sorcery 0.8.6 → 0.9.1

data/spec/{datamapper → data_mapper}/user_spec.rb

@@ -3,7 +3,7 @@ require 'spec_helper'
 require 'rails_app/app/mailers/sorcery_mailer'
 require 'shared_examples/user_shared_examples'
 
-describe User, "with no submodules (core)", :datamapper => true do
+describe User, "with no submodules (core)", :data_mapper => true do
   before(:all) do
     sorcery_reload!
   end

data/spec/mongoid/user_spec.rb

@@ -35,4 +35,17 @@ describe User, "with no submodules (core)", :mongoid => true do
     end
   end
 
+  describe "increment" do
+    it "increments attribute" do
+      User.class_eval do
+        field :some_number, type: Integer
+      end
+
+      user = User.new(some_number: 3)
+      user.sorcery_adapter.increment(:some_number)
+
+      expect(user.some_number).to eql 4
+    end
+  end
+
 end

data/spec/orm/active_record.rb

@@ -7,3 +7,15 @@ ActiveRecord::Migration.verbose = false
 class TestUser < ActiveRecord::Base
   authenticates_with_sorcery!
 end
+
+def setup_orm
+  ActiveRecord::Migrator.migrate(migrations_path)
+end
+
+def teardown_orm
+  ActiveRecord::Migrator.rollback(migrations_path)
+end
+
+def migrations_path
+  Rails.root.join("db", "migrate", "core")
+end

data/spec/orm/{datamapper.rb → data_mapper.rb}

@@ -30,5 +30,19 @@ class TestUser
   property :id, Serial
   authenticates_with_sorcery!
 end
-TestUser.finalize
-DataMapper.auto_migrate!
+
+def setup_orm
+  TestUser.finalize
+  DataMapper.auto_migrate!
+end
+
+module Sorcery
+  module TestHelpers
+    module Internal
+      def update_model(&block)
+        User.class_exec(&block)
+        User.finalize
+      end
+    end
+  end
+end

data/spec/orm/mongo_mapper.rb

@@ -8,4 +8,3 @@ class TestUser
   include MongoMapper::Document
   authenticates_with_sorcery!
 end
-

data/spec/orm/mongoid.rb

@@ -16,3 +16,7 @@ end
 class TestUser
   include Mongoid::Document
 end
+
+def setup_orm
+  Mongoid.purge!
+end

data/spec/rails_app/app/controllers/sorcery_controller.rb

@@ -98,6 +98,18 @@ class SorceryController < ActionController::Base
     login_at(:liveid)
   end
 
+  def login_at_test_jira
+    login_at(:jira)
+  end
+
+  def login_at_test_vk
+    login_at(:vk)
+  end
+
+  def login_at_test_salesforce
+    login_at(:salesforce)
+  end
+
   def login_at_test_with_state
     login_at(:facebook, {state: 'bla'})
   end
@@ -144,6 +156,30 @@ class SorceryController < ActionController::Base
     end
   end
 
+  def test_login_from_vk
+    if @user = login_from(:vk)
+      redirect_to 'bla', notice: 'Success!'
+    else
+      redirect_to 'blu', alert: 'Failed!'
+    end
+  end
+
+  def test_login_from_jira
+    if @user = login_from(:jira)
+      redirect_to 'bla', notice: 'Success!'
+    else
+      redirect_to 'blu', alert: 'Failed!'
+    end
+  end
+
+  def test_login_from_salesforce
+    if @user = login_from(:salesforce)
+      redirect_to 'bla', notice: 'Success!'
+    else
+      redirect_to 'blu', alert: 'Failed!'
+    end
+  end
+
   def test_return_to_with_external_twitter
     if @user = login_from(:twitter)
       redirect_back_or_to 'bla', notice: 'Success!'
@@ -152,6 +188,14 @@ class SorceryController < ActionController::Base
     end
   end
 
+  def test_return_to_with_external_jira
+    if @user = login_from(:jira)
+      redirect_back_or_to 'bla', notice: 'Success!'
+    else
+      redirect_to 'blu', alert: 'Failed!'
+    end
+  end
+
   alias :test_return_to_with_external :test_return_to_with_external_twitter
 
   def test_return_to_with_external_facebook
@@ -186,6 +230,22 @@ class SorceryController < ActionController::Base
     end
   end
 
