introducing lockable implementation

test/integration/lockable_test.rb

@@ -0,0 +1,83 @@
+require 'test/test_helper'
+
+class LockTest < ActionController::IntegrationTest
+  
+  def visit_user_unlock_with_token(unlock_token)
+    visit user_unlock_path(:unlock_token => unlock_token)
+  end
+
+  test 'user should be able to request a new unlock token' do
+    user = create_user(:locked => true)
+    ActionMailer::Base.deliveries.clear
+
+    visit new_user_session_path
+    click_link 'Didn\'t receive unlock instructions?'
+
+    fill_in 'email', :with => user.email
+    click_button 'Resend unlock instructions'
+
+    assert_template 'sessions/new'
+    assert_contain 'You will receive an email with instructions about how to unlock your account in a few minutes'
+    assert_equal 1, ActionMailer::Base.deliveries.size
+  end
+
+  test 'unlocked user should not be able to request a unlock token' do
+    user = create_user(:locked => false)
+    ActionMailer::Base.deliveries.clear
+
+    visit new_user_session_path
+    click_link 'Didn\'t receive unlock instructions?'
+
+    fill_in 'email', :with => user.email
+    click_button 'Resend unlock instructions'
+
+    assert_template 'unlocks/new'
+    assert_contain 'not locked'
+    assert_equal 0, ActionMailer::Base.deliveries.size
+  end
+
+  test 'user with invalid unlock token should not be able to unlock an account' do
+    visit_user_unlock_with_token('invalid_token')
+
+    assert_response :success
+    assert_template 'unlocks/new'
+    assert_have_selector '#errorExplanation'
+    assert_contain /Unlock token(.*)invalid/
+  end
+
+  test "locked user should be able to unlock account" do
+    user = create_user(:locked => true)
+    assert user.locked?
+
+    visit_user_unlock_with_token(user.unlock_token)
+
+    assert_template 'home/index'
+    assert_contain 'Your account was successfully unlocked.'
+
+    assert_not user.reload.locked?
+  end
+
+  test "sign in user automatically after unlocking it's account" do
+    user = create_user(:locked => true)
+    visit_user_unlock_with_token(user.unlock_token)
+
+    assert warden.authenticated?(:user)
+  end
+
+  test "user should not be able to sign in when locked" do
+    user = sign_in_as_user(:locked => true)
+    assert_template 'sessions/new'
+    assert_contain 'Your account is locked.'
+    assert_not warden.authenticated?(:user)
+  end
+
+  test 'error message is configurable by resource name' do
+    store_translations :en, :devise => {
+      :sessions => { :admin => { :locked => "You are locked!" } }
+    } do
+      get new_admin_session_path(:locked => true)
+      assert_contain 'You are locked!'
+    end
+  end
+
+end

test/mailers/unlock_instructions_test.rb

@@ -0,0 +1,62 @@
+require 'test/test_helper'
+
+class UnlockInstructionsTest < ActionMailer::TestCase
+
+  def setup
+    setup_mailer
+    DeviseMailer.sender = 'test@example.com'
+  end
+
+  def user
+    @user ||= begin
+      user = create_user
+      user.lock!
+      user
+    end
+  end
+
+  def mail
+    @mail ||= begin
+      user
+      ActionMailer::Base.deliveries.last
+    end
+  end
+
+  test 'email sent after locking the user' do
+    assert_not_nil mail
+  end
+
+  test 'content type should be set to html' do
+    assert_equal 'text/html', mail.content_type
+  end
+
+  test 'send unlock instructions to the user email' do
+    assert_equal [user.email], mail.to
+  end
+
+  test 'setup sender from configuration' do
+    assert_equal ['test@example.com'], mail.from
+  end
+
+  test 'setup subject from I18n' do
+    store_translations :en, :devise => { :mailer => { :unlock_instructions => 'Unlock instructions' } } do
+      assert_equal 'Unlock instructions', mail.subject
+    end
+  end
+
+  test 'subject namespaced by model' do
+    store_translations :en, :devise => { :mailer => { :user => { :unlock_instructions => 'User Unlock Instructions' } } } do
+      assert_equal 'User Unlock Instructions', mail.subject
+    end
+  end
+
+  test 'body should have user info' do
+    assert_match /#{user.email}/, mail.body
+  end
+
+  test 'body should have link to unlock the account' do
+    host = ActionMailer::Base.default_url_options[:host]
+    unlock_url_regexp = %r{<a href=\"http://#{host}/users/unlock\?unlock_token=#{user.unlock_token}">}
+    assert_match unlock_url_regexp, mail.body
+  end
+end

