thoughtbot-clearance 0.4.8 → 0.4.9

data/CHANGELOG.textile

@@ -1,32 +1,43 @@
+h2. 0.4.9 (2/20/2009)
+
+* Protect passwords & confirmations actions with forbidden filters. (Dan Croak)
+* Return 403 Forbidden status code in those cases. (Tim Pope)
+* Test 403 Forbidden status code in Cucumber feature. (Dan Croak, Joe Ferris)
+* Raise custom ActionController::Forbidden error internally. (Joe Ferris, Mike Burns, Jason Morrison)
+* Test ActionController::Forbidden error is raised in functional test. (Joe Ferris, Mike Burns, Dan Croak)
+* [#45] Fixed bug that allowed anyone to edit another user's password (Marcel Görner)
+* Required Factory Girl >= 1.2.0. (Dan Croak)
+
 h2. 0.4.8 (2/16/2009)
 
-* adding support paths for Cucumber (bmabey)
-* adding documentation for the flash (bmabey)
-* generators require "test_helper" instead of File.join. for rr compatibility. (Joe Ferris)
-* removed interpolated email address from flash message to make i18n easier. 
-* standardized flash messages that refer to email delivery.
+* Added support paths for Cucumber. (Ben Mabey)
+* Added documentation for the flash. (Ben Mabey)
+* Generators require "test_helper" instead of File.join. for rr compatibility. (Joe Ferris)
+* Removed interpolated email address from flash message to make i18n easier. (Bence Nagy)
+* Standardized flash messages that refer to email delivery. (Dan Croak)
 
 h2. 0.4.7 (2/12/2009)
 
-* removed Clearance::Test::TestHelper. one less setup step. all test helpers now in shoulda_macros.
+* Removed Clearance::Test::TestHelper so there is one less setup step. (Dan Croak)
+* All test helpers now in shoulda_macros. (Dan Croak)
 
 h2. 0.4.6 (2/11/2009)
 
-* making the modules behave like mixins again. (hat-tip Eloy Duran)
-* created Actions and PrivateMethods modules on controllers for future RDoc reasons.
+* Made the modules behave like mixins again. (hat-tip Eloy Duran)
+* Created Actions and PrivateMethods modules on controllers for future RDoc reasons. (Dan Croak, Joe Ferris)
 
 h2. 0.4.5 (2/9/2009)
 
-* [#43] Removed email downcasing. (local-part is case sensitive per RFC5321)
-* [#42] Removed dependency on Mocha.
-* Required Shoulda >= 2.9.1.
-* Added password reset feature to clearance_features generator.
-* Removed unnecessary session[:salt].
-* [#41] Only store location for session[:return_to] for GET requests.
-* Audited "sign up" naming convention. "Register" had slipped in a few places.
-* Switched to SHA1 encryption. Cypher doesn't matter much for email confirmation, password reset. Better to have shorter hashes in the emails for clients who line break on 72 chars.
+* [#43] Removed email downcasing because local-part is case sensitive per RFC5321. (Dan Croak)
+* [#42] Removed dependency on Mocha. (Dan Croak)
+* Required Shoulda >= 2.9.1. (Dan Croak)
+* Added password reset feature to clearance_features generator. (Eugene Bolshakov, Dan Croak)
+* Removed unnecessary session[:salt]. (Dan Croak)
+* [#41] Only store location for session[:return_to] for GET requests. (Dan Croak)
+* Audited "sign up" naming convention. "Register" had slipped in a few places. (Dan Croak)
+* Switched to SHA1 encryption. Cypher doesn't matter much for email confirmation, password reset. Better to have shorter hashes in the emails for clients who line break on 72 chars. (Dan Croak)
 
 h2. 0.4.4 (2/2/2009)
 