+  def test_return_to_with_external_vk
+    if @user = login_from(:vk)
+      redirect_back_or_to 'bla', notice: 'Success!'
+    else
+      redirect_to 'blu', alert: 'Failed!'
+    end
+  end
+
+  def test_return_to_with_external_salesforce
+    if @user = login_from(:salesforce)
+      redirect_back_or_to 'bla', notice: 'Success!'
+    else
+      redirect_to 'blu', alert: 'Failed!'
+    end
+  end
+
   def test_create_from_provider
     provider = params[:provider]
     login_from(provider)
@@ -212,7 +272,8 @@ class SorceryController < ActionController::Base
     login_from(provider)
     @user = create_from(provider) do |user|
       # check uniqueness of email
-      User.where(email: user.email).empty?
+      # User.where(email: user.email).empty?
+      false
     end
     if @user
       redirect_to 'bla', notice: 'Success!'

data/spec/rails_app/app/mongo_mapper/user.rb

@@ -1,5 +1,7 @@
 class User
   include MongoMapper::Document
 
+  key :username
+
   many :authentications, :dependent => :destroy
 end

data/spec/rails_app/config/routes.rb

@@ -21,18 +21,27 @@ AppRoot::Application.routes.draw do
     get :test_login_from_github
     get :test_login_from_google
     get :test_login_from_liveid
+    get :test_login_from_vk
+    get :test_login_from_jira
+    get :test_login_from_salesforce
     get :login_at_test
     get :login_at_test_twitter
     get :login_at_test_facebook
     get :login_at_test_github
     get :login_at_test_google
     get :login_at_test_liveid
+    get :login_at_test_vk
+    get :login_at_test_jira
+    get :login_at_test_salesforce
     get :test_return_to_with_external
     get :test_return_to_with_external_twitter
     get :test_return_to_with_external_facebook
     get :test_return_to_with_external_github
     get :test_return_to_with_external_google
     get :test_return_to_with_external_liveid
+    get :test_return_to_with_external_vk
+    get :test_return_to_with_external_jira
+    get :test_return_to_with_external_salesforce
     get :test_http_basic_auth
     get :some_action_making_a_non_persisted_change_to_the_user
     post :test_login_with_remember

data/spec/rails_app/db/migrate/core/20101224223620_create_users.rb

@@ -3,8 +3,8 @@ class CreateUsers < ActiveRecord::Migration
     create_table :users do |t|
       t.string :username,         :null => false
       t.string :email,            :default => nil
-      t.string :crypted_password, :default => nil
-      t.string :salt,             :default => nil
+      t.string :crypted_password
+      t.string :salt
 
       t.timestamps
     end

data/spec/shared_examples/user_activation_shared_examples.rb

@@ -72,11 +72,11 @@ shared_examples_for "rails_3_activation_model" do
     it "clears activation code and change state to 'active' on activation" do
       activation_token = user.activation_token
       user.activate!
-      user2 = User.find(user.id) # go to db to make sure it was saved and not just in memory
+      user2 = User.sorcery_adapter.find(user.id) # go to db to make sure it was saved and not just in memory
 
       expect(user2.activation_token).to be_nil
       expect(user2.activation_state).to eq "active"
-      expect(User.find_by_activation_token activation_token).to be_nil
+      expect(User.sorcery_adapter.find_by_activation_token activation_token).to be_nil
     end
 
 
@@ -91,14 +91,14 @@ shared_examples_for "rails_3_activation_model" do
       it "calls send_activation_needed_email! method of user" do
         expect(new_user).to receive(:send_activation_needed_email!).once
 
-        new_user.sorcery_save(:raise_on_failure => true)
+        new_user.sorcery_adapter.save(:raise_on_failure => true)
       end
 
       it "subsequent saves do not send activation email" do
         user
         old_size = ActionMailer::Base.deliveries.size
         user.email = "Shauli"
-        user.sorcery_save(:raise_on_failure => true)
+        user.sorcery_adapter.save(:raise_on_failure => true)
 
         expect(ActionMailer::Base.deliveries.size).to eq old_size
       end
@@ -121,7 +121,7 @@ shared_examples_for "rails_3_activation_model" do
         user.activate!
         old_size = ActionMailer::Base.deliveries.size
         user.email = "Shauli"
-        user.sorcery_save(:raise_on_failure => true)
+        user.sorcery_adapter.save(:raise_on_failure => true)
 
         expect(ActionMailer::Base.deliveries.size).to eq old_size
       end
@@ -158,7 +158,7 @@ shared_examples_for "rails_3_activation_model" do
 
         expect(user).to receive(:send_activation_needed_email!).never
 
-        user.sorcery_save(:raise_on_failure => true)
+        user.sorcery_adapter.save(:raise_on_failure => true)
       end
 
       it "does not send the user an activation success email on successful activation" do
@@ -182,7 +182,7 @@ shared_examples_for "rails_3_activation_model" do
     end
 
