sorcery 0.8.1 → 0.9.0

data/spec/controllers/controller_oauth2_spec.rb

@@ -0,0 +1,414 @@
+require 'spec_helper'
+
+# require 'shared_examples/controller_oauth2_shared_examples'
+
+describe SorceryController, :active_record => true do
+  before(:all) do
+    if SORCERY_ORM == :active_record
+      ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
+      User.reset_column_information
+    end
+
+    sorcery_reload!([:external])
+    set_external_property
+  end
+
+  after(:all) do
+    if SORCERY_ORM == :active_record
+      ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/external")
+    end
+  end
+
+  describe 'using create_from' do
+    before(:each) do
+      stub_all_oauth2_requests!
+    end
+
+    it 'creates a new user' do
+      sorcery_model_property_set(:authentications_class, Authentication)
+      sorcery_controller_external_property_set(:facebook, :user_info_mapping, { username: 'name' })
+
+      expect(User).to receive(:create_from_provider).with('facebook', '123', {username: 'Noam Ben Ari'})
+      get :test_create_from_provider, provider: 'facebook'
+    end
+
+    it 'supports nested attributes' do
+      sorcery_model_property_set(:authentications_class, Authentication)
+      sorcery_controller_external_property_set(:facebook, :user_info_mapping, { username: 'hometown/name' })
+      expect(User).to receive(:create_from_provider).with('facebook', '123', {username: 'Haifa, Israel'})
+
+      get :test_create_from_provider, provider: 'facebook'
+    end
+
+    it 'does not crash on missing nested attributes' do
+      sorcery_model_property_set(:authentications_class, Authentication)
+      sorcery_controller_external_property_set(:facebook, :user_info_mapping, { username: 'name', created_at: 'does/not/exist' })
+
+      expect(User).to receive(:create_from_provider).with('facebook', '123', {username: 'Noam Ben Ari'})
+
+      get :test_create_from_provider, provider: 'facebook'
+    end
+
+    describe 'with a block' do
+      it 'does not create user' do
+        sorcery_model_property_set(:authentications_class, Authentication)
+        sorcery_controller_external_property_set(:facebook, :user_info_mapping, { username: 'name' })
+
+        u = double('user')
+        expect(User).to receive(:create_from_provider).with('facebook', '123', {username: 'Noam Ben Ari'}).and_return(u).and_yield(u)
+        # test_create_from_provider_with_block in controller will check for uniqueness of username
+        get :test_create_from_provider_with_block, provider: 'facebook'
+      end
+    end
+  end
+
+  # ----------------- OAuth -----------------------
+  context "with OAuth features" do
+
+    let(:user) { double('user', id: 42) }
+
+    before(:each) do
+      stub_all_oauth2_requests!
