aboutsummaryrefslogblamecommitdiffstats
path: root/activemodel/test/cases/secure_password_test.rb
blob: 6d56c8344a99c4549802ea599b709c14abfdff4b (plain) (tree)
1
2
3
4
5
6
7
8
9
10

                      
                        


                                                
                                 
                                                             

                                               
                    
                          



                                                                                                        

     
             
                                                             

     
                                                                                       


                                    

                                                                                

     











                                                                              




                                                                        
                                                                  
                       











                                                                
                                                                                 

                                          




                                                                                    





                                                                                 

     



                                                                             
     
 






                                                                                    
 


                                                                             
 
                                                                                    

                                                     
 
                                                                 
 

                                                   
 
                                                                 

     


                                                                          
     
 




                                                                                




                                                                                                    
 






                                                                        
                                                                                         

                                                   




                                                                                             





                                                                                          
     
 



                                                                                     
     
 





                                                                                            























                                                                                 
     





                                       
     
 


                                                                                       

                                                                         

     
                                                                                    
         



                                                  


                                                                  
                                                
       

     

                                                                                
 

                                                                     
     
   
require 'cases/helper'
require 'models/user'
require 'models/visitor'

class SecurePasswordTest < ActiveModel::TestCase
  setup do
    # Used only to speed up tests
    @original_min_cost = ActiveModel::SecurePassword.min_cost
    ActiveModel::SecurePassword.min_cost = true

    @user = User.new
    @visitor = Visitor.new

    # Simulate loading an existing user from the DB
    @existing_user = User.new
    @existing_user.password_digest = BCrypt::Password.create('password', cost: BCrypt::Engine::MIN_COST)
  end

  teardown do
    ActiveModel::SecurePassword.min_cost = @original_min_cost
  end

  test "automatically include ActiveModel::Validations when validations are enabled" do
    assert_respond_to @user, :valid?
  end

  test "don't include ActiveModel::Validations when validations are disabled" do
    assert_not_respond_to @visitor, :valid?
  end

  test "create a new user with validations and valid password/confirmation" do
    @user.password = 'password'
    @user.password_confirmation = 'password'

    assert @user.valid?(:create), 'user should be valid'

    @user.password = 'a' * 72
    @user.password_confirmation = 'a' * 72

    assert @user.valid?(:create), 'user should be valid'
  end

  test "create a new user with validation and a spaces only password" do
    @user.password = ' ' * 72
    assert @user.valid?(:create), 'user should be valid'
  end

  test "create a new user with validation and a blank password" do
    @user.password = ''
    assert !@user.valid?(:create), 'user should be invalid'
    assert_equal 1, @user.errors.count
    assert_equal ["can't be blank"], @user.errors[:password]
  end

  test "create a new user with validation and a nil password" do
    @user.password = nil
    assert !@user.valid?(:create), 'user should be invalid'
    assert_equal 1, @user.errors.count
    assert_equal ["can't be blank"], @user.errors[:password]
  end

  test 'create a new user with validation and password length greater than 72' do
    @user.password = 'a' * 73
    @user.password_confirmation = 'a' * 73
    assert !@user.valid?(:create), 'user should be invalid'
    assert_equal 1, @user.errors.count
    assert_equal ["is too long (maximum is 72 characters)"], @user.errors[:password]
  end

  test "create a new user with validation and a blank password confirmation" do
    @user.password = 'password'
    @user.password_confirmation = ''
    assert !@user.valid?(:create), 'user should be invalid'
    assert_equal 1, @user.errors.count
    assert_equal ["doesn't match Password"], @user.errors[:password_confirmation]
  end

  test "create a new user with validation and a nil password confirmation" do
    @user.password = 'password'
    @user.password_confirmation = nil
    assert @user.valid?(:create), 'user should be valid'
  end

  test "create a new user with validation and an incorrect password confirmation" do
    @user.password = 'password'
    @user.password_confirmation = 'something else'
    assert !@user.valid?(:create), 'user should be invalid'
    assert_equal 1, @user.errors.count
    assert_equal ["doesn't match Password"], @user.errors[:password_confirmation]
  end

  test "update an existing user with validation and no change in password" do
    assert @existing_user.valid?(:update), 'user should be valid'
  end

  test "update an existing user with validations and valid password/confirmation" do
    @existing_user.password = 'password'
    @existing_user.password_confirmation = 'password'

    assert @existing_user.valid?(:update), 'user should be valid'