-* Added a generator for Cucumber features
-* Standarized naming for "Sign up," "Sign in," and "Sign out"
+* Added a generator for Cucumber features. (Joe Ferris, Dan Croak)
+* Standarized naming for "Sign up," "Sign in," and "Sign out". (Dan Croak) 

data/README.textile

@@ -15,7 +15,7 @@ In config/environment.rb:
     config.gem "thoughtbot-clearance", 
       :lib     => 'clearance', 
       :source  => 'http://gems.github.com', 
-      :version => '>= 0.4.8'
+      :version => '>= 0.4.9'
 
 In config/environments/test.rb:
 
@@ -26,7 +26,7 @@ In config/environments/test.rb:
     config.gem 'thoughtbot-factory_girl',
       :lib     => 'factory_girl',
       :source  => "http://gems.github.com", 
-      :version => '>= 1.1.5'
+      :version => '>= 1.2.0'
 
 Then:
 
@@ -81,7 +81,7 @@ Clearance will add these routes to your routes.rb:
     
 Please note that Clearance depends on root_url, so please make sure that it is defined to *something* in your config/routes.rb:
 
-    map.root :controller => 'home'
+    map.root :controller => 'users', :action => 'new'
     
 h2. Environments
 
@@ -99,11 +99,11 @@ h2. The flash
 
 You will need to display the success, failure, and notice flash messages in your layout. We recommend creating an app/layouts/_flashes.html.erb partial similar to the _flashes partial in Suspenders:
 
-    <div id="flash">
-      <% flash.each do |key, value| -%>
-        <div id="flash_<%= key -%>"><%= html_escape(value) %></div>
-      <% end -%>
-    </div>
+<pre><code><div id="flash">
+  <% flash.each do |key, value| -%>
+    <div id="flash_<%= key -%>"><%= html_escape(value) %></div>
+  <% end -%>
+</div></code></pre>
 
 which is then rendered inside the body tag of your application layout:
 
@@ -140,7 +140,7 @@ h2. Usage: basic workflow
 
 Rails authentication with Clearance uses the standard approach thoughtbot and our clients have agreed upon. 
 
-Users sign up (UsersController) using an email address and a password (User model). They get an email (ClearanceMailer) with a confirmation link to confirm their registration (ConfirmationController).
+Users sign up (UsersController) using an email address and a password (User model). They get an email (ClearanceMailer) with a confirmation link to confirm sign up (ConfirmationController).
 
 Signed up and email confirmed users can sign in and out (SessionsController). If they forget their password, they request an email (ClearanceMailer) containing a link to change it (PasswordsController). 
 
@@ -179,6 +179,15 @@ Please note that all User attributes except email, password and password_confirm
       attr_accessible :first_name, :last_name
     end
 
+h2. Usage: when bad things happen to good users
+
+Clearance is HTTP fluent. If someone tries to hack the URLs for passwords or confirmations actions, they will be met with a 403 Forbidden HTTP status code. Internally, the Rails app will raise a ApplicationController::Forbidden error. This is a custom error in Clearance.
+
+Layman's 403 Forbidden definition:
+
+    "The request was a legal request, but the server is refusing to respond to it. 
+     Unlike a 401 Unauthorized response, authenticating will make no difference."
+
 h2. Hooks: return_to parameter
 
 To specify where to redirect a user (say you want to have a sign in form on every page and redirect the user to the same page) after he/she signs in, you can add a "return_to" parameter to the request (thanks to "Phillippe":http://www.sivarg.com/2009/01/clearance-coming-from-where-your-were.html for the tip):
@@ -230,21 +239,17 @@ h2. Write your own tests with Clearance's helpers
 
 sign_in_as, sign_out, should_be_signed_in_as, should_not_be_signed_in, should_deny_access, signed_in_user_context, and more helpers are available in your test suite. Look in vendor/gems/clearance/shoulda_macros for the full list.
 
