xing_backend_token_auth 0.1.31

data/test/controllers/demo_user_controller_test.rb

@@ -0,0 +1,262 @@
+require 'test_helper'
+
+#  was the web request successful?
+#  was the user redirected to the right page?
+#  was the user successfully authenticated?
+#  was the correct object stored in the response?
+#  was the appropriate message delivered in the json payload?
+
+class DemoUserControllerTest < ActionDispatch::IntegrationTest
+  describe DemoUserController do
+    describe "Token access" do
+      before do
+        @user = users(:confirmed_email_user)
+        @user.skip_confirmation!
+        @user.save!
+
+        @auth_headers = @user.create_new_auth_token
+
+        @token     = @auth_headers['access-token']
+        @client_id = @auth_headers['client']
+        @expiry    = @auth_headers['expiry']
+      end
+
+      describe 'successful request' do
+        before do
+          # ensure that request is not treated as batch request
+          age_token(@user, @client_id)
+
+          get '/demo/members_only', {}, @auth_headers
+
+          @resp_token       = response.headers['access-token']
+          @resp_client_id   = response.headers['client']
+          @resp_expiry      = response.headers['expiry']
+          @resp_uid         = response.headers['uid']
+        end
+
+        describe 'devise mappings' do
+          it 'should define current_user' do
+            assert_equal @user, @controller.current_user
+          end
+
+          it 'should define user_signed_in?' do
+            assert @controller.user_signed_in?
+          end
+
+          it 'should not define current_mang' do
+            refute_equal @user, @controller.current_mang
+          end
+        end
+
+        it 'should return success status' do
+          assert_equal 200, response.status
+        end
+
+        it 'should receive new token after successful request' do
+          refute_equal @token, @resp_token
+        end
+
+        it 'should preserve the client id from the first request' do
+          assert_equal @client_id, @resp_client_id
+        end
+
+        it "should return the user's uid in the auth header" do
+          assert_equal @user.uid, @resp_uid
+        end
+
+        it 'should not treat this request as a batch request' do
+          refute assigns(:is_batch_request)
+        end
+
+        describe 'subsequent requests' do
+          before do
+            @user.reload
+            # ensure that request is not treated as batch request
+            age_token(@user, @client_id)
+
+            get '/demo/members_only', {}, @auth_headers.merge({'access-token' => @resp_token})
+          end
+
+          it 'should not treat this request as a batch request' do
+            refute assigns(:is_batch_request)
+          end
+
+          it "should allow a new request to be made using new token" do
+            assert_equal 200, response.status
+          end
+        end
+      end
+
+      describe 'failed request' do
+        before do
+          get '/demo/members_only', {}, @auth_headers.merge({'access-token' => "bogus"})
+        end
+
+        it 'should not return any auth headers' do
+          refute response.headers['access-token']
+        end
+
+        it 'should return error: unauthorized status' do
+          assert_equal 401, response.status
+        end
+      end
+
+      describe 'disable change_headers_on_each_request' do
+        before do
+          DeviseTokenAuth.change_headers_on_each_request = false
+          @user.reload
+          age_token(@user, @client_id)
+
+          get '/demo/members_only', {}, @auth_headers
+
+          @first_is_batch_request = assigns(:is_batch_request)
+          @first_user = assigns(:user).dup
+          @first_access_token = response.headers['access-token']
+          @first_response_status = response.status
+
+          @user.reload
+          age_token(@user, @client_id)
+
+          # use expired auth header
+          get '/demo/members_only', {}, @auth_headers
+
+          @second_is_batch_request = assigns(:is_batch_request)
+          @second_user = assigns(:user).dup
+          @second_access_token = response.headers['access-token']
+          @second_response_status = response.status
+        end
+
+        after do
+          DeviseTokenAuth.change_headers_on_each_request = true
+        end
+
+        it 'should allow the first request through' do
+          assert_equal 200, @first_response_status
+        end
+
+        it 'should allow the second request through' do
+          assert_equal 200, @second_response_status
+        end
+
+        it 'should return auth headers from the first request' do
+          assert @first_access_token
+        end
+
+        it 'should not treat either requests as batch requests' do
+          refute @first_is_batch_request
+          refute @second_is_batch_request
+        end
+
+        it 'should return auth headers from the second request' do
+          assert @second_access_token
+        end
+
+        it 'should define user during first request' do
+          assert @first_user
+        end
+
+        it 'should define user during second request' do
+          assert @second_user
+        end
+      end
+
+      describe 'batch requests' do
+        describe 'success' do
+          before do
+            age_token(@user, @client_id)
+            #request.headers.merge!(@auth_headers)
+
+            get '/demo/members_only', {}, @auth_headers
+
+            @first_is_batch_request = assigns(:is_batch_request)
+            @first_user = assigns(:user)
+            @first_access_token = response.headers['access-token']
+
+            get '/demo/members_only', {}, @auth_headers
+
+            @second_is_batch_request = assigns(:is_batch_request)
+            @second_user = assigns(:user)
+            @second_access_token = response.headers['access-token']
+          end
+
+          it 'should allow both requests through' do
+            assert_equal 200, response.status
+          end
+
+          it 'should not treat the first request as a batch request' do
+            refute @first_is_batch_request
+          end
+
+          it 'should treat the second request as a batch request' do
+            assert @second_is_batch_request
+          end
+
+          it 'should return access token for first (non-batch) request' do
+            assert @first_access_token
+          end
+
+          it 'should also return auth headers for second (batched) requests' do
+            assert @second_access_token
+          end
+        end
+
+        describe 'time out' do
+          before do
+            @user.reload
+            age_token(@user, @client_id)
+
+            get '/demo/members_only', {}, @auth_headers
+
+            @first_is_batch_request = assigns(:is_batch_request)
+            @first_user = assigns(:user).dup
+            @first_access_token = response.headers['access-token']
+            @first_response_status = response.status
+
+            @user.reload
+            age_token(@user, @client_id)
+
+            # use expired auth header
+            get '/demo/members_only', {}, @auth_headers
+
+            @second_is_batch_request = assigns(:is_batch_request)
+            @second_user = assigns(:user)
+            @second_access_token = response.headers['access-token']
+            @second_response_status = response.status
+          end
+
+          it 'should allow the first request through' do
+            assert_equal 200, @first_response_status
+          end
+
+          it 'should not allow the second request through' do
+            assert_equal 401, @second_response_status
+          end
+
+          it 'should not treat first request as batch request' do
+            refute @secord_is_batch_request
+          end
+
+          it 'should return auth headers from the first request' do
+            assert @first_access_token
+          end
+
+          it 'should not treat second request as batch request' do
+            refute @secord_is_batch_request
+          end
+
+          it 'should not return auth headers from the second request' do
+            refute @second_access_token
+          end
+
+          it 'should define user during first request' do
+            assert @first_user
+          end
+
+          it 'should not define user during second request' do
+            refute @second_user
+          end
+        end
+      end
+    end
+  end
+end

