authlogic 1.3.4 → 1.3.5

data/CHANGELOG.rdoc

@@ -1,3 +1,12 @@
+== 1.3.5 released 2008-11-30
+
+* :transition_from_crypto_provider for acts_as_authentic now accepts an array to transition from multiple providers. Which solves the problem of a double transition.
+* Added AES256 as a crypto_provider option, for those that want to use a reversible encryption method by supplying a key.
+* Fixed typo for using validates_format_of_options instead of validates_length_of_options
+* Fixed bug when accessing the dynamic method for accessing the session record in a namespace, since it uses class_name.underscore which replaces :: with a /
+* Added minimum length requirement of 4 for the password, and removed validates_presence_of for password since validates_length_of enforces this
+* Set before_validation to reset the persistence token if it is blank, since a password is not required for open id authentication
+
 == 1.3.4 released 2008-11-24
 
 * Delegate human_attribute_name to the ActiveRecord class to take advantage of the I18n feature.

data/Manifest

@@ -3,6 +3,7 @@ init.rb
 lib/authlogic/controller_adapters/abstract_adapter.rb
 lib/authlogic/controller_adapters/merb_adapter.rb
 lib/authlogic/controller_adapters/rails_adapter.rb
+lib/authlogic/crypto_providers/aes256.rb
 lib/authlogic/crypto_providers/bcrypt.rb
 lib/authlogic/crypto_providers/sha1.rb
 lib/authlogic/crypto_providers/sha512.rb
@@ -33,11 +34,14 @@ MIT-LICENSE
 Rakefile
 README.rdoc
 shoulda_macros/authlogic.rb
+test/crypto_provider_tests/aes256_test.rb
+test/crypto_provider_tests/bcrypt_test.rb
+test/crypto_provider_tests/sha1_test.rb
+test/crypto_provider_tests/sha512_test.rb
 test/fixtures/companies.yml
 test/fixtures/employees.yml
 test/fixtures/projects.yml
 test/fixtures/users.yml
-test/libs/aes128_crypto_provider.rb
 test/libs/mock_controller.rb
 test/libs/mock_cookie_jar.rb
 test/libs/mock_request.rb

data/README.rdoc

@@ -2,7 +2,7 @@
 
 Authlogic is a clean, simple, and unobtrusive ruby authentication solution. Put simply, its the Chuck Norris of authentication solutions for your framework of choice.
 
-The last thing we need is another authentication solution, right? That's what I thought until I tried out some of the current solutions in both rails and merb. None of them felt right. They were either too complicated, bloated, littered my application with tons of code, or were just confusing. This is not the simple / elegant ruby we all fell in love with. We need a "ruby like" authentication solution. Authlogic is my attempt to satisfy that need...
+So what is Authlogic, and why would I create a solution to a problem that already has plenty of solutions? Because none of the solutions felt right to me, RESTful development and authentication just didn't seem to go well together. It was like trying to fit a square peg in a round hole. All of the current solutions, for both rails and merb, just seemed to force that square peg in the round hole for me. Just because they did it for me doesn't make it right. They were either too complicated, bloated, littered my application with tons of code, had no platform for reasonable updating, used an inferior encryption algorithm, or were just confusing. This is not the simple / elegant ruby we all fell in love with. We need a "ruby like" authentication solution. Authlogic is my attempt to satisfy that need...
 
 Let's take a rails application...
 
@@ -66,7 +66,7 @@ Or how about persisting the session...
       end
   end
 
-Authlogic makes this a reality. This is just the tip of the ice berg. Keep reading to find out everything Authlogic can do.
+Authlogic and REST are like peas and carrots, as Forrest Gump would say. But This is just the tip of the ice berg. Keep reading to find out everything Authlogic can do.
 
 == Helpful links
 
@@ -116,7 +116,7 @@ The user model needs to have the following columns. The names of these columns c
     t.string    :persistence_token,     :null => false
     t.string    :single_access_token,   :null => false # optional, see the tokens section below.
     t.string    :perishable_token,      :null => false # optional, see the tokens section below.
-    t.integer   :login_count                           # optional, this is a "magic" column, see the magic columns section below
+    t.integer   :login_count,           :null => false, :default => 0 # optional, this is a "magic" column, see the magic columns section below
 
 === Set up your model
 
@@ -130,6 +130,36 @@ One thing to keep in mind here is that the default :crypto_provider for Authlogi
 
 You are all set, now go use it just like you would with any other ActiveRecord model. Either glance at the code at the beginning of this README or check out the tutorials (see above in "helpful links") for a more detailed walk through.
 
+== Migrating an existing app from restful_authentication and upgrading your encryption
+
+For those that are switching existing apps over, I made an option especially for you. Just do the following and everything will be taken care of, your users won't even know anything changed:
+
+  # app/models/user.rb
+  class User < ActiveRecord::Base
+    acts_as_authentic :act_like_restful_authentication => true
+  end
+
+The above will not change a thing, from your database's perspective it will be as if you are still using restful_authentication.
+
+Or you can upgrade from Sha1 and transition your users to a much more secure encryption algorithm:
+
+  # app/models/user.rb
+  class User < ActiveRecord::Base
+    acts_as_authentic :transition_from_restful_authentication => true
+  end
+
+By default this will switch your users to Authlogic's Sha512 implementation. You do *NOT* have to use this. Check out the encryption methods section below for a list of encryption methods Authlogic provides you. If you want to use something besides Sha512 just specify it by doing:
+
+  # app/models/user.rb
+  class User < ActiveRecord::Base
+    acts_as_authentic :transition_from_restful_authentication => true,
+      :crypto_provider => Authlogic::CryptoProviders::BCrypt
+  end
+
+Every time a user logs in their password will be upgraded and every time a new account is created it will use the new algorithm all while allowing users to login with the old algorithm.
+
+For more information checkout my blog post on this: http://www.binarylogic.com/2008/11/23/tutorial-easily-migrate-from-restful_authentication-to-authlogic
+
 == Magic Columns
 
 Just like ActiveRecord has "magic" columns, such as: created_at and updated_at. Authlogic has its own "magic" columns too:
@@ -150,6 +180,8 @@ Authlogic tries to check the state of the record before creating the session. If
   active?               Is the record marked as active?
   approved?             Has the record been approved?
   confirmed?            Has the record been conirmed?
+
+Authlogic does nothing to define these methods for you, its up to you to define what they mean. If your object responds to these methods Authlogic will use them, otherwise they are ignored.
   