-    context "when signed in on GET to new" do
-	    setup do
-	      @user = Factory(:email_confirmed_user)
-	      sign_in_as @user
-	      get :new
-	    end
-	    should_be_signed_in_as { @user }
-    end
+<pre></code>context "when signed in on GET to new" do
+  setup do
+    @user = Factory(:email_confirmed_user)
+    sign_in_as @user
+    get :new
+  end
+  should_be_signed_in_as { @user }
+end</code></pre>
 
 h2. Authors
 
-* thoughtbot, inc.
-* Dan Croak
-* Mike Burns
-* Jason Morrison
-* Eugene Bolshakov
-* Josh Nichols
-* Mike Breen
+Clearance was extracted out of "Hoptoad":http://hoptoadapp.com. We merged the authentication code from two of thoughtbot's client's Rails apps. The following people have made significant contributions, suggestions, and generally improved the library. Thank you!
+
+Dan Croak, Mike Burns, Jason Morrison, Joe Ferris, Eugene Bolshakov, Josh Nichols, Mike Breen, Marcel Görner, Bence Nagy, Ben Mabey, Eloy Duran, & Tim Pope.

data/Rakefile

@@ -13,7 +13,7 @@ namespace :test do
   end
   
   Cucumber::Rake::Task.new(:features) do |t|
-    t.cucumber_opts = "--format progress"
+    t.cucumber_opts = "--format pretty"
     t.feature_pattern = 'test/rails_root/features/*.feature'
   end  
 end
@@ -51,13 +51,14 @@ task :default => ['test:all', 'test:features']
 
 gem_spec = Gem::Specification.new do |gem_spec|
   gem_spec.name        = "clearance"
-  gem_spec.version     = "0.4.8"
+  gem_spec.version     = "0.4.9"
   gem_spec.summary     = "Rails authentication for developers who write tests."
   gem_spec.email       = "support@thoughtbot.com"
   gem_spec.homepage    = "http://github.com/thoughtbot/clearance"
   gem_spec.description = "Simple, complete Rails authentication scheme."
   gem_spec.authors     = ["thoughtbot, inc.", "Dan Croak", "Mike Burns", "Jason Morrison",
-                          "Eugene Bolshakov", "Josh Nichols", "Mike Breen"]
+                          "Eugene Bolshakov", "Josh Nichols", "Mike Breen", "Joe Ferris", 
+                          "Bence Nagy", "Marcel Görner", "Ben Mabey", "Tim Pope", "Eloy Duran"]
   gem_spec.files       = FileList["[A-Z]*", "{generators,lib,shoulda_macros,rails}/**/*"]
 end
 

data/generators/clearance/templates/README

@@ -40,6 +40,6 @@ In config/environment.rb:
 3. Clearance depends on root_url, so please make sure that it is defined to
 *something* in your config/routes.rb:
 
-    map.root :controller => 'home'
+    map.root :controller => 'users', :action => 'new'
 
 *******************************************************************************

data/generators/clearance/templates/app/views/passwords/edit.html.erb

@@ -14,7 +14,7 @@
     <%= form.password_field :password %>
   </div>
   <div class="password_field">
-    <%= form.label :password_confirmation, "Verify password" %>
+    <%= form.label :password_confirmation, "Confirm password" %>
     <%= form.password_field :password_confirmation %>
   </div>
   <div class="submit_field">

data/generators/clearance/templates/app/views/users/_form.html.erb

@@ -8,6 +8,6 @@
   <%= form.password_field :password %>
 </div>
 <div class="password_field">
-  <%= form.label :password_confirmation, "Verify password" %>
+  <%= form.label :password_confirmation, "Confirm password" %>
   <%= form.password_field :password_confirmation %>
 </div>

data/generators/clearance_features/templates/features/password_reset.feature

@@ -1,5 +1,5 @@
-Fature: Password Reset
-  In order to sign in even if he forgot his password
+Feature: Password reset
+  In order to sign in even if user forgot their password
   A user
   Should be able to reset it
   
@@ -30,3 +30,10 @@ Fature: Password Reset
       And I sign in as "email@person.com/newpassword"
       Then I should be signed in
       
