auther 0.1.0 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 093c3e3b89c2368100edded3b52d2d3a11461031
-  data.tar.gz: 7e351f9e60c11c0e4336c4795dff68e4f0fdd5dd
+  metadata.gz: 485ebcc245f0f5f8afe7aa31578a4cf1b24539f2
+  data.tar.gz: 3b01086eb3e8daf9f42a7d826c5579172c11c4d0
 SHA512:
-  metadata.gz: 40258f7e43264a953509038a46472a43f1ee56acd71818cda863446bbdc356aae0dba2ac70672cd042ea9917a346eec42b03669d7ce00607fa014b4a700fe85d
-  data.tar.gz: 3e8a937baaa20506299883b701f35aeb268200c318d468ddc0fb66c993026f989ba6a0843b0ec167c83a32d18733d1a23e33bfe00f09fcb0d5cd10fb3aa28285
+  metadata.gz: ec0105f688b04a3afed063caa12fafb8d8f8ca646b4d6473ad4da46dd28dc2b75bb73fc64ebcdc963beeb978f6fbbe20a218a3ec8f6963b105b59eee60fac620
+  data.tar.gz: 116393582fcd43e9cd3c9c1e774c90683f582610af2fa16cb71d784faa9028a2325b722b43751a458f0b04a4ec9e865a90e4dbf938dc8744eb7f85b500784dc4

data/README.md

@@ -9,9 +9,10 @@ HTTP Basic Authentication and/or want to be compatible with password managers.
 
 # Features
 
+* Encrypted session account credentials.
 * Form-based authentication compatible with password managers like [1Password](https://agilebits.com/onepassword).
 * Multiple account support with account specific blacklisted paths.
-* Auto-redirection to blacklisted path (once credentials have been verified).
+* Auto-redirection to requested path (once credentials have been verified).
 * Customizable session view.
 * Customizable session controller.
 
@@ -22,12 +23,12 @@ HTTP Basic Authentication and/or want to be compatible with password managers.
 
 # Setup
 
-Type the following from the command line to securely install (recommended):
+For a secure install, type the following from the command line (recommended):
 
     gem cert --add <(curl -Ls http://www.redalchemist.com/gem-public.pem)
     gem install auther -P HighSecurity
 
-...or type the following to insecurely install (not recommended):
+...or, for an insecure install, type the following (not recommended):
 
     gem install auther
 
@@ -35,12 +36,11 @@ Add the following to your Gemfile:
 
     gem "auther"
 
-# Usage
-
 Edit your routes.rb as follows:
 
     Rails.application.routes.draw do
       mount Auther::Engine => "/auther"
+      get "/login", to: "auther/session#new"
     end
 
 Edit your application.rb as follows:
@@ -51,16 +51,40 @@ Edit your application.rb as follows:
           accounts: [
             {
               name: "test",
-              login: "test@test.com",
-              password: "password",
+              login: "N3JzR213WlBISDZsMjJQNkRXbEVmYVczbVdnMHRYVHRud29lOWRCekp6ST0tLWpFMkROekUvWDBkOHZ4ZngxZHV6clE9PQ==--cd863c39991fa4bb9a35de918aa16da54514e331",
+              password: "cHhFSStjRm9KbEYwK3ZJVlF2MmpTTWVVZU5acEdlejZsZEhjWFJoQWxKND0tLTE3cmpXZVBQdW5VUW1jK0ZSSDdLUnc9PQ==--f51171174fa77055540420f205e0dd9d499cfeb6",
               paths: ["/admin"]
             }
           ],
-          auth_url: "/auther/session/new"
+          secret: "vuKrwD9XWoYuv@s99?tR(9VqryiL,KV{W7wFnejUa4QcVBP+D{2rD4JfuD(mXgA=$tNK4Pfn#NeGs3o3TZ3CqNc^Qb",
+          auth_url: "/login"
         }
       end
     end
 
