RubyGems - sorcery - Versions diffs - 0.11.0 → 0.15.1 - Mend

sorcery 0.11.0 → 0.15.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (106) hide show

checksums.yaml +5 -5
data/.github/ISSUE_TEMPLATE.md +20 -0
data/.rubocop.yml +55 -0
data/.rubocop_todo.yml +145 -0
data/.travis.yml +3 -52
data/CHANGELOG.md +69 -0
data/Gemfile +3 -3
data/{LICENSE.txt → LICENSE.md} +1 -1
data/README.md +34 -7
data/lib/generators/sorcery/USAGE +1 -1
data/lib/generators/sorcery/install_generator.rb +21 -21
data/lib/generators/sorcery/templates/initializer.rb +164 -69
data/lib/generators/sorcery/templates/migration/activity_logging.rb +4 -4
data/lib/generators/sorcery/templates/migration/brute_force_protection.rb +3 -3
data/lib/generators/sorcery/templates/migration/core.rb +2 -2
data/lib/generators/sorcery/templates/migration/external.rb +3 -3
data/lib/generators/sorcery/templates/migration/magic_login.rb +9 -0
data/lib/generators/sorcery/templates/migration/remember_me.rb +2 -2
data/lib/generators/sorcery/templates/migration/reset_password.rb +4 -3
data/lib/generators/sorcery/templates/migration/user_activation.rb +3 -3
data/lib/sorcery.rb +2 -0
data/lib/sorcery/adapters/active_record_adapter.rb +3 -2
data/lib/sorcery/adapters/mongoid_adapter.rb +23 -11
data/lib/sorcery/controller.rb +26 -15
data/lib/sorcery/controller/config.rb +2 -0
data/lib/sorcery/controller/submodules/activity_logging.rb +14 -3
data/lib/sorcery/controller/submodules/brute_force_protection.rb +7 -3
data/lib/sorcery/controller/submodules/external.rb +48 -33
data/lib/sorcery/controller/submodules/http_basic_auth.rb +5 -1
data/lib/sorcery/controller/submodules/remember_me.rb +9 -10
data/lib/sorcery/controller/submodules/session_timeout.rb +32 -6
data/lib/sorcery/crypto_providers/aes256.rb +2 -1
data/lib/sorcery/crypto_providers/bcrypt.rb +8 -2
data/lib/sorcery/engine.rb +16 -3
data/lib/sorcery/model.rb +14 -10
data/lib/sorcery/model/config.rb +12 -4
data/lib/sorcery/model/submodules/brute_force_protection.rb +6 -7
data/lib/sorcery/model/submodules/external.rb +19 -3
data/lib/sorcery/model/submodules/magic_login.rb +130 -0
data/lib/sorcery/model/submodules/reset_password.rb +25 -2
data/lib/sorcery/model/submodules/user_activation.rb +1 -1
data/lib/sorcery/model/temporary_token.rb +3 -1
data/lib/sorcery/protocols/oauth.rb +1 -0
data/lib/sorcery/providers/auth0.rb +46 -0
data/lib/sorcery/providers/discord.rb +52 -0
data/lib/sorcery/providers/heroku.rb +1 -0
data/lib/sorcery/providers/instagram.rb +73 -0
data/lib/sorcery/providers/line.rb +47 -0
data/lib/sorcery/providers/linkedin.rb +45 -36
data/lib/sorcery/providers/vk.rb +5 -4
data/lib/sorcery/providers/wechat.rb +8 -6
data/lib/sorcery/test_helpers/internal.rb +5 -4
data/lib/sorcery/test_helpers/internal/rails.rb +11 -11
data/lib/sorcery/test_helpers/rails/request.rb +20 -0
data/lib/sorcery/version.rb +1 -1