+    Scenario: User requests password reset without token
+      Given a user exists with an email of "user@one.com"
+      When I try to change the password of "user@one.com" without token
+      Then I should be forbidden
+
+
+

data/generators/clearance_features/templates/features/sign_up.feature

@@ -7,7 +7,7 @@ Feature: Sign up
       When I go to the sign up page
       And I fill in "Email" with "invalidemail"
       And I fill in "Password" with "password"
-      And I fill in "Verify Password" with ""
+      And I fill in "Confirm password" with ""
       And I press "Sign Up"
       Then I should see error messages
       
@@ -15,7 +15,7 @@ Feature: Sign up
       When I go to the sign up page
       And I fill in "Email" with "email@person.com"
       And I fill in "Password" with "password"
-      And I fill in "Verify Password" with "password"
+      And I fill in "Confirm password" with "password"
       And I press "Sign Up"
       Then I should see "instructions for confirming"
       And a confirmation message should be sent to "email@person.com"

data/generators/clearance_features/templates/features/step_definitions/clearance_steps.rb

@@ -4,7 +4,13 @@ Then /^I should see error messages$/ do
   Then %{I should see "error(s)? prohibited"}
 end
 
-# DB
+# Database
+
+Factory.factories.each do |name, factory|
+  Given /^an? #{name} exists with an? (.*) of "([^"]*)"$/ do |attr, value|
+    Factory(name, attr.gsub(' ', '_') => value)
+  end
+end
 
 Given /^there is no user with "(.*)"$/ do |email|
   assert_nil User.find_by_email(email)
@@ -68,6 +74,16 @@ When /^I follow the password reset link sent to "(.*)"$/ do |email|
   visit edit_user_password_path(:user_id => user, :token => user.token)
 end
 
+When /^I try to change the password of "(.*)" without token$/ do |email|
+  user = User.find_by_email(email)
+  visit edit_user_password_path(:user_id => user)
+end
+
+Then /^I should be forbidden$/ do
+  assert_response :forbidden
+end
+
+
 # Actions
 
 When /^I sign in( with "remember me")? as "(.*)\/(.*)"$/ do |remember, email, password|
@@ -90,7 +106,7 @@ end
 
 When /^I update my password with "(.*)\/(.*)"$/ do |password, confirmation|
   And %{I fill in "Choose password" with "#{password}"}
-  And %{I fill in "Verify password" with "#{confirmation}"}
+  And %{I fill in "Confirm password" with "#{confirmation}"}
   And %{I press "Save this password"}   
 end
 

data/generators/clearance_features/templates/features/support/paths.rb

@@ -10,7 +10,6 @@ module NavigationHelpers
       new_session_path
     when /the password reset request page/i
       new_password_path
- 
     
     # Add more page name => path mappings here
     

data/lib/clearance.rb

@@ -1,3 +1,5 @@
+require 'clearance/lib/extensions/errors'
+require 'clearance/lib/extensions/rescue'
 require 'clearance/app/controllers/application_controller'
 require 'clearance/app/controllers/confirmations_controller'
 require 'clearance/app/controllers/passwords_controller'

data/lib/clearance/app/controllers/confirmations_controller.rb

@@ -8,8 +8,9 @@ module Clearance
           controller.send(:include, PrivateMethods)
           
           controller.class_eval do
-            before_filter :email_confirmed_user?, :only => :new
-            before_filter :existing_user?, :only => :new
+            before_filter :forbid_confirmed_user,    :only => :new
+            before_filter :forbid_missing_token,     :only => :new
+            before_filter :forbid_non_existant_user, :only => :new
             filter_parameter_logging :token    
           end
         end
@@ -20,7 +21,9 @@ module Clearance
           end
 
           def create
+            @user = User.find_by_id_and_token(params[:user_id], params[:token])
             @user.confirm_email!
+            
             sign_user_in(@user)
             flash[:success] = "Confirmed email and signed in."
             redirect_to url_after_create
@@ -30,19 +33,22 @@ module Clearance
         module PrivateMethods
           private
           
