23633720a8
merge tag v4.5.0
4 months ago
86df8feb80
merge v4.4.0 into mastodon_4_3_0
4 months ago
ce2481a81b
Move OTP secret length to configuration ( #32125 )
2 years ago
bf8eaaa9a5
Convert controller spec for security_key_options endpoint to request spec ( #31938 )
2 years ago
6b6a80b407
Remove `body_as_json` in favor of built-in `response.parsed_body` for JSON response specs ( #31749 )
2 years ago
e1b5f3fc6f
Use `response.parsed_body` for html response checks ( #31750 )
2 years ago
f1003b2560
Enable "zero monkey patching" mode in RSpec ( #31614 )
2 years ago
f1300ad284
Rename jobs/attachments rspec tag names ( #29762 )
2 years ago
1540f42522
Better tests for auth/registrations#update ( #29303 )
2 years ago
d51c3ac087
Add a missing spec to `SessionsController#webauthn_options` ( #29277 )
2 years ago
64f9939e39
Use `capture_emails` helper to improve email assertions in specs ( #29245 )
2 years ago
3454fcbd71
Reduce round trips in auth/sessions spec ( #29233 )
2 years ago
6fe2a47357
Add rate-limit of TOTP authentication attempts at controller level ( #28801 )
2 years ago
e2d9635074
Add notification email on invalid second authenticator ( #28822 )
2 years ago
3593ee2e36
Add rate-limit of TOTP authentication attempts at controller level ( #28801 )
2 years ago
e621c1c44c
Fix registrations not checking MX records for email domain blocks requiring approval ( #28608 )
2 years ago
00341c70ff
Use Sidekiq `fake!` instead of `inline!` in specs ( #25369 )
2 years ago
dfdadb92e8
Add ability to require approval when users sign up using specific email domains ( #28468 )
2 years ago
513d35969e
Fix `RSpec/LetSetup` cop in auth controller specs ( #28464 )
2 years ago
6fed0fcbaa
Remove unneeded settings cleanup from specs ( #28425 )
2 years ago
b2c5b20ef2
Fix `RSpec/AnyInstance` cop ( #27810 )
2 years ago
69d00e2721
Fix `RSpec/InstanceVariable` cop ( #27766 )
2 years ago
e545978076
Use framework helpers instead of i-vars in controller specs ( #27767 )
2 years ago
2e6bf60f15
Use `deliveries.size` in mailer-related examples in controller specs ( #27589 )
2 years ago
6c5a2233a8
Fix `RSpec/StubbedMock` cop ( #25552 )
...
Co-authored-by: Claire <claire.github-309c@sitedethib.com>
3 years ago
05f9e39b32
Fix `RSpec/VerifiedDoubles` cop ( #25469 )
3 years ago
6c0e3f490a
Fix RSpec/MissingExampleGroupArgument cop ( #25310 )
3 years ago
0f2c16ac4b
Fix RSpec/NoExpectationExample cop ( #25103 )
3 years ago
604e1c2b11
Remove usage of random sample values in specs ( #24869 )
3 years ago
a610a02d4f
Fix RSpec/ScatteredSetup cop ( #24848 )
3 years ago
c97b611b6b
Fix RSpec/InferredSpecType cop ( #24736 )
3 years ago
710745e16b
Fix RSpec/ContextWording cop ( #24739 )
3 years ago
d00e45a7d3
Fix Rails/I18nLocaleAssignment cop ( #24693 )
3 years ago
e98c86050a
Refactor `Cache-Control` and `Vary` definitions ( #24347 )
3 years ago
688287c59d
Coverage improvement round-out following up previous work ( #23987 )
3 years ago
84cc805cae
Enable Style/FrozenStringLiteralComment for specs ( #23790 )
3 years ago
5116347eb7
Autofix Rubocop RSpec/BeEq ( #23740 )
3 years ago
4552685f6b
Autofix Rubocop RSpec/LeadingSubject ( #23670 )
3 years ago
aef0051fd0
Enable Rubocop HTTP status rules ( #23717 )
3 years ago
81ad6c2e39
Autofix Rubocop Style/StringLiterals ( #23695 )
3 years ago
634368c491
Autofix Rubocop Lint/SymbolConversion ( #23683 )
3 years ago
669f6d2c0a
Run rubocop formatting except line length ( #23632 )
3 years ago
5fb1c3e934
Revoke all authorized applications on password reset ( #21325 )
...
* Clear sessions on password change
* Rename User::clear_sessions to revoke_access for a clearer meaning
* Add reset paassword controller test
* Use User.find instead of User.find_for_authentication for reset password test
* Use redirect and render for better test meaning in reset password
Co-authored-by: Effy Elden <effy@effy.space>
3 years ago
327eed0076
Fix suspicious sign-in mails never being sent ( #18599 )
...
* Add tests
* Fix suspicious sign-in mails never being sent
4 years ago
6221b36b27
Remove sign-in token authentication, instead send e-mail about new sign-in ( #17970 )
4 years ago
e38fc319dc
Refactor and improve tests ( #17386 )
...
* Change account and user fabricators to simplify and improve tests
- `Fabricate(:account)` implicitly fabricates an associated `user` if
no `domain` attribute is given (an account with `domain: nil` is
considered a local account, but no user record was created), unless
`user: nil` is passed
- `Fabricate(:account, user: Fabricate(:user))` should still be possible
but is discouraged.
* Fix and refactor tests
- avoid passing unneeded attributes to `Fabricate(:user)` or
`Fabricate(:account)`
- avoid embedding `Fabricate(:user)` into a `Fabricate(:account)` or the other
way around
- prefer `Fabricate(:user, account_attributes: …)` to
`Fabricate(:user, account: Fabricate(:account, …)`
- also, some tests were using remote accounts with local user records, which is
not representative of production code.
4 years ago
8e84ebf0cb
Remove IP tracking columns from users table ( #16409 )
4 years ago
2396c9061a
Fix webauthn secure key authentication ( #16792 )
...
* Add tests
* Fix webauthn secure key authentication
Fixes #16769
4 years ago
2688f18d06
Fix authentication failures after going halfway through a sign-in attempt ( #16607 )
...
* Add tests
* Add security-related tests
My first (unpublished) attempt at fixing the issues introduced (extremely
hard-to-exploit) security vulnerabilities, addressing them in a test.
* Fix authentication failures after going halfway through a sign-in attempt
* Refactor `authenticate_with_sign_in_token` and `authenticate_with_two_factor` to make the two authentication steps more obvious
4 years ago
24f9ea7818
Fix webauthn secure key authentication ( #16792 )
...
* Add tests
* Fix webauthn secure key authentication
Fixes #16769
5 years ago
Misty De Meo
David Roetzel
Matt Jankowski
Damien Mathieu
Wolfgang Fournès
Claire
Eugen Rochko
Nick Schonning
Francis Murillo