thoughtbot-clearance 0.1.4

data/README.textile

@@ -0,0 +1,178 @@
+h1. Clearance
+
+Simple, complete Ruby web app authentication. 
+
+"We have clearance, Clarence.":http://www.youtube.com/v/mNRXJEE3Nz8
+
+h2. Features
+
+* email & password
+* modules, not a generator
+* gem, not a plugin
+* tests included using "shoulda":http://thoughtbot.com/projects/shoulda & "factory_girl":http://thoughtbot.com/projects/factory_girl
+
+h2. Gem installation (Rails 2.1+)
+
+Specify the gem dependency in your config/environment.rb file:
+
+    Rails::Initializer.run do |config|
+      # ...
+      config.gem 'thoughtbot-shoulda', :lib => 'shoulda', :source => "http://gems.github.com"
+      config.gem 'thoughtbot-factory_girl', :lib => 'factory_girl', :source => "http://gems.github.com"
+      config.gem "dancroak-clearance", :lib => 'clearance', :source => 'http://gems.github.com/'
+    end
+
+Then:
+
+    rake gems:install
+    rake gems:unpack
+
+h2. Tests
+
+The tests use "Shoulda":http://thoughtbot.com/projects/shoulda and "Factory Girl":http://thoughtbot.com/projects/factory_girl. You should create a User Factory:
+
+    Factory.sequence :email do |n|
+      "user#{n}@example.com"
+    end
+
+    Factory.define :user do |user|
+      user.email { Factory.next :email }
+      user.password 'sekrit'
+      user.password_confirmation 'sekrit'
+    end
+
+In test/test_helper.rb: 
+
+    class Test::Unit::TestCase
+      self.use_transactional_fixtures = true
+      self.use_instantiated_fixtures  = false
+      include Clearance::TestHelper
+    end
+
+In test/unit/user_test.rb: 
+
+    require File.dirname(__FILE__) + '/../test_helper'
+    
+    class UserTest < Test::Unit::TestCase
+      include Clearance::UserTest
+    end
+
+In test/functional/sessions_controller_test.rb: 
+
+  require File.dirname(__FILE__) + '/../test_helper'
+
+  class SessionsControllerTest < ActionController::TestCase
+    include Clearance::SessionsControllerTest
+    
+    private
+    
+    def url_after_create
+      root_url # the default
+    end
+    
+    def url_after_destroy
+      login_url # the default
+    end
+  end
+
+In test/functional/users_controller_test.rb: 
+
+  require File.dirname(__FILE__) + '/../test_helper'
+
+  class UsersControllerTest < ActionController::TestCase
+    include Clearance::UsersControllerTest
+    
+    private
+    
+    def url_after_create
+      root_url # the default
+    end
+    
+    def url_after_update
+      root_url # the default
+    end
+  end
+
+h2. Schema
+
+Change your User model so it has these attributes:
+
+    change_table(:users) do |t|
+      t.column :email, :string
+      t.column :crypted_password, :string, :limit => 40
+      t.column :salt, :string, :limit => 40
+      t.column :remember_token, :string
+      t.column :remember_token_expires_at, :datetime
+    end
+    
+    add_index :users, [:email, :crypted_password]
+
+h2. User Model
+
+In app/models/user.rb:
+
+    class User < ActiveRecord::Base
+      include Clearance::Model
+    end
+
+h2. Controllers
+
+In app/controllers/application_controller.rb:
+
+    class ApplicationController < ActionController::Base
+      helper :all
+      protect_from_forgery
+      include Clearance::ApplicationController
+    end
+
+In app/controllers/sessions_controller.rb:
+
+    class SessionsController < ApplicationController
+      include Clearance::SessionsController
+    end
+
+In app/controllers/users_controller.rb:
+
+    class UsersController < ApplicationController
+      include Clearance::UsersController
+    end
+
+h2. Routes
+
+    map.with_options :controller => 'sessions'  do |m|
+      m.login  '/login',  :action => 'new'
+      m.logout '/logout', :action => 'destroy'
+    end
+    map.resource :session
+    map.resources :users
+
+h2. Views
+
+In app/views/sessions/new.html.erb
+
+  <% form_for :session, :url => session_path do |f| %>
+	  <div class="group">
+	    <%= f.label :email %>
+	    <%= f.text_field :email %>  
+	  </div>
+	  <div class="group">
+	    <%= f.label :password %>
+	    <%= f.password_field :password %>
+	  </div>
+	  <div class="checkbox">
+	    <%= f.check_box :remember_me %>
+	    <%= f.label :remember_me %>
+	  </div>
+	  <div class="group buttons">
+	    <%= f.submit 'Login', :disable_with => 'Please wait...' %>
+	  </div>
+	<% end %>
+
+h2. Authors
+
+* thoughtbot, inc.
+* Dan Croak
+* Josh Nichols
+* Mike Breen
+* Mike Burns
+* Jason Morrison