-          def email_confirmed_user?
-            @user = User.find_by_id(params[:user_id])
-            if @user.nil?
-              render :nothing => true, :status => :not_found
-            elsif @user.email_confirmed?
-              redirect_to new_session_url
+          def forbid_confirmed_user
+            user = User.find_by_id(params[:user_id])
+            if user && user.email_confirmed?
+              raise ActionController::Forbidden, "confirmed user"
             end
           end
           
-          def existing_user?
-            @user = User.find_by_id_and_token(params[:user_id], params[:token])
-            if @user.nil?
-              render :nothing => true, :status => :not_found
+          def forbid_missing_token
+            if params[:token].blank?
+              raise ActionController::Forbidden, "missing token"
+            end
+          end
+          
+          def forbid_non_existant_user
+            unless User.find_by_id_and_token(params[:user_id], params[:token])
+              raise ActionController::Forbidden, "non-existant user"
             end
           end
 

data/lib/clearance/app/controllers/passwords_controller.rb

@@ -7,8 +7,9 @@ module Clearance
           controller.send(:include, Actions)
           controller.send(:include, PrivateMethods)
           
-          controller.class_eval do  
-            before_filter :existing_user?, :only => [:edit, :update]
+          controller.class_eval do
+            before_filter :forbid_missing_token,     :only => [:edit, :update]
+            before_filter :forbid_non_existant_user, :only => [:edit, :update]
             filter_parameter_logging :password, :password_confirmation
           end
         end
@@ -32,9 +33,12 @@ module Clearance
           end
 
           def edit
+            @user = User.find_by_id_and_token(params[:user_id], params[:token])
           end
 
           def update
+            @user = User.find_by_id_and_token(params[:user_id], params[:token])
+            
             if @user.update_password(params[:user])
               sign_user_in(@user)
               redirect_to url_after_update
@@ -47,10 +51,15 @@ module Clearance
         module PrivateMethods  
           private
           
-          def existing_user?
-            @user = User.find_by_id_and_token(params[:user_id], params[:token])
-            if @user.nil?
-              render :nothing => true, :status => :not_found
+          def forbid_missing_token
+            if params[:token].blank?
+              raise ActionController::Forbidden, "missing token"
+            end
+          end
+          
+          def forbid_non_existant_user
+            unless User.find_by_id_and_token(params[:user_id], params[:token])
+              raise ActionController::Forbidden, "non-existant user"
             end
           end
 

data/lib/clearance/lib/extensions/errors.rb

@@ -0,0 +1,4 @@
+module ActionController
+  class Forbidden < StandardError
+  end
+end

data/lib/clearance/lib/extensions/rescue.rb

@@ -0,0 +1 @@
+ActionController::Base.rescue_responses.update('ActionController::Forbidden' => :forbidden)

data/lib/clearance/test/functional/confirmations_controller_test.rb

@@ -8,9 +8,14 @@ module Clearance
 
             should_filter_params :token
 
-            context "Given a user whose email has not been confirmed" do
+            context "a user whose email has not been confirmed" do
               setup { @user = Factory(:user) }
               
+              should "have a token" do
+                assert_not_nil @user.token
+                assert_not_equal "", @user.token
+              end
+              
               context "on GET to #new with correct id and token" do
                 setup do
                   get :new, :user_id => @user.to_param, :token => @user.token
@@ -22,53 +27,39 @@ module Clearance
                 should_redirect_to_url_after_create
               end
 
-              context "on GET to #new with incorrect token" do
-                setup do
-                  token = ""
-                  assert_not_equal token, @user.token
-
-                  get :new, :user_id => @user.to_param, :token => token
+              context "with an incorrect token" do
+                setup do 
+                  @bad_token = "bad token"
+                  assert_not_equal @bad_token, @user.token
+                end
+                
+                should_forbid "on GET to #new with incorrect token" do
+                  get :new, :user_id => @user.to_param, :token => @bad_token
                 end
-
-                should_respond_with :not_found
-                should_render_nothing
+              end
+              
+              should_forbid "on GET to #new with blank token" do
+                get :new, :user_id => @user.to_param, :token => ""
+              end
+              
+              should_forbid "on GET to #new with no token" do
+                get :new, :user_id => @user.to_param
               end
             end
 
