authkit 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +17 -0
- data/FEATURES.md +73 -0
- data/Gemfile +4 -0
- data/LICENSE.txt +22 -0
- data/README.md +168 -0
- data/Rakefile +60 -0
- data/authkit.gemspec +27 -0
- data/config/database.yml.example +19 -0
- data/lib/authkit.rb +5 -0
- data/lib/authkit/engine.rb +7 -0
- data/lib/authkit/version.rb +3 -0
- data/lib/generators/authkit/USAGE +18 -0
- data/lib/generators/authkit/install_generator.rb +113 -0
- data/lib/generators/authkit/templates/app/controllers/application_controller.rb +94 -0
- data/lib/generators/authkit/templates/app/controllers/email_confirmation_controller.rb +25 -0
- data/lib/generators/authkit/templates/app/controllers/password_change_controller.rb +29 -0
- data/lib/generators/authkit/templates/app/controllers/password_reset_controller.rb +29 -0
- data/lib/generators/authkit/templates/app/controllers/sessions_controller.rb +35 -0
- data/lib/generators/authkit/templates/app/controllers/users_controller.rb +89 -0
- data/lib/generators/authkit/templates/app/models/user.rb +170 -0
- data/lib/generators/authkit/templates/app/views/password_change/show.html.erb +16 -0
- data/lib/generators/authkit/templates/app/views/password_reset/show.html.erb +12 -0
- data/lib/generators/authkit/templates/app/views/sessions/new.html.erb +13 -0
- data/lib/generators/authkit/templates/app/views/users/edit.html.erb +58 -0
- data/lib/generators/authkit/templates/app/views/users/new.html.erb +58 -0
- data/lib/generators/authkit/templates/db/migrate/add_authkit_fields_to_users.rb +110 -0
- data/lib/generators/authkit/templates/db/migrate/create_users.rb +17 -0
- data/lib/generators/authkit/templates/lib/email_format_validator.rb +11 -0
- data/lib/generators/authkit/templates/spec/controllers/application_controller_spec.rb +188 -0
- data/lib/generators/authkit/templates/spec/controllers/email_confirmation_controller_spec.rb +80 -0
- data/lib/generators/authkit/templates/spec/controllers/password_change_controller_spec.rb +98 -0
- data/lib/generators/authkit/templates/spec/controllers/password_reset_controller_spec.rb +87 -0
- data/lib/generators/authkit/templates/spec/controllers/sessions_controller_spec.rb +111 -0
- data/lib/generators/authkit/templates/spec/controllers/users_controller_spec.rb +195 -0
- data/lib/generators/authkit/templates/spec/models/user_spec.rb +268 -0
- data/spec/spec_helper.rb +16 -0
- metadata +165 -0
checksums.yaml
ADDED
@@ -0,0 +1,7 @@
|
|
1
|
+
---
|
2
|
+
SHA1:
|
3
|
+
metadata.gz: 90322223474f0c5031812ebb9b08656f13667ad0
|
4
|
+
data.tar.gz: dbf307ddf9d5269d69742427777b6e7f72373428
|
5
|
+
SHA512:
|
6
|
+
metadata.gz: ba3bd5d2352745b4f9ff270ac323715359c95ecdde097ca4e60ca4b6f708275724e113d441f9b4c75f200f57a766ed55d0ce409dfefeaf3454f556e9d5e6bea3
|
7
|
+
data.tar.gz: cef78bd47d5249fdde5bb51276ef05b68400c9d251265deb0500fe7a7450142bc3db3b550c09bce606c22051c941c8ca5dab84f32d0dd4ff6f2f7c5e991e04f8
|
data/.gitignore
ADDED
data/FEATURES.md
ADDED
@@ -0,0 +1,73 @@
|
|
1
|
+
# Authkit Features
|
2
|
+
|
3
|
+
* Signup (username or email)
|
4
|
+
* Login/Logout
|
5
|
+
* Database backed unique constraints
|
6
|
+
* Email confirmation (you must connect a mailer, see below)
|
7
|
+
* Password reset (you must connect a mailer, see below)
|
8
|
+
* One time password / Two factor authentication
|
9
|
+
* Token support
|
10
|
+
* Remember me
|
11
|
+
* Account page
|
12
|
+
* Time zones
|
13
|
+
* Do not track (DNT) support
|
14
|
+
* Sign-in Tracking
|
15
|
+
* Analytics (coming soon)
|
16
|
+
* Lockout for failed attempts (coming soon)
|
17
|
+
|
18
|
+
## Basic functionality
|
19
|
+
|
20
|
+
Users should be able to sign up, login and logout. Authkit takes the approach that users should
|
21
|
+
immediately be given access to the site once they have signed up. An email confirmation is
|
22
|
+
sent, but on sign up the user is immediately logged in and their email address is immediately
|
23
|
+
active.
