sorcery 0.8.6 → 0.9.0

data/spec/shared_examples/user_brute_force_protection_shared_examples.rb

@@ -1,38 +1,156 @@
 shared_examples_for "rails_3_brute_force_protection_model" do
+  let(:user) { create_new_user }
+  before(:each) do
+    User.sorcery_adapter.delete_all
+  end
+
+
   context "loaded plugin configuration" do
 
     let(:config) { User.sorcery_config }
-    let(:user) { create_new_user }
-  
+
     before(:all) do
       sorcery_reload!([:brute_force_protection])
     end
-  
+
     after(:each) do
       User.sorcery_config.reset!
     end
-    
+
     specify { expect(user).to respond_to(:failed_logins_count) }
     specify { expect(user).to respond_to(:lock_expires_at) }
- 
+
     it "enables configuration option 'failed_logins_count_attribute_name'" do
       sorcery_model_property_set(:failed_logins_count_attribute_name, :my_count)
       expect(config.failed_logins_count_attribute_name).to eq :my_count
     end
-    
+
     it "enables configuration option 'lock_expires_at_attribute_name'" do
       sorcery_model_property_set(:lock_expires_at_attribute_name, :expires)
       expect(config.lock_expires_at_attribute_name).to eq :expires
     end
-    
+
     it "enables configuration option 'consecutive_login_retries_amount_allowed'" do
       sorcery_model_property_set(:consecutive_login_retries_amount_limit, 34)
       expect(config.consecutive_login_retries_amount_limit).to eq 34
     end
-    
+
     it "enables configuration option 'login_lock_time_period'" do
       sorcery_model_property_set(:login_lock_time_period, 2.hours)
       expect(config.login_lock_time_period).to eq 2.hours
     end
+
+    describe "#locked?" do
+      it "is locked" do
+        user.send("#{config.lock_expires_at_attribute_name}=", Time.now + 5.days)
+        expect(user).to be_locked
+      end
+
+      it "isn't locked" do
+        user.send("#{config.lock_expires_at_attribute_name}=", nil)
+        expect(user).not_to be_locked
+      end
+    end
+  end
+
+  describe "#register_failed_login!" do
+    it "locks user when number of retries reached the limit" do
+      expect(user.lock_expires_at).to be_nil
+
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 1)
+      user.register_failed_login!
+      lock_expires_at = User.sorcery_adapter.find_by_id(user.id).lock_expires_at
+
+      expect(lock_expires_at).not_to be_nil
+    end
+
+    context "unlock_token_mailer_disabled is true" do
+      it "does not automatically send unlock email" do
+        sorcery_model_property_set(:unlock_token_mailer_disabled, true)
+        sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+        sorcery_model_property_set(:login_lock_time_period, 0)
+        sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+
+        3.times { user.register_failed_login! }
+
+        expect(ActionMailer::Base.deliveries.size).to eq 0
+
+      end
+    end
+
+    context "unlock_token_mailer_disabled is false" do
+      before do
+        sorcery_model_property_set(:unlock_token_mailer_disabled, false)
+        sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+        sorcery_model_property_set(:login_lock_time_period, 0)
+        sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      end
+
+      it "does not automatically send unlock email" do
+        3.times { user.register_failed_login! }
+
+        expect(ActionMailer::Base.deliveries.size).to eq 1
+      end
+
+      it "generates unlock token before mail is sent" do
+        3.times { user.register_failed_login! }
+
+        expect(ActionMailer::Base.deliveries.last.body.to_s.match(user.unlock_token)).not_to be_nil
+      end
+    end
+  end
+
+  context ".authenticate" do
+
+    it "unlocks after lock time period passes" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0.2)
+      2.times { user.register_failed_login! }
+
+      lock_expires_at = User.sorcery_adapter.find_by_id(user.id).lock_expires_at
+      expect(lock_expires_at).not_to be_nil
+
+      Timecop.travel(Time.now.in_time_zone + 0.3)
+      User.authenticate('bla@bla.com', 'secret')
+
+      lock_expires_at = User.sorcery_adapter.find_by_id(user.id).lock_expires_at
+      expect(lock_expires_at).to be_nil
+      Timecop.return
+    end
+
+    it "doest not unlock if time period is 0 (permanent lock)" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+
+      2.times { user.register_failed_login! }
+
+      unlock_date = user.lock_expires_at
+      Timecop.travel(Time.now.in_time_zone + 1)
+
+      user.register_failed_login!
+
+      expect(user.lock_expires_at.to_s).to eq unlock_date.to_s
+      Timecop.return
+    end
+
+  end
+
+  describe "#unlock!" do
+    it "unlocks after entering unlock token" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times { user.register_failed_login! }
+
+      expect(user.unlock_token).not_to be_nil
+
+      token = user.unlock_token
+      user = User.load_from_unlock_token(token)
+
+      expect(user).not_to be_nil
+
+      user.unlock!
+      expect(User.load_from_unlock_token(user.unlock_token)).to be_nil
+    end
   end
-end
+end