     before(:each) do
-      User.delete_all
+      User.sorcery_adapter.delete_all
     end
 
     it "does not allow a non-active user to authenticate" do

data/spec/shared_examples/user_activity_logging_shared_examples.rb

@@ -3,22 +3,22 @@ shared_examples_for "rails_3_activity_logging_model" do
     before(:all) do
       sorcery_reload!([:activity_logging])
     end
-  
+
     after(:each) do
       User.sorcery_config.reset!
     end
-    
+
     it "allows configuration option 'last_login_at_attribute_name'" do
       sorcery_model_property_set(:last_login_at_attribute_name, :login_time)
 
       expect(User.sorcery_config.last_login_at_attribute_name).to eq :login_time
     end
-    
+
     it "allows configuration option 'last_logout_at_attribute_name'" do
       sorcery_model_property_set(:last_logout_at_attribute_name, :logout_time)
       expect(User.sorcery_config.last_logout_at_attribute_name).to eq :logout_time
     end
-    
+
     it "allows configuration option 'last_activity_at_attribute_name'" do
       sorcery_model_property_set(:last_activity_at_attribute_name, :activity_time)
       expect(User.sorcery_config.last_activity_at_attribute_name).to eq :activity_time
@@ -28,5 +28,73 @@ shared_examples_for "rails_3_activity_logging_model" do
       sorcery_model_property_set(:last_login_from_ip_address_name, :ip_address)
       expect(User.sorcery_config.last_login_from_ip_address_name).to eq :ip_address
     end
+
+    describe ".current_users" do
+      let(:user) { create_new_user }
+
+      it "is empty when no users are logged in" do
+        skip('unavailable in MongoMapper') if SORCERY_ORM == :mongo_mapper
+        expect(User.current_users).to be_empty
+      end
+
+      it "holds the user object when 1 user is logged in" do
+        skip('unavailable in MongoMapper') if SORCERY_ORM == :mongo_mapper
+        user.set_last_activity_at(Time.now.in_time_zone)
+
+        expect(User.current_users).to match([User.sorcery_adapter.find(user.id)])
+      end
+
+      it "'current_users' shows all current_users, whether they have logged out before or not." do
+        skip('unavailable in MongoMapper') if SORCERY_ORM == :mongo_mapper
+        User.sorcery_adapter.delete_all
+        user1 = create_new_user({:username => 'gizmo1', :email => "bla1@bla.com", :password => 'secret1'})
+        user2 = create_new_user({:username => 'gizmo2', :email => "bla2@bla.com", :password => 'secret2'})
+        user3 = create_new_user({:username => 'gizmo3', :email => "bla3@bla.com", :password => 'secret3'})
+
+        now = Time.now.in_time_zone
+        [user1, user2, user3].each do |user|
+          user.set_last_login_at(now)
+          user.set_last_activity_at(now)
+        end
+
+        expect(User.current_users.map(&:id)).to match_array([user1, user2, user3].map(&:id))
+        Timecop.travel now + 5
+        user1.set_last_logout_at(Time.now.in_time_zone)
+        expect(User.current_users.map(&:id)).to match_array([user2, user3].map(&:id))
+        Timecop.return
+      end
+
+    end
+
+    it '.set_last_login_at update last_login_at' do
+      user = create_new_user
+      now = Time.now.in_time_zone
+      expect(user.sorcery_adapter).to receive(:update_attribute).with(:last_login_at, now)
+
+      user.set_last_login_at(now)
+    end
+
+    it '.set_last_logout_at update last_logout_at' do
+      user = create_new_user
+      now = Time.now.in_time_zone
+      expect(user.sorcery_adapter).to receive(:update_attribute).with(:last_logout_at, now)
+
+      user.set_last_logout_at(now)
+    end
+
+    it '.set_last_activity_at update last_activity_at' do
+      user = create_new_user
+      now = Time.now.in_time_zone
+      expect(user.sorcery_adapter).to receive(:update_attribute).with(:last_activity_at, now)
+
+      user.set_last_activity_at(now)
+    end
+
+    it '.set_last_ip_addess update last_login_from_ip_address' do
+      user = create_new_user
+      expect(user.sorcery_adapter).to receive(:update_attribute).with(:last_login_from_ip_address, '0.0.0.0')
+
+      user.set_last_ip_addess('0.0.0.0')
+    end
   end
-end
+end

data/spec/shared_examples/user_brute_force_protection_shared_examples.rb

@@ -1,38 +1,156 @@
 shared_examples_for "rails_3_brute_force_protection_model" do
+  let(:user) { create_new_user }
+  before(:each) do
+    User.sorcery_adapter.delete_all
+  end
+
+
   context "loaded plugin configuration" do
 
