sorcery 0.8.1 → 0.9.0

data/spec/controllers/controller_remember_me_spec.rb

@@ -0,0 +1,117 @@
+require 'spec_helper'
+
+describe SorceryController do
+
+  let!(:user) { double('user', id: 42) }
+
+  # ----------------- REMEMBER ME -----------------------
+  context "with remember me features" do
+
+    before(:all) do
+      sorcery_reload!([:remember_me])
+    end
+
+    after(:each) do
+      session = nil
+      cookies = nil
+    end
+
+    before(:each) do
+      allow(user).to receive(:remember_me_token)
+      allow(user).to receive(:remember_me_token_expires_at)
+      allow(user).to receive_message_chain(:sorcery_config, :remember_me_token_attribute_name).and_return(:remember_me_token)
+      allow(user).to receive_message_chain(:sorcery_config, :remember_me_token_expires_at_attribute_name).and_return(:remember_me_token_expires_at)
+    end
+
+    it "sets cookie on remember_me!" do
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+      expect(user).to receive(:remember_me!)
+
+      post :test_login_with_remember, :email => 'bla@bla.com', :password => 'secret'
+
+      expect(cookies.signed["remember_me_token"]).to eq assigns[:current_user].remember_me_token
+    end
+
+    it "clears cookie on forget_me!" do
+      cookies["remember_me_token"] == {:value => 'asd54234dsfsd43534', :expires => 3600}
+      get :test_logout
+
+      expect(cookies["remember_me_token"]).to be_nil
+    end
+
+    it "login(email,password,remember_me) logs user in and remembers" do
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret', '1').and_return(user)
+      expect(user).to receive(:remember_me!)
+      expect(user).to receive(:remember_me_token).and_return('abracadabra').twice
+
+      post :test_login_with_remember_in_login, :email => 'bla@bla.com', :password => 'secret', :remember => "1"
+
+      expect(cookies.signed["remember_me_token"]).not_to be_nil
+      expect(cookies.signed["remember_me_token"]).to eq assigns[:user].remember_me_token
+    end
+
+    it "logout also calls forget_me!" do
+      session[:user_id] = user.id.to_s
+			expect(User.sorcery_adapter).to receive(:find_by_id).with(user.id.to_s).and_return(user)
+      expect(user).to receive(:remember_me!)
+      expect(user).to receive(:forget_me!)
+      get :test_logout_with_remember
+
+      expect(cookies["remember_me_token"]).to be_nil
+    end
+
+    it "logs user in from cookie" do
+			session[:user_id] = user.id.to_s
+			expect(User.sorcery_adapter).to receive(:find_by_id).with(user.id.to_s).and_return(user)
+      expect(user).to receive(:remember_me!)
+      expect(user).to receive(:remember_me_token).and_return('token').twice
+      expect(user).to receive(:has_remember_me_token?) { true }
+
+      subject.remember_me!
+      subject.instance_eval do
+        remove_instance_variable :@current_user
+      end
+      session[:user_id] = nil
+
+      expect(User.sorcery_adapter).to receive(:find_by_remember_me_token).with('token').and_return(user)
+
+      get :test_login_from_cookie
+
+      expect(assigns[:current_user]).to eq user
+    end
+
+    it "doest not remember_me! when not asked to, even if third parameter is used" do
+      post :test_login_with_remember_in_login, :email => 'bla@bla.com', :password => 'secret', :remember => "0"
+
+      expect(cookies["remember_me_token"]).to be_nil
+    end
+
+    it "doest not remember_me! when not asked to" do
+      post :test_login, :email => 'bla@bla.com', :password => 'secret'
+      expect(cookies["remember_me_token"]).to be_nil
+    end
+
+    # --- login_user(user) ---
+    specify { expect(@controller).to respond_to :auto_login }
+
+    it "auto_login(user) logs in an user instance without remembering" do
+      session[:user_id] = nil
+      subject.auto_login(user)
+      get :test_login_from_cookie
+
+      expect(assigns[:current_user]).to eq user
+      expect(cookies["remember_me_token"]).to be_nil
+    end
+
+    it "auto_login(user, true) logs in an user instance with remembering" do
+      session[:user_id] = nil
+      expect(user).to receive(:remember_me!)
+      subject.auto_login(user, true)
+
+      get :test_login_from_cookie
+
+      expect(assigns[:current_user]).to eq user
+      expect(cookies["remember_me_token"]).not_to be_nil
+    end
+  end
+end