-            context "Given a user whose email has been confirmed" do
+            context "a user with email confirmed" do
               setup { @user = Factory(:email_confirmed_user) }
 
-              context "on GET to #new with correct id and token" do
-                setup do
-                  get :new, :user_id => @user.to_param, :token => @user.token
-                end
-
-                should_not_be_signed_in
-                should_redirect_to 'new_session_url'
-              end
-
-              context "on GET to #new with incorrect token" do
-                setup do
-                  token = ""
-                  assert_not_equal token, @user.token
-
-                  get :new, :user_id => @user.to_param, :token => token
-                end
-
-                should_not_be_signed_in
-                should_redirect_to 'new_session_url'
+              should_forbid "on GET to #new with correct id" do
+                get :new, :user_id => @user.to_param
               end
             end
 
-            context "Given no user records" do
+            context "no users" do
               setup { assert_equal 0, User.count }
-              context "on GET to #new with nonexistent id and token" do
-                setup do
-                  get :new, :user_id => '123', :token => '123'
-                end
-
-                should_respond_with :not_found
-                should_render_nothing
+              
+              should_forbid "on GET to #new with nonexistent id and token" do
+                get :new, :user_id => '123', :token => '123'
               end
             end
 

data/lib/clearance/test/functional/passwords_controller_test.rb

@@ -9,163 +9,169 @@ module Clearance
             should_route :get, '/users/1/password/edit', 
               :action  => 'edit', :user_id => '1'
 
-            context "with a confirmed user" do
+            context "a user with confirmed email" do
               setup do
-                @user = Factory(:user)
+                @user = Factory(:email_confirmed_user)
                 @user.confirm_email!
               end
 
-              context 'A GET to #new' do
+              context "on GET to #new" do
                 setup { get :new, :user_id => @user.to_param }
 
                 should_respond_with :success
                 should_render_template "new"
               end
 
-              context "A POST to #create" do
-                context "with an existing user's email address" do
+              context "on POST to #create" do
+                context "with correct email address" do
                   setup do
                     ActionMailer::Base.deliveries.clear
                     post :create, :password => { :email => @user.email }
                   end
                   
-                  should_send_the_change_your_password_email
+                  should "generate a token for the change your password email" do
+                    assert_not_nil @user.reload.token                                   
+                  end
+
+                  should "send the change your password email" do
+                    assert_sent_email do |email|
+                      email.subject =~ /change your password/i
+                    end
+                  end
+                  
                   should_set_the_flash_to /password/i
                   should_redirect_to_url_after_create
                 end
 
-                context "with a non-existent email address" do
+                context "with incorrect email address" do
                   setup do
                     email = "user1@example.com"
                     assert ! User.exists?(['email = ?', email])
                     ActionMailer::Base.deliveries.clear
+                    assert_nil @user.reload.token
 
                     post :create, :password => { :email => email }
                   end
                   
-                  should_not_send_the_change_your_password_email
+                  should "not generate a token for the change your password email" do
+                    assert_nil @user.reload.token                                   
+                  end                  
+
+                  should "not send a password reminder email" do
+                    assert ActionMailer::Base.deliveries.empty?
+                  end
                   
                   should "set a :notice flash" do
                     assert_not_nil flash.now[:notice]
                   end
 
-                  should_render_template "new"
+                  should_render_template :new
                 end
               end
+            end
+            
+            context "a user with confirmed email and forgotten password" do
+              setup do
+                @user = Factory(:email_confirmed_user)
+                @user.forgot_password!
+              end
               
