
|
-
sign_in_as_user
|
34
|
-
user.reload
|
35
|
-
|
36
|
-
assert_equal "127.0.0.1", user.current_sign_in_ip
|
37
|
-
assert_equal "127.0.0.1", user.last_sign_in_ip
|
38
|
-
end
|
39
|
-
|
40
|
-
test "current remote ip returns original ip behind a non transparent proxy" do
|
41
|
-
user = create_user
|
42
|
-
|
43
|
-
arbitrary_ip = '200.121.1.69'
|
44
|
-
sign_in_as_user do
|
45
|
-
header 'HTTP_X_FORWARDED_FOR', arbitrary_ip
|
46
|
-
end
|
47
|
-
user.reload
|
48
|
-
assert_equal arbitrary_ip, user.current_sign_in_ip
|
49
|
-
end
|
50
|
-
|
51
|
-
test "increase sign in count" do
|
52
|
-
user = create_user
|
53
|
-
assert_equal 0, user.sign_in_count
|
54
|
-
|
55
|
-
sign_in_as_user
|
56
|
-
user.reload
|
57
|
-
assert_equal 1, user.sign_in_count
|
58
|
-
|
59
|
-
visit destroy_user_session_path
|
60
|
-
sign_in_as_user
|
61
|
-
user.reload
|
62
|
-
assert_equal 2, user.sign_in_count
|
63
|
-
end
|
64
|
-
|
65
|
-
test "does not update anything if user has signed out along the way" do
|
66
|
-
swap Devise, :allow_unconfirmed_access_for => 0 do
|
67
|
-
user = create_user(:confirm => false)
|
68
|
-
sign_in_as_user
|
69
|
-
|
70
|
-
user.reload
|
71
|
-
assert_nil user.current_sign_in_at
|
72
|
-
assert_nil user.last_sign_in_at
|
73
|
-
end
|
74
|
-
end
|
75
|
-
|
76
|
-
test "do not track if devise.skip_trackable is set" do
|
77
|
-
user = create_user
|
78
|
-
sign_in_as_user do
|
79
|
-
header 'devise.skip_trackable', '1'
|
80
|
-
end
|
81
|
-
user.reload
|
82
|
-
assert_equal 0, user.sign_in_count
|
83
|
-
visit destroy_user_session_path
|
84
|
-
|
85
|
-
sign_in_as_user do
|
86
|
-
header 'devise.skip_trackable', false
|
87
|
-
end
|
88
|
-
user.reload
|
89
|
-
assert_equal 1, user.sign_in_count
|
90
|
-
end
|
91
|
-
|
92
|
-
end
|