     let(:config) { User.sorcery_config }
-    let(:user) { create_new_user }
-  
+
     before(:all) do
       sorcery_reload!([:brute_force_protection])
     end
-  
+
     after(:each) do
       User.sorcery_config.reset!
     end
-    
+
     specify { expect(user).to respond_to(:failed_logins_count) }
     specify { expect(user).to respond_to(:lock_expires_at) }
- 
+
     it "enables configuration option 'failed_logins_count_attribute_name'" do
       sorcery_model_property_set(:failed_logins_count_attribute_name, :my_count)
       expect(config.failed_logins_count_attribute_name).to eq :my_count
     end
-    
+
     it "enables configuration option 'lock_expires_at_attribute_name'" do
       sorcery_model_property_set(:lock_expires_at_attribute_name, :expires)
       expect(config.lock_expires_at_attribute_name).to eq :expires
     end
-    
+
     it "enables configuration option 'consecutive_login_retries_amount_allowed'" do
       sorcery_model_property_set(:consecutive_login_retries_amount_limit, 34)
       expect(config.consecutive_login_retries_amount_limit).to eq 34
     end
-    
+
     it "enables configuration option 'login_lock_time_period'" do
       sorcery_model_property_set(:login_lock_time_period, 2.hours)
       expect(config.login_lock_time_period).to eq 2.hours
     end
+
+    describe "#locked?" do
+      it "is locked" do
+        user.send("#{config.lock_expires_at_attribute_name}=", Time.now + 5.days)
+        expect(user).to be_locked
+      end
+
+      it "isn't locked" do
+        user.send("#{config.lock_expires_at_attribute_name}=", nil)
+        expect(user).not_to be_locked
+      end
+    end
+  end
+
+  describe "#register_failed_login!" do
+    it "locks user when number of retries reached the limit" do
+      expect(user.lock_expires_at).to be_nil
+
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 1)
+      user.register_failed_login!
+      lock_expires_at = User.sorcery_adapter.find_by_id(user.id).lock_expires_at
+
+      expect(lock_expires_at).not_to be_nil
+    end
+
+    context "unlock_token_mailer_disabled is true" do
+      it "does not automatically send unlock email" do
+        sorcery_model_property_set(:unlock_token_mailer_disabled, true)
+        sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+        sorcery_model_property_set(:login_lock_time_period, 0)
+        sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+
+        3.times { user.register_failed_login! }
+
+        expect(ActionMailer::Base.deliveries.size).to eq 0
+
+      end
+    end
+
+    context "unlock_token_mailer_disabled is false" do
+      before do
+        sorcery_model_property_set(:unlock_token_mailer_disabled, false)
+        sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+        sorcery_model_property_set(:login_lock_time_period, 0)
+        sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      end
+
+      it "does not automatically send unlock email" do
+        3.times { user.register_failed_login! }
+
+        expect(ActionMailer::Base.deliveries.size).to eq 1
+      end
+
+      it "generates unlock token before mail is sent" do
+        3.times { user.register_failed_login! }
+
+        expect(ActionMailer::Base.deliveries.last.body.to_s.match(user.unlock_token)).not_to be_nil
+      end
+    end
+  end
+
+  context ".authenticate" do
+
+    it "unlocks after lock time period passes" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0.2)
+      2.times { user.register_failed_login! }
+
+      lock_expires_at = User.sorcery_adapter.find_by_id(user.id).lock_expires_at
+      expect(lock_expires_at).not_to be_nil
+
+      Timecop.travel(Time.now.in_time_zone + 0.3)
+      User.authenticate('bla@bla.com', 'secret')
+
+      lock_expires_at = User.sorcery_adapter.find_by_id(user.id).lock_expires_at
+      expect(lock_expires_at).to be_nil
+      Timecop.return
+    end
+
+    it "doest not unlock if time period is 0 (permanent lock)" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+
+      2.times { user.register_failed_login! }
+
+      unlock_date = user.lock_expires_at
+      Timecop.travel(Time.now.in_time_zone + 1)
+
+      user.register_failed_login!
+
+      expect(user.lock_expires_at.to_s).to eq unlock_date.to_s
+      Timecop.return
+    end
+
+  end
+
+  describe "#unlock!" do
+    it "unlocks after entering unlock token" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times { user.register_failed_login! }
+
+      expect(user.unlock_token).not_to be_nil
+
+      token = user.unlock_token
+      user = User.load_from_unlock_token(token)
+
+      expect(user).not_to be_nil
+
+      user.unlock!
+      expect(User.load_from_unlock_token(user.unlock_token)).to be_nil
+    end
   end
-end
+end