+    end
+
+    after(:each) do
+      User.sorcery_adapter.delete_all
+      Authentication.sorcery_adapter.delete_all
+    end
+
+    context "when callback_url begin with /" do
+      before do
+        sorcery_controller_external_property_set(:facebook, :callback_url, "/oauth/twitter/callback")
+      end
+      it "login_at redirects correctly" do
+        get :login_at_test_facebook
+        expect(response).to be_a_redirect
+        expect(response).to redirect_to("https://graph.facebook.com/oauth/authorize?client_id=#{::Sorcery::Controller::Config.facebook.key}&display=page&redirect_uri=http%3A%2F%2Ftest.host%2Foauth%2Ftwitter%2Fcallback&response_type=code&scope=email%2Coffline_access&state=")
+      end
+      it "logins with state" do
+        get :login_at_test_with_state
+        expect(response).to be_a_redirect
+        expect(response).to redirect_to("https://graph.facebook.com/oauth/authorize?client_id=#{::Sorcery::Controller::Config.facebook.key}&display=page&redirect_uri=http%3A%2F%2Ftest.host%2Foauth%2Ftwitter%2Fcallback&response_type=code&scope=email%2Coffline_access&state=bla")
+      end
+      after do
+        sorcery_controller_external_property_set(:facebook, :callback_url, "http://blabla.com")
+      end
+    end
+
+    #this test can never pass because of the previous test (the callback url can't change anymore)
+=begin
+    context "when callback_url begin with http://" do
+      it "login_at redirects correctly" do
+        create_new_user
+        get :login_at_test2
+        response.should be_a_redirect
+        response.should redirect_to("https://graph.facebook.com/oauth/authorize?response_type=code&client_id=#{::Sorcery::Controller::Config.facebook.key}&redirect_uri=http%3A%2F%2Fblabla.com&scope=email%2Coffline_access&display=page&state")
+      end
+    end
+=end
+    it "'login_from' logins if user exists" do
+      # dirty hack for rails 4
+      allow(subject).to receive(:register_last_activity_time_to_db)
+
+      sorcery_model_property_set(:authentications_class, Authentication)
+      expect(User).to receive(:load_from_provider).with(:facebook, '123').and_return(user)
+      get :test_login_from_facebook
+
+      expect(flash[:notice]).to eq "Success!"
+    end
+
+    it "'login_from' fails if user doesn't exist" do
+      sorcery_model_property_set(:authentications_class, Authentication)
+      expect(User).to receive(:load_from_provider).with(:facebook, '123').and_return(nil)
+      get :test_login_from_facebook
+
+      expect(flash[:alert]).to eq "Failed!"
+    end
+
+    it "on successful login_from the user is redirected to the url he originally wanted" do
+      # dirty hack for rails 4
+      allow(subject).to receive(:register_last_activity_time_to_db)
+
+      sorcery_model_property_set(:authentications_class, Authentication)
+      expect(User).to receive(:load_from_provider).with(:facebook, '123').and_return(user)
+      get :test_return_to_with_external_facebook, {}, :return_to_url => "fuu"
+
+      expect(response).to redirect_to("fuu")
+      expect(flash[:notice]).to eq "Success!"
+    end
+
+    [:github, :google, :liveid, :vk, :salesforce].each do |provider|
+
+      describe "with #{provider}" do
+
+        it "login_at redirects correctly" do
+          get :"login_at_test_#{provider}"
+
+          expect(response).to be_a_redirect
+          expect(response).to redirect_to(provider_url provider)
+        end
+
+        it "'login_from' logins if user exists" do
+          # dirty hack for rails 4
+          allow(subject).to receive(:register_last_activity_time_to_db)
+
+          sorcery_model_property_set(:authentications_class, Authentication)
+          expect(User).to receive(:load_from_provider).with(provider, '123').and_return(user)
+          get :"test_login_from_#{provider}"
+
+          expect(flash[:notice]).to eq "Success!"
+        end
+
+        it "'login_from' fails if user doesn't exist" do
+          sorcery_model_property_set(:authentications_class, Authentication)
+          expect(User).to receive(:load_from_provider).with(provider, '123').and_return(nil)
+          get :"test_login_from_#{provider}"
+
+          expect(flash[:alert]).to eq "Failed!"
+        end
+
+        it "on successful login_from the user is redirected to the url he originally wanted (#{provider})" do
+          # dirty hack for rails 4
+          allow(subject).to receive(:register_last_activity_time_to_db)
+
+          sorcery_model_property_set(:authentications_class, Authentication)
+          expect(User).to receive(:load_from_provider).with(provider, '123').and_return(user)
+          get :"test_return_to_with_external_#{provider}", {}, :return_to_url => "fuu"
+
+          expect(response).to redirect_to "fuu"
+          expect(flash[:notice]).to eq "Success!"