 What's neat about this is that these are checked upon any type of login. When logging in explicitly, by cookie, session, or basic http auth. So if you mark a user inactive in the middle of their session they wont be logged back in next time they refresh the page. Giving you complete control.
 
@@ -161,14 +193,19 @@ Just like ActiveRecord you can create your own hooks / callbacks so that you can
 
   before_create
   after_create
+  
   before_destroy
   after_destroy
+  
   before_find
   after_find
+  
   before_save
   after_save
+  
   before_update
   after_update
+  
   before_validation
   after_validation
 
@@ -199,11 +236,12 @@ For more information on ids checkout Authlogic::Session::Base#id
 
 == Encryption methods
 
-Authlogic is designed so you can use *any* encryption method you want. It delegates this task to a class of your choice. Here are you choices:
+Authlogic is designed so you can use *any* encryption method you want. It delegates this task to a class of your choice. Authlogic comes preloaded with some common algorithms:
 
 1. Authlogic::CryptoProviders::Sha1 (used mainly for migrating from restful_authentication)
-2. Authlogic::CryptoProviders::Sha512
-3. Authlogic::CryptoProviders::BCrypt
+2. Authlogic::CryptoProviders::Sha512 (default)
+3. Authlogic::CryptoProviders::BCrypt (requires bcrypt-ruby gem)
+4. Authlogic::CryptoProviders::AES256 (requires you to supply a key, see the AES256 class in the docs for more info)
 
 By default Authlogic uses salted Sha512 with 20 stretches, but you can easily change this. For example, if you wanted to use the BCrypt algorithm just do the following:
 
@@ -211,7 +249,7 @@ By default Authlogic uses salted Sha512 with 20 stretches, but you can easily ch
 
 For more information on BCrypt checkout my blog post on it: http://www.binarylogic.com/2008/11/22/storing-nuclear-launch-codes-in-your-app-enter-bcrypt-for-authlogic
 
-Also, check out the Authlogic::CryptoProviders module and subclasses to get an idea of how to write your own crypto provider. You don't have to use the provided classes, you can easily write your own. All that you have to do is make a class with a class level encrypt and matches? method. That's it, the sky is the limit.
+Also, check out the Authlogic::CryptoProviders module and subclasses to get an idea of how to write your own crypto provider. You don't have to use the provided classes, you can easily write your own. All that you have to do is make a class with a class level encrypt and matches? method. That's it, all of the encryption and decryption logic is left to you.
 
 == Switching to a new encryption method
 
@@ -222,6 +260,15 @@ Switching to a new encryption method used to be a pain in the ass. Authlogic has
 
 That's it. When a user successfully logs in and is using the old method their password will be updated with the new method and all new registrations will use the new method as well. Your users won't know anything changed.
 
+But wait, what if a couple of years later CCrypt comes out and its better than BCrypt and you're still in the middle of transitioning all of your users to BCrypt. Oh no!
+
+Not to worry, because Authlogic can transition your users from more than one algorithm. Just pass an array to :transition_from_crypto_provider
+
+  acts_as_authentic :crypto_provider => CCrypt,
+    :transition_from_crypto_provider => [Authlogic::CryptoProviders::Sha512, Authlogic::CryptoProviders::BCrypt]
+
+That's it, specify as many as you want. One thing to keep in mind here is that if you are using BCrypt you should never have to do this. All that you need to do is increase the cost to make the algorithm stronger, no need to jump to entirely new algorithm. I did this for example purposes only.
+
 == Tokens (persistence, resetting passwords, private feed access, etc.)
 
 To start, let me define tokens as Authlogic sees it. A token is a form of credentials that grants some type of access to their account. Depending on the type of access, a different type of token may be needed. Put simply, it's a way for the user to say "I am this person, let me proceed". What types of different access you ask? Here are just a few:
@@ -235,11 +282,11 @@ There could be many more depending on your application. What's great about Authl
 
 Here are the 3 tokens in more detail:
 
-=== Persistence token
+=== 1. Persistence token (stored in cookie / session)
 
 This token is used to persist the user's session. This is the token that is stored in the session and the cookie, so that during each request the user stays logged in. What's unique about this token is that the first time it is used the value is stored in the session, thus persisting the session. This field is required and must be in your database.
 
-=== Single access token
+=== 2. Single access token (private feed access, etc.)
 
 This token is used for single access only, it is not persisted. Meaning the user provides it, Authlogic grants them access, and that's it. If they want access again they need to provide the token again. Authlogic will *NEVER* store this value in the session or a cookie. For added security, by default this token is *ONLY* allowed for RSS and ATOM requests. Also, this token does *NOT* change with the password. Meaning if the user changes their password, this token will remain the same. Lastly, this token uses a "friendly" toke (see the URL example below) so that it is easier to email / copy and paste. You can change all of this with configuration (see Authlogic::Session::config), so if you don't like how this works by default, just set some simple configuration in your session.
 
@@ -256,7 +303,7 @@ The single_access_token parameter name is configurable (see Authlogic::Session::
 
 For more information see: Authlogic::ORMAdapters::ActiveRecordAdapter::ActsAsAuthentic::SingleAccess
 
-=== Perishable token
+=== 3. Perishable token (resetting passwords, confirming accounts, etc)
 
 This token is used for temporary account access, hence the term "perishable". This token is constantly changing, it changes...
 