-              context 'who requested password recovery' do
-                setup { @user.forgot_password! }
-
-                context "A GET to #edit" do
-                  context "with an existing user's id and token" do
-                    setup do
-                      get :edit, :user_id => @user.to_param, :token => @user.token
-                    end
-
-                    should "find the user with the given id and token" do
-                      assert_equal @user, assigns(:user)
-                    end
-
-                    should_respond_with :success
-                    should_render_template "edit"
-                    should_display_a_password_update_form
-                  end
-
-                  context "with an existing user's id but not token" do
-                    setup do
-                      get :edit, :user_id => @user.to_param, :token => ""
-                    end
-
-                    should_respond_with :not_found
-                    should_render_nothing
-                  end
+              context "on GET to #edit with correct id and token" do
+                setup do
+                  get :edit, :user_id => @user.to_param, :token => @user.token
                 end
-
-                context "A PUT to #update" do
-                  context "with a matching password and password confirmation" do
-                    setup do
-                      new_password = "new_password"
-                      @encrypted_new_password = @user.encrypt(new_password)
-                      assert_not_equal @encrypted_new_password, @user.encrypted_password
-
-                      put(:update,
-                          :user_id  => @user,
-                          :token    => @user.token,
-                          :user     => {
-                            :password              => new_password,
-                            :password_confirmation => new_password
-                          })
-                      @user.reload
-                    end
-
-                    should "update the user's password" do
-                      assert_equal @encrypted_new_password, @user.encrypted_password
-                    end
-                    
-                    should "clear the token" do
-                      assert_nil @user.token
-                    end                    
-
-                    should_be_signed_in_as { @user }
-                    should_redirect_to_url_after_update
-                  end
-
-                  context "with password but blank password confirmation" do
-                    setup do
-                      new_password = "new_password"
-                      @encrypted_new_password = @user.encrypt(new_password)
-
-                      put(:update,
-                          :user_id => @user.to_param,
-                          :token   => @user.token,
-                          :user    => {
-                            :password => new_password,
-                            :password_confirmation => ''
-                          })
-                      @user.reload
-                    end
-
-                    should "not update the user's password" do
-                      assert_not_equal @encrypted_new_password, @user.encrypted_password
-                    end
-                    
-                    should "not clear the token" do
-                      assert_not_nil @user.token
-                    end                    
-
-                    should_not_be_signed_in
-                    should_respond_with :success
-                    should_render_template :edit
-                    
-                    should_display_a_password_update_form                       
-                  end
-                  
-                  context "with an existing user's id but not token" do
-                    setup do
-                      new_password = "new_password"
-                      @encrypted_new_password = @user.encrypt(new_password)                    
-                      put(:update, 
-                          :user_id => @user.to_param, 
-                          :token   => "",
-                          :user    => {
-                            :password => new_password,
-                            :password => new_password                          
-                          })
-                    end
-
-                    should "not update the user's password" do
-                      assert_not_equal @encrypted_new_password, @user.encrypted_password
-                    end
-
-                    should_not_be_signed_in
-                    should_respond_with :not_found
-                    should_render_nothing
-                  end                  
+              
+                should "find the user" do
+                  assert_equal @user, assigns(:user)
                 end
-           
+              
+                should_respond_with :success
+                should_render_template "edit"
+                should_display_a_password_update_form
+              end
+              
+              should_forbid "on GET to #edit with correct id but blank token" do
+                get :edit, :user_id => @user.to_param, :token => ""
+              end
+              
+              should_forbid "on GET to #edit with correct id but no token" do
+                get :edit, :user_id => @user.to_param
               end
               
