authlogic 2.0.1 → 2.1.1

data/lib/authlogic/acts_as_authentic/password.rb

@@ -18,7 +18,7 @@ module Authlogic
         # * <tt>Default:</tt> :crypted_password, :encrypted_password, :password_hash, or :pw_hash
         # * <tt>Accepts:</tt> Symbol
         def crypted_password_field(value = nil)
-          config(:crypted_password_field, value, first_column_to_exist(:crypted_password, :encrypted_password, :password_hash, :pw_hash))
+          rw_config(:crypted_password_field, value, first_column_to_exist(nil, :crypted_password, :encrypted_password, :password_hash, :pw_hash))
         end
         alias_method :crypted_password_field=, :crypted_password_field
         
@@ -27,53 +27,129 @@ module Authlogic
         # * <tt>Default:</tt> :password_salt, :pw_salt, :salt, nil if none exist
         # * <tt>Accepts:</tt> Symbol
         def password_salt_field(value = nil)
-          config(:password_salt_field, value, first_column_to_exist(nil, :password_salt, :pw_salt, :salt))
+          rw_config(:password_salt_field, value, first_column_to_exist(nil, :password_salt, :pw_salt, :salt))
         end
         alias_method :password_salt_field=, :password_salt_field
         
+        # Whether or not to require a password confirmation. If you don't want your users to confirm their password
+        # just set this to false.
+        #
+        # * <tt>Default:</tt> true
+        # * <tt>Accepts:</tt> Boolean
+        def require_password_confirmation(value = nil)
+          rw_config(:require_password_confirmation, value, true)
+        end
+        alias_method :require_password_confirmation=, :require_password_confirmation
+        
+        # By default passwords are required when a record is new or the crypted_password is blank, but if both of these things
+        # are met a password is not required. In this case, blank passwords are ignored.
+        #
+        # Think about a profile page, where the user can edit all of their information, including changing their password.
+        # If they do not want to change their password they just leave the fields blank. This will try to set the password to
+        # a blank value, in which case is incorrect behavior. As such, Authlogic ignores this. But let's say you have a completely
+        # separate page for resetting passwords, you might not want to ignore blank passwords. If this is the case for you, then
+        # just set this value to false.
+        #
+        # * <tt>Default:</tt> true
+        # * <tt>Accepts:</tt> Boolean
+        def ignore_blank_passwords(value = nil)
+          rw_config(:ignore_blank_passwords, value, true)
+        end
+        alias_method :ignore_blank_passwords=, :ignore_blank_passwords
+        
+        # When calling valid_password?("some pass") do you want to check that password against what's in that object or whats in
+        # the datbase. Take this example:
+        #
+        #   u = User.first
+        #   u.password = "new pass"
+        #   u.valid_password?("old pass")
+        #
+        # Should the last line above return true or false? The record hasn't been saved yet, so most would assume yes.
+        # Other would assume no. So I let you decide by giving you this option.
+        #
+        # * <tt>Default:</tt> true
+        # * <tt>Accepts:</tt> Boolean
+        def check_passwords_against_database(value = nil)
+          rw_config(:check_passwords_against_database, value, true)
+        end
+        alias_method :check_passwords_against_database=, :check_passwords_against_database
+        
         # Whether or not to validate the password field.
         #
         # * <tt>Default:</tt> true
         # * <tt>Accepts:</tt> Boolean
         def validate_password_field(value = nil)
-          config(:validate_password_field, value, true)
+          rw_config(:validate_password_field, value, true)
         end
         alias_method :validate_password_field=, :validate_password_field
         
         # A hash of options for the validates_length_of call for the password field. Allows you to change this however you want.
         #
+        # <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
+        # merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
+        # options.</b>
+        #
         # * <tt>Default:</tt> {:minimum => 4, :if => :require_password?}
         # * <tt>Accepts:</tt> Hash of options accepted by validates_length_of
         def validates_length_of_password_field_options(value = nil)
-          config(:validates_length_of_password_field_options, value, {:minimum => 4, :if => :require_password?})
+          rw_config(:validates_length_of_password_field_options, value, {:minimum => 4, :if => :require_password?})
         end
         alias_method :validates_length_of_password_field_options=, :validates_length_of_password_field_options
         