test/models/lockable_test.rb

@@ -0,0 +1,202 @@
+require 'test/test_helper'
+
+class LockableTest < ActiveSupport::TestCase
+  
+  def setup
+    setup_mailer
+  end
+  
+  test "should increment failed attempts on unsuccessful authentication" do
+    user = create_user
+    assert_equal 0, user.failed_attempts
+    authenticated_user = User.authenticate(:email => user.email, :password => "anotherpassword")
+    assert_equal 1, user.reload.failed_attempts
+  end
+  
+  test "should lock account base on maximum_attempts" do
+    user = create_user
+    attempts = Devise.maximum_attempts + 1
+    attempts.times { authenticated_user = User.authenticate(:email => user.email, :password => "anotherpassword") }
+    assert user.reload.locked?
+  end
+  
+  test "should respect maximum attempts configuration" do
+    user = create_user
+    swap Devise, :maximum_attempts => 2 do
+      3.times { authenticated_user = User.authenticate(:email => user.email, :password => "anotherpassword") }
+      assert user.reload.locked?
+    end
+  end
+  
+  test "should clear failed_attempts on successfull sign in" do
+    user = create_user
+    User.authenticate(:email => user.email, :password => "anotherpassword")
+    assert_equal 1, user.reload.failed_attempts
+    User.authenticate(:email => user.email, :password => "123456")
+    assert_equal 0, user.reload.failed_attempts
+  end
+
+  test "should verify wheter a user is locked or not" do
+    user = create_user
+    assert_not user.locked?
+    user.lock!
+    assert user.locked?
+  end
+
+  test "active? should be the opposite of locked?" do
+    user = create_user
+    user.confirm!
+    assert user.active?
+    user.lock!
+    assert_not user.active?
+  end
+
+  test "should unlock an user by cleaning locked_at, falied_attempts and unlock_token" do
+    user = create_user
+    user.lock!
+    assert_not_nil user.reload.locked_at
+    assert_not_nil user.reload.unlock_token
+    user.unlock!
+    assert_nil user.reload.locked_at
+    assert_nil user.reload.unlock_token
+    assert 0, user.reload.failed_attempts
+  end
+  
+  test 'should not unlcok an unlocked user' do
+    user = create_user
+    assert_not user.unlock!
+    assert_match /not locked/, user.errors[:email]
+  end
+
+  test "new user should not be locked and should have zero failed_attempts" do
+    assert_not new_user.locked?
+    assert_equal 0, create_user.failed_attempts
+  end
+
+  test "should unlock user after unlock_in period" do
+    swap Devise, :unlock_in => 3.hours do
+      user = new_user
+      user.locked_at = 2.hours.ago
+      assert user.locked?
+
+      Devise.unlock_in = 1.hour
+      assert_not user.locked?
+    end
+  end
+
+  test "should not unlock in 'unlock_in' if :time unlock strategy is not set" do
+    swap Devise, :unlock_strategy => :email do
+      user = new_user
+      user.locked_at = 2.hours.ago
+      assert user.locked?
+    end
+  end
+
+  test "should set unlock_token when locking" do
+    user = create_user
+    assert_nil user.unlock_token
+    user.lock!
+    assert_not_nil user.unlock_token
+  end
+
+  test 'should not regenerate unlock token if it already exists' do
+    user = create_user
+    user.lock!
+    3.times do
+      token = user.unlock_token
+      user.resend_unlock!
+      assert_equal token, user.unlock_token
+    end
+  end
+
+  test "should never generate the same unlock token for different users" do
+    unlock_tokens = []
+    3.times do
+      user = create_user
+      user.lock!
+      token = user.unlock_token
+      assert !unlock_tokens.include?(token)
+      unlock_tokens << token
+    end
+  end
+
+  test "should not generate unlock_token when :email is not an unlock strategy" do
+    swap Devise, :unlock_strategy => :time do
+      user = create_user
+      user.lock!
+      assert_nil user.unlock_token
+    end
+  end
+
+  test "should send email with unlock instructions when :email is an unlock strategy" do
+    swap Devise, :unlock_strategy => :email do
+      user = create_user
+      assert_email_sent do
+        user.lock!
+      end
+    end
+  end
+
+  test "should not send email with unlock instructions when :email is not an unlock strategy" do
+    swap Devise, :unlock_strategy => :time do
+      user = create_user
+      assert_email_not_sent do
+        user.lock!
+      end
+    end
+  end
+
+  test 'should find and unlock an user automatically' do
+    user = create_user
+    user.lock!
+    locked_user = User.unlock!(:unlock_token => user.unlock_token)
+    assert_equal locked_user, user
+    assert_not user.reload.locked?
+  end
+
+  test 'should return a new record with errors when a invalid token is given' do
+    locked_user = User.unlock!(:unlock_token => 'invalid_token')
+    assert locked_user.new_record?
+    assert_match /invalid/, locked_user.errors[:unlock_token]
+  end
+
+  test 'should return a new record with errors when a blank token is given' do
+    locked_user = User.unlock!(:unlock_token => '')
+    assert locked_user.new_record?
+    assert_match /blank/, locked_user.errors[:unlock_token]
+  end
+
+  test 'should authenticate a unlocked user' do
+    user = create_user
+    user.lock!
+    user.unlock!
+    authenticated_user = User.authenticate(:email => user.email, :password => user.password)
+    assert_equal authenticated_user, user
+  end
+
+  test 'should find a user to send unlock instructions' do
+    user = create_user
+    user.lock!
+    unlock_user = User.send_unlock_instructions(:email => user.email)
+    assert_equal unlock_user, user
+  end
+
+  test 'should return a new user if no email was found' do
+    unlock_user = User.send_unlock_instructions(:email => "invalid@email.com")
+    assert unlock_user.new_record?
+  end
+
+  test 'should add error to new user email if no email was found' do
+    unlock_user = User.send_unlock_instructions(:email => "invalid@email.com")
+    assert unlock_user.errors[:email]
+    assert_equal 'not found', unlock_user.errors[:email]
+  end
+
+  test 'should not be able to send instructions if the user is not locked' do
+    user = create_user
+    assert_not user.resend_unlock!
+    assert_not user.locked?
+    assert_equal 'not locked', user.errors[:email]
+  end
+
+end