-           end
+              context "on PUT to #update with matching password and password confirmation" do
+                setup do
+                  new_password = "new_password"
+                  @encrypted_new_password = @user.encrypt(new_password)
+                  assert_not_equal @encrypted_new_password, @user.encrypted_password
+              
+                  put(:update,
+                      :user_id  => @user,
+                      :token    => @user.token,
+                      :user     => {
+                        :password              => new_password,
+                        :password_confirmation => new_password
+                      })
+                  @user.reload
+                end
+              
+                should "update password" do
+                  assert_equal @encrypted_new_password, @user.encrypted_password
+                end
+                
+                should "clear token" do
+                  assert_nil @user.token
+                end                    
+              
+                should_be_signed_in_as { @user }
+                should_redirect_to_url_after_update
+              end
+              
+              context "on PUT to #update with password but blank password confirmation" do
+                setup do
+                  new_password = "new_password"
+                  @encrypted_new_password = @user.encrypt(new_password)
+              
+                  put(:update,
+                      :user_id => @user.to_param,
+                      :token   => @user.token,
+                      :user    => {
+                        :password => new_password,
+                        :password_confirmation => ''
+                      })
+                  @user.reload
+                end
+              
+                should "not update password" do
+                  assert_not_equal @encrypted_new_password, @user.encrypted_password
+                end
+                
+                should "not clear token" do
+                  assert_not_nil @user.token
+                end                    
+              
+                should_not_be_signed_in
+                should_respond_with    :success
+                should_render_template :edit
+                
+                should_display_a_password_update_form                       
+              end
+              
+              should_forbid "on PUT to #update with id but no token" do
+                put :update, :user_id => @user.to_param, :token => ""
+              end
+            end
+            
+            context "given two users and user one signs in" do
+              setup do
+                @user_one = Factory(:user)
+                @user_two = Factory(:user)
+                sign_in_as @user_one
+              end
+
+              should_forbid "when user one tries to change user two's password on GET with no token" do
+                get :edit, :user_id => @user_two.to_param
+              end
+            end  
           end
         end
 

data/shoulda_macros/clearance.rb

@@ -53,6 +53,16 @@ module Clearance
       end
     end
     
+    # HTTP FLUENCY
+    
+    def should_forbid(description, &block)
+      should "forbid #{description}" do
+        assert_raises ActionController::Forbidden do
+          instance_eval(&block)
+        end
+      end
+    end
+    
     # CONTEXTS
 
     def signed_in_user_context(&blk)
@@ -140,30 +150,6 @@ module Clearance
       end
     end
     
-    # EMAILS
-    
-    def should_send_the_change_your_password_email
-      should "generate a token for the change your password email" do
-        assert_not_nil @user.reload.token                                   
-      end
-                        
-      should "send the change your password email" do
-        assert_sent_email do |email|
-          email.subject =~ /change your password/i
-        end
-      end    
-    end
-    
-    def should_not_send_the_change_your_password_email
-      should "generate a token for the change your password email" do
-        assert_nil @user.reload.token                                   
-      end                  
-
-      should "not send a password reminder email" do
-        assert ActionMailer::Base.deliveries.empty?
-      end        
-    end
-    
     # FORMS
     
     def should_display_a_password_update_form

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: thoughtbot-clearance
 version: !ruby/object:Gem::Version 
-  version: 0.4.8
+  version: 0.4.9
 platform: ruby
 authors: 
 - thoughtbot, inc.
@@ -11,11 +11,17 @@ authors:
 - Eugene Bolshakov
 - Josh Nichols
 - Mike Breen
+- Joe Ferris
+- Bence Nagy
+- "Marcel G\xC3\xB6rner"
+- Ben Mabey
+- Tim Pope
+- Eloy Duran
 autorequire: 
 bindir: bin
 cert_chain: []
 
-date: 2009-02-15 21:00:00 -08:00
+date: 2009-02-19 21:00:00 -08:00
 default_executable: 
 dependencies: []
 
@@ -103,6 +109,10 @@ files:
 - lib/clearance/app/models
 - lib/clearance/app/models/clearance_mailer.rb
 - lib/clearance/app/models/user.rb
+- lib/clearance/lib
+- lib/clearance/lib/extensions
+- lib/clearance/lib/extensions/errors.rb
+- lib/clearance/lib/extensions/rescue.rb
 - lib/clearance/test
 - lib/clearance/test/functional
 - lib/clearance/test/functional/confirmations_controller_test.rb