data/spec/controllers/controller_session_timeout_spec.rb

@@ -0,0 +1,80 @@
+require 'spec_helper'
+
+describe SorceryController do
+
+  let!(:user) { double('user', id: 42) }
+
+  # ----------------- SESSION TIMEOUT -----------------------
+  context "with session timeout features" do
+    before(:all) do
+      sorcery_reload!([:session_timeout])
+      sorcery_controller_property_set(:session_timeout,0.5)
+    end
+
+    after(:each) do
+      Timecop.return
+    end
+
+    before(:each) do
+      allow(user).to receive(:username)
+      allow(user).to receive_message_chain(:sorcery_config, :username_attribute_names, :first) { :username }
+    end
+
+    it "does not reset session before session timeout" do
+      login_user user
+      get :test_should_be_logged_in
+
+      expect(session[:user_id]).not_to be_nil
+      expect(response).to be_a_success
+    end
+
+    it "resets session after session timeout" do
+      login_user user
+      Timecop.travel(Time.now.in_time_zone+0.6)
+      get :test_should_be_logged_in
+
+      expect(session[:user_id]).to be_nil
+      expect(response).to be_a_redirect
+    end
+
+    it "works if the session is stored as a string or a Time" do
+      session[:login_time] = Time.now.to_s
+      # TODO: ???
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+
+      get :test_login, :email => 'bla@bla.com', :password => 'secret'
+
+      expect(session[:user_id]).not_to be_nil
+      expect(response).to be_a_success
+    end
+
+    context "with 'session_timeout_from_last_action'" do
+      it "does not logout if there was activity" do
+        sorcery_controller_property_set(:session_timeout_from_last_action, true)
+        expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+
+        get :test_login, :email => 'bla@bla.com', :password => 'secret'
+        Timecop.travel(Time.now.in_time_zone+0.3)
+        get :test_should_be_logged_in
+
+        expect(session[:user_id]).not_to be_nil
+
+        Timecop.travel(Time.now.in_time_zone+0.3)
+        get :test_should_be_logged_in
+
+        expect(session[:user_id]).not_to be_nil
+        expect(response).to be_a_success
+      end
+
+      it "with 'session_timeout_from_last_action' logs out if there was no activity" do
+        sorcery_controller_property_set(:session_timeout_from_last_action, true)
+        get :test_login, :email => 'bla@bla.com', :password => 'secret'
+        Timecop.travel(Time.now.in_time_zone+0.6)
+        get :test_should_be_logged_in
+
+        expect(session[:user_id]).to be_nil
+        expect(response).to be_a_redirect
+      end
+    end
+  end
+end