+        end
+      end
+    end
+
+  end
+
+  describe "OAuth with User Activation features" do
+    before(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/activation")
+      end
+
+      sorcery_reload!([:user_activation,:external], :user_activation_mailer => ::SorceryMailer)
+      sorcery_controller_property_set(:external_providers, [:facebook, :github, :google, :liveid, :vk, :salesforce])
+
+      sorcery_controller_external_property_set(:facebook, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:facebook, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:facebook, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:github, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:github, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:github, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:google, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:google, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:google, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:liveid, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:liveid, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:liveid, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:vk, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:vk, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:vk, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:salesforce, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:salesforce, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:salesforce, :callback_url, "http://blabla.com")
+    end
+
+    after(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activation")
+      end
+    end
+
+    after(:each) do
+      User.sorcery_adapter.delete_all
+    end
+
+    it "does not send activation email to external users" do
+      old_size = ActionMailer::Base.deliveries.size
+      create_new_external_user(:facebook)
+
+      expect(ActionMailer::Base.deliveries.size).to eq old_size
+    end
+
+    it "does not send external users an activation success email" do
+      sorcery_model_property_set(:activation_success_email_method_name, nil)
+      create_new_external_user(:facebook)
+      old_size = ActionMailer::Base.deliveries.size
+      @user.activate!
+
+      expect(ActionMailer::Base.deliveries.size).to eq old_size
+    end
+
+    [:github, :google, :liveid, :vk, :salesforce].each do |provider|
+      it "does not send activation email to external users (#{provider})" do
+        old_size = ActionMailer::Base.deliveries.size
+        create_new_external_user provider
+        expect(ActionMailer::Base.deliveries.size).to eq old_size
+      end
+
+      it "does not send external users an activation success email (#{provider})" do
+        sorcery_model_property_set(:activation_success_email_method_name, nil)
+        create_new_external_user provider
+        old_size = ActionMailer::Base.deliveries.size
+        @user.activate!
+      end
+    end
+  end
+
+  describe "OAuth with user activation features"  do
+
+    let(:user) { double('user', id: 42) }
+
+    before(:all) do
+      sorcery_reload!([:activity_logging, :external])
+    end
+
+    after(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/external")
+        ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activity_logging")
+      end
+    end
+
+    %w(facebook github google liveid vk salesforce).each do |provider|
+      context "when #{provider}" do
+        before(:each) do
+          sorcery_controller_property_set(:register_login_time, true)
+          sorcery_controller_property_set(:register_logout_time, false)
+          sorcery_controller_property_set(:register_last_activity_time, false)
+          sorcery_controller_property_set(:register_last_ip_address, false)
+          stub_all_oauth2_requests!
+          sorcery_model_property_set(:authentications_class, Authentication)
+        end
+
+        it "registers login time" do
+          now = Time.now.in_time_zone
+          Timecop.freeze(now)
+          expect(User).to receive(:load_from_provider).and_return(user)
+          expect(user).to receive(:set_last_login_at).with(be_within(0.1).of(now))
+          get "test_login_from_#{provider}".to_sym
+          Timecop.return
+        end
+
+        it "does not register login time if configured so" do
+          sorcery_controller_property_set(:register_login_time, false)
+          now = Time.now.in_time_zone
+          Timecop.freeze(now)
+          expect(User).to receive(:load_from_provider).and_return(user)
+          expect(user).to receive(:set_last_login_at).never
+          get "test_login_from_#{provider}".to_sym
+
+        end
+      end
+    end
+  end
+
+  describe "OAuth with session timeout features" do
+    before(:all) do
+      sorcery_reload!([:session_timeout, :external])
+    end
+
+    let(:user) { double('user', id: 42) }
+
+    %w(facebook github google liveid vk salesforce).each do |provider|
+      context "when #{provider}" do
+        before(:each) do
+          sorcery_model_property_set(:authentications_class, Authentication)
+          sorcery_controller_property_set(:session_timeout,0.5)
+          stub_all_oauth2_requests!