data/clearance.gemspec

@@ -0,0 +1,21 @@
+Gem::Specification.new do |s|
+  s.name = "clearance"
+  s.version = "0.1.4"
+  s.date = "2008-09-24"
+  s.summary = "Simple, complete Rails authentication."
+  s.email = "dcroak@thoughtbot.com"
+  s.homepage = "http://github.com/dancroak/clearance"
+  s.description = "Simple, complete Rails authentication scheme."
+  s.authors = ["thoughtbot, inc.", "Dan Croak", "Josh Nichols", "Mike Breen", "Mike Burns", "Jason Morrison"]
+  s.files = ["README.textile", 
+    "clearance.gemspec", 
+    "lib/clearance.rb", 
+    "lib/clearance/app/controllers/application_controller.rb", 
+    "lib/clearance/app/models/model.rb", 
+    "lib/clearance/app/controllers/sessions_controller.rb", 
+    "lib/clearance/test/functionals/sessions_controller_test.rb", 
+    "lib/clearance/test/test_helper.rb", 
+    "lib/clearance/test/units/user_test.rb", 
+    "lib/clearance/app/controllers/users_controller.rb", 
+    "lib/clearance/test/functionals/users_controller_test.rb"]
+end

data/lib/clearance.rb

@@ -0,0 +1,8 @@
+require 'clearance/app/controllers/application_controller'
+require 'clearance/app/controllers/sessions_controller'
+require 'clearance/app/controllers/users_controller'
+require 'clearance/app/models/model'
+require 'clearance/test/test_helper'
+require 'clearance/test/functionals/sessions_controller_test'
+require 'clearance/test/functionals/users_controller_test'
+require 'clearance/test/units/user_test'

data/lib/clearance/app/controllers/application_controller.rb

@@ -0,0 +1,70 @@
+module Clearance
+  module ApplicationController
+    
+    def self.included(base)
+      base.class_eval do
+        helper_method :current_user
+        helper_method :logged_in?
+        
+        include InstanceMethods
+
+     protected
+        include ProtectedInstanceMethods
+      end
+    end
+    
+    module InstanceMethods
+      def current_user
+        @current_user ||= (user_from_session || user_from_cookie)
+      end
+      
+      def logged_in?
+        ! current_user.nil?
+      end
+    end
+
+    module ProtectedInstanceMethods
+      def authenticate
+        deny_access unless self.current_user
+      end
+
+      def user_from_session
+        User.find_by_id session[:user_id]
+      end
+
+      def user_from_cookie
+        user = User.find_by_remember_token(cookies[:auth_token]) if cookies[:auth_token]
+        user && user.remember_token? ? user : nil
+      end
+
+      def login(user)
+        create_session_for user
+        @current_user = user
+      end
+
+      def create_session_for(user)
+        session[:user_id] = user.id if user
+      end
+
+      def redirect_back_or(default)
+        session[:return_to] ? redirect_to(session[:return_to]) : redirect_to(default)
+        session[:return_to] = nil
+      end
+      
+      def redirect_to_root
+        redirect_to root_url
+      end
+
+      def store_location
+        session[:return_to] = request.request_uri
+      end
+
+      def deny_access(flash_message = nil, opts = {})
+        opts[:redirect] ||= login_url
+        store_location
+        flash[:error] = flash_message if flash_message
+        redirect_to opts[:redirect]
+      end
+    end
+  end
+end