@@ -367,7 +414,7 @@ The errors in Authlogic work JUST LIKE ActiveRecord. In fact, it uses the exact
 
 This is one of my favorite features that I think is pretty cool. It's things like this that make a library great and let you know you are on the right track.
 
-Just to clear up any confusion, Authlogic does not store the plain id in the session. It stores a token. This token changes with the password, this way stale sessions can not be persisted.
+Just to clear up any confusion, Authlogic stores both the record id and the persistence token in the session. Why? So stale sessions can not be persisted. It stores the id so it can quickly find the record, and the persistence token to ensure no sessions are stale. The persistence token changes with the password, if someone is logged in and their password is changed, they should be logged out, unless they made the change. That being said, the person making the change needs their session to be updated with the new persistence token, so they stay logged in, which is what this section is all about.
 
 That being said...What if a user changes their password? You have to re-log them in with the new password, recreate the session, etc, pain in the ass. Or what if a user creates a new user account? You have to do the same thing. Here's an even better one: what if a user is in the admin area and changes his own password? There might even be another place passwords can change. It shouldn't matter, your code should be written in a way where you don't have to remember to do this.
 
@@ -382,51 +429,33 @@ Here is basically how this is done....
     
     private
       def maintain_sessions!
-        # If we aren't logged in and a user is create log them in as that user
+        # If we aren't logged in and a user is created, log them in as that user
         # If we aren't logged in and a user's password changes, log them in as that user
         # If we are logged in and they change their password, update the session so they remain logged in
       end
   end
 
-Obviously there is a little more to it than this, but hopefully this clarifies any confusion. Lastly, this can be altered / disabled via a configuration option. Just set :session_ids => nil when calling acts_as_authentic.
+Obviously there is a little more to it than this, but hopefully this clarifies any confusion. Basically if you are *logged out* and you are changing passwords, Authlogic will log you in, since you already know the password for that account. Lastly, this can be altered / disabled via a configuration option. Just set :session_ids => nil when calling acts_as_authentic.
 
 When things come together like this I think its a sign that you are doing something right. Put that in your pipe and smoke it!
 
-== Migrating from restful_authentication
-
-Migrating from the restful_authentication plugin? I made an option especially for you. Just do the following and everything will be taken care of, your users won't even know anything changed:
-
-  # app/models/user.rb
-  class User < ActiveRecord::Base
-    acts_as_authentic :act_like_restful_authentication => true
-  end
-
-Or you can transition your users to the Authlogic password system:
-
-  # app/models/user.rb
-  class User < ActiveRecord::Base
-    acts_as_authentic :transition_from_restful_authentication => true
-  end
-
-For more information checkout my blog post on this: http://www.binarylogic.com/2008/11/23/tutorial-easily-migrate-from-restful_authentication-to-authlogic
-
 == Framework agnostic (Rails, Merb, etc.)
 
 I designed Authlogic to be framework agnostic, meaning it doesn't care what framework you use it in. Right out of the box it supports rails and merb. I have not had the opportunity to use other frameworks, but the only thing stopping Authlogic from being used in other frameworks is a simple adapter. Check out controller_adapters/rails_adapter, or controller_adapters/merb_adapter.
 
-Since pretty much all of the frameworks in ruby follow the Rack conventions, the code should be very similar across adapters. In fact that abstract adapter assumes you are using Rack. If you are using it properly there really isn't any code you should have to write. Check out the merb_adapter to see for yourself. You're saying "but Ben, why not just hook into Rack and avoid the need for controller adapters all together?". It's not that simple, because rails doesn't inherit from the Rack::Request class, plus there are small differences between how rack is implemented in each framework. Authlogic has to hook into your controller with a before_filter anyways, so it can "activate" itself. Why not just use the controller object?
+Since pretty much all of the frameworks in ruby follow the Rack standards, the code should be very similar across adapters. In fact that abstract adapter assumes you are following the Rack standards. If your framework is following the rack standards, there really isn't any code you should have to write. Check out the merb_adapter to see for yourself, the merb adapter is basically blank. You're saying "but Ben, why not just hook into Rack and avoid the need for controller adapters all together?". It's not that simple, because rails doesn't inherit from the Rack::Request class, plus there are small differences between how rack is implemented in each framework. Authlogic has to hook into your controller with a before_filter anyways, so it can "activate" itself. Why not just use the controller object? Also when we have access to the controller object we can do other nifty things. Checkout the OpenID tutorial in the helpful links section above to see what I mean.
 
 The point in all of this rambling is that implementing Authlogic is as simple as creating an adapter. I created both the rails and merb adapters in under 10 minutes. If you have an adapter you created and would like to add please let me know and I will add it into the source.
 
 == How it works
 
-Interested in how all of this all works? Basically a before_filter is automatically set in your controller which lets Authlogic know about the current controller object. This "activates" Authlogic and allows Authlogic to set sessions, cookies, login via basic http auth, etc. If you are using your framework in a multiple thread environment, don't worry. I kept that in mind and made this thread safe.
+Interested in how all of this all works? Basically a before filter is automatically set in your controller which lets Authlogic know about the current controller object. This "activates" Authlogic and allows Authlogic to set sessions, cookies, login via basic http auth, etc. If you are using your framework in a multiple thread environment, don't worry. I kept that in mind and made this thread safe.
 
 From there it is pretty simple. When you try to create a new session the record is authenticated and then all of the session / cookie magic is done for you. The sky is the limit.
 
 == What's wrong with the current solutions?
 
-You probably don't care, but I think releasing the millionth authentication solution for a framework that has been around for over 4 years requires a little explanation.
+You probably don't care, but I think releasing the millionth ruby authentication solution requires a little explanation.
 
