adva 0.0.1 → 0.1.0

data/adva_user/lib/action_controller/authenticate_user.rb

@@ -1,201 +0,0 @@
-module ActionController
-
-  # Module automatically mixed into the all controllers making the
-  # application of authentication easy. See
-  # Login::ControllerIntegration::ClassMethods for how to apply
-  # authentication.
-  module AuthenticateUser
-    def self.included(target)
-      target.extend(ClassMethods)
-      target.send(:include, InstanceMethods)
-      target.helper_method(:logged_in?, :authenticated?)
-    end
-
-    # Methods available as macro-style methods on any controller
-    module ClassMethods
-
-      # Sets up the controller so that authentication is required. If
-      # the user is not authenticated then they will be redirected to
-      # the login screen.
-      #
-      # The page requested will be saved so that once the login has
-      # occured they will be sent back to the page they first
-      # requested. If no page was requested (they went to the login
-      # page directly) then they will be directed to profiles/home
-      # after login which is a placeholder for the app to override.
-      #
-      # Options given are passed directly to the before_filter method
-      # so feel free to provide :only and :except options.
-      def authentication_required
-        before_filter :require_authentication
-      end
-
-      # Will remove authentication from certain actions. Options given
-      # are passed directly to skip_before_filter so feel free to use
-      # :only and :except options.
-      #
-      # This method is useful in cases where you have locked down the
-      # entire application by putting authentication_required in your
-      # ApplicationController but then want to open an action back up
-      # in a specific controller.
-      def no_authentication_required
-        skip_before_filter :require_authentication
-      end
-    end
-
-    # Methods callable from within actions
-    module InstanceMethods
-      def authenticate_user(credentials)
-        User.authenticate(credentials).tap do |user|
-          if user
-            # prevent session hijacking - unnecessary according to http://dev.rubyonrails.org/ticket/10108
-            # reset_session_except :return_location
-            session[:uid] = user.id
-            set_user_cookie!(user)
-          end
-        end
-      end
-
-      # Will retrieve the current_user. Will not force a login but
-      # simply load the current user if a person is logged in. If
-      # you need the user object loaded with extra options (such as
-      # eager loading) then create a private method called
-      # "user_find_options" on your controller that returns a hash
-      # of the find options you want.
-      #
-      # This method will also inform the models of the current user
-      # if the current user is logged in and the "User" class responds
-      # to the class method current_user=. This is a nice way to
-      # communciate the current user down to the model level for
-      # model-level security. This means you will want to call this
-      # method at least once before using the model-level security.
-      # Usually you will call it in a before filter. This method is
-      # called automatically when authentication_required is applied to
-      # an action.
-      def current_user
-        @current_user ||= begin
-          # Check for session[:uid] here? That would mean that for token auth the
-          # user always needs to be logged out (e.g. in UserController#create).
-          # Looks a bit more robust this way:
-          try_login
-          if session && session[:uid]
-            user = find_current_user
-            set_user_cookie!(user)
-            user
-          end
-        end
-      end
-
-      def authenticated?
-        !!current_user
-      end
-      alias :logged_in? :authenticated?
-
-      # killed this because it's just the wrong way to do it
-      #
-      # # Will store the current params so that we can return here on
-      # # successful login. If you want to redirect to the login yourself
-      # # (perhaps you are applying your own security instead of just
-      # # determining if the user is logged in) then you will want to
-      # # call this before issuing your redirect to the login screen.
-      # def store_return_location
-      #   session[:return_location] = params
-      # end
-
-      private
-
-        # Will actually test to see if the user is authorized
-        def require_authentication
-          # No matter what the app does a user can always login, forgot
-          # password and register. The controllers provided by this
-          # plugin alreaddy have these controllers/actions on an
-          # exception list but this prevents a mistake an overridden
-          # controller from preventing the normal login behavior.
-          %w(session password user).each do |c|
-  	        %w(new create).each do |a|
-              return if (controller_name == c) && (action_name == a)
-            end
-  	      end
-
-          # If we cannot get the current user store the requested page
-          # and send them to the login page.
-          if current_user.nil? or current_user.anonymous?
-            redirect_to login_url(:return_to => request.url) and false
-          end
-        end
-
-        def logout
-          reset_session
-          forget_me!
-        end
-
-        def forget_me!
-          cookies[:remember_me] = nil
-          cookies[:uid] = nil
-          cookies[:uname] = nil
-        end
-
-        def remember_me!
-          token = current_user.assign_token!('remember me')
-          cookies[:remember_me] = { :value => "#{current_user.id};#{token}", :expires => 10.years.from_now }
-        end
-
-        def set_user_cookie!(user = current_user)
-          if user
-            cookies[:uid] = user.id.to_s
-            cookies[:uname] = user.name
-          end
-        end
-
-        # There are a few ways that a user can login without going through
-        # a login screen. These methods all rely on authenticating with
-        # the information given in the request. If any of these methods
-        # are successful then session[:uid] will be set with the current
-        # user id and current_user will return the current user
-        def try_login
-          if user = http_auth_login || validation_login || remember_me_login
-            session[:uid] = user.id
-          end
-        end
-
-        # Will attempt to authenticate with HTTP Auth. HTTP Auth will not
-        # be required. We are just checking if it is provided mainly for
-        # RESTful requests.
-        def http_auth_login
-          # FIXME: Implement
-        end
-
-        # Will use the URL param :token to see if we can do a token
-        # authentication.
-        def validation_login
-          validate_token User, params[:token]
-        end
-
-        # Will check for a :remember_me cookie for a token that will
-        # authenticate the user.
-        def remember_me_login
-          validate_token User, cookies[:remember_me]
-        end
-
-        # The tokens are stored in various places as id;token. This method
-        # will split that out and validate it. If everything is successful
-        # then the user object is returned. Otherwise nil is returned.
-        # The full token should be passed in.
-        def validate_token(klass, token, options = {})
-          return nil if token.blank?
-          return nil unless token =~ /\;/
-
-          uid, token = token.split ';'
-          if object = klass.find_by_id(uid)
-            return object if object.authenticate(token)
-          end
-          nil
-        end
-
-        def find_current_user
-          User.find_by_id(session[:uid])
-        end
-
-    end
-  end
-end