data/spec/shared_examples/user_oauth_shared_examples.rb

@@ -6,12 +6,9 @@ shared_examples_for "rails_3_oauth_model" do
   describe "loaded plugin configuration" do
 
     before(:all) do
-      if defined?(DataMapper) && User.ancestors.include?(DataMapper::Resource)
-        Authentication.all.destroy
-      else
-        Authentication.delete_all
-      end
-      User.delete_all
+      Authentication.sorcery_adapter.delete_all
+      User.sorcery_adapter.delete_all
+
       sorcery_reload!([:external])
       sorcery_controller_property_set(:external_providers, [:twitter])
       sorcery_model_property_set(:authentications_class, Authentication)

data/spec/shared_examples/user_remember_me_shared_examples.rb

@@ -35,12 +35,15 @@ shared_examples_for "rails_3_remember_me_model" do
       expect(user.remember_me_token).not_to be_nil
     end
     
-    # FIXME: assert on line 37 sometimes fails by a second
     it "sets an expiration based on 'remember_me_for' attribute" do
       sorcery_model_property_set(:remember_me_for, 2 * 60 * 60 * 24)
-      user.remember_me!
 
-      expect(user.remember_me_token_expires_at.utc.to_s).to eq (Time.now.in_time_zone + 2 * 60 * 60 * 24).utc.to_s
+      ts = Time.now.in_time_zone
+      Timecop.freeze(ts) do
+        user.remember_me!
+      end
+
+      expect(user.remember_me_token_expires_at.utc.to_s).to eq (ts + 2 * 60 * 60 * 24).utc.to_s
     end
     
     it "deletes the token and expiration on 'forget_me!'" do

data/spec/shared_examples/user_reset_password_shared_examples.rb

@@ -82,7 +82,7 @@ shared_examples_for "rails_3_reset_password_model" do
     end
 
     before(:each) do
-      User.delete_all
+      User.sorcery_adapter.delete_all
       user
     end
 
@@ -91,29 +91,29 @@ shared_examples_for "rails_3_reset_password_model" do
     end
 
     it "load_from_reset_password_token returns user when token is found" do
-      user.deliver_reset_password_instructions!
-      updated_user  = defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource) ? User.find(user.id) : user
+      user.generate_reset_password_token!
+      updated_user  = User.sorcery_adapter.find(user.id)
 
       expect(User.load_from_reset_password_token user.reset_password_token).to eq updated_user
     end
 
     it "load_from_reset_password_token does NOT return user when token is NOT found" do
-      user.deliver_reset_password_instructions!
+      user.generate_reset_password_token!
 
       expect(User.load_from_reset_password_token "a").to be_nil
     end
 
     it "load_from_reset_password_token returns user when token is found and not expired" do
       sorcery_model_property_set(:reset_password_expiration_period, 500)
-      user.deliver_reset_password_instructions!
-      updated_user  = defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource) ? User.find(user.id) : user
+      user.generate_reset_password_token!
+      updated_user  = User.sorcery_adapter.find(user.id)
 
       expect(User.load_from_reset_password_token user.reset_password_token).to eq updated_user
     end
 