data/lib/clearance/app/controllers/sessions_controller.rb

@@ -0,0 +1,73 @@
+module Clearance
+  module SessionsController
+
+    def self.included(base)
+      base.class_eval do
+        skip_before_filter :authenticate
+        protect_from_forgery :except => :create
+        filter_parameter_logging :password
+        
+        include InstanceMethods
+        
+      protected
+        include ProtectedInstanceMethods
+      end
+    end
+    
+    module InstanceMethods
+      def create
+        remember_me = params[:session][:remember_me] if params[:session]
+        login_via_password(params[:session][:email], params[:session][:password], remember_me)
+      end
+
+      def destroy
+        forget current_user
+        reset_session
+        flash[:notice] = 'You have been logged out.'
+        redirect_to url_after_destroy
+      end
+    end
+
+    module ProtectedInstanceMethods
+      def login_via_password(email, password, remember_me)
+        user = User.authenticate(email, password)
+        if login(user)
+          create_session_for(user)
+          remember(user) if remember_me == '1'
+          login_successful
+        else
+          login_failure
+        end
+      end
+      
+      def login_successful
+        flash[:notice] = 'Logged in successfully'
+        redirect_back_or url_after_create
+      end
+
+      def login_failure(message = "Bad email or password.")
+        flash.now[:notice] = message
+        render :action => :new
+      end
+      
+      def remember(user)
+        user.remember_me!
+        cookies[:auth_token] = { :value   => user.remember_token, 
+                                 :expires => user.remember_token_expires_at }
+      end
+
+      def forget(user)
+        user.forget_me! if user
+        cookies.delete :auth_token
+      end
+
+      def url_after_create
+        root_url
+      end
+
+      def url_after_destroy
+        login_url
+      end
+    end
+  end
+end

data/lib/clearance/app/controllers/users_controller.rb

@@ -0,0 +1,81 @@
+module Clearance
+  module UsersController
+
+    def self.included(base)
+      base.class_eval do
+        before_filter :authenticate, :except => [:new, :create]
+        before_filter :redirect_to_root, :only => [:new, :create], :if => :logged_in?
+        before_filter :ensure_user_is_accessing_self, :only => [:edit, :update, :show]
+
+        filter_parameter_logging :password
+        
+        include InstanceMethods
+        
+      private
+        include PrivateInstanceMethods
+      end
+    end
+
+    module InstanceMethods
+      def index
+        @users = User.find :all
+      end
+      
+      def new
+        @user = User.new
+      end
+      
+      def show
+        @user = User.find params[:id]
+      end
+      
+      def create
+        @user = User.new params[:user]
+        if @user.save
+          current_user = @user
+          flash[:notice] = "User created and logged in."
+          redirect_back_or root_url
+        else
+          render :action => "new"
+        end
+      end
+
+      def edit
+        @user = User.find params[:id]
+      end
+      
+      def update
+        @user = User.find params[:id]
+        
+        if @user.update_attributes params[:user]
+          flash[:notice] = "User updated."
+          redirect_back_or root_url
+        else
+          render :action => "edit"
+        end
+      end
+
+      def destroy
+        @user = User.find params[:id]
+        @user.destroy
+        redirect_to root_url
+      end
+    end
+
+    module PrivateInstanceMethods
+      def ensure_user_is_accessing_self
+        return if current_user and current_user.respond_to?(:admin?) and current_user.admin?
+        deny_access('You cannot edit that user.', :redirect => root_url) unless current_user.id.to_i == params[:id].to_i
+      end
+
+      def url_after_create
+        root_url
+      end
+
+      def url_after_update
+        root_url
+      end
+    end
+
+  end
+end