data/adva_user/lib/active_record/belongs_to_author.rb

@@ -1,37 +0,0 @@
-module ActiveRecord
-  module BelongsToAuthor
-    def self.included(base)
-      base.extend ActMacro
-    end
-
-    module ActMacro
-      def belongs_to_user(*args)
-        options = args.extract_options!
-        args = (args.empty? ? [:user] : args)
-        belongs_to_cacheable *args.dup << options # FIXME should not be polymorphic!
-        
-        args.each do |name|
-          class_eval <<-code, __FILE__, __LINE__
-            def #{name}_ip
-              #{name}.ip if #{name} && #{name}.respond_to?(:ip)
-            end
-
-            def #{name}_agent
-              #{name}.agent if #{name} && #{name}.respond_to?(:agent)
-            end
-
-            def #{name}_referer
-              #{name}.referer if #{name} && #{name}.respond_to?(:referer)
-            end
-          code
-        end
-      end
-
-      def belongs_to_author(*args)
-        options = args.extract_options!
-        args = (args.empty? ? [:author] : args) << options
-        belongs_to_user *args
-      end
-    end
-  end
-end

data/adva_user/lib/adva_user/version.rb

@@ -1,3 +0,0 @@
-module AdvaUser
-  VERSION = "0.0.1"
-end

data/adva_user/lib/adva_user.rb

@@ -1,28 +0,0 @@
-# require "adva_user/version"
-
-# load vendored gems
-Dir["#{File.expand_path("#{File.dirname(__FILE__)}/../vendor/gems")}/**/lib"].each do |vendored_gem_path|
-  $: << vendored_gem_path
-end
-require "authentication"
-
-require "rails"
-
-require "action_controller/authenticate_user"
-require "action_controller/authenticate_anonymous"
-require "active_record/belongs_to_author"
-require "login/helper_integration"
-
-module AdvaUser
-  class Engine < Rails::Engine
-    initializer "adva_user.init" do
-      ActionController::Base.send :include, ActionController::AuthenticateUser
-      ActionController::Base.send :include, ActionController::AuthenticateAnonymous
-      ActiveRecord::Base.send :include, ActiveRecord::BelongsToAuthor
-      ActionView::Base.send :include, Login::HelperIntegration
-
-      Event.observers << 'UserMailer'
-      Event.observers << 'PasswordMailer'
-    end
-  end
-end

data/adva_user/test/test_helper.rb

@@ -1 +0,0 @@
-require File.expand_path(File.dirname(__FILE__) + '/../../adva_cms/test/test_helper')

data/adva_user/vendor/gems/authentication/.gitignore

@@ -1,17 +0,0 @@
-*.gem
-*.rbc
-.bundle
-.config
-.yardoc
-Gemfile.lock
-InstalledFiles
-_yardoc
-coverage
-doc/
-lib/bundler/man
-pkg
-rdoc
-spec/reports
-test/tmp
-test/version_tmp
-tmp

data/adva_user/vendor/gems/authentication/LICENSE

@@ -1,22 +0,0 @@
-Copyright (c) 2012 Micah Geisel
-
-MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/adva_user/vendor/gems/authentication/lib/authentication/remember_me.rb