|
24
|
+
|
25
|
+
Because of this, users are immediately able to reset their password (in case they forget it).
|
26
|
+
This also makes supporting third-party authentication easier. In order to support password
|
27
|
+
resets you must implement the `send_reset_password` in `user.rb`.
|
28
|
+
|
29
|
+
```ruby
|
30
|
+
def send_reset_password
|
31
|
+
return false unless set_token(:reset_password_token)
|
32
|
+
|
33
|
+
# TODO: insert your mailer logic here
|
34
|
+
true
|
35
|
+
end
|
36
|
+
```
|
37
|
+
|
38
|
+
|
39
|
+
## Email confirmation
|
40
|
+
|
41
|
+
In order to properly use email confirmation you must implement the `send_confirmation`
|
42
|
+
method in `user.rb`
|
43
|
+
|
44
|
+
```ruby
|
45
|
+
def send_confirmation
|
46
|
+
return false unless set_token(:confirmation_token)
|
47
|
+
|
48
|
+
# TODO: insert your mailer logic here
|
49
|
+
true
|
50
|
+
end
|
51
|
+
```
|
52
|
+
|
53
|
+
Email confirmation is deceptively simple. By default you can sign up with any email address
|
54
|
+
and that address must be unique. A confirmation is immediately sent to the email address.
|
55
|
+
When editing the user settings the email is not adjusted (so a user cannot lock themselves
|
56
|
+
out) until it is confirmed. Because of this, the edit form modifies the `confirmation_email`
|
57
|
+
and sends out a new confirmation if changed. Once the confirmation is accepted the
|
58
|
+
`confirmation_email` is copied to the `email` field and confirmation tokens are cleared.
|
59
|
+
|
60
|
+
When changing the confirmation email it is checked for uniqueness against the existing set
|
61
|
+
of user emails. However, it is possible that a user will change their email and then
|
62
|
+
sign up with that email after the fact. If the user then confirms the original change it
|
63
|
+
will fail to confirm because the email will already be in use.
|
64
|
+
|
65
|
+
## Remember me
|
66
|
+
|
67
|
+
Authkit takes the approach that users always want to be remembered. When users are working on
|
68
|
+
public computers, it is assumed that they will logout before leaving or their session will
|
69
|
+
be reset (as is the case in most libraries). If your application contains sensitive data
|
70
|
+
you may want to change this default. There are a number of approaches to determining that
|
71
|
+
the user wants to be remembered (checkbox, etc.) but ultimately the `set_remember_cookie`
|
72
|
+
call in the `login` must be called conditionally.