 I don't necessarily think the current solutions are "wrong", nor am I saying Authlogic is the answer to your prayers. But, to me, the current solutions were lacking something. Here's what I came up with...
 
@@ -440,6 +469,10 @@ Using a library that hundreds of other people use has it advantages. Probably on
 
 Lastly, there is a pattern here, why clutter up all of your applications with the same code over and over?
 
+=== Security gets outdated
+
+Just as I stated in the above section, you can't stay up to date with your security since the code is generated and updating the plugin does nothing. If there is one thing you should stay up to date with, it's security. But it's not just the fact that there is no reasonable method for receiving updates. It's the fact that they tie you down to an encryption algorithm *AND* they use a bad one at that. Every single solution I've seen uses Sha1, which is joining the party with MD5. Sha1 is not as secure as it used to be. But that's the nature of algorithms, they eventually get phased out, which is fine. Everyone knows this, why not accommodate for this? Authlogic does this with the :transition_from_crypto_provider option. It takes care of transitioning all of your users to a new algorithm. Even better, it provides BCrypt as an option which should, in theory, never require you to switch since you can adjust the cost and make the encryption stronger. At the same time, still compatible with older passwords using the lower cost.
+
 === Why test the same code over and over?
 
 I've noticed my apps get cluttered with authentication tests, and they are the same exact tests! This irritates me. When you have identical tests across your apps thats a red flag that code can be extracted into a library. What's great about Authlogic is that I tested it for you. You don't write tests that test the internals of ActiveRecord do you? The same applies for Authlogic. Only test code that you've written. Essentially testing authentication is similar to testing any another RESTful controller. This makes your tests focused and easier to understand.
@@ -454,7 +487,7 @@ A lot of them forced me to name my password column as "this", or the key of my c
 
 === Disclaimer
 
-I am not trying to  "bash" any other authentication solutions. These are just my opinions, formulate your own opinion. I released Authlogic because it has made my life easier and I enjoy using it, hopefully it does the same for you.
+I am not trying to  "bash" any other authentication solutions. These are just my opinions, formulate your own opinion. I released Authlogic because I was "scratching my own itch". It has made my life easier and I enjoy using it, hopefully it does the same for you.
 
 
 Copyright (c) 2008 Ben Johnson of [Binary Logic](http://www.binarylogic.com), released under the MIT license

data/authlogic.gemspec

@@ -2,15 +2,15 @@
 
 Gem::Specification.new do |s|
   s.name = %q{authlogic}
-  s.version = "1.3.4"
+  s.version = "1.3.5"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 1.2") if s.respond_to? :required_rubygems_version=
   s.authors = ["Ben Johnson of Binary Logic"]
-  s.date = %q{2008-11-24}
+  s.date = %q{2008-11-30}
   s.description = %q{A clean, simple, and unobtrusive ruby authentication solution.}
   s.email = %q{bjohnson@binarylogic.com}
-  s.extra_rdoc_files = ["CHANGELOG.rdoc", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "README.rdoc"]
-  s.files = ["CHANGELOG.rdoc", "init.rb", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "Manifest", "MIT-LICENSE", "Rakefile", "README.rdoc", "shoulda_macros/authlogic.rb", "test/fixtures/companies.yml", "test/fixtures/employees.yml", "test/fixtures/projects.yml", "test/fixtures/users.yml", "test/libs/aes128_crypto_provider.rb", "test/libs/mock_controller.rb", "test/libs/mock_cookie_jar.rb", "test/libs/mock_request.rb", "test/libs/ordered_hash.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/credentials_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/logged_in_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/perishability_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/persistence_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/session_maintenance_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/single_access_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/authenticates_many_test.rb", "test/session_tests/active_record_trickery_test.rb", "test/session_tests/authenticates_many_association_test.rb", "test/session_tests/base_test.rb", "test/session_tests/config_test.rb", "test/session_tests/cookies_test.rb", "test/session_tests/params_test.rb", "test/session_tests/perishability_test.rb", "test/session_tests/scopes_test.rb", "test/session_tests/session_test.rb", "test/test_helper.rb", "authlogic.gemspec", "test/crypto_provider_tests/bcrypt_test.rb", "test/crypto_provider_tests/sha1_test.rb", "test/crypto_provider_tests/sha512_test.rb"]
+  s.extra_rdoc_files = ["CHANGELOG.rdoc", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/aes256.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "README.rdoc"]
+  s.files = ["CHANGELOG.rdoc", "init.rb", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/aes256.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "Manifest", "MIT-LICENSE", "Rakefile", "README.rdoc", "shoulda_macros/authlogic.rb", "test/crypto_provider_tests/aes256_test.rb", "test/crypto_provider_tests/bcrypt_test.rb", "test/crypto_provider_tests/sha1_test.rb", "test/crypto_provider_tests/sha512_test.rb", "test/fixtures/companies.yml", "test/fixtures/employees.yml", "test/fixtures/projects.yml", "test/fixtures/users.yml", "test/libs/mock_controller.rb", "test/libs/mock_cookie_jar.rb", "test/libs/mock_request.rb", "test/libs/ordered_hash.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/credentials_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/logged_in_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/perishability_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/persistence_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/session_maintenance_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/single_access_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/authenticates_many_test.rb", "test/session_tests/active_record_trickery_test.rb", "test/session_tests/authenticates_many_association_test.rb", "test/session_tests/base_test.rb", "test/session_tests/config_test.rb", "test/session_tests/cookies_test.rb", "test/session_tests/params_test.rb", "test/session_tests/perishability_test.rb", "test/session_tests/scopes_test.rb", "test/session_tests/session_test.rb", "test/test_helper.rb", "authlogic.gemspec"]
   s.has_rdoc = true
   s.homepage = %q{http://github.com/binarylogic/authlogic}
   s.rdoc_options = ["--line-numbers", "--inline-source", "--title", "Authlogic", "--main", "README.rdoc"]
@@ -18,7 +18,7 @@ Gem::Specification.new do |s|
   s.rubyforge_project = %q{authlogic}
   s.rubygems_version = %q{1.3.1}
   s.summary = %q{A clean, simple, and unobtrusive ruby authentication solution.}
-  s.test_files = ["test/crypto_provider_tests/bcrypt_test.rb", "test/crypto_provider_tests/sha1_test.rb", "test/crypto_provider_tests/sha512_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/credentials_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/logged_in_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/perishability_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/persistence_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/session_maintenance_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/single_access_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/authenticates_many_test.rb", "test/session_tests/active_record_trickery_test.rb", "test/session_tests/authenticates_many_association_test.rb", "test/session_tests/base_test.rb", "test/session_tests/config_test.rb", "test/session_tests/cookies_test.rb", "test/session_tests/params_test.rb", "test/session_tests/perishability_test.rb", "test/session_tests/scopes_test.rb", "test/session_tests/session_test.rb", "test/test_helper.rb"]
+  s.test_files = ["test/crypto_provider_tests/aes256_test.rb", "test/crypto_provider_tests/bcrypt_test.rb", "test/crypto_provider_tests/sha1_test.rb", "test/crypto_provider_tests/sha512_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/credentials_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/logged_in_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/perishability_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/persistence_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/session_maintenance_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/single_access_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/authenticates_many_test.rb", "test/session_tests/active_record_trickery_test.rb", "test/session_tests/authenticates_many_association_test.rb", "test/session_tests/base_test.rb", "test/session_tests/config_test.rb", "test/session_tests/cookies_test.rb", "test/session_tests/params_test.rb", "test/session_tests/perishability_test.rb", "test/session_tests/scopes_test.rb", "test/session_tests/session_test.rb", "test/test_helper.rb"]
 
