sorcery 0.8.2 → 0.8.6

data/spec/active_record/controller_brute_force_protection_spec.rb

@@ -0,0 +1,158 @@
+require 'spec_helper'
+
+describe SorceryController, :active_record => true do
+
+  let(:db_user) { User.find_by_email 'bla@bla.com' }
+  let!(:user) { create_new_user }
+
+  def request_test_login
+    get :test_login, :email => 'bla@bla.com', :password => 'blabla'
+  end
+
+  before(:all) do
+    ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/brute_force_protection")
+    User.reset_column_information
+  end
+
+  after(:all) do
+    ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/brute_force_protection")
+  end
+
+  # ----------------- SESSION TIMEOUT -----------------------
+  describe "brute force protection features" do
+
+    before(:all) do
+      sorcery_reload!([:brute_force_protection])
+    end
+
+
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      sorcery_controller_property_set(:user_class, User)
+      Timecop.return
+    end
+
+    it "counts login retries" do
+      3.times { request_test_login }
+      expect(db_user.failed_logins_count).to eq 3
+    end
+
+    it "generates unlock token before mail is sent" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times { request_test_login }
+      expect(ActionMailer::Base.deliveries.last.body.to_s.match(db_user.unlock_token)).not_to be_nil
+    end
+
+    it "unlocks after entering unlock token" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times { request_test_login }
+
+      expect(db_user.unlock_token).not_to be_nil
+
+      token = db_user.unlock_token
+      user = User.load_from_unlock_token(token)
+
+      expect(user).not_to be_nil
+
+      user.unlock!
+      expect(User.load_from_unlock_token(db_user.unlock_token)).to be_nil
+    end
+
+    it "resets the counter on a good login" do
+      # dirty hack for rails 4
+      allow(@controller).to receive(:register_last_activity_time_to_db)
+
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 5)
+      3.times { request_test_login }
+      get :test_login, :email => 'bla@bla.com', :password => 'secret'
+
+      expect(db_user.failed_logins_count).to eq 0
+    end
+
+    it "locks user when number of retries reached the limit" do
+      expect(db_user.lock_expires_at).to be_nil
+
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 1)
+      request_test_login
+
+      expect(db_user.reload.lock_expires_at).not_to be_nil
+    end
+
+    it "unlocks after lock time period passes" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0.2)
+      2.times { request_test_login }
+
+      expect(db_user.reload.lock_expires_at).not_to be_nil
+
+      Timecop.travel(Time.now.in_time_zone + 0.3)
+      request_test_login
+
+      expect(db_user.reload.lock_expires_at).to be_nil
+    end
+
+    it "doest not unlock if time period is 0 (permanent lock)" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      2.times { request_test_login }
+      unlock_date = db_user.lock_expires_at
+      Timecop.travel(Time.now.in_time_zone + 1)
+      request_test_login
+
+      expect(db_user.lock_expires_at.to_s).to eq unlock_date.to_s
+    end
+
+    context "unlock_token_mailer_disabled is true" do
+
+      before(:each) do
+        sorcery_model_property_set(:unlock_token_mailer_disabled, true)
+        sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+        sorcery_model_property_set(:login_lock_time_period, 0)
+        sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      end
+
+      it "generates unlock token after user locked" do
+        3.times { request_test_login }
+
+        expect(db_user.unlock_token).not_to be_nil
+      end
+
+      it "doest *not* automatically send unlock mail" do
+        old_size = ActionMailer::Base.deliveries.size
+        3.times { request_test_login }
+
+        expect(ActionMailer::Base.deliveries.size).to eq old_size
+      end
+
+    end
+
+    context "unlock_token_mailer_disabled is false" do
+
+      before(:each) do
+        sorcery_model_property_set(:unlock_token_mailer_disabled, false)
+        sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+        sorcery_model_property_set(:login_lock_time_period, 0)
+        sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      end
+
+      it "sets the unlock token after user locked" do
+        3.times { request_test_login }
+
+        expect(db_user.unlock_token).not_to be_nil
+      end
+
+      it "automatically sends unlock mail" do
+        old_size = ActionMailer::Base.deliveries.size
+        3.times { request_test_login }
+
+        expect(ActionMailer::Base.deliveries.size).to eq old_size + 1
+      end
+
+    end
+
+  end
+end

data/spec/active_record/controller_http_basic_auth_spec.rb

@@ -0,0 +1,65 @@
+require 'spec_helper'
+
+describe SorceryController, :active_record => true do
+
+  let!(:user) { create_new_user }
+
+  # ----------------- HTTP BASIC AUTH -----------------------
+  describe  "with http basic auth features" do
+    before(:all) do
+      sorcery_reload!([:http_basic_auth])
+
+      sorcery_controller_property_set(:controller_to_realm_map, {"sorcery" => "sorcery"})
+    end
+
+    after(:each) do
+      logout_user
+    end
+
+    it "requests basic authentication when before_filter is used" do
+      get :test_http_basic_auth
+
+      expect(response.code).to eq "401"
+    end
+
+    it "authenticates from http basic if credentials are sent" do
+      # dirty hack for rails 4
+      allow(subject).to receive(:register_last_activity_time_to_db)
+
+      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{user.email}:secret")
+      get :test_http_basic_auth, nil, :http_authentication_used => true
+
+      expect(response).to be_a_success
+    end
+
+    it "fails authentication if credentials are wrong" do
+      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{user.email}:wrong!")