|
73
|
+
|
data/Gemfile
ADDED
data/LICENSE.txt
ADDED
@@ -0,0 +1,22 @@
|
|
1
|
+
Copyright (c) 2013 Jeff Rafter
|
2
|
+
|
3
|
+
MIT License
|
4
|
+
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining
|
6
|
+
a copy of this software and associated documentation files (the
|
7
|
+
"Software"), to deal in the Software without restriction, including
|
8
|
+
without limitation the rights to use, copy, modify, merge, publish,
|
9
|
+
distribute, sublicense, and/or sell copies of the Software, and to
|
10
|
+
permit persons to whom the Software is furnished to do so, subject to
|
11
|
+
the following conditions:
|
12
|
+
|
13
|
+
The above copyright notice and this permission notice shall be
|
14
|
+
included in all copies or substantial portions of the Software.
|
15
|
+
|
16
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
17
|
+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
18
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
19
|
+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
20
|
+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
21
|
+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
22
|
+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
data/README.md
ADDED
@@ -0,0 +1,168 @@
|
|
1
|
+
# Authkit
|
2
|
+
|
3
|
+
A gem for installing auth into you app.
|
4
|
+
|
5
|
+
## Why?
|
6
|
+
|
7
|
+
There are lots of great authentication gems out there; devise? clearance? restful_auth?
|
8
|
+
All of these seek to solve the problem of adding authentication to your application but they all share
|
9
|
+
one philosophy: you shouldn't need to think about authentication to build your app. For me, I find I
|
10
|
+
spend way more time trying to figure out how to customize the tools for the few cases when my
|
11
|
+
application needs to do something different.
|
12
|
+
|
13
|
+
Authkit takes the opposite stance: auth belongs in your app. It is important and it is specific to your
|
14
|
+
app. It only includes generators and installs itself with some specs. You customize it. Everything
|
15
|
+
is right where you would expect it to be.
|
16
|
+
|
17
|
+
## Features
|
18
|
+
|
19
|
+
Authkit supports Ruby down to version 1.9 but targets 2.0. It is built for Rails 4. It is possible
|
20
|
+
that it could support Rails 3.x (it would need strong parameters). Some of the features include:
|
21
|
+
|
22
|
+
* Signup (username or email)
|
23
|
+
* Login/Logout
|
24
|
+
* Database backed unique constraints
|
25
|
+
* Email confirmation (you must connect a mailer, see below)
|
26
|
+
* Password reset (you must connect a mailer, see below)
|
27
|
+
* One time password / Two factor authentication
|
28
|
+
* Token support
|
29
|
+
* Remember me
|
30
|
+
* Account page
|
31
|
+
* Time zones
|
32
|
+
* Do not track (DNT) support
|
33
|
+
* Sign-in Tracking
|
34
|
+
* Analytics (coming soon)
|
35
|
+
* Lockout for failed attempts (coming soon)
|
36
|
+
|
37
|
+
Some possible features include:
|
38
|
+
|
39
|
+
* Master lockout/reset
|
40
|
+
* Visit tracking and anonymous users
|
41
|
+
* Third party accounts
|
42
|
+
* Installer options (test framework, security bulletins, modules)
|
43
|
+
|
44
|
+
If there is a feature you don't want to use, you just have to go and delete the generated code.
|
45
|
+
It is your application to customize.
|
46
|
+
|
47
|
+
More information is available in [FEATURES](FEATURES.md).