data/spec/shared_examples/user_oauth_shared_examples.rb

@@ -6,12 +6,9 @@ shared_examples_for "rails_3_oauth_model" do
   describe "loaded plugin configuration" do
 
     before(:all) do
-      if defined?(DataMapper) && User.ancestors.include?(DataMapper::Resource)
-        Authentication.all.destroy
-      else
-        Authentication.delete_all
-      end
-      User.delete_all
+      Authentication.sorcery_adapter.delete_all
+      User.sorcery_adapter.delete_all
+
       sorcery_reload!([:external])
       sorcery_controller_property_set(:external_providers, [:twitter])
       sorcery_model_property_set(:authentications_class, Authentication)

data/spec/shared_examples/user_remember_me_shared_examples.rb

@@ -35,12 +35,15 @@ shared_examples_for "rails_3_remember_me_model" do
       expect(user.remember_me_token).not_to be_nil
     end
     
-    # FIXME: assert on line 37 sometimes fails by a second
     it "sets an expiration based on 'remember_me_for' attribute" do
       sorcery_model_property_set(:remember_me_for, 2 * 60 * 60 * 24)
-      user.remember_me!
 
-      expect(user.remember_me_token_expires_at.utc.to_s).to eq (Time.now.in_time_zone + 2 * 60 * 60 * 24).utc.to_s
+      ts = Time.now.in_time_zone
+      Timecop.freeze(ts) do
+        user.remember_me!
+      end
+
+      expect(user.remember_me_token_expires_at.utc.to_s).to eq (ts + 2 * 60 * 60 * 24).utc.to_s
     end
     
     it "deletes the token and expiration on 'forget_me!'" do

data/spec/shared_examples/user_reset_password_shared_examples.rb

@@ -82,7 +82,7 @@ shared_examples_for "rails_3_reset_password_model" do
     end
 
     before(:each) do
-      User.delete_all
+      User.sorcery_adapter.delete_all
       user
     end
 
@@ -91,29 +91,29 @@ shared_examples_for "rails_3_reset_password_model" do
     end
 
     it "load_from_reset_password_token returns user when token is found" do
-      user.deliver_reset_password_instructions!
-      updated_user  = defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource) ? User.find(user.id) : user
+      user.generate_reset_password_token!
+      updated_user  = User.sorcery_adapter.find(user.id)
 
       expect(User.load_from_reset_password_token user.reset_password_token).to eq updated_user
     end
 
     it "load_from_reset_password_token does NOT return user when token is NOT found" do
-      user.deliver_reset_password_instructions!
+      user.generate_reset_password_token!
 
       expect(User.load_from_reset_password_token "a").to be_nil
     end
 
     it "load_from_reset_password_token returns user when token is found and not expired" do
       sorcery_model_property_set(:reset_password_expiration_period, 500)
-      user.deliver_reset_password_instructions!
-      updated_user  = defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource) ? User.find(user.id) : user
+      user.generate_reset_password_token!
+      updated_user  = User.sorcery_adapter.find(user.id)
 
       expect(User.load_from_reset_password_token user.reset_password_token).to eq updated_user
     end
 
     it "load_from_reset_password_token does NOT return user when token is found and expired" do
       sorcery_model_property_set(:reset_password_expiration_period, 0.1)
-      user.deliver_reset_password_instructions!
+      user.generate_reset_password_token!
       Timecop.travel(Time.now.in_time_zone+0.5)
 
       expect(User.load_from_reset_password_token user.reset_password_token).to be_nil
@@ -121,8 +121,8 @@ shared_examples_for "rails_3_reset_password_model" do
 
     it "load_from_reset_password_token is always valid if expiration period is nil" do
       sorcery_model_property_set(:reset_password_expiration_period, nil)
-      user.deliver_reset_password_instructions!
-      updated_user  = defined?(DataMapper) && user.class.ancestors.include?(DataMapper::Resource) ? User.find(user.id) : user
+      user.generate_reset_password_token!
+      updated_user  = User.sorcery_adapter.find(user.id)
 
       expect(User.load_from_reset_password_token user.reset_password_token).to eq updated_user
     end
@@ -156,7 +156,7 @@ shared_examples_for "rails_3_reset_password_model" do
 
         expect(ActionMailer::Base.deliveries.size).to eq old_size + 1
       end
-      
+
       it "calls send_reset_password_email! on reset" do
         expect(user).to receive(:send_reset_password_email!).once