data/sorcery.gemspec +28 -11
data/spec/active_record/user_activation_spec.rb +2 -2
data/spec/active_record/user_activity_logging_spec.rb +2 -2
data/spec/active_record/user_brute_force_protection_spec.rb +2 -2
data/spec/active_record/user_magic_login_spec.rb +15 -0
data/spec/active_record/user_oauth_spec.rb +2 -2
data/spec/active_record/user_remember_me_spec.rb +2 -2
data/spec/active_record/user_reset_password_spec.rb +2 -2
data/spec/active_record/user_spec.rb +0 -10
data/spec/controllers/controller_http_basic_auth_spec.rb +1 -1
data/spec/controllers/controller_oauth2_spec.rb +212 -123
data/spec/controllers/controller_oauth_spec.rb +7 -7
data/spec/controllers/controller_remember_me_spec.rb +16 -8
data/spec/controllers/controller_session_timeout_spec.rb +90 -3
data/spec/controllers/controller_spec.rb +13 -3
data/spec/orm/active_record.rb +2 -2
data/spec/providers/example_provider_spec.rb +17 -0
data/spec/providers/example_spec.rb +17 -0
data/spec/providers/vk_spec.rb +42 -0
data/spec/rails_app/app/assets/config/manifest.js +1 -0
data/spec/rails_app/app/controllers/sorcery_controller.rb +131 -32
data/spec/rails_app/app/mailers/sorcery_mailer.rb +7 -0
data/spec/rails_app/app/views/sorcery_mailer/magic_login_email.html.erb +13 -0
data/spec/rails_app/app/views/sorcery_mailer/magic_login_email.text.erb +6 -0
data/spec/rails_app/config/application.rb +8 -3
data/spec/rails_app/config/boot.rb +1 -1
data/spec/rails_app/config/environment.rb +1 -1
data/spec/rails_app/config/routes.rb +14 -0
data/spec/rails_app/config/secrets.yml +4 -0
data/spec/rails_app/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb +2 -2
data/spec/rails_app/db/migrate/invalidate_active_sessions/20180221093235_add_invalidate_active_sessions_before_to_users.rb +9 -0
data/spec/rails_app/db/migrate/magic_login/20170924151831_add_magic_login_to_users.rb +17 -0
data/spec/rails_app/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb +2 -0
data/spec/rails_app/db/schema.rb +7 -9
data/spec/shared_examples/user_magic_login_shared_examples.rb +150 -0
data/spec/shared_examples/user_oauth_shared_examples.rb +1 -1
data/spec/shared_examples/user_remember_me_shared_examples.rb +1 -1
data/spec/shared_examples/user_reset_password_shared_examples.rb +37 -5
data/spec/shared_examples/user_shared_examples.rb +104 -43
data/spec/sorcery_crypto_providers_spec.rb +61 -1
data/spec/sorcery_temporary_token_spec.rb +27 -0
data/spec/spec.opts +1 -1
data/spec/spec_helper.rb +2 -2
data/spec/support/migration_helper.rb +19 -0
data/spec/support/providers/example.rb +11 -0
data/spec/support/providers/example_provider.rb +11 -0
metadata +89 -33
data/gemfiles/active_record-rails40.gemfile +0 -7
data/gemfiles/active_record-rails41.gemfile +0 -7
data/gemfiles/active_record-rails42.gemfile +0 -7
data/spec/rails_app/config/initializers/secret_token.rb +0 -7