+        # A convenience function to merge options into the validates_length_of_login_field_options. So intead of:
+        #
+        #   self.validates_length_of_password_field_options = validates_length_of_password_field_options.merge(:my_option => my_value)
+        #
+        # You can do this:
+        #
+        #   merge_validates_length_of_password_field_options :my_option => my_value
+        def merge_validates_length_of_password_field_options(options = {})
+          self.validates_length_of_password_field_options = validates_length_of_password_field_options.merge(options)
+        end
+        
         # A hash of options for the validates_confirmation_of call for the password field. Allows you to change this however you want.
         #
-        # * <tt>Default:</tt> {:minimum => 4, :if => "#{password_salt_field}_changed?".to_sym}
+        # <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
+        # merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
+        # options.</b>
+        #
+        # * <tt>Default:</tt> {:if => :require_password?}
         # * <tt>Accepts:</tt> Hash of options accepted by validates_confirmation_of
         def validates_confirmation_of_password_field_options(value = nil)
-          config(:validates_confirmation_of_password_field_options, value, {:minimum => 4, :if => (password_salt_field ? "#{password_salt_field}_changed?".to_sym : nil)})
+          rw_config(:validates_confirmation_of_password_field_options, value, {:if => :require_password?})
         end
         alias_method :validates_confirmation_of_password_field_options=, :validates_confirmation_of_password_field_options
         
+        # See merge_validates_length_of_password_field_options. The same thing, except for validates_confirmation_of_password_field_options
+        def merge_validates_confirmation_of_password_field_options(options = {})
+          self.validates_confirmation_of_password_field_options = validates_confirmation_of_password_field_options.merge(options)
+        end
+        
         # A hash of options for the validates_length_of call for the password_confirmation field. Allows you to change this however you want.
         #
-        # * <tt>Default:</tt> {:minimum => 4, :if => :require_password_?}
+        # <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
+        # merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
+        # options.</b>
+        #
+        # * <tt>Default:</tt> validates_length_of_password_field_options
         # * <tt>Accepts:</tt> Hash of options accepted by validates_length_of
         def validates_length_of_password_confirmation_field_options(value = nil)
-          config(:validates_length_of_password_confirmation_field_options, value, {:minimum => 4, :if => :require_password?})
+          rw_config(:validates_length_of_password_confirmation_field_options, value, validates_length_of_password_field_options)
         end
         alias_method :validates_length_of_password_confirmation_field_options=, :validates_length_of_password_confirmation_field_options
         
+        # See merge_validates_length_of_password_field_options. The same thing, except for validates_length_of_password_confirmation_field_options
+        def merge_validates_length_of_password_confirmation_field_options(options = {})
+          self.validates_length_of_password_confirmation_field_options = validates_length_of_password_confirmation_field_options.merge(options)
+        end
+        
         # The class you want to use to encrypt and verify your encrypted passwords. See the Authlogic::CryptoProviders module for more info
         # on the available methods and how to create your own.
         #
         # * <tt>Default:</tt> CryptoProviders::Sha512
         # * <tt>Accepts:</tt> Class
         def crypto_provider(value = nil)
-          config(:crypto_provider, value, CryptoProviders::Sha512)
+          rw_config(:crypto_provider, value, CryptoProviders::Sha512)
         end
         alias_method :crypto_provider=, :crypto_provider
         
@@ -89,7 +165,7 @@ module Authlogic
         # * <tt>Default:</tt> nil
         # * <tt>Accepts:</tt> Class or Array
         def transition_from_crypto_providers(value = nil)
-          config(:transition_from_crypto_providers, (!value.nil? && [value].flatten.compact) || value, [])
+          rw_config(:transition_from_crypto_providers, (!value.nil? && [value].flatten.compact) || value, [])
         end
         alias_method :transition_from_crypto_providers=, :transition_from_crypto_providers
       end
@@ -102,6 +178,7 @@ module Authlogic
         ]
         
         def self.included(klass)
+          return if klass.crypted_password_field.nil?
           klass.define_callbacks *METHODS
         end
         
@@ -118,107 +195,149 @@ module Authlogic
       # The methods related to the password field.
       module Methods
         def self.included(klass)
+          return if klass.crypted_password_field.nil?
+          
           klass.class_eval do
+            include InstanceMethods
+            
             if validate_password_field
               validates_length_of :password, validates_length_of_password_field_options
-              validates_confirmation_of :password, validates_confirmation_of_password_field_options
-              validates_length_of :password_confirmation, validates_length_of_password_confirmation_field_options
+              
+              if require_password_confirmation
+                validates_confirmation_of :password, validates_confirmation_of_password_field_options
+                validates_length_of :password_confirmation, validates_length_of_password_confirmation_field_options
+              end
             end
+            
+            after_save :reset_password_changed
           end
         end
         
-        # The password
-        def password
-          @password
-        end
+        module InstanceMethods
+          # The password
+          def password
+            @password
+          end
         
-        # This is a virtual method. Once a password is passed to it, it will create new password salt as well as encrypt
-        # the password.
-        def password=(pass)
-          return if pass.blank?
-          before_password_set
-          @password = pass
-          send("#{password_salt_field}=", Authlogic::Random.friendly_token) if password_salt_field
-          send("#{crypted_password_field}=", crypto_provider.encrypt(*encrypt_arguments(@password, act_like_restful_authentication? ? :restful_authentication : nil)))
-          after_password_set
-        end
+          # This is a virtual method. Once a password is passed to it, it will create new password salt as well as encrypt
+          # the password.
+          def password=(pass)
+            return if ignore_blank_passwords? && pass.blank?
+            before_password_set
+            @password = pass
+            send("#{password_salt_field}=", Authlogic::Random.friendly_token) if password_salt_field
+            send("#{crypted_password_field}=", crypto_provider.encrypt(*encrypt_arguments(@password, false, act_like_restful_authentication? ? :restful_authentication : nil)))
+            @password_changed = true
+            after_password_set
+          end
         