+        end
+
+        after(:each) do
+          Timecop.return
+        end
+
+        it "does not reset session before session timeout" do
+          expect(User).to receive(:load_from_provider).with(provider.to_sym, '123').and_return(user)
+          get "test_login_from_#{provider}".to_sym
+
+          expect(session[:user_id]).not_to be_nil
+          expect(flash[:notice]).to eq "Success!"
+        end
+
+        it "resets session after session timeout" do
+          expect(User).to receive(:load_from_provider).with(provider.to_sym, '123').and_return(user)
+          get "test_login_from_#{provider}".to_sym
+          expect(session[:user_id]).to eq "42"
+          Timecop.travel(Time.now.in_time_zone+0.6)
+          get :test_should_be_logged_in
+
+          expect(session[:user_id]).to be_nil
+          expect(response).to be_a_redirect
+        end
+      end
+    end
+  end
+
+  def stub_all_oauth2_requests!
+    access_token    = double(OAuth2::AccessToken)
+    allow(access_token).to receive(:token_param=)
+    response        = double(OAuth2::Response)
+    allow(response).to receive(:body) { {
+      "id"=>"123",
+      "user_id"=>"123", # Needed for Salesforce
+      "name"=>"Noam Ben Ari",
+      "first_name"=>"Noam",
+      "last_name"=>"Ben Ari",
+      "link"=>"http://www.facebook.com/nbenari1",
+      "hometown"=>{"id"=>"110619208966868", "name"=>"Haifa, Israel"},
+      "location"=>{"id"=>"106906559341067", "name"=>"Pardes Hanah, Hefa, Israel"},
+      "bio"=>"I'm a new daddy, and enjoying it!",
+      "gender"=>"male",
+      "email"=>"nbenari@gmail.com",
+      "timezone"=>2,
+      "locale"=>"en_US",
+      "languages"=>[{"id"=>"108405449189952", "name"=>"Hebrew"}, {"id"=>"106059522759137", "name"=>"English"}, {"id"=>"112624162082677", "name"=>"Russian"}],
+      "verified"=>true,
+      "updated_time"=>"2011-02-16T20:59:38+0000",
+      # response for VK auth
+      "response"=>[
+          {
+            "uid"=>"123",
+            "first_name"=>"Noam",
+            "last_name"=>"Ben Ari"
+            }
+        ]}.to_json }
+    allow(access_token).to receive(:get) { response }
+    allow(access_token).to receive(:token) { "187041a618229fdaf16613e96e1caabc1e86e46bbfad228de41520e63fe45873684c365a14417289599f3" }
+    # access_token params for VK auth
+    allow(access_token).to receive(:params) { { "user_id"=>"100500", "email"=>"nbenari@gmail.com" } }
+    allow_any_instance_of(OAuth2::Strategy::AuthCode).to receive(:get_token) { access_token }
+  end
+
+  def set_external_property
+    sorcery_controller_property_set(:external_providers, [:facebook, :github, :google, :liveid, :vk, :salesforce])
+    sorcery_controller_external_property_set(:facebook, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:facebook, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:facebook, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:github, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:github, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:github, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:google, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:google, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:google, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:liveid, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:liveid, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:liveid, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:vk, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:vk, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:vk, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:salesforce, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:salesforce, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:salesforce, :callback_url, "http://blabla.com")
+  end
+
+  def provider_url(provider)
+    {
+      github: "https://github.com/login/oauth/authorize?client_id=#{::Sorcery::Controller::Config.github.key}&display=&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=&state=",
+      google: "https://accounts.google.com/o/oauth2/auth?client_id=#{::Sorcery::Controller::Config.google.key}&display=&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile&state=",
+      liveid: "https://oauth.live.com/authorize?client_id=#{::Sorcery::Controller::Config.liveid.key}&display=&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=wl.basic+wl.emails+wl.offline_access&state=",
+      vk: "https://oauth.vk.com/authorize?client_id=#{::Sorcery::Controller::Config.vk.key}&display=&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=#{::Sorcery::Controller::Config.vk.scope}&state=",
+      salesforce: "https://login.salesforce.com/services/oauth2/authorize?client_id=#{::Sorcery::Controller::Config.salesforce.key}&display=&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=#{::Sorcery::Controller::Config.salesforce.scope}&state="
+    }[provider]
+  end
+end
+

data/spec/controllers/controller_oauth_spec.rb

@@ -0,0 +1,240 @@
+require 'spec_helper'
+
+# require 'shared_examples/controller_oauth_shared_examples'
+require 'ostruct'
+
+def stub_all_oauth_requests!