data/spec/controllers/controller_spec.rb

@@ -0,0 +1,218 @@
+require 'spec_helper'
+
+describe SorceryController do
+  describe "plugin configuration" do
+    before(:all) do
+      sorcery_reload!
+    end
+
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      sorcery_reload!
+    end
+
+    it "enables configuration option 'user_class'" do
+      sorcery_controller_property_set(:user_class, "TestUser")
+
+      expect(Sorcery::Controller::Config.user_class).to eq "TestUser"
+    end
+
+    it "enables configuration option 'not_authenticated_action'" do
+      sorcery_controller_property_set(:not_authenticated_action, :my_action)
+
+      expect(Sorcery::Controller::Config.not_authenticated_action).to eq :my_action
+    end
+
+  end
+
+  # ----------------- PLUGIN ACTIVATED -----------------------
+  context "when activated with sorcery" do
+    let(:user) { double('user', id: 42) }
+
+    before(:all) do
+      sorcery_reload!
+    end
+
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      sorcery_reload!
+      sorcery_controller_property_set(:user_class, User)
+      sorcery_model_property_set(:username_attribute_names, [:email])
+    end
+
+    specify { should respond_to(:login) }
+
+    specify { should respond_to(:logout) }
+
+    specify { should respond_to(:logged_in?) }
+
+    specify { should respond_to(:current_user) }
+
+    it "login(username,password) returns the user when success and set the session with user.id" do
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+
+      get :test_login, :email => 'bla@bla.com', :password => 'secret'
+
+      expect(assigns[:user]).to eq user
+      expect(session[:user_id]).to eq "42"
+    end
+
+    it "login(email,password) returns the user when success and set the session with user.id" do
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+
+      get :test_login, :email => 'bla@bla.com', :password => 'secret'
+
+      expect(assigns[:user]).to eq user
+      expect(session[:user_id]).to eq user.id.to_s
+    end
+
+    it "login(username,password) returns nil and not set the session when failure" do
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'opensesame!').and_return(nil)
+
+      get :test_login, :email => 'bla@bla.com', :password => 'opensesame!'
+
+      expect(assigns[:user]).to be_nil
+      expect(session[:user_id]).to be_nil
+    end
+
+    it "login(email,password) returns the user when success and set the session with the _csrf_token" do
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+      get :test_login, :email => 'bla@bla.com', :password => 'secret'
+
+      expect(session[:_csrf_token]).not_to be_nil
+    end
+
+    it "login(username,password) returns nil and not set the session when upper case username" do
+      skip('DM Adapter dependant') if SORCERY_ORM == :data_mapper
+      get :test_login, :email => 'BLA@BLA.COM', :password => 'secret'
+
+      expect(assigns[:user]).to be_nil
+      expect(session[:user_id]).to be_nil
+    end
+
+    # TODO: move test to model
+    it "login(username,password) returns the user and set the session with user.id when upper case username and config is downcase before authenticating" do
+      sorcery_model_property_set(:downcase_username_before_authenticating, true)
+      expect(User).to receive(:authenticate).with('BLA@BLA.COM', 'secret').and_return(user)
+      get :test_login, :email => 'BLA@BLA.COM', :password => 'secret'
+
+      expect(assigns[:user]).to eq user
+      expect(session[:user_id]).to eq user.id.to_s
+    end
+
+    # TODO: move test to model
+    it "login(username,password) returns nil and not set the session when user was created with upper case username, config is default, and log in username is lower case" do
+      skip('DM Adapter dependant') if SORCERY_ORM == :data_mapper
+      expect(User).to receive(:authenticate).with('bla1@bla.com', 'secret1').and_return(nil)
+      get :test_login, :email => 'bla1@bla.com', :password => 'secret1'
+
+      expect(assigns[:user]).to be_nil
+      expect(session[:user_id]).to be_nil
+    end
+
+    # TODO: move test to model
+    it "login(username,password) returns the user and set the session with user.id when user was created with upper case username and config is downcase before authenticating" do
+      skip('DM Adapter dependant') if SORCERY_ORM == :data_mapper
+      sorcery_model_property_set(:downcase_username_before_authenticating, true)
+      expect(User).to receive(:authenticate).with('bla1@bla.com', 'secret1').and_return(user)
+      get :test_login, :email => 'bla1@bla.com', :password => 'secret1'
+
+      expect(assigns[:user]).to eq user
+      expect(session[:user_id]).to eq user.id.to_s
+    end
+
+    it "logout clears the session" do
+      cookies[:remember_me_token] = nil
+      session[:user_id] = user.id.to_s
+      expect(User.sorcery_adapter).to receive(:find_by_id).with("42") { user }
+      get :test_logout
+
+      expect(session[:user_id]).to be_nil
+    end
+
+    it "logged_in? returns true if logged in" do
+      session[:user_id] = user.id.to_s
+      expect(User.sorcery_adapter).to receive(:find_by_id).with("42") { user }
+
+      expect(subject.logged_in?).to be true
+    end
+
+    it "logged_in? returns false if not logged in" do
+      session[:user_id] = nil
+
+      expect(subject.logged_in?).to be false
+    end
+
+    it "current_user returns the user instance if logged in" do
+      session[:user_id] = user.id.to_s
+      expect(User.sorcery_adapter).to receive(:find_by_id).with("42") { user }
+
+      2.times { expect(subject.current_user).to eq user } # memoized!
+    end
+
+    it "current_user returns false if not logged in" do
+      session[:user_id] = nil
+      expect(User.sorcery_adapter).to_not receive(:find_by_id)
+
+      2.times { expect(subject.current_user).to be_nil } # memoized!
+    end
+
+    specify { should respond_to(:require_login) }
+
+    it "calls the configured 'not_authenticated_action' when authenticate before_filter fails" do
+      session[:user_id] = nil
+      sorcery_controller_property_set(:not_authenticated_action, :test_not_authenticated_action)
+      get :test_logout
+
+      expect(response.body).to eq "test_not_authenticated_action"
+    end
+
+    it "require_login before_filter saves the url that the user originally wanted" do
+      get :some_action
+
+      expect(session[:return_to_url]).to eq "http://test.host/some_action"
+      expect(response).to redirect_to("http://test.host/")
+    end
+
+    it "require_login before_filter does not save the url that the user originally wanted upon all non-get http methods" do
+      [:post, :put, :delete].each do |m|
+        self.send(m, :some_action)
+
+        expect(session[:return_to_url]).to be_nil
+      end
+    end
+
+    it "on successful login the user is redirected to the url he originally wanted" do
+      session[:return_to_url] = "http://test.host/some_action"
+      post :test_return_to, :email => 'bla@bla.com', :password => 'secret'
+
+      expect(response).to redirect_to("http://test.host/some_action")
+      expect(flash[:notice]).to eq "haha!"
+    end
+
+
+    # --- auto_login(user) ---
+    specify { should respond_to(:auto_login) }
+
+    it "auto_login(user) los in a user instance" do
+      session[:user_id] = nil
+      subject.auto_login(user)
+
+      expect(subject.logged_in?).to be true
+    end
+
+    it "auto_login(user) works even if current_user was already set to false" do
+      get :test_logout
+
+      expect(session[:user_id]).to be_nil
+      expect(subject.current_user).to be_nil
+
+      expect(User).to receive(:first) { user }
+
+      get :test_auto_login
+
+      expect(assigns[:result]).to eq user
+    end
+  end
+
+end