data/spec/rails_app/app/mailers/sorcery_mailer.rb CHANGED Viewed

@@ -28,4 +28,11 @@ class SorceryMailer < ActionMailer::Base
     mail(to: user.email,
          subject: 'Your account has been locked due to many wrong logins')
   end
+  def magic_login_email(user)
+    @user = user
+    @url  = 'http://example.com/login'
+    mail(to: user.email,
+         subject: 'Magic Login')
+  end
 end

data/spec/rails_app/app/views/sorcery_mailer/magic_login_email.html.erb ADDED Viewed

@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta content="text/html; charset=UTF-8" http-equiv="Content-Type" />
+</head>
+<body>
+<h1>Hello, <%= @user.username %></h1>
+<p>
+  To login without a password, just follow this link: <%= @url %>.
+</p>
+<p>Have a great day!</p>
+</body>
+</html>

data/spec/rails_app/app/views/sorcery_mailer/magic_login_email.text.erb ADDED Viewed

@@ -0,0 +1,6 @@
+Hello, <%= @user.username %>
+===============================================
+To login without a password, just follow this link: <%= @url %>.
+Have a great day!

data/spec/rails_app/config/application.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../boot', __FILE__)
+require File.expand_path('boot', __dir__)
 require 'action_controller/railtie'
 require 'action_mailer/railtie'
@@ -6,16 +6,19 @@ require 'rails/test_unit/railtie'
 Bundler.require :default, SORCERY_ORM
+# rubocop:disable Lint/HandleExceptions
 begin
   require "#{SORCERY_ORM}/railtie"
 rescue LoadError
+  # TODO: Log this issue or change require scheme.
 end
+# rubocop:enable Lint/HandleExceptions
 require 'sorcery'
 module AppRoot
   class Application < Rails::Application
-    config.autoload_paths.reject! { |p| p =~ /\/app\/(\w+)$/ && !%w(controllers helpers mailers views).include?(Regexp.last_match(1)) }
+    config.autoload_paths.reject! { |p| p =~ %r{/\/app\/(\w+)$/} && !%w[controllers helpers mailers views].include?(Regexp.last_match(1)) }
     config.autoload_paths += ["#{config.root}/app/#{SORCERY_ORM}"]
     # Settings in config/environments/* take precedence over those specified here.
@@ -50,7 +53,9 @@ module AppRoot
     config.filter_parameters += [:password]
     config.action_mailer.delivery_method = :test
     config.active_support.deprecation = :stderr
+    if Rails.version >= '5.1.0' && config.active_record.sqlite3.present?
+      config.active_record.sqlite3.represent_boolean_as_integer = true
+    end
   end
 end

data/spec/rails_app/config/boot.rb CHANGED Viewed

@@ -1,4 +1,4 @@
 # Set up gems listed in the Gemfile.
-ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../../Gemfile', __FILE__)
+ENV['BUNDLE_GEMFILE'] ||= File.expand_path('../../../Gemfile', __dir__)
 require 'bundler/setup' if File.exist?(ENV['BUNDLE_GEMFILE'])

data/spec/rails_app/config/environment.rb CHANGED Viewed

@@ -1,5 +1,5 @@
 # Load the rails application
-require File.expand_path('../application', __FILE__)
+require File.expand_path('application', __dir__)
 # Initialize the rails application
 AppRoot::Application.initialize!

data/spec/rails_app/config/routes.rb CHANGED Viewed

@@ -11,7 +11,9 @@ AppRoot::Application.routes.draw do
     get :test_login_from_cookie
     get :test_login_from
     get :test_logout_with_remember
+    get :test_logout_with_forget_me
     get :test_logout_with_force_forget_me
+    get :test_invalidate_active_session
     get :test_should_be_logged_in
     get :test_create_from_provider
     get :test_add_second_provider
@@ -29,6 +31,10 @@ AppRoot::Application.routes.draw do
     get :test_login_from_jira
     get :test_login_from_salesforce
     get :test_login_from_slack
+    get :test_login_from_instagram
+    get :test_login_from_auth0
+    get :test_login_from_line
+    get :test_login_from_discord
     get :login_at_test
     get :login_at_test_twitter
     get :login_at_test_facebook
@@ -42,6 +48,10 @@ AppRoot::Application.routes.draw do
     get :login_at_test_jira
     get :login_at_test_salesforce
     get :login_at_test_slack
+    get :login_at_test_instagram
+    get :login_at_test_auth0
+    get :login_at_test_line
+    get :login_at_test_discord
     get :test_return_to_with_external
     get :test_return_to_with_external_twitter
     get :test_return_to_with_external_facebook
@@ -55,6 +65,10 @@ AppRoot::Application.routes.draw do
     get :test_return_to_with_external_jira
     get :test_return_to_with_external_salesforce
     get :test_return_to_with_external_slack
+    get :test_return_to_with_external_instagram
+    get :test_return_to_with_external_auth0
+    get :test_return_to_with_external_line
+    get :test_return_to_with_external_discord
     get :test_http_basic_auth
     get :some_action_making_a_non_persisted_change_to_the_user
     post :test_login_with_remember

data/spec/rails_app/config/secrets.yml ADDED Viewed

@@ -0,0 +1,4 @@
+# secrets.yml
+test:
+  secret_key_base: 'a9789f869a0d0ac2f2b683d6e9410c530696b178bca28a7971f4a652b14ff2da89f2cf4dcbf0355f6bc41f81731aa8e46085674d1acc1980436f61cdba76ff5d'

data/spec/rails_app/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb CHANGED Viewed