+NOTE: The decrypted account credentials, for example above, are as follows:
+
+* login: test@test.com
+* password: password
+
+# Usage
+
+Using the setup examples, from above, launch your Rails application and visit either of the following routes:
+
+    http://localhost:3000/login
+    http://localhost:3000/admin # Will redirect to /login if not authorized.
+
+To encrypt/decrypt account credentials, launch a rails console and type the following:
+
+    # Best if more than 150 characters and gibberish to read. Must be the same as defined in auther settings.
+    cipher = Auther::Cipher.new "vuKrwD9XWoYuv@s99?tR(9VqryiL,KV{W7wFnejUa4QcVBP+D{2rD4JfuD(mXgA=$tNK4Pfn#NeGs3o3TZ3CqNc^Qb"
+
+    # Do this to encrypt an unecrypted value.
+    cipher.encrypt "test@test.com"
+
+    # Do this to decrypt an encrypted value.
+    cipher.decrypt "N3JzR213WlBISDZsMjJQNkRXbEVmYVczbVdnMHRYVHRud29lOWRCekp6ST0tLWpFMkROekUvWDBkOHZ4ZngxZHV6clE9PQ==--cd863c39991fa4bb9a35de918aa16da54514e331"
+
 # Customization
 
 Don't like the default authorization form? No problem, simply create the following file within your Rails application

data/app/controllers/auther/session_controller.rb

@@ -1,21 +1,21 @@
 class Auther::SessionController < ApplicationController
   layout "auther/auth"
+  before_filter :name_options, only: [:new, :create]
 
   def show
     redirect_to action: :new
   end
 
   def new
+    @account = Auther::Account.new
   end
 
   def create
-    settings = Rails.application.config.auther_settings
-    account = settings.fetch(:accounts).select { |account| account.fetch(:login) == params[:login] }.first
+    account_params = params.fetch(:account)
+    @account = Auther::Account.new find_account(account_params.fetch(:name))
 
-    if account
-      keymaster = Auther::Keymaster.new account[:name]
-      session[keymaster.login_key] = params[:login]
-      session[keymaster.password_key] = params[:password]
+    if @account.valid?
+      store_credentials @account, account_params.fetch(:login), account_params.fetch(:password)
       redirect_to session["auther_redirect_url"] || '/'
     else
       render template: "auther/session/new"
@@ -23,9 +23,37 @@ class Auther::SessionController < ApplicationController
   end
 
   def destroy
-    keymaster = Auther::Keymaster.new params[:account_name]
+    remove_credentials params[:name]
+    redirect_to action: :new
+  end
+
+  private
+
+  def settings
+    Rails.application.config.auther_settings
+  end
+
+  def name_options
+    @name_options = settings.fetch(:accounts).map do |account|
+      name = account.fetch :name
+      [name.capitalize, name]
+    end
+  end
+
+  def find_account name
+    settings.fetch(:accounts).select { |account| account.fetch(:name) == name }.first
+  end
+
+  def store_credentials account, login, password
+    keymaster = Auther::Keymaster.new account.name
+    cipher = Auther::Cipher.new settings.fetch(:secret)
+    session[keymaster.login_key] = cipher.encrypt login
+    session[keymaster.password_key] = cipher.encrypt password
+  end
+
+  def remove_credentials name
+    keymaster = Auther::Keymaster.new name
     session.delete keymaster.login_key
     session.delete keymaster.password_key
-    redirect_to action: :new
   end
 end

data/app/models/auther/account.rb

@@ -0,0 +1,17 @@
+module Auther
+  class Account
+    include ActiveModel::Validations
+
+    attr_accessor :name, :login, :password, :paths
+
+    validates :name, :login, :password, presence: true
+    validates :paths, presence: {unless: lambda { |account| account.paths.is_a? Array }, message: "must be an array"}
+
+    def initialize name: nil, login: nil, password: nil, paths: []
+      @name = name
+      @login = login
+      @password = password
+      @paths = paths
+    end
+  end
+end

data/app/views/auther/session/new.html.slim

@@ -1,19 +1,25 @@
-= form_tag "/auther/session", class: "auther-form"
+= form_for @account, as: :account, url: "/auther/session", html: {class: "auther-form"} do |form|
   .row
     h1.title Authorization
 