     it "load_from_reset_password_token does NOT return user when token is found and expired" do
       sorcery_model_property_set(:reset_password_expiration_period, 0.1)
-      user.deliver_reset_password_instructions!
+      user.generate_reset_password_token!
       Timecop.travel(Time.now.in_time_zone+0.5)
 
       expect(User.load_from_reset_password_token user.reset_password_token).to be_nil
@@ -121,8 +121,8 @@ shared_examples_for "rails_3_reset_password_model" do
 
     it "load_from_reset_password_token is always valid if expiration period is nil" do
       sorcery_model_property_set(:reset_password_expiration_period, nil)
-      user.deliver_reset_password_instructions!
-      updated_user  = defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource) ? User.find(user.id) : user
+      user.generate_reset_password_token!
+      updated_user  = User.sorcery_adapter.find(user.id)
 
       expect(User.load_from_reset_password_token user.reset_password_token).to eq updated_user
     end
@@ -156,7 +156,7 @@ shared_examples_for "rails_3_reset_password_model" do
 
         expect(ActionMailer::Base.deliveries.size).to eq old_size + 1
       end
-      
+
       it "calls send_reset_password_email! on reset" do
         expect(user).to receive(:send_reset_password_email!).once
 

data/spec/shared_examples/user_shared_examples.rb

@@ -69,12 +69,16 @@ shared_examples_for "rails_3_core_model" do
 
       expect(User.sorcery_config.stretches).to eq stretches
     end
+
+    it 'respond to username=' do
+      expect(User.new).to respond_to(:username=)
+    end
   end
 
   describe "when activated with sorcery" do
     before(:all) { sorcery_reload! }
-    before(:each) { User.delete_all }
-    
+    before(:each) { User.sorcery_adapter.delete_all }
+
     it "does not add authenticate method to base class", active_record: true do
       expect(ActiveRecord::Base).not_to respond_to(:authenticate) if defined?(ActiveRecord)
     end
@@ -131,7 +135,7 @@ shared_examples_for "rails_3_core_model" do
   describe "registration" do
 
     before(:all) { sorcery_reload! }
-    before(:each) { User.delete_all }
+    before(:each) { User.sorcery_adapter.delete_all }
 
     it "by default, encryption_provider is not nil" do
       expect(User.sorcery_config.encryption_provider).not_to be_nil
@@ -161,13 +165,10 @@ shared_examples_for "rails_3_core_model" do
       user.password = '4blupush'
       user.username = nil
 
-      User.class_eval { validates_presence_of :username }
+      expect(user).to receive(:save) { raise RuntimeError }
+
       begin
-        if defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource)
-          user.save
-        else
-          user.save! # triggers validation exception since username field is required.
-        end
+        user.save
       rescue
       end
 
@@ -176,32 +177,21 @@ shared_examples_for "rails_3_core_model" do
 
     it "does not encrypt the password twice when a user is updated" do
       user.email = "blup@bla.com"
-      if defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource)
-        user.save
-      else
-        user.save!
-      end
+      user.save
 
       expect(User.sorcery_config.encryption_provider.matches? crypted_password, 'secret', user.salt).to be true
     end
 
     it "replaces the crypted_password in case a new password is set" do
       user.password = 'new_secret'
-      if defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource)
-        user.save
-      else
-        user.save!
-      end
+      user.save
 
       expect(User.sorcery_config.encryption_provider.matches? crypted_password, 'secret', user.salt).to be false
     end
 
     describe "when user has password_confirmation_defined" do
       before(:all) do
-        User.class_eval { attr_accessor :password_confirmation }
-        if defined?(DataMapper)
-          DataMapper.finalize
-        end
+        update_model { attr_accessor :password_confirmation }
       end
 
       after(:all) do
@@ -227,6 +217,21 @@ shared_examples_for "rails_3_core_model" do
     end
   end
 