|
48
|
+
|
49
|
+
## Installation
|
50
|
+
|
51
|
+
Add this line to your application's Gemfile:
|
52
|
+
|
53
|
+
group :development do
|
54
|
+
gem 'authkit'
|
55
|
+
end
|
56
|
+
|
57
|
+
And then execute:
|
58
|
+
|
59
|
+
$ bundle
|
60
|
+
|
61
|
+
Or install it yourself as:
|
62
|
+
|
63
|
+
$ gem install authkit
|
64
|
+
|
65
|
+
## Usage
|
66
|
+
|
67
|
+
Once you've installed authkit you can run the generator:
|
68
|
+
|
69
|
+
rails g authkit:install
|
70
|
+
|
71
|
+
This will add some basic migrations for the user:
|
72
|
+
|
73
|
+
create db/migrate/20131025001051_create_users.rb
|
74
|
+
create db/migrate/20131025001052_add_authkit_fields_to_users.rb
|
75
|
+
|
76
|
+
It will also create general authentication models and controllers:
|
77
|
+
|
78
|
+
create app/models/user.rb
|
79
|
+
create app/controllers/users_controller.rb
|
80
|
+
create app/controllers/sessions_controller.rb
|
81
|
+
create app/controllers/password_reset_controller.rb
|
82
|
+
create app/controllers/password_change_controller.rb
|
83
|
+
create app/controllers/email_confirmation_controller.rb
|
84
|
+
create app/views/users/new.html.erb
|
85
|
+
create app/views/users/edit.html.erb
|
86
|
+
create app/views/sessions/new.html.erb
|
87
|
+
create app/views/password_reset/show.html.erb
|
88
|
+
create app/views/password_change/show.html.erb
|
89
|
+
|
90
|
+
And will insert a series of helpers into your application controller:
|
91
|
+
|
92
|
+
insert app/controllers/application_controller.rb
|
93
|
+
|
94
|
+
And create corresponding specs:
|
95
|
+
|
96
|
+
create spec/models/user_spec.rb
|
97
|
+
create spec/controllers/application_controller_spec.rb
|
98
|
+
create spec/controllers/users_controller_spec.rb
|
99
|
+
create spec/controllers/sessions_controller_spec.rb
|
100
|
+
create spec/controllers/password_reset_controller_spec.rb
|
101
|
+
create spec/controllers/password_change_controller_spec.rb
|
102
|
+
create spec/controllers/email_confirmation_controller_spec.rb
|
103
|
+
|
104
|
+
And a nice helpful email format validator:
|
105
|
+
|
106
|
+
create lib/email_format_validator.rb
|
107
|
+
|
108
|
+
It will also generate a set of routes:
|
109
|
+
|
110
|
+
route get '/email/confirm/:token', to: 'email_confirmation#show', as: :confirm
|
111
|
+
route post '/password/reset', to: 'password_reset#create'
|
112
|
+
route get '/password/reset', to: 'password_reset#show', as: :password_reset
|
113
|
+
route post '/password/change/:token', to: 'password_change#create'
|
114
|
+
route get '/password/change/:token', to: 'password_change#show', as: :password_change
|
115
|
+
route get '/signup', to: 'users#new', as: :signup
|
116
|
+
route get '/logout', to: 'sessions#destroy', as: :logout
|
117
|
+
route get '/login', to: 'sessions#new', as: :login
|
118
|
+
route put '/account', to: 'users#update'
|
119
|
+
route get '/account', to: 'users#edit', as: :user
|
120
|
+
|
121
|
+
route resources :sessions, only: [:new, :create, :destroy]
|
122
|
+
route resources :users, only: [:new, :create]
|
123
|
+
|
124
|
+
And will add some gems to your Gemfile:
|
125
|
+
|
126
|
+
gemfile active_model_otp
|
127
|
+
gemfile bcrypt-ruby (~> 3.0.0)
|
128
|
+
gemfile rspec-rails, :test, :development
|
129
|
+
gemfile shoulda-matchers, :test, :development
|
130
|
+
|
131
|
+
Once you have this installed you can remove the gem, however you may want to
|
132
|
+
keep the gem installed in development as you will be able to update it
|
133
|
+
and check for security bulletins.
|
134
|
+
|
135
|
+
You'll need to migrate your database (check the migrations before you do):
|
136
|
+
|
137
|
+
rake db:migrate
|
138
|
+
|
139
|
+
You'll also need to connect your mailers for sending password reset instructions
|
140
|
+
and email confirmations. (See the TODO in `user.rb`)
|
141
|
+
|
142
|
+
## Testing
|
143
|
+
|
144
|
+
The files generated using the installer include specs. To test these you should be
|
145
|
+
able to:
|
146
|
+
|
147
|
+
$ bundle install
|
148
|
+
|
149
|
+
Then run the default task:
|
150
|
+
|
151
|
+
$ rake
|
152
|
+
|
153
|
+
This will run the specs, which by default will generate a new Rails application,
|
154
|
+
run the installer, and execute the specs in the context of that temporary
|
155
|
+
application.