+      get :test_http_basic_auth, nil, :http_authentication_used => true
+
+      expect(response).to redirect_to root_url
+    end
+
+    it "allows configuration option 'controller_to_realm_map'" do
+      sorcery_controller_property_set(:controller_to_realm_map, {"1" => "2"})
+
+      expect(Sorcery::Controller::Config.controller_to_realm_map).to eq({"1" => "2"})
+    end
+
+    it "displays the correct realm name configured for the controller" do
+      sorcery_controller_property_set(:controller_to_realm_map, {"sorcery" => "Salad"})
+      get :test_http_basic_auth
+
+      expect(response.headers["WWW-Authenticate"]).to eq "Basic realm=\"Salad\""
+    end
+
+    it "signs in the user's session on successful login" do
+      # dirty hack for rails 4
+      allow(controller).to receive(:register_last_activity_time_to_db)
+
+      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{user.email}:secret")
+      get :test_http_basic_auth, nil, :http_authentication_used => true
+
+      expect(session[:user_id]).to be User.find_by_email(user.email).id
+    end
+  end
+end

data/spec/active_record/controller_oauth2_spec.rb

@@ -0,0 +1,342 @@
+require 'spec_helper'
+
+require 'shared_examples/controller_oauth2_shared_examples'
+
+describe SorceryController, :active_record => true do
+  before(:all) do
+    ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
+    User.reset_column_information
+
+    sorcery_reload!([:external])
+    set_external_property
+  end
+
+  after(:all) do
+    ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/external")
+  end
+
+  it_behaves_like "oauth2_controller"
+
+  # ----------------- OAuth -----------------------
+  context "with OAuth features" do
+
+    before(:each) do
+      stub_all_oauth2_requests!
+    end
+
+    after(:each) do
+      User.delete_all
+      Authentication.delete_all
+    end
+
+    context "when callback_url begin with /" do
+      before do
+        sorcery_controller_external_property_set(:facebook, :callback_url, "/oauth/twitter/callback")
+      end
+      it "login_at redirects correctly" do
+        create_new_user
+        get :login_at_test_facebook
+        expect(response).to be_a_redirect
+        expect(response).to redirect_to("https://graph.facebook.com/oauth/authorize?client_id=#{::Sorcery::Controller::Config.facebook.key}&display=page&redirect_uri=http%3A%2F%2Ftest.host%2Foauth%2Ftwitter%2Fcallback&response_type=code&scope=email%2Coffline_access&state=")
+      end
+      it "logins with state" do
+        create_new_user
+        get :login_at_test_with_state
+        expect(response).to be_a_redirect
+        expect(response).to redirect_to("https://graph.facebook.com/oauth/authorize?client_id=#{::Sorcery::Controller::Config.facebook.key}&display=page&redirect_uri=http%3A%2F%2Ftest.host%2Foauth%2Ftwitter%2Fcallback&response_type=code&scope=email%2Coffline_access&state=bla")
+      end
+      after do
+        sorcery_controller_external_property_set(:facebook, :callback_url, "http://blabla.com")
+      end
+    end
+
+    #this test can never pass because of the previous test (the callback url can't change anymore)
+=begin
+    context "when callback_url begin with http://" do
+      it "login_at redirects correctly" do
+        create_new_user
+        get :login_at_test2
+        response.should be_a_redirect
+        response.should redirect_to("https://graph.facebook.com/oauth/authorize?response_type=code&client_id=#{::Sorcery::Controller::Config.facebook.key}&redirect_uri=http%3A%2F%2Fblabla.com&scope=email%2Coffline_access&display=page&state")
+      end
+    end
+=end
+    it "'login_from' logins if user exists" do
+      # dirty hack for rails 4
+      allow(subject).to receive(:register_last_activity_time_to_db)
+
+      sorcery_model_property_set(:authentications_class, Authentication)
+      create_new_external_user(:facebook)
+      get :test_login_from_facebook
+
+      expect(flash[:notice]).to eq "Success!"