+  consumer = OAuth::Consumer.new("key","secret", :site => "http://myapi.com")
+  req_token = OAuth::RequestToken.new(consumer)
+  acc_token = OAuth::AccessToken.new(consumer)
+
+  response = OpenStruct.new()
+  response.body = {"following"=>false, "listed_count"=>0, "profile_link_color"=>"0084B4", "profile_image_url"=>"http://a1.twimg.com/profile_images/536178575/noamb_normal.jpg", "description"=>"Programmer/Heavy Metal Fan/New Father", "status"=>{"text"=>"coming soon to sorcery gem: twitter and facebook authentication support.", "truncated"=>false, "favorited"=>false, "source"=>"web", "geo"=>nil, "in_reply_to_screen_name"=>nil, "in_reply_to_user_id"=>nil, "in_reply_to_status_id_str"=>nil, "created_at"=>"Sun Mar 06 23:01:12 +0000 2011", "contributors"=>nil, "place"=>nil, "retweeted"=>false, "in_reply_to_status_id"=>nil, "in_reply_to_user_id_str"=>nil, "coordinates"=>nil, "retweet_count"=>0, "id"=>44533012284706816, "id_str"=>"44533012284706816"}, "show_all_inline_media"=>false, "geo_enabled"=>true, "profile_sidebar_border_color"=>"a8c7f7", "url"=>nil, "followers_count"=>10, "screen_name"=>"nbenari", "profile_use_background_image"=>true, "location"=>"Israel", "statuses_count"=>25, "profile_background_color"=>"022330", "lang"=>"en", "verified"=>false, "notifications"=>false, "profile_background_image_url"=>"http://a3.twimg.com/profile_background_images/104087198/04042010339.jpg", "favourites_count"=>5, "created_at"=>"Fri Nov 20 21:58:19 +0000 2009", "is_translator"=>false, "contributors_enabled"=>false, "protected"=>false, "follow_request_sent"=>false, "time_zone"=>"Greenland", "profile_text_color"=>"333333", "name"=>"Noam Ben Ari", "friends_count"=>10, "profile_sidebar_fill_color"=>"C0DFEC", "id"=>123, "id_str"=>"91434812", "profile_background_tile"=>false, "utc_offset"=>-10800}.to_json
+
+  session[:request_token] = req_token.token
+  session[:request_token_secret] = req_token.secret
+
+  allow(OAuth::Consumer).to receive(:new) { consumer }
+  allow(consumer).to receive(:get_request_token) { req_token }
+  allow(req_token).to receive(:get_access_token) { acc_token }
+  allow(OAuth::RequestToken).to receive(:new) { req_token }
+  allow(acc_token).to receive(:get) { response }
+end
+
+describe SorceryController do
+
+  let(:user) { double('user', id: 42) }
+
+  before(:all) do
+    sorcery_reload!([:external])
+    sorcery_controller_property_set(:external_providers, [:twitter, :jira])
+    sorcery_controller_external_property_set(:twitter, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:twitter, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:twitter, :callback_url, "http://blabla.com")
+
+    sorcery_controller_external_property_set(:jira, :key, "7810b8e317ebdc81601c72f8daecc0f1")
+    sorcery_controller_external_property_set(:jira, :secret, "MyAppUsingJira")
+    sorcery_controller_external_property_set(:jira, :site, "http://jira.mycompany.com/plugins/servlet/oauth")
+    sorcery_controller_external_property_set(:jira, :signature_method, "RSA-SHA1")
+    sorcery_controller_external_property_set(:jira, :private_key_file, "myrsakey.pem")
+    sorcery_controller_external_property_set(:jira, :callback_url, "http://myappusingjira.com/home")
+  end
+
+  # ----------------- OAuth -----------------------
+  describe SorceryController, "'using external API to login'" do
+
+    before(:each) do
+      stub_all_oauth_requests!