|
156
|
+
|
157
|
+
The specs that are generated utilize a generous amount of mocking and stubbing in
|
158
|
+
an attempt to keep them fast. However, they use vanilla `rspec-rails`, meaning
|
159
|
+
they are not using FactoryGirl, or mocha. The one caveat is shoulda-matchers
|
160
|
+
which are required.
|
161
|
+
|
162
|
+
## Contributing
|
163
|
+
|
164
|
+
1. Fork it
|
165
|
+
2. Create your feature branch (`git checkout -b my-new-feature`)
|
166
|
+
3. Commit your changes (`git commit -am 'Add some feature'`)
|
167
|
+
4. Push to the branch (`git push origin my-new-feature`)
|
168
|
+
5. Create new Pull Request
|
data/Rakefile
ADDED
@@ -0,0 +1,60 @@
|
|
1
|
+
require "bundler/gem_tasks"
|
2
|
+
require 'rspec/core/rake_task'
|
3
|
+
|
4
|
+
gem_name = :authkit
|
5
|
+
|
6
|
+
RSpec::Core::RakeTask.new(spec: ["generator:cleanup", "generator:prepare", "generator:#{gem_name}"]) do |task|
|
7
|
+
task.pattern = "spec/**/*_spec.rb"
|
8
|
+
task.rspec_opts = "--color --drb"
|
9
|
+
task.verbose = true
|
10
|
+
end
|
11
|
+
|
12
|
+
namespace :spec do
|
13
|
+
RSpec::Core::RakeTask.new(database: ["generator:cleanup", "generator:prepare", "generator:database", "generator:#{gem_name}"]) do |task|
|
14
|
+
task.pattern = "spec/**/*_spec.rb"
|
15
|
+
task.verbose = true
|
16
|
+
end
|
17
|
+
end
|
18
|
+
|
19
|
+
namespace :generator do
|
20
|
+
desc "Cleans up the sample app before running the generator"
|
21
|
+
task :cleanup do
|
22
|
+
FileUtils.rm_rf("spec/tmp/sample") if Dir.exist?("spec/tmp/sample") if ENV['SKIP_CLEANUP'].nil?
|
23
|
+
end
|
24
|
+
|
25
|
+
desc "Prepare the sample app before running the generator"
|
26
|
+
task :prepare do
|
27
|
+
next if Dir.exist?("spec/tmp/sample")
|
28
|
+
|
29
|
+
FileUtils.mkdir_p("spec/tmp")
|
30
|
+
|
31
|
+
system "cd spec/tmp && rails new sample"
|
32
|
+
|
33
|
+
# bundle
|
34
|
+
gem_root = File.expand_path(File.dirname(__FILE__))
|
35
|
+
system "echo \"gem 'rspec-rails'\" >> spec/tmp/sample/Gemfile"
|
36
|
+
system "echo \"gem '#{gem_name}', :path => '#{gem_root}'\" >> spec/tmp/sample/Gemfile"
|
37
|
+
system "cd spec/tmp/sample && bundle install"
|
38
|
+
system "cd spec/tmp/sample && rails g rspec:install"
|
39
|
+
|
40
|
+
# Make a thing
|
41
|
+
system "cd spec/tmp/sample && rails g scaffold thing name:string mood:string"
|
42
|
+
end
|
43
|
+
|
44
|
+
# This task is not used unless you need to test the generator with an alternate database
|
45
|
+
# such as mysql or postgres. By default the sample application utilize sqlite3
|
46
|
+
desc "Prepares the application with an alternate database"
|
47
|
+
task :database do
|
48
|
+
puts "== Configuring the database =================================================="
|
49
|
+
system "cp config/database.yml.example spec/tmp/sample/config/database.yml"
|
50
|
+
system "cd spec/tmp/sample && rake db:migrate:reset"