data/spec/data_mapper/user_activation_spec.rb

@@ -0,0 +1,10 @@
+require 'spec_helper'
+
+require 'rails_app/app/mailers/sorcery_mailer'
+require 'shared_examples/user_activation_shared_examples'
+
+describe User, "with activation submodule", :data_mapper => true do
+
+  it_behaves_like "rails_3_activation_model"
+
+end

data/spec/data_mapper/user_activity_logging_spec.rb

@@ -0,0 +1,14 @@
+require 'spec_helper'
+
+require 'shared_examples/user_activity_logging_shared_examples'
+
+describe User, "with activity logging submodule", :data_mapper => true do
+
+  it_behaves_like "rails_3_activity_logging_model"
+
+  it "raises an error when incompatible adapter" do
+    allow(User.repository.adapter).to receive(:is_a?).with(DataMapper::Adapters::MysqlAdapter) { false }
+    expect(-> { sorcery_reload!(:activity_logging) }).to raise_error(Exception)
+  end
+
+end

data/spec/data_mapper/user_brute_force_protection_spec.rb

@@ -0,0 +1,9 @@
+require 'spec_helper'
+
+require 'shared_examples/user_brute_force_protection_shared_examples'
+
+describe User, "with brute_force_protection submodule", :data_mapper => true do
+
+  it_behaves_like "rails_3_brute_force_protection_model"
+
+end

data/spec/data_mapper/user_oauth_spec.rb

@@ -0,0 +1,9 @@
+require 'spec_helper'
+
+require 'shared_examples/user_oauth_shared_examples'
+
+describe User, "with oauth submodule", :data_mapper => true do
+
+  it_behaves_like "rails_3_oauth_model"
+
+end

data/spec/data_mapper/user_remember_me_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_remember_me_shared_examples'
+
+describe User, "with remember_me submodule", :data_mapper => true do
+
+  it_behaves_like "rails_3_remember_me_model"
+
+end

data/spec/data_mapper/user_reset_password_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_reset_password_shared_examples'
+
+describe User, "with reset_password submodule", :data_mapper => true do
+
+  it_behaves_like "rails_3_reset_password_model"
+
+end

data/spec/data_mapper/user_spec.rb

@@ -0,0 +1,27 @@
+require 'spec_helper'
+
+require 'rails_app/app/mailers/sorcery_mailer'
+require 'shared_examples/user_shared_examples'
+
+describe User, "with no submodules (core)", :data_mapper => true do
+  before(:all) do
+    sorcery_reload!
+  end
+
+  context "when app has plugin loaded" do
+    it "User responds to .authenticates_with_sorcery!" do
+      expect(User).to respond_to :authenticates_with_sorcery!
+    end
+  end
+
+  # ----------------- PLUGIN CONFIGURATION -----------------------
+
+  it_should_behave_like "rails_3_core_model"
+
+  describe "external users" do
+
+    it_should_behave_like "external_user"
+
+  end
+
+end