+    end
+
+    context "when callback_url begin with /" do
+      before do
+        sorcery_controller_external_property_set(:twitter, :callback_url, "/oauth/twitter/callback")
+      end
+      it "login_at redirects correctly" do
+        get :login_at_test
+        expect(response).to be_a_redirect
+        expect(response).to redirect_to("http://myapi.com/oauth/authorize?oauth_callback=http%3A%2F%2Ftest.host%2Foauth%2Ftwitter%2Fcallback&oauth_token=")
+      end
+      after do
+        sorcery_controller_external_property_set(:twitter, :callback_url, "http://blabla.com")
+      end
+    end
+
+    context "when callback_url begin with http://" do
+      it "login_at redirects correctly", pending: true do
+        get :login_at_test
+        expect(response).to be_a_redirect
+        expect(response).to redirect_to("http://myapi.com/oauth/authorize?oauth_callback=http%3A%2F%2Fblabla.com&oauth_token=")
+      end
+    end
+
+    it "logins if user exists" do
+      expect(User).to receive(:load_from_provider).with(:twitter, '123').and_return(user)
+
+      get :test_login_from, :oauth_verifier => "blablaRERASDFcxvSDFA"
+      expect(flash[:notice]).to eq "Success!"
+    end
+
+    it "'login_from' fails if user doesn't exist" do
+      expect(User).to receive(:load_from_provider).with(:twitter, '123').and_return(nil)
+
+      get :test_login_from, :oauth_verifier => "blablaRERASDFcxvSDFA"
+      expect(flash[:alert]).to eq "Failed!"
+    end
+
+    it "on successful 'login_from' the user is redirected to the url he originally wanted" do
+      expect(User).to receive(:load_from_provider).with(:twitter, '123').and_return(user)
+      get :test_return_to_with_external, {}, :return_to_url => "fuu"
+      expect(response).to redirect_to("fuu")
+      expect(flash[:notice]).to eq "Success!"
+    end
+
+    context "when jira" do
+      it "user logins successfully" do
+        get :login_at_test_jira
+        expect(session[:request_token]).not_to be_nil
+        expect(response).to be_a_redirect
+      end
+    end
+
+  end
+
+  describe SorceryController do
+    describe "using 'create_from'" do
+      before(:each) do
+        stub_all_oauth_requests!