@@ -1,52 +0,0 @@
-require 'authentication/hash_helper'
-
-module Authentication
-
-  # This token module works mostly like the SingleToken module with
-  # three differences:
-  #
-  # * It uses a different field name (remember_me CHAR(40))
-  # * It doesn't care about any expiration time set
-  # * It will only assign a token if the token name is /remember.?me/i
-  #
-  # This module is ideally suited for the remember me functionality
-  # because of these changes. This module would probably not be
-  # necessary if you are using a token module that supports more than
-  # one token. Since the default one (SingleToken) only supports one
-  # we need a seperate module for the remember me functionality so
-  # we can basically now store two tokens by default.
-  #
-  # This module supports the same "verified_at" hidden feature that
-  # the Authentication::SaltedHash module supports
-  class RememberMe
-    include HashHelper
-
-    # Will test to see if the given remember me key is valid
-    def authenticate(user, key)
-      return false unless valid_model? user
-      return false unless key.to_s.length == 40
-
-      conditions = ['id = ? AND remember_me = ?', user.id, hash_string(key)]
-      conditions[0] << ' AND verified_at IS NOT NULL' if user.respond_to? :verified_at
-      0 < user.class.count(:conditions => conditions)
-    end
-
-    # Will create a new remember me token. We will ignore the expiration
-    # since a remember me is always forever.
-    def assign_token(user, name, expire=nil)
-      return nil unless valid_model? user
-      return nil unless name =~ /remember.?me/i
-
-      token = hash_string "remember-me-#{Time.zone.now}"
-      user.remember_me = hash_string token
-      token
-    end
-
-    private
-
-    # This functionality is only used if remember me an available column
-    def valid_model?(user)
-      user.class.column_names.include? 'remember_me'
-    end
-  end
-end

data/adva_user/vendor/gems/authentication/lib/authentication/single_token.rb

@@ -1,53 +0,0 @@
-require 'authentication/hash_helper'
-
-module Authentication
-  # Implements a token with expiration that is stored on the model
-  # being authenticated. This is designed to implement the common
-  # practice of having a token in the URL that will automatically
-  # authenticate the user. 
-  #
-  # The model should implement the fields "token_key" (a 40 character
-  # field) and "token_expiration" (a datetime field). If they are not
-  # implemented this class cannot authenticate or assign tokens.
-  #
-  # This token module is called SingleToken because it only can
-  # store one token. If another token is assigned the first is lost
-  # and will not authenticate the user anymore. For common needs such
-  # as forgot my password and account restoration this is fine.
-  #
-  # This token does NOT honor the verified_at field that the
-  # Authentication::SaltedHash module and Authentication::RememberMe
-  # module do since this token may be used to actually implement the
-  # email verification.
-  class SingleToken
-    include HashHelper
-
-    # Will test to see if the given key is valid for the given user
-    def authenticate(user, key)
-      return false unless valid_model? user
-      return false unless key.to_s.length == 40
-
-      conditions = [
-        'id = ? AND token_key = ? AND (token_expiration >= ? OR token_expiration IS NULL)',
-        user.id, hash_string(key), Time.zone.now
-      ]
-      0 < user.class.count(:conditions => conditions)
-    end
-
-    # Will create a new token for the given user with the given expiration
-    def assign_token(user, name, expire)
-      return nil unless valid_model? user
-
-      user.token_expiration = expire
-      token = hash_string "token-#{Time.zone.now}"
-      user.token_key = hash_string token
-      token
-    end
-
-    private
-
-    def valid_model?(user)
-      user.class.includes_all_columns? :token_key, :token_expiration
-    end
-  end
-end

data/doc/js_rbac.txt

@@ -1,54 +0,0 @@
-# JS Rbac layer
-
-In order to display links only to authorized users while still page_caching
-most frontend pages, we need to implement a role/permission-based layer in
-javascript.
-
-Of course, this isn't really "access control" because it only controls if a
-link is displayed to the user (the actual access control then happens on the
-server) but I can't come up with a better word for it.
-
-We can have three tiers:
-
-1. In the HTML we encode required roles as CSS classes. A link to a comment's
-edit page that requires the user to be at least the author of the comment could
-look like this:
-
-<a class="newsletter_stats site-1-admin section-1-moderator comment-1-author">edit</a>
-
-A link to a wikipage's edit page that requires a user to be logged in could be:
-
-<a class="newsletter_stats user">edit</a>
-
-(A link to a wikipage's edit page that does not require any authorization
-would simply omit the newsletter_stats class.)
-
-By explicitely listing the possible roles we avoid implementing a role
-hierarchie in the JS layer so the system stays more simple and better
-decoupled.
-
-2. The CSS class .requires hides the link and triggers a JS function that
-looks up roles for the user and re-displays the link if any of them matches
-one of the other CSS classes.
-
-3. The JS layer calls our application and fetches a JSON document that grants
-certain roles to the user for the current site, section and other objects. The
-JSON documents can probably also be page cached and only sweeped when the user's
-roles change.
-
-We can easily retrieve the superuser, admin and moderator roles for the whole
-site and all sections. 
-
-The only thing that breaks ranks is how to sanely check for authorships.
-People can easily pile up hundreds of forum posts so it would not make sense
-to send them all at once. In the case of the forum it seems sane to request
-and send authorships per topic instead.
-
-So, the backend URLs could look like this:
-
-/users/1/roles.js           # site-1-admin, section-1-moderator
-/users/1/roles/topic/1.js   # site-1-admin, section-1-moderator, post-1-author, post-2-author, post-3-author, ...
-
-The returned JS will then simply compare the classes present on the page to
-the values returned from the backend and display the links that match (or
-whatever else).