|
51
|
+
end
|
52
|
+
|
53
|
+
desc "Run the #{gem_name} generator"
|
54
|
+
task gem_name do
|
55
|
+
system "cd spec/tmp/sample && rails g #{gem_name}:install --force && rake db:migrate db:test:prepare"
|
56
|
+
end
|
57
|
+
|
58
|
+
end
|
59
|
+
|
60
|
+
task :default => :spec
|
data/authkit.gemspec
ADDED
@@ -0,0 +1,27 @@
|
|
1
|
+
# coding: utf-8
|
2
|
+
lib = File.expand_path('../lib', __FILE__)
|
3
|
+
$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
|
4
|
+
require 'authkit/version'
|
5
|
+
|
6
|
+
Gem::Specification.new do |spec|
|
7
|
+
spec.name = "authkit"
|
8
|
+
spec.version = Authkit::VERSION
|
9
|
+
spec.authors = ["Jeff Rafter"]
|
10
|
+
spec.email = ["jeffrafter@gmail.com"]
|
11
|
+
spec.description = %q{Auth for your Rails application}
|
12
|
+
spec.summary = %q{Auth for your Rails application}
|
13
|
+
spec.homepage = "https://github.com/jeffrafter/authkit"
|
14
|
+
spec.license = "MIT"
|
15
|
+
|
16
|
+
spec.files = `git ls-files`.split($/)
|
17
|
+
spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
|
18
|
+
spec.test_files = spec.files.grep(%r{^(test|spec|features)/})
|
19
|
+
spec.require_paths = ["lib"]
|
20
|
+
|
21
|
+
spec.add_development_dependency "bundler", "~> 1.3"
|
22
|
+
spec.add_development_dependency "rake"
|
23
|
+
spec.add_development_dependency "rspec-rails"
|
24
|
+
spec.add_development_dependency "factory_girl_rails"
|
25
|
+
spec.add_development_dependency "mocha"
|
26
|
+
spec.add_development_dependency "active_model_otp"
|
27
|
+
end
|
@@ -0,0 +1,19 @@
|
|
1
|
+
# This file is not copied to or used by your Rails environment. The only time
|
2
|
+
# these settings are used is when you have executed rake test:database while
|
3
|
+
# running the tests for the authkit gem (not from within Rails). This file makes
|
4
|
+
# it easy to test alternate database drivers with Authkit. The
|
5
|
+
# default testing environment uses the rails default (sqlite3).
|
6
|
+
|
7
|
+
development:
|
8
|
+
adapter: mysql
|
9
|
+
database: authkit_development
|
10
|
+
username: root
|
11
|
+
password:
|
12
|
+
host: localhost
|
13
|
+
|
14
|
+
test:
|
15
|
+
adapter: mysql
|
16
|
+
database: authkit_test
|
17
|
+
username: root
|
18
|
+
password:
|
19
|
+
host: localhost
|
data/lib/authkit.rb
ADDED
@@ -0,0 +1,18 @@
|
|
1
|
+
Usage:
|
2
|
+
rails generate authkit [options]
|
3
|
+
|
4
|
+
Runtime options:
|
5
|
+
-f, [--force] # Overwrite files that already exist
|
6
|
+
-p, [--pretend] # Run but do not make any changes
|
7
|
+
-s, [--skip] # Skip files that already exist
|
8
|
+
-q, [--quiet] # Supress status output
|
9
|
+
|
10
|
+
Description:
|
11
|
+
Installs an auth system for your Rails application.
|
12
|
+
|
13
|
+
Example:
|
14
|
+
rails generate authkit:install
|
15
|
+
|
16
|
+
This will create:
|
17
|
+
|
18
|
+
...
|