   if s.respond_to? :specification_version then
     current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION

data/lib/authlogic.rb

@@ -9,6 +9,7 @@ require File.dirname(__FILE__) + "/authlogic/controller_adapters/merb_adapter" i
 require File.dirname(__FILE__) + "/authlogic/crypto_providers/sha1"
 require File.dirname(__FILE__) + "/authlogic/crypto_providers/sha512"
 require File.dirname(__FILE__) + "/authlogic/crypto_providers/bcrypt"
+require File.dirname(__FILE__) + "/authlogic/crypto_providers/aes256"
 
 if defined?(ActiveRecord)
   require File.dirname(__FILE__) + "/authlogic/orm_adapters/active_record_adapter/acts_as_authentic"

data/lib/authlogic/controller_adapters/merb_adapter.rb

@@ -1,10 +1,12 @@
 module Authlogic
   module ControllerAdapters
     # = Merb Adapter
+    #
     # Adapts authlogic to work with merb. The point is to close the gap between what authlogic expects and what the merb controller object
     # provides. Similar to how ActiveRecord has an adapter for MySQL, PostgreSQL, SQLite, etc.
     class MerbAdapter < AbstractAdapter
       # = Merb Implementation
+      #
       # Lets Authlogic know about the controller object, AKA "activates" authlogic.
       module MerbImplementation
         def self.included(klass) # :nodoc:

data/lib/authlogic/controller_adapters/rails_adapter.rb

@@ -1,6 +1,7 @@
 module Authlogic
   module ControllerAdapters
     # = Rails Adapter
+    #
     # Adapts authlogic to work with rails. The point is to close the gap between what authlogic expects and what the rails controller object
     # provides. Similar to how ActiveRecord has an adapter for MySQL, PostgreSQL, SQLite, etc.
     class RailsAdapter < AbstractAdapter
@@ -17,6 +18,7 @@ module Authlogic
       end
       
       # = Rails Implementation
+      #
       # Lets Authlogic know about the controller object, AKA "activates" authlogic.
       module RailsImplementation
         def self.included(klass) # :nodoc:

data/lib/authlogic/crypto_providers/aes256.rb

@@ -0,0 +1,45 @@
+require "openssl"
+
+module Authlogic
+  module CryptoProviders
+    # = AES256
+    #
+    # This encryption method is reversible if you have the supplied key. So in order to use this encryption method you must supply it with a key first.
+    # In an initializer, or before your application initializes, you should do the following:
+    #
+    #   Authlogic::CryptoProviders::AES256.key = "my really long and unique key, preferrable a bunch of random characters"
+    #
+    # My final comment is that this is a strong encryption method, but its main weakness is that its reversible. If you do not need to reverse the hash
+    # then you should consider Sha512 or BCrypt instead.
+    #
+    # Keep your key in a safe place, some even say the key should be stored on a separate server.
+    # This won't hurt performance because the only time it will try and access the key on the separate server is during initialization, which only
+    # happens once. The reasoning behind this is if someone does compromise your server they won't have the key also. Basically, you don't want to
+    # store the key with the lock.
+    class AES256
+      class << self
+        attr_writer :key
+    
+        def encrypt(*tokens)
+          aes.encrypt
+          aes.key = @key
+          [aes.update(tokens.join) + aes.final].pack("m").chomp
+        end
+    
+        def matches?(crypted, *tokens)
+          aes.decrypt
+          aes.key = @key
+          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
+        rescue OpenSSL::CipherError
+          false
+        end
+    
+        private
+          def aes
+            raise ArgumentError.new("You provide a key like #{name}.key = my_key before using the #{name}") if @key.blank?
+            @aes ||= OpenSSL::Cipher::Cipher.new("AES-256-ECB")
+          end
+      end
+    end
+  end
+end