+    end
+
+    it "'login_from' fails if user doesn't exist" do
+      sorcery_model_property_set(:authentications_class, Authentication)
+      create_new_user
+      get :test_login_from_facebook
+
+      expect(flash[:alert]).to eq "Failed!"
+    end
+
+    it "on successful login_from the user is redirected to the url he originally wanted" do
+      # dirty hack for rails 4
+      allow(subject).to receive(:register_last_activity_time_to_db)
+
+      sorcery_model_property_set(:authentications_class, Authentication)
+      create_new_external_user(:facebook)
+      get :test_return_to_with_external_facebook, {}, :return_to_url => "fuu"
+
+      expect(response).to redirect_to("fuu")
+      expect(flash[:notice]).to eq "Success!"
+    end
+
+    [:github, :google, :liveid].each do |provider|
+
+      describe "with #{provider}" do
+
+        it "login_at redirects correctly" do
+          create_new_user
+          get :"login_at_test_#{provider}"
+
+          expect(response).to be_a_redirect
+          expect(response).to redirect_to(provider_url provider)
+        end
+
+        it "'login_from' logins if user exists" do
+          # dirty hack for rails 4
+          allow(subject).to receive(:register_last_activity_time_to_db)
+
+          sorcery_model_property_set(:authentications_class, Authentication)
+          create_new_external_user(provider)
+          get :"test_login_from_#{provider}"
+
+          expect(flash[:notice]).to eq "Success!"
+        end
+
+        it "'login_from' fails if user doesn't exist" do
+          sorcery_model_property_set(:authentications_class, Authentication)
+          create_new_user
+          get :"test_login_from_#{provider}"
+
+          expect(flash[:alert]).to eq "Failed!"
+        end
+
+        it "on successful login_from the user is redirected to the url he originally wanted (github)" do
+          # dirty hack for rails 4
+          allow(subject).to receive(:register_last_activity_time_to_db)
+
+          sorcery_model_property_set(:authentications_class, Authentication)
+          create_new_external_user(provider)
+          get :"test_return_to_with_external_#{provider}", {}, :return_to_url => "fuu"
+
+          expect(response).to redirect_to "fuu"
+          expect(flash[:notice]).to eq "Success!"
+        end
+      end
+    end
+
+  end
+
+  describe "OAuth with User Activation features" do
+    before(:all) do
+      ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/activation")
+      sorcery_reload!([:user_activation,:external], :user_activation_mailer => ::SorceryMailer)
+      sorcery_controller_property_set(:external_providers, [:facebook, :github, :google, :liveid])
+      sorcery_controller_external_property_set(:facebook, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:facebook, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:facebook, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:github, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:github, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:github, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:google, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:google, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:google, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:liveid, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:liveid, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:liveid, :callback_url, "http://blabla.com")
+
+    end
+
+    after(:all) do
+      ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activation")
+    end
+
+    after(:each) do
+      User.delete_all
+    end
+
+    it "does not send activation email to external users" do
+      old_size = ActionMailer::Base.deliveries.size
+      create_new_external_user(:facebook)
+
+      expect(ActionMailer::Base.deliveries.size).to eq old_size
+    end
+
+    it "does not send external users an activation success email" do
+      sorcery_model_property_set(:activation_success_email_method_name, nil)
+      create_new_external_user(:facebook)
+      old_size = ActionMailer::Base.deliveries.size
+      @user.activate!
+
+      expect(ActionMailer::Base.deliveries.size).to eq old_size
+    end
+
+  # provider: github
+    [:github, :google, :liveid].each do |provider|
+      it "does not send activation email to external users (github)" do
+        old_size = ActionMailer::Base.deliveries.size
+        create_new_external_user provider
+        expect(ActionMailer::Base.deliveries.size).to eq old_size
+      end
+
+      it "does not send external users an activation success email (github)" do
+        sorcery_model_property_set(:activation_success_email_method_name, nil)
+        create_new_external_user provider
+        old_size = ActionMailer::Base.deliveries.size
+        @user.activate!
+
+        expect(ActionMailer::Base.deliveries.size).to eq old_size
+      end
+    end
+  end
+
+  describe "OAuth with user activation features"  do
+    before(:all) do
+      ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
+      ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/activity_logging")
+      User.reset_column_information
+      sorcery_reload!([:activity_logging, :external])
+    end
+
+    after(:all) do
+      ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/external")
+      ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activity_logging")
+    end
+
+    %w(facebook github google liveid).each do |provider|
+      context "when #{provider}" do
+        before(:each) do
+          User.delete_all
+          Authentication.delete_all
+          sorcery_controller_property_set(:register_login_time, true)
+          stub_all_oauth2_requests!