   .row
     .label
-      = label_tag :login, "Login:"
+      = form.label :login, "Login:"
     .input
-      = text_field_tag :login, nil
+      = form.text_field :login
 
   .row
     .label
-      = label_tag :password, "Password:"
+      = form.label :password, "Password:"
     .input
-      = password_field_tag :password, nil
+      = form.password_field :password
+
+  .row
+    .label
+      = form.label :name, "Account:"
+    .input
+      = form.select :name, @name_options
 
   .row
     .actions
-      = submit_tag "Login", class: "btn btn-primary"
+      = form.submit "Login"

data/lib/auther.rb

@@ -1,4 +1,5 @@
 require "slim-rails"
+require "auther/cipher"
 require "auther/keymaster"
 require "auther/gatekeeper"
 require "auther/engine"

data/lib/auther/cipher.rb

@@ -0,0 +1,21 @@
+module Auther
+  class Cipher
+    def initialize secret
+      @encryptor = ActiveSupport::MessageEncryptor.new secret
+    end
+
+    def encrypt data
+      encryptor.encrypt_and_sign data
+    end
+
+    def decrypt data
+      encryptor.decrypt_and_verify data
+    end
+
+    private
+
+    def encryptor
+      @encryptor
+    end
+  end
+end

data/lib/auther/gatekeeper.rb

@@ -42,7 +42,18 @@ module Auther
     def authenticated? env, account
       session = env.fetch "rack.session"
       keymaster = Auther::Keymaster.new account.fetch(:name)
-      session[keymaster.login_key] == account.fetch(:login) && session[keymaster.password_key] == account.fetch(:password)
+      cipher = Auther::Cipher.new settings.fetch(:secret)
+
+      begin
+        session_login = cipher.decrypt session[keymaster.login_key]
+        session_password = cipher.decrypt session[keymaster.password_key]
+        account_login = cipher.decrypt account.fetch(:login)
+        account_password = cipher.decrypt account.fetch(:password)
+
+        session_login == account_login && session_password == account_password
+      rescue ActiveSupport::MessageVerifier::InvalidSignature => error
+        false
+      end
     end
 
     def authorized? env, path

data/lib/auther/version.rb

@@ -1,3 +1,3 @@
 module Auther
-  VERSION = "0.1.0"
+  VERSION = "0.2.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: auther
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.2.0
 platform: ruby
 authors:
 - Brooke Kuhlmann
@@ -30,7 +30,7 @@ cert_chain:
   SJpzzzZ8gO6BKn4fhd+ENNQ333Qy3nuNk07TVIaNnlgeHhowUDuD9T7Z8Lka0pt3
   4PteiTppsf0SSVAM9zSO5IuFngXMRwWgvjOfXE70f43RDuUVTCSyylc=
   -----END CERTIFICATE-----
-date: 2014-01-10 00:00:00.000000000 Z
+date: 2014-01-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -259,11 +259,13 @@ files:
 - app/controllers/auther/application_controller.rb
 - app/controllers/auther/session_controller.rb
 - app/helpers/auther/application_helper.rb
+- app/models/auther/account.rb
 - app/views/auther/session/new.html.slim
 - app/views/layouts/auther/auth.html.slim
 - bin/rails
 - config/routes.rb
 - lib/auther.rb
+- lib/auther/cipher.rb
 - lib/auther/engine.rb
 - lib/auther/gatekeeper.rb
 - lib/auther/keymaster.rb
@@ -288,7 +290,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.0
+rubygems_version: 2.2.1
 signing_key: 
 specification_version: 4
 summary: A Rails Engine with simple, form-based authentication support.