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb

@@ -124,8 +124,8 @@ module Authlogic
         # * <tt>password_field_validation_options</tt> - default: {},
         #   The same as :validation_options but these are only applied to validations that pertain to the :password_field
         #
-        # * <tt>password_field_validates_presence_of_options</tt> - default: {:on => :create},
-        #   These options are applied to the validates_presence_of call for the :password_field
+        # * <tt>password_field_validates_length_of_options</tt> - default: {:minimum => 4},
+        #   These options are applied to the validates_length_of call for the :password_field
         #
         # * <tt>login_field_validates_confirmation_of_options</tt> - default: {},
         #   These options are applied to the validates_confirmation_of call for the :password_field
@@ -187,7 +187,7 @@ module Authlogic
               field_key = "#{field_name}_field_validation_options".to_sym
               options[field_key] = options[:validation_options].merge(options[field_key] || {})
               
-              validation_types = field_name == :password ? [:presence, :confirmation] : [:length, :format, :uniqueness]
+              validation_types = field_name == :password ? [:length, :confirmation] : [:length, :format, :uniqueness]
               validation_types.each do |validation_type|
                 validation_key = "#{field_name}_field_validates_#{validation_type}_of_options".to_sym
                 options[validation_key] = options[field_key].merge(options[validation_key] || {})
@@ -207,6 +207,8 @@ module Authlogic
                 options[crypto_provider_key].stretches = 1
               end
             end
+            
+            options[:transition_from_crypto_provider] = [options[:transition_from_crypto_provider]].compact unless options[:transition_from_crypto_provider].is_a?(Array)
 
             class_eval <<-"end_eval", __FILE__, __LINE__
               def self.acts_as_authentic_config

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb

@@ -30,7 +30,7 @@ module Authlogic
                 case options[:login_field_type]
                 when :email
                   validates_length_of options[:login_field], {:within => 6..100}.merge(options[:login_field_validates_length_of_options])
-                  validates_format_of options[:login_field], {:with => email_field_regex, :message => "should look like an email address."}.merge(options[:login_field_validates_length_of_options])
+                  validates_format_of options[:login_field], {:with => email_field_regex, :message => "should look like an email address."}.merge(options[:login_field_validates_format_of_options])
                 else
                   validates_length_of options[:login_field], {:within => 2..100}.merge(options[:login_field_validates_length_of_options])
                   validates_format_of options[:login_field], {:with => /\A\w[\w\.\-_@ ]+\z/, :message => "should use only letters, numbers, spaces, and .-_@ please."}.merge(options[:login_field_validates_format_of_options])
@@ -40,9 +40,9 @@ module Authlogic
               end
               
               if options[:validate_password_field]
-                validates_presence_of options[:password_field], {:on => :create}.merge(options[:password_field_validates_presence_of_options])
-                validates_confirmation_of options[:password_field], options[:password_field_validates_confirmation_of_options].merge(:if => "#{options[:crypted_password_field]}_changed?".to_sym)
-                validates_presence_of "#{options[:password_field]}_confirmation", :if => "#{options[:crypted_password_field]}_changed?"
+                validates_length_of options[:password_field], {:minimum => 4}.merge(options[:password_field_validates_length_of_options].merge(:if => "validate_#{options[:password_field]}?".to_sym))
+                validates_confirmation_of options[:password_field], options[:password_field_validates_confirmation_of_options].merge(:if => "validate_#{options[:password_field]}?".to_sym)
+                validates_presence_of "#{options[:password_field]}_confirmation", :if => "validate_#{options[:password_field]}?".to_sym
               end
               
               if options[:validate_email_field] && options[:email_field]
@@ -73,22 +73,17 @@ module Authlogic
               def valid_#{options[:password_field]}?(attempted_password)
                 return false if attempted_password.blank? || #{options[:crypted_password_field]}.blank? || #{options[:password_salt_field]}.blank?
                 
-                [#{options[:crypto_provider]}, #{options[:transition_from_crypto_provider].inspect}].compact.each do |encryptor|
+                ([#{options[:crypto_provider]}] + #{options[:transition_from_crypto_provider].inspect}).each_with_index do |encryptor, index|
                   # The arguments_type of for the transitioning from restful_authentication
-                  arguments_type = nil
-                  
-                  case encryptor.name
-                  when "#{options[:crypto_provider]}"
-                    arguments_type = :restful_authentication if #{options[:act_like_restful_authentication].inspect}
-                  when "#{options[:transition_from_crypto_provider].inspect}"
-                    arguments_type = :restful_authentication if #{options[:transition_from_restful_authentication].inspect}
-                  end
+                  arguments_type = (#{options[:act_like_restful_authentication].inspect} && index == 0) ||
+                    (#{options[:transition_from_restful_authentication].inspect} && index > 0 && encryptor == Authlogic::CryptoProviders::Sha1) ?
+                    :restful_authentication : nil
                   
                   if encryptor.matches?(#{options[:crypted_password_field]}, *encrypt_arguments(attempted_password, arguments_type))
                     # If we are transitioning from an older encryption algorithm and the password is still using the old algorithm
                     # then let's reset the password using the new algorithm. If the algorithm has a cost (BCrypt) and the cost has changed, update the password with
                     # the new cost.
-                    if encryptor == #{options[:transition_from_crypto_provider].inspect} || (encryptor.respond_to?(:cost_matches?) && !encryptor.cost_matches?(#{options[:crypted_password_field]}))
+                    if index > 0 || (encryptor.respond_to?(:cost_matches?) && !encryptor.cost_matches?(#{options[:crypted_password_field]}))
                       update_#{options[:password_field]}(attempted_password)
                       save(false)
                     end
@@ -118,6 +113,10 @@ module Authlogic
               end
               alias_method :randomize_password!, :reset_password!
               