data/test/controllers/devise_token_auth/confirmations_controller_test.rb

@@ -0,0 +1,107 @@
+require 'test_helper'
+
+#  was the web request successful?
+#  was the user redirected to the right page?
+#  was the user successfully authenticated?
+#  was the correct object stored in the response?
+#  was the appropriate message delivered in the json payload?
+
+class DeviseTokenAuth::ConfirmationsControllerTest < ActionController::TestCase
+  describe DeviseTokenAuth::ConfirmationsController do
+    describe "Confirmation" do
+      before do
+        @redirect_url = Faker::Internet.url
+        @new_user = users(:unconfirmed_email_user)
+        @new_user.send_confirmation_instructions({
+          redirect_url: @redirect_url
+        })
+        @mail          = ActionMailer::Base.deliveries.last
+        @token         = @mail.body.match(/confirmation_token=([^&]*)&/)[1]
+        @client_config = @mail.body.match(/config=([^&]*)&/)[1]
+      end
+
+      test 'should generate raw token' do
+        assert @token
+      end
+
+      test "should include config name as 'default' in confirmation link" do
+        assert_equal "default", @client_config
+      end
+
+      test "should store token hash in user" do
+        assert @new_user.confirmation_token
+      end
+
+      describe "success" do
+        before do
+          xhr :get, :show, {confirmation_token: @token, redirect_url: @redirect_url}
+          @user = assigns(:user)
+        end
+
+        test "user should now be confirmed" do
+          assert @user.confirmed?
+        end
+
+        test "should redirect to success url" do
+          assert_redirected_to(/^#{@redirect_url}/)
+        end
+      end
+
+      describe "failure" do
+        test "user should not be confirmed" do
+          assert_raises(ActionController::RoutingError) {
+            xhr :get, :show, {confirmation_token: "bogus"}
+          }
+          @user = assigns(:user)
+          refute @user.confirmed?
+        end
+      end
+    end
+
+    # test with non-standard user class
+    describe "Alternate user model" do
+      setup do
+        @request.env['devise.mapping'] = Devise.mappings[:mang]
+      end
+
+      teardown do
+        @request.env['devise.mapping'] = Devise.mappings[:user]
+      end
+
+      before do
+        @config_name = "altUser"
+        @new_user    = mangs(:unconfirmed_email_user)
+
+        @new_user.send_confirmation_instructions(client_config: @config_name)
+
+        @mail          = ActionMailer::Base.deliveries.last
+        @token         = @mail.body.match(/confirmation_token=(.*)\"/)[1]
+        @client_config = @mail.body.match(/config=(.*)\&/)[1]
+      end
+
+      test 'should generate raw token' do
+        assert @token
+      end
+
+      test "should include config name in confirmation link" do
+        assert_equal @config_name, @client_config
+      end
+
+      test "should store token hash in user" do
+        assert @new_user.confirmation_token
+      end
+
+      describe "success" do
+        before do
+          @redirect_url = Faker::Internet.url
+          xhr :get, :show, {confirmation_token: @token, redirect_url: @redirect_url}
+          @user = assigns(:user)
+        end
+
+        test "user should now be confirmed" do
+          assert @user.confirmed?
+        end
+      end
+    end
+  end
+end