data/lib/clearance/app/models/model.rb

@@ -0,0 +1,78 @@
+module Clearance
+  module Model
+    
+    def self.included(base)
+      base.class_eval do
+        
+        attr_accessible :email, :password, :password_confirmation
+        attr_accessor :password, :password_confirmation
+
+        validates_presence_of     :email
+        validates_presence_of     :password, :if => :password_required?
+        validates_confirmation_of :password, :if => :password_required?
+        validates_uniqueness_of   :email
+
+        before_save :initialize_salt, :encrypt_password
+        
+        extend ClassMethods
+        include InstanceMethods
+        
+      protected
+
+        include ProtectedInstanceMethods
+        
+      end
+    end
+    
+    module ClassMethods
+      def authenticate(email, password)
+        user = find_by_email email
+        user && user.authenticated?(password) ? user : nil
+      end
+    end
+    
+    module InstanceMethods
+      def authenticated?(password)
+        crypted_password == encrypt(password)
+      end
+
+      def encrypt(password)
+        Digest::SHA1.hexdigest "--#{salt}--#{password}--"
+      end
+
+      def remember_token?
+        remember_token_expires_at && Time.now.utc < remember_token_expires_at
+      end
+
+      def remember_me!
+        remember_me_until 2.weeks.from_now.utc
+      end
+
+      def remember_me_until(time)
+        self.update_attribute :remember_token_expires_at, time
+        self.update_attribute :remember_token, encrypt("#{email}--#{remember_token_expires_at}")
+      end
+
+      def forget_me!
+        self.update_attribute :remember_token_expires_at, nil
+        self.update_attribute :remember_token, nil
+      end
+    end
+    
+    module ProtectedInstanceMethods
+      def initialize_salt
+        self.salt = Digest::SHA1.hexdigest("--#{Time.now.to_s}--#{email}--") if new_record?
+      end
+
+      def encrypt_password
+        return if password.blank?
+        self.crypted_password = encrypt(password)
+      end
+
+      def password_required?
+        crypted_password.blank? || !password.blank?
+      end
+    end
+  
+  end
+end

data/lib/clearance/test/functionals/sessions_controller_test.rb

@@ -0,0 +1,82 @@
+module Clearance
+  module SessionsControllerTest
+    
+    def self.included(base)
+      base.class_eval do
+        context "Given a user" do
+          setup { @user = Factory :user }
+
+          should_filter :password
+
+          context "on GET to /sessions/new" do
+            setup { get :new }
+          
+            should_respond_with :success
+            should_render_template :new
+            should_not_set_the_flash
+            should_have_form :action => "session_path",
+              :fields => { "session[email]" => :text,
+                "session[password]" => :password,
+                "session[remember_me]" => :checkbox }
+          end
+
+          context "a POST to #create with good credentials" do
+            setup do
+              post :create, :session => { :email => @user.email, :password => @user.password }
+            end
+
+            should_set_the_flash_to /success/i
+            should_redirect_to '@controller.send(:url_after_create)'
+            # TODO: should set session
+          end
+
+          context "a POST to #create with bad credentials" do
+            setup do
+              post :create, :session => { :email => @user.email, :password => "bad value" }
+            end
+
+            should_set_the_flash_to /bad/i
+            should_render_template :new
+            # TODO: should not set session
+          end
+          
+          # TODO: two tests for remember me - success and failure
+        end
+
+        context "While logged out" do
+          setup { logout }
+
+          context "logging out again" do
+            setup { delete :destroy }
+            should_redirect_to '@controller.send(:url_after_destroy)'
+          end
+        end
+
+        logged_in_user_context do
+          context "a DELETE to #destroy without a cookie" do
+            setup { delete :destroy }
+
+            should_set_the_flash_to(/logged out/i)
+            should_redirect_to '@controller.send(:url_after_destroy)'
+          end
+
+          context 'a DELETE to #destroy with a cookie' do
+            setup do
+              cookies['auth_token'] = CGI::Cookie.new 'token', 'value'
+              delete :destroy
+            end
+
+            should 'delete the cookie' do
+              assert cookies['auth_token'].empty?
+            end
+
+            should 'delete the remember me token in users table' do
+              assert_nil @user.reload.remember_token
+              assert_nil @user.reload.remember_token_expires_at
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/clearance/test/functionals/users_controller_test.rb