@@ -5,11 +5,11 @@ class AddActivityLoggingToUsers < ActiveRecord::CompatibleLegacyMigration.migrat
     add_column :users, :last_activity_at,  :datetime, default: nil
     add_column :users, :last_login_from_ip_address, :string, default: nil
-    add_index :users, [:last_logout_at, :last_activity_at]
+    add_index :users, %i[last_logout_at last_activity_at]
   end
   def self.down
-    remove_index :users, [:last_logout_at, :last_activity_at]
+    remove_index :users, %i[last_logout_at last_activity_at]
     remove_column :users, :last_activity_at
     remove_column :users, :last_logout_at

data/spec/rails_app/db/migrate/invalidate_active_sessions/20180221093235_add_invalidate_active_sessions_before_to_users.rb ADDED Viewed

@@ -0,0 +1,9 @@
+class AddInvalidateSessionsBeforeToUsers < ActiveRecord::CompatibleLegacyMigration.migration_class
+  def self.up
+    add_column :users, :invalidate_sessions_before, :datetime, default: nil
+  end
+  def self.down
+    remove_column :users, :invalidate_sessions_before
+  end
+end

data/spec/rails_app/db/migrate/magic_login/20170924151831_add_magic_login_to_users.rb ADDED Viewed

@@ -0,0 +1,17 @@
+class AddMagicLoginToUsers < ActiveRecord::CompatibleLegacyMigration.migration_class
+  def self.up
+    add_column :users, :magic_login_token, :string, default: nil
+    add_column :users, :magic_login_token_expires_at, :datetime, default: nil
+    add_column :users, :magic_login_email_sent_at, :datetime, default: nil
+    add_index :users, :magic_login_token
+  end
+  def self.down
+    remove_index :users, :magic_login_token
+    remove_column :users, :magic_login_token
+    remove_column :users, :magic_login_token_expires_at
+    remove_column :users, :magic_login_email_sent_at
+  end
+end

data/spec/rails_app/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb CHANGED Viewed

@@ -3,11 +3,13 @@ class AddResetPasswordToUsers < ActiveRecord::CompatibleLegacyMigration.migratio
     add_column :users, :reset_password_token, :string, default: nil
     add_column :users, :reset_password_token_expires_at, :datetime, default: nil
     add_column :users, :reset_password_email_sent_at, :datetime, default: nil
+    add_column :users, :access_count_to_reset_password_page, :integer, default: 0
   end
   def self.down
     remove_column :users, :reset_password_email_sent_at
     remove_column :users, :reset_password_token_expires_at
     remove_column :users, :reset_password_token
+    remove_column :users, :access_count_to_reset_password_page
   end
 end

data/spec/rails_app/db/schema.rb CHANGED Viewed

@@ -10,14 +10,12 @@
 #
 # It's strongly recommended to check this file into your version control system.
-ActiveRecord::Schema.define(:version => 20101224223620) do
-  create_table "users", :force => true do |t|
-    t.string   "username"
-    t.string   "email"
-    t.string   "crypted_password"
-    t.datetime "created_at"
-    t.datetime "updated_at"
+ActiveRecord::Schema.define(version: 20_101_224_223_620) do
+  create_table 'users', force: true do |t|
+    t.string   'username'
+    t.string   'email'
+    t.string   'crypted_password'
+    t.datetime 'created_at'
+    t.datetime 'updated_at'
   end
 end

