Support Rails 8.0 and 8.1 (#1686)

* Support Rails 8.0 and 8.1

The gemspec already allowed Rails 8.1 (`< 8.2`), but nothing in CI
exercised anything newer than Rails 7.0, so support past 7.0 was
asserted rather than verified. This adds real coverage.

- Add gemfiles/rails_8_0.gemfile and gemfiles/rails_8_1.gemfile, with
  the Rails version pinned to the minor (`~> 8.0.0` / `~> 8.1.0`) so
  each job tests the version it names.
- Add matching Appraisals entries.
- Add both gemfiles to the CI matrix, excluding Ruby < 3.2 since Rails 8
  requires Ruby >= 3.2.
- Use `check_all_pending!` in the test helper when available;
  `check_pending!` was deprecated in Rails 7.1 and removed in Rails 8.0.
- Widen the sqlite3 dev dependency, since Rails 8 needs sqlite3 2.x.
- Widen the mongoid dev dependency ceiling to `< 10`; mongoid 7.x caps
  activemodel at `< 6.1`, which makes Rails 8 unresolvable.
- Bump the rails ceiling to `< 8.3` so 8.2 is allowed when it ships.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Pin each gemfile to the Rails version it names

The gemfiles used `~> 7.0`-style constraints, which allow any 7.x. They
only resolved to the version in their filename because the `mongoid
'< 8'` dev dependency transitively capped activemodel and held Rails
down. Widening that ceiling for Rails 8 removed the cap, and
rails_7_0.gemfile silently began resolving to Rails 7.2 — which is what
made the omniauth tests fail.

Pin to the minor (`~> 7.0.0`) so each job tests the version it claims
and resolution cannot drift when an unrelated dependency changes.

* Revert "Pin each gemfile to the Rails version it names"

This reverts commit 6aba91b.

* Pin only the Rails 7.0 gemfiles

The blanket pin regressed rails_6_0.gemfile: it has been resolving to
Rails 6.1 all along, and the dummy app's legacy_connection_handling=
setting does not exist in real 6.0, so pinning it broke a previously
green row.

Pin only rails_7_0*, which needs it because widening the mongoid
ceiling removes the transitive cap that used to hold it at 7.0.

* Replace CGI.parse in the omniauth redirect for Ruby 3.5 / Rails 8.1

`CGI.parse` is no longer available in the cgi gem shipped with Ruby 3.5,
which Rails 8.1 pulls in. Every omniauth test errors with
`undefined method 'parse' for class CGI` at routes.rb:79.

Use `Rack::Utils.parse_query` instead. It returns a bare value for
single occurrences where `CGI.parse` returned a one-element array, so
normalize with `Array()` — downstream code does `qs['x'] = [resource]`
and `v.first` and depends on that shape.

Verified equivalent to `CGI.parse` for the inputs this route sees,
including repeated keys, bare keys, empty values, empty strings and
percent-encoded reserved characters. The only divergence is the legacy
`;` separator, which `Rack::Utils.parse_query` does not split on; that
form is long deprecated and does not occur in omniauth callbacks.

Rack is always loaded here since this file reopens
ActionDispatch::Routing::Mapper.

* Rewind the request body before re-reading it in the omniauth redirect

For POSTed omniauth requests the route falls back to `request.body.read`
when QUERY_STRING is empty. As of Rails 7.1 the body has typically
already been consumed by the time this redirect block runs, so `read`
returns "" and every param — auth_origin_url, omniauth_window_type,
resource_class — is silently dropped.

Rewind before reading. Guarded with respond_to? since not every rack
input is rewindable.

* Fix two test-side assumptions broken by newer Rails

Neither is a library bug; both are test expectations that no longer
match Rails behaviour.

1. Rails 7.2 changed `redirect_to` to set an empty response body
   instead of the "You are being redirected" HTML snippet, so the
   confirmations tests could no longer find the redirect URL in
   `response.body`. Assert against `response.location`, which carries
   the same URL on every supported version.

2. The dummy app's show_exceptions guard read
   `MAJOR >= 7 && MINOR > 0`, which is false on Rails 8.0 (MINOR == 0),
   so it set the pre-7.1 `false` value. Rails 7.1+ treats this setting
   as an enum and an unrecognised value falls through to "render
   exceptions", so the four `assert_raises` tests saw a rendered error
   page instead of a raised exception. Compare with Rails.gem_version
   instead. This is why those tests failed on 8.0 but not 8.1.