data/test/controllers/devise_token_auth/omniauth_callbacks_controller_test.rb

@@ -0,0 +1,144 @@
+require 'test_helper'
+
+#  was the web request successful?
+#  was the user redirected to the right page?
+#  was the user successfully authenticated?
+#  was the correct object stored in the response?
+#  was the appropriate message delivered in the json payload?
+
+class OmniauthTest < ActionDispatch::IntegrationTest
+  setup do
+    OmniAuth.config.test_mode = true
+    OmniAuth.config.mock_auth[:facebook] = OmniAuth::AuthHash.new({
+      :provider => 'facebook',
+      :uid => '123545',
+      :info => {
+        name: 'chong',
+        email: 'chongbong@aol.com'
+      }
+    })
+  end
+
+  before do
+    @redirect_url = "http://ng-token-auth.dev/"
+  end
+
+  describe 'default user model' do
+    describe 'from api to provider' do
+      before do
+        get_via_redirect '/auth/facebook', {
+          auth_origin_url: @redirect_url
+        }
+
+        @user = assigns(:user)
+      end
+
+      test 'status should be success' do
+        assert_equal 200, response.status
+      end
+
+      test 'request should determine the correct resource_class' do
+        assert_equal 'User', controller.omniauth_params['resource_class']
+      end
+
+      test 'request should pass correct redirect_url' do
+        assert_equal @redirect_url, controller.omniauth_params['auth_origin_url']
+      end
+
+      test 'user should have been created' do
+        assert @user
+      end
+
+      test 'user should be assigned info from provider' do
+        assert_equal 'chongbong@aol.com', @user.email
+      end
+
+      test 'user should be of the correct class' do
+        assert_equal User, @user.class
+      end
+
+      test 'response contains all serializable attributes for user' do
+        post_message = JSON.parse(/postMessage\((?<data>.*), '\*'\);/m.match(response.body)[:data])
+
+        assert post_message["id"]
+        assert post_message["email"]
+        assert post_message["uid"]
+        assert post_message["name"]
+        assert post_message["favorite_color"]
+        assert post_message["message"]
+        assert post_message["client_id"]
+        assert post_message["auth_token"]
+        refute post_message["tokens"]
+        refute post_message["password"]
+      end
+
+      test 'session vars have been cleared' do
+        refute request.session['dta.omniauth.auth']
+        refute request.session['dta.omniauth.params']
+      end
+    end
+
+    describe 'pass additional params' do
+      before do
+        @fav_color = 'alizarin crimson'
+        @unpermitted_param = "M. Bison"
+        get_via_redirect '/auth/facebook', {
+          auth_origin_url: @redirect_url,
+          favorite_color: @fav_color,
+          name: @unpermitted_param
+        }
+
+        @user = assigns(:user)
+      end
+
+      test 'status shows success' do
+        assert_equal 200, response.status
+      end
+
+      test 'additional attribute was passed' do
+        assert_equal @fav_color, @user.favorite_color
+      end
+
+      test 'non-whitelisted attributes are ignored' do
+        refute_equal @unpermitted_param, @user.name
+      end
+    end
+  end
+
+
+  describe 'alternate user model' do
+    describe 'from api to provider' do
+      before do
+        get_via_redirect '/mangs/facebook', {
+          auth_origin_url: @redirect_url
+        }
+
+        @user = assigns(:user)
+      end
+
+      test 'status should be success' do
+        assert_equal 200, response.status
+      end
+
+      test 'request should determine the correct resource_class' do
+        assert_equal 'Mang', controller.omniauth_params['resource_class']
+      end
+
+      test 'request should pass correct redirect_url' do
+        assert_equal @redirect_url, controller.omniauth_params['auth_origin_url']
+      end
+
+      test 'user should have been created' do
+        assert @user
+      end
+
+      test 'user should be assigned info from provider' do
+        assert_equal 'chongbong@aol.com', @user.email
+      end
+
+      test 'user should be of the correct class' do
+        assert_equal Mang, @user.class
+      end
+    end
+  end
+end