+  describe "password validation" do
+
+    let(:user_with_pass) { create_new_user({:username => 'foo_bar', :email => "foo@bar.com", :password => 'foobar'})}
+
+    specify { expect(user_with_pass).to respond_to :valid_password? }
+    
+    it "returns true if password is correct" do
+      expect(user_with_pass.valid_password?("foobar")).to be true
+    end
+  
+    it "returns false if password is incorrect" do
+      expect(user_with_pass.valid_password?("foobug")).to be false
+    end
+  end
+
   describe "special encryption cases" do
     before(:all) do
       sorcery_reload!()
@@ -234,7 +239,7 @@ shared_examples_for "rails_3_core_model" do
     end
 
     before(:each) do
-      User.delete_all
+      User.sorcery_adapter.delete_all
     end
 
     after(:each) do
@@ -344,13 +349,13 @@ shared_examples_for "rails_3_core_model" do
   describe "ORM adapter" do
     before(:all) do
       sorcery_reload!()
-      User.delete_all
+      User.sorcery_adapter.delete_all
     end
 
     before(:each) { user }
 
     after(:each) do
-      User.delete_all
+      User.sorcery_adapter.delete_all
       User.sorcery_config.reset!
     end
 
@@ -358,17 +363,17 @@ shared_examples_for "rails_3_core_model" do
     it "find_by_username works as expected" do
       sorcery_model_property_set(:username_attribute_names, [:username])
 
-      expect(User.find_by_username "gizmo").to eq user
+      expect(User.sorcery_adapter.find_by_username "gizmo").to eq user
     end
 
     it "find_by_username works as expected with multiple username attributes" do
       sorcery_model_property_set(:username_attribute_names, [:username, :email])
 
-      expect(User.find_by_username "gizmo").to eq user
+      expect(User.sorcery_adapter.find_by_username "gizmo").to eq user
     end
 
     it "find_by_email works as expected" do
-      expect(User.find_by_email "bla@bla.com").to eq user
+      expect(User.sorcery_adapter.find_by_email "bla@bla.com").to eq user
     end
   end
 end
@@ -378,7 +383,7 @@ shared_examples_for "external_user" do
   let(:external_user) { create_new_external_user :twitter }
 
   before(:each) do
-    User.delete_all
+    User.sorcery_adapter.delete_all
   end
 
   it "responds to 'external?'" do
@@ -392,4 +397,86 @@ shared_examples_for "external_user" do
   it "external? is true for external users" do
     expect(external_user.external?).to be true
   end
+
+  describe ".create_from_provider" do
+
+    before(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
+        User.reset_column_information
+      end
+
+      sorcery_reload!([:external])
+    end
+
+    after(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/external")
+      end
+    end
+
+    it 'supports nested attributes' do
+      sorcery_model_property_set(:authentications_class, Authentication)
+
+      expect { User.create_from_provider('facebook', '123', {username: 'Noam Ben Ari'}) }.to change { User.count }.by(1)
+      expect(User.first.username).to eq 'Noam Ben Ari'
+    end
+
+    context 'with block' do
+      it 'create user when block return true' do
+        expect {
+          User.create_from_provider('facebook', '123', {username: 'Noam Ben Ari'}) { true }
+        }.to change { User.count }.by(1)
+      end
+
+      it 'does not create user when block return false' do
+        expect {
+          User.create_from_provider('facebook', '123', {username: 'Noam Ben Ari'}) { false }
+        }.not_to change { User.count }
+      end
+    end
+
+  end
+
+  describe 'activation' do
+    before(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
+        ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/activation")
+      end
+
+      sorcery_reload!([:user_activation,:external], :user_activation_mailer => ::SorceryMailer)
+    end
+
+    after(:all) do
+      if SORCERY_ORM == :active_record
+        ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activation")
+        ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/external")
+      end
+    end
+
+    after(:each) do
+      User.sorcery_adapter.delete_all
+    end
+
+    [:facebook, :github, :google, :liveid].each do |provider|
+
+      it "does not send activation email to external users" do
+        old_size = ActionMailer::Base.deliveries.size
+        create_new_external_user(provider)
+
+        expect(ActionMailer::Base.deliveries.size).to eq old_size
+      end
+
+      it "does not send external users an activation success email" do
+        sorcery_model_property_set(:activation_success_email_method_name, nil)
+        create_new_external_user(provider)
+        old_size = ActionMailer::Base.deliveries.size
+        @user.activate!
+
+        expect(ActionMailer::Base.deliveries.size).to eq old_size
+      end
+    end
+
+  end
 end