7d33fba7af
Upgrade devise, devise-two-factor, and attr_encrypted Devise 4 includes support for Rails 5, working towards #14286. devise-async doesn't support Devise 4.0 and in 4.1 the bug that was blocking using Devise's built-in ActiveJob integration was fixed. So devise-async is removed. devise-two-factor 3.0.0 is required for Devise 4 support. attr_encrypted and encryptor are optional but recommended upgrades for devise-two-factor 3.0.0. The mode and algorithm will need to be changed in order to update to attr_encrypted 4.x in the future. See merge request !4216
122 lines
3.8 KiB
Ruby
122 lines
3.8 KiB
Ruby
require 'spec_helper'
|
|
|
|
describe SessionsController do
|
|
describe '#create' do
|
|
before do
|
|
@request.env['devise.mapping'] = Devise.mappings[:user]
|
|
end
|
|
|
|
context 'when using standard authentications' do
|
|
context 'invalid password' do
|
|
it 'does not authenticate user' do
|
|
post(:create, user: { login: 'invalid', password: 'invalid' })
|
|
|
|
expect(response)
|
|
.to set_flash.now[:alert].to /Invalid Login or password/
|
|
end
|
|
end
|
|
|
|
context 'when using valid password' do
|
|
let(:user) { create(:user) }
|
|
|
|
it 'authenticates user correctly' do
|
|
post(:create, user: { login: user.username, password: user.password })
|
|
|
|
expect(response).to set_flash.to /Signed in successfully/
|
|
expect(subject.current_user). to eq user
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'when using two-factor authentication' do
|
|
let(:user) { create(:user, :two_factor) }
|
|
|
|
def authenticate_2fa(user_params)
|
|
post(:create, { user: user_params }, { otp_user_id: user.id })
|
|
end
|
|
|
|
context 'remember_me field' do
|
|
it 'sets a remember_user_token cookie when enabled' do
|
|
allow(controller).to receive(:find_user).and_return(user)
|
|
expect(controller).
|
|
to receive(:remember_me).with(user).and_call_original
|
|
|
|
authenticate_2fa(remember_me: '1', otp_attempt: user.current_otp)
|
|
|
|
expect(response.cookies['remember_user_token']).to be_present
|
|
end
|
|
|
|
it 'does nothing when disabled' do
|
|
allow(controller).to receive(:find_user).and_return(user)
|
|
expect(controller).not_to receive(:remember_me)
|
|
|
|
authenticate_2fa(remember_me: '0', otp_attempt: user.current_otp)
|
|
|
|
expect(response.cookies['remember_user_token']).to be_nil
|
|
end
|
|
end
|
|
|
|
##
|
|
# See #14900 issue
|
|
#
|
|
context 'when authenticating with login and OTP of another user' do
|
|
context 'when another user has 2FA enabled' do
|
|
let(:another_user) { create(:user, :two_factor) }
|
|
|
|
context 'when OTP is valid for another user' do
|
|
it 'does not authenticate' do
|
|
authenticate_2fa(login: another_user.username,
|
|
otp_attempt: another_user.current_otp)
|
|
|
|
expect(subject.current_user).not_to eq another_user
|
|
end
|
|
end
|
|
|
|
context 'when OTP is invalid for another user' do
|
|
it 'does not authenticate' do
|
|
authenticate_2fa(login: another_user.username,
|
|
otp_attempt: 'invalid')
|
|
|
|
expect(subject.current_user).not_to eq another_user
|
|
end
|
|
end
|
|
|
|
context 'when authenticating with OTP' do
|
|
context 'when OTP is valid' do
|
|
it 'authenticates correctly' do
|
|
authenticate_2fa(otp_attempt: user.current_otp)
|
|
|
|
expect(subject.current_user).to eq user
|
|
end
|
|
end
|
|
|
|
context 'when OTP is invalid' do
|
|
before { authenticate_2fa(otp_attempt: 'invalid') }
|
|
|
|
it 'does not authenticate' do
|
|
expect(subject.current_user).not_to eq user
|
|
end
|
|
|
|
it 'warns about invalid OTP code' do
|
|
expect(response).to set_flash.now[:alert]
|
|
.to /Invalid two-factor code/
|
|
end
|
|
end
|
|
end
|
|
|
|
context 'when another user does not have 2FA enabled' do
|
|
let(:another_user) { create(:user) }
|
|
|
|
it 'does not leak that 2FA is disabled for another user' do
|
|
authenticate_2fa(login: another_user.username,
|
|
otp_attempt: 'invalid')
|
|
|
|
expect(response).to set_flash.now[:alert]
|
|
.to /Invalid two-factor code/
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|
|
end
|