    @existing_user.password = 'a' * 72
    @existing_user.password_confirmation = 'a' * 72

    assert @existing_user.valid?(:update), 'user should be valid'
  end

  test "updating an existing user with validation and a blank password" do
    @existing_user.password = ''
    assert @existing_user.valid?(:update), 'user should be valid'
  end

  test "updating an existing user with validation and a spaces only password" do
    @user.password = ' ' * 72
    assert @user.valid?(:update), 'user should be valid'
  end

  test "updating an existing user with validation and a blank password and password_confirmation" do
    @existing_user.password = ''
    @existing_user.password_confirmation = ''
    assert @existing_user.valid?(:update), 'user should be valid'
  end

  test "updating an existing user with validation and a nil password" do
    @existing_user.password = nil
    assert !@existing_user.valid?(:update), 'user should be invalid'
    assert_equal 1, @existing_user.errors.count
    assert_equal ["can't be blank"], @existing_user.errors[:password]
  end

  test 'updating an existing user with validation and password length greater than 72' do
    @existing_user.password = 'a' * 73
    @existing_user.password_confirmation = 'a' * 73
    assert !@existing_user.valid?(:update), 'user should be invalid'
    assert_equal 1, @existing_user.errors.count
    assert_equal ["is too long (maximum is 72 characters)"], @existing_user.errors[:password]
  end

  test "updating an existing user with validation and a blank password confirmation" do
    @existing_user.password = 'password'
    @existing_user.password_confirmation = ''
    assert !@existing_user.valid?(:update), 'user should be invalid'
    assert_equal 1, @existing_user.errors.count
    assert_equal ["doesn't match Password"], @existing_user.errors[:password_confirmation]
  end

  test "updating an existing user with validation and a nil password confirmation" do
    @existing_user.password = 'password'
    @existing_user.password_confirmation = nil
    assert @existing_user.valid?(:update), 'user should be valid'
  end

  test "updating an existing user with validation and an incorrect password confirmation" do
    @existing_user.password = 'password'
    @existing_user.password_confirmation = 'something else'
    assert !@existing_user.valid?(:update), 'user should be invalid'
    assert_equal 1, @existing_user.errors.count
    assert_equal ["doesn't match Password"], @existing_user.errors[:password_confirmation]
  end

  test "updating an existing user with validation and a blank password digest" do
    @existing_user.password_digest = ''
    assert !@existing_user.valid?(:update), 'user should be invalid'
    assert_equal 1, @existing_user.errors.count
    assert_equal ["can't be blank"], @existing_user.errors[:password]
  end

  test "updating an existing user with validation and a nil password digest" do
    @existing_user.password_digest = nil
    assert !@existing_user.valid?(:update), 'user should be invalid'
    assert_equal 1, @existing_user.errors.count
    assert_equal ["can't be blank"], @existing_user.errors[:password]
  end

  test "setting a blank password should not change an existing password" do
    @existing_user.password = ''
    assert @existing_user.password_digest == 'password'
  end

  test "setting a nil password should clear an existing password" do
    @existing_user.password = nil
    assert_equal nil, @existing_user.password_digest
  end

  test "authenticate" do
    @user.password = "secret"

    assert !@user.authenticate("wrong")
    assert @user.authenticate("secret")
  end

  test "Password digest cost defaults to bcrypt default cost when min_cost is false" do
    ActiveModel::SecurePassword.min_cost = false

    @user.password = "secret"
    assert_equal BCrypt::Engine::DEFAULT_COST, @user.password_digest.cost
  end

  test "Password digest cost honors bcrypt cost attribute when min_cost is false" do
    begin
      original_bcrypt_cost = BCrypt::Engine.cost
      ActiveModel::SecurePassword.min_cost = false
      BCrypt::Engine.cost = 5

      @user.password = "secret"
      assert_equal BCrypt::Engine.cost, @user.password_digest.cost
    ensure
      BCrypt::Engine.cost = original_bcrypt_cost
    end
  end

  test "Password digest cost can be set to bcrypt min cost to speed up tests" do
    ActiveModel::SecurePassword.min_cost = true

    @user.password = "secret"
    assert_equal BCrypt::Engine::MIN_COST, @user.password_digest.cost
  end
end