+      end
+
+      it "creates a new user" do
+        sorcery_controller_external_property_set(:twitter, :user_info_mapping, {:username => "screen_name"})
+        expect(User).to receive(:load_from_provider).with('twitter', '123').and_return(nil)
+        expect(User).to receive(:create_from_provider).with('twitter', '123', {username: 'nbenari'}).and_return(user)
+
+        get :test_create_from_provider, :provider => "twitter"
+      end
+
+      it "supports nested attributes" do
+        sorcery_controller_external_property_set(:twitter, :user_info_mapping, {:username => "status/text"})
+        expect(User).to receive(:load_from_provider).with('twitter', '123').and_return(nil)
+        expect(User).to receive(:create_from_provider).with('twitter', '123', {username: 'coming soon to sorcery gem: twitter and facebook authentication support.'}).and_return(user)
+
+        get :test_create_from_provider, :provider => "twitter"
+      end
+
+      it "does not crash on missing nested attributes" do
+        sorcery_controller_external_property_set(:twitter, :user_info_mapping, {:username => "status/text", :created_at => "does/not/exist"})
+        expect(User).to receive(:load_from_provider).with('twitter', '123').and_return(nil)
+        expect(User).to receive(:create_from_provider).with('twitter', '123', {username: 'coming soon to sorcery gem: twitter and facebook authentication support.'}).and_return(user)
+
+        get :test_create_from_provider, :provider => "twitter"
+      end
+
+      it "binds new provider" do
+        sorcery_model_property_set(:authentications_class, UserProvider)
+
+        allow(user).to receive_message_chain(:sorcery_config, :username_attribute_names, :first) { :username }
+        allow(user).to receive(:username).and_return('bla@bla.com')
+        login_user(user)
+
+        expect(user).to receive(:add_provider_to_user).with('twitter', '123')
+        get :test_add_second_provider, :provider => "twitter"
+      end
+
+      describe "with a block" do
+        it "does not create user" do
+          sorcery_model_property_set(:authentications_class, Authentication)
+          sorcery_controller_external_property_set(:twitter, :user_info_mapping, {:username => "screen_name"})
+
+          u = double('user')
+          expect(User).to receive(:load_from_provider).with('twitter', '123').and_return(nil)
+          expect(User).to receive(:create_from_provider).with('twitter', '123', {username: 'nbenari'}).and_return(u).and_yield(u)
+
+          get :test_create_from_provider_with_block, :provider => "twitter"
+        end
+
+      end
+    end
+  end
+
+  describe SorceryController, "OAuth with user activation features"  do
+    before(:all) do
+      sorcery_reload!([:activity_logging, :external])
+    end
+
+    context "when twitter" do
+      before(:each) do
+        sorcery_controller_property_set(:register_login_time, true)
+        sorcery_controller_property_set(:register_logout_time, false)
+        sorcery_controller_property_set(:register_last_activity_time, false)
+        sorcery_controller_property_set(:register_last_ip_address, false)
+        stub_all_oauth_requests!
+      end
+
+      it "registers login time" do
+        now = Time.now.in_time_zone
+        Timecop.freeze(now)
+        expect(User).to receive(:load_from_provider).and_return(user)
+        expect(user).to receive(:set_last_login_at).with(be_within(0.1).of(now))
+        get :test_login_from
+        Timecop.return
+      end
+
+      it "does not register login time if configured so" do
+        sorcery_controller_property_set(:register_login_time, false)
+        now = Time.now.in_time_zone
+        Timecop.freeze(now)
+        expect(User).to receive(:load_from_provider).and_return(user)
+        expect(user).to receive(:set_last_login_at).never
+        get :test_login_from
+        Timecop.return
+      end
+    end
+  end
+
+  describe SorceryController, "OAuth with session timeout features" do
+    before(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
+        User.reset_column_information
+      end
+
+      sorcery_reload!([:session_timeout, :external])
+    end
+
+    after(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/external")
+      end
+    end
+
+    context "when twitter" do
+      before(:each) do
+        sorcery_model_property_set(:authentications_class, Authentication)
+        sorcery_controller_property_set(:session_timeout,0.5)
+        stub_all_oauth_requests!
+      end
+
+      after(:each) do
+        Timecop.return
+      end
+
+      it "does not reset session before session timeout" do
+        expect(User).to receive(:load_from_provider).with(:twitter, '123').and_return(user)
+        get :test_login_from
+
+        expect(session[:user_id]).not_to be_nil
+        expect(flash[:notice]).to eq "Success!"
+      end
+
+      it "resets session after session timeout" do
+        get :test_login_from
+        Timecop.travel(Time.now.in_time_zone+0.6)
+        get :test_should_be_logged_in
+
+        expect(session[:user_id]).to be_nil
+        expect(response).to be_a_redirect
+      end
+    end
+  end
+end