+              def validate_#{options[:password_field]}?
+                new_record? || #{options[:crypted_password_field]}_changed?
+              end
+              
               private
                 def encrypt_arguments(raw_password, arguments_type = nil)
                   case arguments_type

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb

@@ -22,7 +22,10 @@ module Authlogic
           def acts_as_authentic_with_persistence(options = {})
             acts_as_authentic_without_persistence(options)
           
+            validates_presence_of options[:persistence_token_field]
             validates_uniqueness_of options[:persistence_token_field], :if => "#{options[:persistence_token_field]}_changed?".to_sym
+            
+            before_validation "reset_#{options[:persistence_token_field]}".to_sym, :if => "reset_#{options[:persistence_token_field]}?".to_sym
           
             def forget_all!
               # Paginate these to save on memory
@@ -46,10 +49,23 @@ module Authlogic
               end
             
               def #{options[:password_field]}_with_persistence=(value)
-                self.#{options[:persistence_token_field]} = self.class.unique_token
+                reset_#{options[:persistence_token_field]}
                 self.#{options[:password_field]}_without_persistence = value
               end
               alias_method_chain :#{options[:password_field]}=, :persistence
+              
+              def reset_#{options[:persistence_token_field]}
+                self.#{options[:persistence_token_field]} = self.class.unique_token
+              end
+              
+              def reset_#{options[:persistence_token_field]}!
+                reset_#{options[:persistence_token_field]}
+                save_without_session_maintenance(false)
+              end
+              
+              def reset_#{options[:persistence_token_field]}?
+                #{options[:persistence_token_field]}.blank?
+              end
             end_eval
           end
         end

data/lib/authlogic/session/base.rb

@@ -203,7 +203,7 @@ module Authlogic
       end
       
       # Allows you to set a unique identifier for your session, so that you can have more than 1 session at a time. A good example when this might be needed is when you want to have a normal user session
-      # and a "secure" user session. The secure user session would be created only when they want to modify their billing information, or other sensative information. Similar to me.com. This requires 2
+      # and a "secure" user session. The secure user session would be created only when they want to modify their billing information, or other sensitive information. Similar to me.com. This requires 2
       # user sessions. Just use an id for the "secure" session and you should be good.
       #
       # You can set the id during initialization (see initialize for more information), or as an attribute:
@@ -357,7 +357,7 @@ module Authlogic
           return if respond_to?(login_field) # already created these methods
           
           self.class.class_eval <<-"end_eval", __FILE__, __LINE__
-            alias_method :#{klass_name.underscore}, :record
+            alias_method :#{klass_name.underscore.split("/").last}, :record
             
             attr_reader :#{login_field}
             

data/lib/authlogic/version.rb

@@ -44,7 +44,7 @@ module Authlogic # :nodoc:
 
     MAJOR = 1
     MINOR = 3
-    TINY  = 4
+    TINY  = 5
 
     # The current version as a Version instance
     CURRENT = new(MAJOR, MINOR, TINY)

data/test/crypto_provider_tests/aes256_test.rb

@@ -0,0 +1,14 @@
+require File.dirname(__FILE__) + '/../test_helper.rb'
+
+module CryptoProviderTests
+  class AES256Test < ActiveSupport::TestCase
+    def test_encrypt
+      assert Authlogic::CryptoProviders::AES256.encrypt("mypass")
+    end
+    
+    def test_matches
+      hash = Authlogic::CryptoProviders::AES256.encrypt("mypass")
+      assert Authlogic::CryptoProviders::AES256.matches?(hash, "mypass")
+    end
+  end
+end

data/test/fixtures/employees.yml

@@ -2,7 +2,7 @@ drew:
   company: binary_logic
   email: dgainor@binarylogic.com
   password_salt: <%= salt = Employee.unique_token %>
-  crypted_password: "<%= Employee.acts_as_authentic_config[:crypto_provider].encrypt("drewrocks" + salt) %>"
+  crypted_password: '<%= Employee.acts_as_authentic_config[:crypto_provider].encrypt("drewrocks" + salt) %>'
   persistence_token: 5273d85ed156e9dbd6a7c1438d319ef8c8d41dd24368db6c222de11346c7b11e53ee08d45ecf619b1c1dc91233d22b372482b751b066d0a6f6f9bac42eacaabf
   first_name: Drew
   last_name: Gainor
@@ -11,7 +11,7 @@ jennifer:
   company: logic_over_data
   email: jjohnson@logicoverdata.com
   password_salt: <%= salt = Employee.unique_token %>
-  crypted_password: "<%= Employee.acts_as_authentic_config[:crypto_provider].encrypt("jenniferocks" + salt) %>"
+  crypted_password: '<%= Employee.acts_as_authentic_config[:crypto_provider].encrypt("jenniferocks" + salt) %>'
   persistence_token: 2be52a8f741ad00056e6f94eb6844d5316527206da7a3a5e3d0e14d19499ef9fe4c47c89b87febb59a2b41a69edfb4733b6b79302040f3de83f297c6991c75a2
   first_name: Jennifer
   last_name: Johnson

data/test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb

@@ -36,7 +36,7 @@ module ORMAdaptersTests
             :validate_fields => true,
             :login_field => :login,
             :perishable_token_valid_for => 600,
-            :password_field_validates_presence_of_options => {},
+            :password_field_validates_length_of_options => {},
             :password_field => :password,
             :validate_login_field => true,
             :email_field => :email,
@@ -44,7 +44,8 @@ module ORMAdaptersTests
             :password_field_validates_confirmation_of_options => {},
             :validate_email_field => true,
             :validation_options => {},
-            :login_field_validation_options => {}
+            :login_field_validation_options => {},
+            :transition_from_crypto_provider => []
            }
           assert_equal default_config, User.acts_as_authentic_config
         end
@@ -76,6 +77,8 @@ module ORMAdaptersTests
         def test_transition_from_crypto_provider
           ben = users(:ben)
           convert_password_to(Authlogic::CryptoProviders::BCrypt, ben)
+          convert_password_to(Authlogic::CryptoProviders::Sha1, ben, [Authlogic::CryptoProviders::Sha512, Authlogic::CryptoProviders::BCrypt])
+          convert_password_to(Authlogic::CryptoProviders::Sha512, ben, [Authlogic::CryptoProviders::Sha1, Authlogic::CryptoProviders::BCrypt])
         end
         