+          sorcery_model_property_set(:authentications_class, Authentication)
+          create_new_external_user(provider.to_sym)
+        end
+
+        it "registers login time" do
+          now = Time.now.in_time_zone
+          get "test_login_from_#{provider}".to_sym
+
+          expect(User.last.last_login_at).not_to be_nil
+          expect(User.last.last_login_at.to_s(:db)).to be >= now.to_s(:db)
+          expect(User.last.last_login_at.to_s(:db)).to be <= (now+2).to_s(:db)
+        end
+
+        it "does not register login time if configured so" do
+          sorcery_controller_property_set(:register_login_time, false)
+          now = Time.now.in_time_zone
+          get "test_login_from_#{provider}".to_sym
+
+          expect(User.last.last_login_at).to be_nil
+        end
+      end
+    end
+  end
+
+  describe "OAuth with session timeout features" do
+    before(:all) do
+      ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
+      User.reset_column_information
+      sorcery_reload!([:session_timeout, :external])
+    end
+
+    after(:all) do
+      ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/external")
+    end
+
+    %w(facebook github google liveid).each do |provider|
+      context "when #{provider}" do
+        before(:each) do
+          User.delete_all
+          Authentication.delete_all
+          sorcery_model_property_set(:authentications_class, Authentication)
+          sorcery_controller_property_set(:session_timeout,0.5)
+          stub_all_oauth2_requests!
+          create_new_external_user(provider.to_sym)
+        end
+
+        after(:each) do
+          Timecop.return
+        end
+
+        it "does not reset session before session timeout" do
+          get "test_login_from_#{provider}".to_sym
+
+          expect(session[:user_id]).not_to be_nil
+          expect(flash[:notice]).to eq "Success!"
+        end
+
+        it "resets session after session timeout" do
+          get "test_login_from_#{provider}".to_sym
+          Timecop.travel(Time.now.in_time_zone+0.6)
+          get :test_should_be_logged_in
+
+          expect(session[:user_id]).to be_nil
+          expect(response).to be_a_redirect
+        end
+      end
+    end
+  end
+
+  def stub_all_oauth2_requests!
+    access_token    = double(OAuth2::AccessToken)
+    allow(access_token).to receive(:token_param=)
+    response        = double(OAuth2::Response)
+    allow(response).to receive(:body) { {
+      "id"=>"123",
+      "name"=>"Noam Ben Ari",
+      "first_name"=>"Noam",
+      "last_name"=>"Ben Ari",
+      "link"=>"http://www.facebook.com/nbenari1",
+      "hometown"=>{"id"=>"110619208966868", "name"=>"Haifa, Israel"},
+      "location"=>{"id"=>"106906559341067", "name"=>"Pardes Hanah, Hefa, Israel"},
+      "bio"=>"I'm a new daddy, and enjoying it!",
+      "gender"=>"male",
+      "email"=>"nbenari@gmail.com",
+      "timezone"=>2,
+      "locale"=>"en_US",
+      "languages"=>[{"id"=>"108405449189952", "name"=>"Hebrew"}, {"id"=>"106059522759137", "name"=>"English"}, {"id"=>"112624162082677", "name"=>"Russian"}],
+      "verified"=>true,
+      "updated_time"=>"2011-02-16T20:59:38+0000"}.to_json }
+    allow(access_token).to receive(:get) { response }
+    allow_any_instance_of(OAuth2::Strategy::AuthCode).to receive(:get_token) { access_token }
+  end
+
+  def set_external_property
+    sorcery_controller_property_set(:external_providers, [:facebook, :github, :google, :liveid])
+    sorcery_controller_external_property_set(:facebook, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:facebook, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:facebook, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:github, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:github, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:github, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:google, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:google, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:google, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:liveid, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:liveid, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:liveid, :callback_url, "http://blabla.com")
+  end
+
+  def provider_url(provider)
+    {
+      github: "https://github.com/login/oauth/authorize?client_id=#{::Sorcery::Controller::Config.github.key}&display=&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=&state=",
+      google: "https://accounts.google.com/o/oauth2/auth?client_id=#{::Sorcery::Controller::Config.google.key}&display=&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.email+https%3A%2F%2Fwww.googleapis.com%2Fauth%2Fuserinfo.profile&state=",
+      liveid: "https://oauth.live.com/authorize?client_id=#{::Sorcery::Controller::Config.liveid.key}&display=&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=wl.basic+wl.emails+wl.offline_access&state="
+    }[provider]
+  end
+
+end