data/spec/shared_examples/user_magic_login_shared_examples.rb ADDED Viewed

@@ -0,0 +1,150 @@
+shared_examples_for 'magic_login_model' do
+  let(:user) { create_new_user }
+  before(:each) do
+    User.sorcery_adapter.delete_all
+  end
+  context 'loaded plugin configuration' do
+    let(:config) { User.sorcery_config }
+    before(:all) do
+      sorcery_reload!([:magic_login])
+    end
+    after(:each) do
+      User.sorcery_config.reset!
+    end
+    describe 'enables configuration options' do
+      it do
+        sorcery_model_property_set(:magic_login_token_attribute_name, :test_magic_login_token)
+        expect(config.magic_login_token_attribute_name).to eq :test_magic_login_token
+      end
+      it do
+        sorcery_model_property_set(:magic_login_token_expires_at_attribute_name, :test_magic_login_token_expires_at)
+        expect(config.magic_login_token_expires_at_attribute_name).to eq :test_magic_login_token_expires_at
+      end
+      it do
+        sorcery_model_property_set(:magic_login_email_sent_at_attribute_name, :test_magic_login_email_sent_at)
+        expect(config.magic_login_email_sent_at_attribute_name).to eq :test_magic_login_email_sent_at
+      end
+      it do
+        TestMailerClass = Class.new # need a mailer class to test
+        sorcery_model_property_set(:magic_login_mailer_class, TestMailerClass)
+        expect(config.magic_login_mailer_class).to eq TestMailerClass
+      end
+      it do
+        sorcery_model_property_set(:magic_login_mailer_disabled, false)
+        expect(config.magic_login_mailer_disabled).to eq false
+      end
+      it do
+        sorcery_model_property_set(:magic_login_email_method_name, :test_magic_login_email)
+        expect(config.magic_login_email_method_name).to eq :test_magic_login_email
+      end
+      it do
+        sorcery_model_property_set(:magic_login_expiration_period, 100_000_000)
+        expect(config.magic_login_expiration_period).to eq 100_000_000
+      end
+      it do
+        sorcery_model_property_set(:magic_login_time_between_emails, 100_000_000)
+        expect(config.magic_login_time_between_emails).to eq 100_000_000
+      end
+    end
+    describe '#generate_magic_login_token!' do
+      context 'magic_login_token is nil' do
+        it "magic_login_token_expires_at and magic_login_email_sent_at aren't nil " do
+          user.generate_magic_login_token!
+          expect(user.magic_login_token_expires_at).not_to be_nil
+          expect(user.magic_login_email_sent_at).not_to be_nil
+        end
+        it 'magic_login_token is different from the one before' do
+          token_before = user.magic_login_token
+          user.generate_magic_login_token!
+          expect(user.magic_login_token).not_to eq token_before
+        end
+      end
+      context 'magic_login_token is not nil' do
+        it 'changes `user.magic_login_token`' do
+          token_before = user.magic_login_token
+          user.generate_magic_login_token!
+          expect(user.magic_login_token).not_to eq token_before
+        end
+      end
+    end
+    describe '#deliver_magic_login_instructions!' do
+      context 'success' do
+        before do
+          sorcery_model_property_set(:magic_login_time_between_emails, 30 * 60)
+          sorcery_model_property_set(:magic_login_mailer_disabled, false)
+          Timecop.travel(10.days.ago) do
+            user.send(:"#{config.magic_login_email_sent_at_attribute_name}=", DateTime.now)
+          end
+          sorcery_model_property_set(:magic_login_mailer_class, ::SorceryMailer)
+        end
+        it do
+          user.deliver_magic_login_instructions!
+          expect(ActionMailer::Base.deliveries.size).to eq 1
+        end
+        it do
+          expect(user.deliver_magic_login_instructions!).to eq true
+        end
+      end
+      context 'failure' do
+        context 'magic_login_time_between_emails is nil' do
+          it 'returns false' do
+            sorcery_model_property_set(:magic_login_time_between_emails, nil)
+            expect(user.deliver_magic_login_instructions!).to eq false
+          end
+        end
+        context 'magic_login_email_sent_at is nil' do
+          it 'returns false' do
+            user.send(:"#{config.magic_login_email_sent_at_attribute_name}=", nil)
+            expect(user.deliver_magic_login_instructions!).to eq false
+          end
+        end
+        context 'now is before magic_login_email_sent_at plus the interval' do
+          it 'returns false' do
+            user.send(:"#{config.magic_login_email_sent_at_attribute_name}=", DateTime.now)
+            sorcery_model_property_set(:magic_login_time_between_emails, 30 * 60)
+            expect(user.deliver_magic_login_instructions!).to eq false
+          end
+        end
+        context 'magic_login_mailer_disabled is true' do
+          it 'returns false' do
+            sorcery_model_property_set(:magic_login_mailer_disabled, true)
+            expect(user.deliver_magic_login_instructions!).to eq false
+          end
+        end
+      end
+    end
+    describe '#clear_magic_login_token!' do
+      it 'makes magic_login_token_attribute_name and magic_login_token_expires_at_attribute_name nil' do
+        user.magic_login_token = 'test_token'
+        user.magic_login_token_expires_at = Time.now
+        user.clear_magic_login_token!
+        expect(user.magic_login_token).to eq nil
+        expect(user.magic_login_token_expires_at).to eq nil
+      end
+    end
+  end
+end