@@ -0,0 +1,113 @@
+module Clearance
+  module UsersControllerTest
+
+    def self.included(base)
+      base.class_eval do
+        public_context do
+
+          context "on GET to /users/new" do
+            setup { get :new }
+            should_respond_with :success
+            should_render_template :new
+            should_not_set_the_flash
+            should_have_form :action => "users_path",
+              :method => :post,
+              :fields => { :email => :text,
+                :password => :password,
+                :password_confirmation => :password }
+          end
+
+          context "on POST to /users" do
+            setup do
+              post :create, :user => {
+                :email => Factory.next(:email),
+                :password => 'skerit',
+                :password_confirmation => 'skerit'
+              }
+            end
+            
+            should_set_the_flash_to /created/i
+            should_redirect_to "@controller.send(:url_after_create)"
+            should_assign_to :user
+            should_change 'User.count', :by => 1
+          end
+
+          should_deny_access_on "get :edit, :id => 1", :redirect => "login_url"
+          should_deny_access_on "put :update, :id => 1", :redirect => "login_url"
+          should_deny_access_on "get :show, :id => 1", :redirect => "login_url"
+          should_deny_access_on "delete :destroy, :id => 1", :redirect => "login_url"
+
+        end
+
+        logged_in_user_context do
+
+          should_deny_access_on "get :new"
+          should_deny_access_on "post :create, :user => {}" 
+          should_filter :password
+
+          context "viewing their account" do
+            context "on GET to /users/:id/show" do
+              setup { get :show, :id => @user.to_param }
+              should_respond_with :success
+              should_render_template :show
+              should_not_set_the_flash
+              
+              should 'assign to @user' do
+                assert_equal @user, assigns(:user)
+              end
+            end
+
+            should_deny_access_on "delete :destroy, :id => @user.to_param"
+
+            context "on GET to /users/:id/edit" do
+              setup { get :edit, :id => @user.to_param }
+
+              should_respond_with :success
+              should_render_template :edit
+              should_not_set_the_flash
+              should_assign_to :user
+              should_have_form :action => "user_path(@user)",
+                :method => :put,
+                :fields => { :email => :text,
+                  :password => :password,
+                  :password_confirmation => :password }
+            end
+
+            context "on PUT to /users/:id" do
+              setup do
+                put :update, 
+                  :id => @user.to_param, 
+                  :user => { :email => "none@example.com" }
+              end
+              should_set_the_flash_to /updated/i
+              should_redirect_to "@controller.send(:url_after_update)"
+              should_assign_to :user
+              should "update the user's attributes" do
+                assert_equal "none@example.com", assigns(:user).email
+              end
+            end
+
+            context "on PUT to /users/:id with invalid attributes" do
+              setup { put :update, :id => @user.to_param, :user => {:email => ''} }
+              should_not_set_the_flash
+              should_assign_to :user
+              should_render_template 'edit'
+              should "display errors" do
+                assert_select '#errorExplanation'
+              end
+            end
+          end
+
+          context "trying to access another user's account" do
+            setup { @user = Factory :user }
+
+            should_deny_access_on "get :show, :id => @user.to_param",                :flash => /cannot edit/i
+            should_deny_access_on "get :edit, :id => @user.to_param",                :flash => /cannot edit/i
+            should_deny_access_on "put :update, :id => @user.to_param, :user => {}", :flash => /cannot edit/i
+          end
+        end
+      end
+    end
+
+  end
+end