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: MaicolBen

.github/workflows/test.yml

@@ -23,6 +23,8 @@ jobs:
           - gemfiles/rails_5_2.gemfile
           - gemfiles/rails_6_0.gemfile
           - gemfiles/rails_7_0.gemfile
+          - gemfiles/rails_8_0.gemfile
+          - gemfiles/rails_8_1.gemfile
         db:
           - sqlite
           - mysql
@@ -122,6 +124,19 @@ jobs:
             gemfile: gemfiles/rails_5_2.gemfile
           - ruby: 3.4
             gemfile: gemfiles/rails_6_0.gemfile
+          # Rails 8 requires Ruby >= 3.2
+          - ruby: 2.7
+            gemfile: gemfiles/rails_8_0.gemfile
+          - ruby: 2.7
+            gemfile: gemfiles/rails_8_1.gemfile
+          - ruby: '3.0'
+            gemfile: gemfiles/rails_8_0.gemfile
+          - ruby: '3.0'
+            gemfile: gemfiles/rails_8_1.gemfile
+          - ruby: 3.1
+            gemfile: gemfiles/rails_8_0.gemfile
+          - ruby: 3.1
+            gemfile: gemfiles/rails_8_1.gemfile
 
     services:
       mysql:

Appraisals

@@ -44,3 +44,20 @@ end
     gem 'mongoid-locker', '~> 1.0'
   end
 end
+
+[
+  { name: '8-0', version: '8.0' },
+  { name: '8-1', version: '8.1' }
+].each do |rails|
+  appraise "rails-#{rails[:name]}" do
+    gem 'rails', "~> #{rails[:version]}.0"
+
+    gem 'sqlite3', '~> 2.1'
+    gem 'mysql2'
+    gem 'pg'
+
+    group :development, :test do
+      gem 'minitest-rails', "~> #{rails[:version]}"
+    end
+  end
+end

devise_token_auth.gemspec

@@ -22,14 +22,14 @@ Gem::Specification.new do |s|
 
   s.required_ruby_version = ">= 2.3.0"
 
-  s.add_dependency 'rails', '>= 4.2.0', '< 8.2'
+  s.add_dependency 'rails', '>= 4.2.0', '< 8.3'
   s.add_dependency 'devise', '> 3.5.2', '< 6'
   s.add_dependency 'bcrypt', '~> 3.0'
 
   s.add_development_dependency 'appraisal'
-  s.add_development_dependency 'sqlite3', '~> 1.4'
+  s.add_development_dependency 'sqlite3', '>= 1.4', '< 3.0'
   s.add_development_dependency 'pg'
   s.add_development_dependency 'mysql2'
-  s.add_development_dependency 'mongoid', '>= 4', '< 8'
+  s.add_development_dependency 'mongoid', '>= 4', '< 10'
   s.add_development_dependency 'mongoid-locker', '>= 1.0', '< 3.0'
 end

gemfiles/rails_7_0.gemfile

@@ -4,7 +4,7 @@ source "https://rubygems.org"
 
 gem "omniauth", "~> 2.0"
 gem "omniauth-rails_csrf_protection"
-gem "rails", "~> 7.0"
+gem "rails", "~> 7.0.0"
 gem "sqlite3", "~> 1.4.1"
 gem "mysql2"
 gem "pg"

gemfiles/rails_7_0_mongoid_7.gemfile

@@ -3,7 +3,7 @@
 source "https://rubygems.org"
 
 gem "omniauth", "~> 2.0"
-gem "rails", "~> 7.0"
+gem "rails", "~> 7.0.0"
 gem "omniauth-rails_csrf_protection"
 gem "mongoid", "~> 7.0"
 gem "mongoid-locker", "~> 1.0"

gemfiles/rails_8_0.gemfile

@@ -0,0 +1,45 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "omniauth", "~> 2.0"
+gem "omniauth-rails_csrf_protection"
+gem "rails", "~> 8.0.0"
+gem "sqlite3", "~> 2.1"
+gem "mysql2"
+gem "pg"
+
+group :development, :test do
+  gem "attr_encrypted"
+  gem "figaro", "~> 1.2"
+  gem "omniauth-facebook"
+  gem "omniauth-github"
+  gem "omniauth-google-oauth2"
+  gem "omniauth-apple"
+  gem "rack-cors"
+  gem "thor", "~> 1.2"
+  gem "database_cleaner"
+  gem "factory_bot_rails"
+  gem "faker", "~> 3.2"
+  gem "fuzz_ball"
+  gem "minitest"
+  gem "minitest-focus"
+  gem "minitest-rails", "~> 8.0"
+  gem "minitest-reporters"
+  gem "mocha", ">= 1.5"
+  gem "pry"
+  gem "pry-byebug"
+  gem "pry-remote"
+  gem "rubocop", require: false
+end
+
+group :test do
+  gem "rails-controller-testing"
+  gem "simplecov", require: false
+end
+
+group :development do
+  gem "github_changelog_generator"
+end
+
+gemspec path: "../"