data/spec/mongo_mapper/user_activation_spec.rb

@@ -0,0 +1,9 @@
+require 'spec_helper'
+require 'rails_app/app/mailers/sorcery_mailer'
+require 'shared_examples/user_activation_shared_examples'
+
+describe User, "with activation submodule", :mongo_mapper => true do
+
+  it_behaves_like "rails_3_activation_model"
+
+end

data/spec/mongo_mapper/user_activity_logging_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_activity_logging_shared_examples'
+
+describe User, "with activity logging submodule", :mongo_mapper => true do
+
+  it_behaves_like "rails_3_activity_logging_model"
+
+end

data/spec/mongo_mapper/user_brute_force_protection_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_brute_force_protection_shared_examples'
+
+describe User, "with brute_force_protection submodule", :mongo_mapper => true do
+
+  it_behaves_like "rails_3_brute_force_protection_model"
+
+end

data/spec/mongo_mapper/user_oauth_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_oauth_shared_examples'
+
+describe User, "with oauth submodule", :mongo_mapper => true do
+
+  it_behaves_like "rails_3_oauth_model"
+
+end

data/spec/mongo_mapper/user_remember_me_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_remember_me_shared_examples'
+
+describe User, "with remember_me submodule", :mongo_mapper => true do
+
+  it_behaves_like "rails_3_remember_me_model"
+
+end

data/spec/mongo_mapper/user_reset_password_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_reset_password_shared_examples'
+
+describe User, "with reset_password submodule", :mongo_mapper => true do
+
+  it_behaves_like "rails_3_reset_password_model"
+
+end

data/spec/mongo_mapper/user_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+require 'rails_app/app/mailers/sorcery_mailer'
+require 'shared_examples/user_shared_examples'
+
+describe User, "with no submodules (core)", :mongo_mapper => true do
+  before(:all) do
+    sorcery_reload!
+  end
+
+  describe User, "when app has plugin loaded" do
+    it "User responds to .authenticates_with_sorcery!" do
+      expect(User).to respond_to :authenticates_with_sorcery!
+    end
+  end
+
+  # ----------------- PLUGIN CONFIGURATION -----------------------
+
+  it_should_behave_like "rails_3_core_model"
+
+  describe "external users" do
+
+    it_should_behave_like "external_user"
+
+  end
+
+  context "when inherited" do
+    it "inherits mongo_mapper keys" do
+      User.class_eval do
+        key :blabla
+      end
+      class SubUser < User
+      end
+
+      expect(SubUser.keys).to include("blabla")
+    end
+  end
+end

data/spec/mongoid/user_activation_spec.rb

@@ -0,0 +1,9 @@
+require 'spec_helper'
+require 'rails_app/app/mailers/sorcery_mailer'
+require 'shared_examples/user_activation_shared_examples'
+
+describe User, "with activation submodule", :mongoid => true do
+
+  it_behaves_like "rails_3_activation_model"
+
+end

data/spec/mongoid/user_activity_logging_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_activity_logging_shared_examples'
+
+describe User, "with activity logging submodule", :mongoid => true do
+
+  it_behaves_like "rails_3_activity_logging_model"
+
+end

data/spec/mongoid/user_brute_force_protection_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_brute_force_protection_shared_examples'
+
+describe User, "with brute_force_protection submodule", :mongoid => true do
+
+  it_behaves_like "rails_3_brute_force_protection_model"
+
+end

data/spec/mongoid/user_oauth_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_oauth_shared_examples'
+
+describe User, "with oauth submodule", :mongoid => true do
+
+  it_behaves_like "rails_3_oauth_model"
+
+end

data/spec/mongoid/user_remember_me_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_remember_me_shared_examples'
+
+describe User, "with remember_me submodule", :mongoid => true do
+
+  it_behaves_like "rails_3_remember_me_model"
+
+end

data/spec/mongoid/user_reset_password_spec.rb

@@ -0,0 +1,8 @@
+require 'spec_helper'
+require 'shared_examples/user_reset_password_shared_examples'
+
+describe User, "with reset_password submodule", :mongoid => true do
+
+  it_behaves_like "rails_3_reset_password_model"
+
+end