data/lib/clearance/test/test_helper.rb

@@ -0,0 +1,100 @@
+module Clearance 
+  module TestHelper
+    
+    def self.included(base)
+      base.class_eval do
+        include InstanceMethods
+        extend ClassMethods
+      end
+    end
+
+    module InstanceMethods
+      def login_as(user = nil)
+        user ||= Factory(:user)
+        @request.session[:user_id] = user.id
+        return user
+      end
+
+      def logout 
+        @request.session[:user_id] = nil
+      end
+    end
+    
+    module ClassMethods
+      def should_deny_access_on(command, opts = {})
+        opts[:redirect] ||= "root_url"
+
+        context "on #{command}" do
+          setup { eval command }
+          should_redirect_to opts[:redirect]
+          if opts[:flash]
+            should_set_the_flash_to opts[:flash]
+          else
+            should_not_set_the_flash
+          end
+        end
+      end
+      
+      def should_filter(*keys)
+        keys.each do |key|
+          should "filter #{key}" do
+            assert @controller.respond_to?(:filter_parameters),
+              "The key #{key} is not filtered"
+            filtered = @controller.send(:filter_parameters, {key.to_s => key.to_s})
+            assert_equal '[FILTERED]', filtered[key.to_s],
+              "The key #{key} is not filtered"
+          end
+        end
+      end
+      
+      # should_have_form :action => 'admin_users_path',
+      #   :method => :get, 
+      #   :fields => { 'email' => :text }
+      # TODO: http_method should be pulled out
+      def should_have_form(opts)
+        model = self.name.gsub(/ControllerTest$/, '').singularize.downcase
+        model = model[model.rindex('::')+2..model.size] if model.include?('::')
+        http_method, hidden_http_method = form_http_method opts[:method]
+        should "have a #{model} form" do
+          assert_select "form[action=?][method=#{http_method}]", eval(opts[:action]) do
+            if hidden_http_method
+              assert_select "input[type=hidden][name=_method][value=#{hidden_http_method}]"
+            end
+            opts[:fields].each do |attribute, type|
+              attribute = attribute.is_a?(Symbol) ? "#{model}[#{attribute.to_s}]" : attribute
+              assert_select "input[type=#{type.to_s}][name=?]", attribute
+            end
+            assert_select "input[type=submit]"
+          end
+        end
+      end
+      
+      def form_http_method(http_method)
+        http_method = http_method.nil? ? 'post' : http_method.to_s
+        if http_method == "post" || http_method == "get"
+          return http_method, nil
+        else
+          return "post", http_method
+        end
+      end
+      
+      def logged_in_user_context(&blk)
+        context "A logged in user" do
+          setup do
+            @user = Factory :user
+            login_as @user
+          end
+          merge_block(&blk)
+        end
+      end
+      
+      def public_context(&blk)
+        context "The public" do
+          setup { logout }
+          merge_block(&blk)
+        end
+      end
+    end
+  
+  end
+end