test/models_test.rb

@@ -24,6 +24,10 @@ class Timeoutable < User
   devise :authenticatable, :timeoutable
 end
 
+class Lockable < User
+  devise :authenticatable, :lockable
+end
+
 class IsValidatable < User
   devise :authenticatable, :validatable
 end
@@ -33,7 +37,7 @@ class Devisable < User
 end
 
 class Exceptable < User
-  devise :all, :except => [:recoverable, :rememberable, :validatable]
+  devise :all, :except => [:recoverable, :rememberable, :validatable, :lockable]
 end
 
 class Configurable < User
@@ -84,13 +88,17 @@ class ActiveRecordTest < ActiveSupport::TestCase
     assert_include_modules Timeoutable, :authenticatable, :timeoutable
   end
 
+  test 'add lockable module only' do
+    assert_include_modules Lockable, :authenticatable, :lockable
+  end
+
   test 'add validatable module only' do
     assert_include_modules IsValidatable, :authenticatable, :validatable
   end
 
   test 'add all modules' do
     assert_include_modules Devisable,
-      :authenticatable, :confirmable, :recoverable, :rememberable, :trackable, :validatable
+      :authenticatable, :confirmable, :recoverable, :rememberable, :trackable, :validatable, :lockable
   end
 
   test 'configure modules with except option' do

test/orm/active_record.rb

@@ -16,6 +16,7 @@ ActiveRecord::Schema.define(:version => 1) do
         t.recoverable
         t.rememberable
         t.trackable
+        t.lockable
       end
 
       t.timestamps

test/rails_app/app/active_record/admin.rb

@@ -1,5 +1,5 @@
 class Admin < ActiveRecord::Base
-  devise :all, :timeoutable, :except => [:recoverable, :confirmable, :rememberable, :validatable, :trackable]
+  devise :all, :timeoutable, :except => [:recoverable, :confirmable, :rememberable, :validatable, :trackable, :lockable]
 
   def self.find_for_authentication(conditions)
     last(:conditions => conditions)

test/rails_app/config/initializers/devise.rb

@@ -8,7 +8,7 @@ Devise.setup do |config|
   # Remember that Devise includes other modules on its own (like :activatable
   # and :timeoutable) which are not included here and also plugins. So be sure
   # to check the docs for a complete set.
-  config.all = [:authenticatable, :confirmable, :recoverable, :rememberable, :trackable, :validatable]
+  config.all = [:authenticatable, :confirmable, :recoverable, :rememberable, :trackable, :validatable, :lockable]
 
   # Invoke `rake secret` and use the printed value to setup a pepper to generate
   # the encrypted password. By default no pepper is used.
@@ -54,6 +54,18 @@ Devise.setup do |config|
   # are using only default views.
   # config.scoped_views = true
 
+  # Number of authentication tries before locking an account.
+  # config.maximum_attempts = 5
+
+  # Defines which strategy will be used to unlock an account.
+  # :email = Sends an unlock link to the user email
+  # :time  = Reanables login after a certain ammount of time (see :unlock_in below)
+  # :both  = enables both strategies
+  # config.unlock_strategy = :both
+
+  # Time interval to unlock the account if :time is enabled as unlock_strategy.
+  # config.unlock_in = 1.hour
+
   # If you want to use other strategies, that are not (yet) supported by Devise,
   # you can configure them inside the config.warden block. The example below
   # allows you to setup OAuth, using http://github.com/roman/warden_oauth

test/support/integration_tests_helper.rb

@@ -10,6 +10,7 @@ class ActionController::IntegrationTest
         :email => 'user@test.com', :password => '123456', :password_confirmation => '123456', :created_at => Time.now.utc
       )
       user.confirm! unless options[:confirm] == false
+      user.lock! if options[:locked] == true
       user
     end
   end