data/spec/shared_examples/user_oauth_shared_examples.rb CHANGED Viewed

@@ -27,7 +27,7 @@ shared_examples_for 'rails_3_oauth_model' do
     it "'load_from_provider' returns nil if user doesn't exist" do
       external_user
-      expect(User.load_from_provider(:twitter, 980342)).to be_nil
+      expect(User.load_from_provider(:twitter, 980_342)).to be_nil
     end
   end
 end

data/spec/shared_examples/user_remember_me_shared_examples.rb CHANGED Viewed

@@ -42,7 +42,7 @@ shared_examples_for 'rails_3_remember_me_model' do
         user.remember_me!
       end
-      expect(user.remember_me_token_expires_at.utc.to_s).to eq (ts + 2 * 60 * 60 * 24).utc.to_s
+      expect(user.remember_me_token_expires_at.utc.to_s).to eq((ts + 2 * 60 * 60 * 24).utc.to_s)
     end
     context 'when not persisting globally' do

data/spec/shared_examples/user_reset_password_shared_examples.rb CHANGED Viewed

@@ -14,6 +14,8 @@ shared_examples_for 'rails_3_reset_password_model' do
     context 'API' do
       specify { expect(user).to respond_to :deliver_reset_password_instructions! }
+      specify { expect(user).to respond_to :change_password }
       specify { expect(user).to respond_to :change_password! }
       it 'responds to .load_from_reset_password_token' do
@@ -214,6 +216,22 @@ shared_examples_for 'rails_3_reset_password_model' do
       expect(user.reset_password_token).not_to eq old_password_code
     end
+    describe '#increment_password_reset_page_access_counter' do
+      it 'increments reset_password_page_access_count_attribute_name' do
+        expected_count = user.access_count_to_reset_password_page + 1
+        user.increment_password_reset_page_access_counter
+        expect(user.access_count_to_reset_password_page).to eq expected_count
+      end
+    end
+    describe '#reset_password_reset_page_access_counter' do
+      it 'reset reset_password_page_access_count_attribute_name into 0' do
+        user.update(access_count_to_reset_password_page: 10)
+        user.reset_password_reset_page_access_counter
+        expect(user.access_count_to_reset_password_page).to eq 0
+      end
+    end
     context 'mailer is enabled' do
       it 'sends an email on reset' do
         old_size = ActionMailer::Base.deliveries.size
@@ -229,7 +247,7 @@ shared_examples_for 'rails_3_reset_password_model' do
       end
       it 'does not send an email if time between emails has not passed since last email' do
-        sorcery_model_property_set(:reset_password_time_between_emails, 10000)
+        sorcery_model_property_set(:reset_password_time_between_emails, 10_000)
         old_size = ActionMailer::Base.deliveries.size
         user.deliver_reset_password_instructions!
@@ -273,7 +291,7 @@ shared_examples_for 'rails_3_reset_password_model' do
       end
       it 'does not send an email if time between emails has not passed since last email' do
-        sorcery_model_property_set(:reset_password_time_between_emails, 10000)
+        sorcery_model_property_set(:reset_password_time_between_emails, 10_000)
         old_size = ActionMailer::Base.deliveries.size
         user.deliver_reset_password_instructions!
@@ -298,19 +316,33 @@ shared_examples_for 'rails_3_reset_password_model' do
       end
     end
-    it 'when change_password! is called, deletes reset_password_token' do
+    it 'when change_password! is called, deletes reset_password_token and calls #save!' do
       user.deliver_reset_password_instructions!
       expect(user.reset_password_token).not_to be_nil
+      expect(user).to_not receive(:save)
+      expect(user).to receive(:save!)
       user.change_password!('blabulsdf')
-      user.save!
+      expect(user.reset_password_token).to be_nil
+    end
+    it 'when change_password is called, deletes reset_password_token and calls #save' do
+      new_password = 'blabulsdf'
+      user.deliver_reset_password_instructions!
+      expect(user.reset_password_token).not_to be_nil
+      expect(user).to_not receive(:save!)
+      expect(user).to receive(:save)
+      user.change_password(new_password)
       expect(user.reset_password_token).to be_nil
     end
     it 'returns false if time between emails has not passed since last email' do
-      sorcery_model_property_set(:reset_password_time_between_emails, 10000)
+      sorcery_model_property_set(:reset_password_time_between_emails, 10_000)
       user.deliver_reset_password_instructions!
       expect(user.deliver_reset_password_instructions!).to be false