gemfiles/rails_8_1.gemfile

@@ -0,0 +1,45 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "omniauth", "~> 2.0"
+gem "omniauth-rails_csrf_protection"
+gem "rails", "~> 8.1.0"
+gem "sqlite3", "~> 2.1"
+gem "mysql2"
+gem "pg"
+
+group :development, :test do
+  gem "attr_encrypted"
+  gem "figaro", "~> 1.2"
+  gem "omniauth-facebook"
+  gem "omniauth-github"
+  gem "omniauth-google-oauth2"
+  gem "omniauth-apple"
+  gem "rack-cors"
+  gem "thor", "~> 1.2"
+  gem "database_cleaner"
+  gem "factory_bot_rails"
+  gem "faker", "~> 3.2"
+  gem "fuzz_ball"
+  gem "minitest"
+  gem "minitest-focus"
+  gem "minitest-rails", "~> 8.1"
+  gem "minitest-reporters"
+  gem "mocha", ">= 1.5"
+  gem "pry"
+  gem "pry-byebug"
+  gem "pry-remote"
+  gem "rubocop", require: false
+end
+
+group :test do
+  gem "rails-controller-testing"
+  gem "simplecov", require: false
+end
+
+group :development do
+  gem "github_changelog_generator"
+end
+
+gemspec path: "../"

lib/devise_token_auth/rails/routes.rb

@@ -76,7 +76,20 @@ def mount_devise_token_auth_for(resource, opts)
             match "#{full_path}/:provider", to: redirect(status: 307) { |params, request|
               # get the current querystring
               # TODO: deprecate in favor of using params
-              qs = CGI::parse(request.env['QUERY_STRING'].empty? ? request.body.read : request.env['QUERY_STRING'] )
+              # `CGI.parse` is unavailable as of the cgi gem shipped with Ruby 3.5
+              # (pulled in by Rails 8.1). `Rack::Utils.parse_query` returns a bare
+              # value for single occurrences, so normalize to arrays to keep the
+              # shape `CGI.parse` returned.
+              # As of Rails 7.1 the request body may already have been read when
+              # this runs, in which case `read` returns "" and every param is
+              # silently dropped. Rewind first so POSTed params survive.
+              query_string = if request.env['QUERY_STRING'].empty?
+                               request.body.rewind if request.body.respond_to?(:rewind)
+                               request.body.read
+                             else
+                               request.env['QUERY_STRING']
+                             end
+              qs = Rack::Utils.parse_query(query_string).transform_values { |v| Array(v) }
 
               # append name of current resource
               qs['resource_class'] = [resource]

test/controllers/devise_token_auth/confirmations_controller_test.rb

@@ -62,8 +62,8 @@ def token_and_client_config_from(body)
           end
 
           test 'redirect url includes token params' do
-            assert @token_params.all? { |param| response.body.include?(param) }
-            assert response.body.include?('account_confirmation_success')
+            assert @token_params.all? { |param| response.location.include?(param) }
+            assert response.location.include?('account_confirmation_success')
           end
         end
 
@@ -86,8 +86,8 @@ def token_and_client_config_from(body)
           end
 
           test 'redirect url does not include token params' do
-            refute @token_params.any? { |param| response.body.include?(param) }
-            assert response.body.include?('account_confirmation_success')
+            refute @token_params.any? { |param| response.location.include?(param) }
+            assert response.location.include?('account_confirmation_success')
           end
         end
 

test/dummy/config/environments/test.rb

@@ -32,7 +32,10 @@
   config.action_controller.perform_caching = false
 
   # Raise exceptions instead of rendering exception templates.
-  if Rails::VERSION::MAJOR >= 7 && Rails::VERSION::MINOR > 0
+  # Rails 7.1 turned this into an enum; `false` is no longer recognised and
+  # falls through to the "show everything" default. Note the version check must
+  # not be `MAJOR >= 7 && MINOR > 0`, which is false on Rails 8.0.
+  if Rails.gem_version >= Gem::Version.new('7.1')
     config.action_dispatch.show_exceptions = :none
   else
     config.action_dispatch.show_exceptions = false