data/lib/clearance/test/units/user_test.rb

@@ -0,0 +1,186 @@
+module Clearance
+  module UserTest
+    
+    def self.included(base)
+      base.class_eval do
+        should_require_attributes :email, :password
+
+        should "require password validation on create" do
+          user = Factory.build(:user, :password => 'blah', :password_confirmation => 'boogidy')
+          assert !user.save
+          assert_match(/confirmation/i, user.errors.on(:password))
+        end
+
+        should "create a crypted_password on save" do
+          assert_not_nil Factory(:user, :crypted_password => nil).crypted_password
+        end
+
+        context 'updating a password' do
+          setup do
+            @user = Factory(:user)
+            assert_not_nil @user.crypted_password
+            @crypt = @user.crypted_password
+            assert_not_nil @user.salt
+            @salt = @user.salt
+            @user.password = 'a_new_password'
+            @user.password_confirmation = 'a_new_password'
+            assert @user.save
+          end
+
+          should 'update a crypted_password' do
+            @user.reload
+            assert @user.crypted_password != @crypt
+          end
+        end
+        
+        context 'A user' do
+          setup do
+            @password = 'sekrit'
+            @salt = 'salt'
+            User.any_instance.stubs(:initialize_salt)
+            @user = Factory(:user, :password => @password, :salt => @salt)
+          end
+          
+          should "require password validation on update" do
+            @user.update_attributes(:password => "blah", :password_confirmation => "boogidy")
+            assert !@user.save
+            assert_match(/confirmation/i, @user.errors.on(:password))
+          end
+          
+          should_require_unique_attributes :email
+          
+          context 'authenticating a user' do
+            context 'with good credentials' do
+              setup do
+                @result = User.authenticate @user.email, 'sekrit'
+              end
+
+              should 'return true' do
+                assert @result
+              end
+            end
+
+            context 'with bad credentials' do
+              setup do
+                @result = User.authenticate @user.email, 'horribly_wrong_password'
+              end
+
+              should 'return false' do
+                assert !@result
+              end
+            end
+          end
+          
+          context 'authenticated?' do
+            context 'with good credentials' do
+              setup do
+                @result = @user.authenticated? @password
+              end
+
+              should 'return true' do
+                assert @result
+              end
+            end
+
+            context 'with bad credentials' do
+              setup do
+                @result = @user.authenticated? 'horribly_wrong_password'
+              end
+
+              should 'return false' do
+                assert !@result
+              end
+            end
+          end
+
+          context 'encrypt' do
+            setup do
+              @crypted  = @user.encrypt(@password)
+              @expected = Digest::SHA1.hexdigest("--#{@salt}--#{@password}--")
+            end
+
+            should 'create a Hash using SHA1 encryption' do
+              assert_equal @expected, @crypted
+              assert_not_equal @password, @crypted
+            end
+          end
+
+          context 'remember_me!' do
+            setup do
+              assert_nil @user.remember_token
+              assert_nil @user.remember_token_expires_at
+              @user.remember_me!
+            end
+
+            should 'set the remember token and expiration date' do
+              assert_not_nil @user.remember_token
+              assert_not_nil @user.remember_token_expires_at
+            end
+
+            should 'remember_token?' do
+              assert @user.remember_token?
+            end
+
+            context 'forget_me!' do
+              setup do
+                @user.forget_me!
+              end
+
+              should 'unset the remember token and expiration date' do
+                assert_nil @user.remember_token
+                assert_nil @user.remember_token_expires_at
+              end
+
+              should 'not remember_token?' do
+                assert ! @user.remember_token?
+              end
+            end
+          end
+
+          context 'remember_token?' do
+            context 'when token expires in the future' do
+              setup do
+                @user.update_attribute :remember_token_expires_at, 2.weeks.from_now.utc
+              end
+
+              should 'be true' do
+                assert @user.remember_token?
+              end
+            end
+
+            context 'when token expired' do
+              setup do
+                @user.update_attribute :remember_token_expires_at, 2.weeks.ago.utc
+              end
+
+              should 'be false' do
+                assert ! @user.remember_token?
+              end
+            end
+          end
+
+          context "User.authenticate with a valid email and password" do
+            setup do
+              @found_user = User.authenticate @user.email, @user.password
+            end
+
+            should "find that user" do
+              assert_equal @user, @found_user
+            end
+          end
+
+          context "When sent authenticate with an invalid email and password" do
+            setup do
+              @found_user = User.authenticate "not", "valid" 
+            end
+
+            should "find nothing" do
+              assert_nil @found_user
+            end
+          end
+        end
+
+      end
+    end
+  end
+end

metadata

@@ -0,0 +1,68 @@
+--- !ruby/object:Gem::Specification 
+name: thoughtbot-clearance
+version: !ruby/object:Gem::Version 
+  version: 0.1.4
+platform: ruby
+authors: 
+- thoughtbot, inc.
+- Dan Croak
+- Josh Nichols
+- Mike Breen
+- Mike Burns
+- Jason Morrison
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2008-09-24 00:00:00 -07:00
+default_executable: 
+dependencies: []
+
+description: Simple, complete Rails authentication scheme.
+email: dcroak@thoughtbot.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: []
+
+files: 
+- README.textile
+- clearance.gemspec
+- lib/clearance.rb
+- lib/clearance/app/controllers/application_controller.rb
+- lib/clearance/app/models/model.rb
+- lib/clearance/app/controllers/sessions_controller.rb
+- lib/clearance/test/functionals/sessions_controller_test.rb
+- lib/clearance/test/test_helper.rb
+- lib/clearance/test/units/user_test.rb
+- lib/clearance/app/controllers/users_controller.rb
+- lib/clearance/test/functionals/users_controller_test.rb
+has_rdoc: false
+homepage: http://github.com/dancroak/clearance
+post_install_message: 
+rdoc_options: []
+
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.2.0
+signing_key: 
+specification_version: 2
+summary: Simple, complete Rails authentication.
+test_files: []
+