         def test_act_like_restful_authentication
@@ -97,7 +100,7 @@ module ORMAdaptersTests
         def test_transition_from_restful_authentication
           User.acts_as_authentic(:transition_from_restful_authentication => true)
           assert_equal Authlogic::CryptoProviders::Sha512, User.acts_as_authentic_config[:crypto_provider]
-          assert_equal Authlogic::CryptoProviders::Sha1, User.acts_as_authentic_config[:transition_from_crypto_provider]
+          assert_equal [Authlogic::CryptoProviders::Sha1], User.acts_as_authentic_config[:transition_from_crypto_provider]
         end
         
         private
@@ -109,8 +112,9 @@ module ORMAdaptersTests
             User.acts_as_authentic @default_configuration
           end
           
-          def convert_password_to(crypto_provider, *records)
-            User.acts_as_authentic(:crypto_provider => crypto_provider, :transition_from_crypto_provider => Authlogic::CryptoProviders::Sha512)
+          def convert_password_to(crypto_provider, records, from_crypto_providers = Authlogic::CryptoProviders::Sha512)
+            records = [records] unless records.is_a?(Array)
+            User.acts_as_authentic(:crypto_provider => crypto_provider, :transition_from_crypto_provider => from_crypto_providers)
             records.each do |record|
               old_hash = record.crypted_password
               assert record.valid_password?(password_for(record))

data/test/test_helper.rb

@@ -4,7 +4,6 @@ require "ruby-debug"
 require "active_record"
 require 'active_record/fixtures'
 require File.dirname(__FILE__) + '/../lib/authlogic' unless defined?(Authlogic)
-require File.dirname(__FILE__) + '/libs/aes128_crypto_provider'
 require File.dirname(__FILE__) + '/libs/mock_request'
 require File.dirname(__FILE__) + '/libs/mock_cookie_jar'
 require File.dirname(__FILE__) + '/libs/mock_controller'
@@ -94,8 +93,10 @@ class User < ActiveRecord::Base
   has_and_belongs_to_many :projects
 end
 
+Authlogic::CryptoProviders::AES256.key = "myafdsfddddddddddddddddddddddddddddddddddddddddddddddd"
+
 class Employee < ActiveRecord::Base
-  acts_as_authentic :crypto_provider => AES128CryptoProvider
+  acts_as_authentic :crypto_provider => Authlogic::CryptoProviders::AES256
   belongs_to :company
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: authlogic
 version: !ruby/object:Gem::Version 
-  version: 1.3.4
+  version: 1.3.5
 platform: ruby
 authors: 
 - Ben Johnson of Binary Logic
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2008-11-24 00:00:00 -05:00
+date: 2008-11-30 00:00:00 -05:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -43,6 +43,7 @@ extra_rdoc_files:
 - lib/authlogic/controller_adapters/abstract_adapter.rb
 - lib/authlogic/controller_adapters/merb_adapter.rb
 - lib/authlogic/controller_adapters/rails_adapter.rb
+- lib/authlogic/crypto_providers/aes256.rb
 - lib/authlogic/crypto_providers/bcrypt.rb
 - lib/authlogic/crypto_providers/sha1.rb
 - lib/authlogic/crypto_providers/sha512.rb
@@ -75,6 +76,7 @@ files:
 - lib/authlogic/controller_adapters/abstract_adapter.rb
 - lib/authlogic/controller_adapters/merb_adapter.rb
 - lib/authlogic/controller_adapters/rails_adapter.rb
+- lib/authlogic/crypto_providers/aes256.rb
 - lib/authlogic/crypto_providers/bcrypt.rb
 - lib/authlogic/crypto_providers/sha1.rb
 - lib/authlogic/crypto_providers/sha512.rb
@@ -105,11 +107,14 @@ files:
 - Rakefile
 - README.rdoc
 - shoulda_macros/authlogic.rb
+- test/crypto_provider_tests/aes256_test.rb
+- test/crypto_provider_tests/bcrypt_test.rb
+- test/crypto_provider_tests/sha1_test.rb
+- test/crypto_provider_tests/sha512_test.rb
 - test/fixtures/companies.yml
 - test/fixtures/employees.yml
 - test/fixtures/projects.yml
 - test/fixtures/users.yml
-- test/libs/aes128_crypto_provider.rb
 - test/libs/mock_controller.rb
 - test/libs/mock_cookie_jar.rb
 - test/libs/mock_request.rb
@@ -165,6 +170,7 @@ signing_key:
 specification_version: 2
 summary: A clean, simple, and unobtrusive ruby authentication solution.
 test_files: 
+- test/crypto_provider_tests/aes256_test.rb
 - test/crypto_provider_tests/bcrypt_test.rb
 - test/crypto_provider_tests/sha1_test.rb
 - test/crypto_provider_tests/sha512_test.rb

data/test/libs/aes128_crypto_provider.rb

@@ -1,17 +0,0 @@
-require "ezcrypto"
-
-class AES128CryptoProvider
-  class << self
-    def encrypt(*tokens)
-      [key.encrypt(tokens.join)].pack("m").chomp
-    end
-    
-    def matches?(crypted, *tokens)
-      key.decrypt(crypted.unpack("m").first) == tokens.join
-    end
-    
-    def key
-      EzCrypto::Key.with_password "master_key", "some_salt"
-    end
-  end
-end