-        # Accepts a raw password to determine if it is the correct password or not.
-        def valid_password?(attempted_password)
-          return false if attempted_password.blank? || send(crypted_password_field).blank?
+          # Accepts a raw password to determine if it is the correct password or not. Notice the second argument. That defaults to the value of
+          # check_passwords_against_database. See that method for mor information, but basically it just tells Authlogic to check the password
+          # against the value in the database or the value in the object.
+          def valid_password?(attempted_password, check_against_database = check_passwords_against_database?)
+            crypted = check_against_database && send("#{crypted_password_field}_changed?") ? send("#{crypted_password_field}_was") : send(crypted_password_field)
+            return false if attempted_password.blank? || crypted.blank?
+            before_password_verification
           
-          before_password_verification
-          
-          crypto_providers = [crypto_provider] + transition_from_crypto_providers
-          crypto_providers.each_with_index do |encryptor, index|
-            # The arguments_type of for the transitioning from restful_authentication
-            arguments_type = (act_like_restful_authentication? && index == 0) ||
-              (transition_from_restful_authentication? && index > 0 && encryptor == Authlogic::CryptoProviders::Sha1) ?
-              :restful_authentication : nil
+            crypto_providers.each_with_index do |encryptor, index|
+              # The arguments_type of for the transitioning from restful_authentication
+              arguments_type = (act_like_restful_authentication? && index == 0) ||
+                (transition_from_restful_authentication? && index > 0 && encryptor == Authlogic::CryptoProviders::Sha1) ?
+                :restful_authentication : nil
             
-            if encryptor.matches?(send(crypted_password_field), *encrypt_arguments(attempted_password, arguments_type))
-              # If we are transitioning from an older encryption algorithm and the password is still using the old algorithm
-              # then let's reset the password using the new algorithm. If the algorithm has a cost (BCrypt) and the cost has changed, update the password with
-              # the new cost.
-              if index > 0 || (encryptor.respond_to?(:cost_matches?) && !encryptor.cost_matches?(send(crypted_password_field)))
-                self.password = attempted_password
-                save(false)
+              if encryptor.matches?(crypted, *encrypt_arguments(attempted_password, check_against_database, arguments_type))
+                transition_password(attempted_password) if transition_password?(index, encryptor, crypted, check_against_database)
+                after_password_verification
+                return true
               end
-              
-              after_password_verification
-              
-              return true
             end
-          end
           
-          false
-        end
+            false
+          end
         
-        # Resets the password to a random friendly token.
-        def reset_password
-          friendly_token = Authlogic::Random.friendly_token
-          self.password = friendly_token
-          self.password_confirmation = friendly_token
-        end
-        alias_method :randomize_password, :reset_password
+          # Resets the password to a random friendly token.
+          def reset_password
+            friendly_token = Authlogic::Random.friendly_token
+            self.password = friendly_token
+            self.password_confirmation = friendly_token
+          end
+          alias_method :randomize_password, :reset_password
         
-        # Resets the password to a random friendly token and then saves the record.
-        def reset_password!
-          reset_password
-          save_without_session_maintenance(false)
-        end
-        alias_method :randomize_password!, :reset_password!
+          # Resets the password to a random friendly token and then saves the record.
+          def reset_password!
+            reset_password
+            save_without_session_maintenance(false)
+          end
+          alias_method :randomize_password!, :reset_password!
         
-        private
-          def encrypt_arguments(raw_password, arguments_type = nil)
-            salt = password_salt_field ? send(password_salt_field) : nil
-            case arguments_type
-            when :restful_authentication
-              [REST_AUTH_SITE_KEY, salt, raw_password, REST_AUTH_SITE_KEY].compact
-            else
-              [raw_password, salt].compact
+          private
+            def check_passwords_against_database?
+              self.class.check_passwords_against_database == true
+            end
+            
+            def crypto_providers
+              [crypto_provider] + transition_from_crypto_providers
+            end
+            
+            def encrypt_arguments(raw_password, check_against_database, arguments_type = nil)
+              salt = nil
+              salt = (check_against_database && send("#{password_salt_field}_changed?") ? send("#{password_salt_field}_was") : send(password_salt_field)) if password_salt_field
+              
+              case arguments_type
+              when :restful_authentication
+                [REST_AUTH_SITE_KEY, salt, raw_password, REST_AUTH_SITE_KEY].compact
+              else
+                [raw_password, salt].compact
+              end
+            end
+            
+            # Determines if we need to tranisiton the password.
+            # If the index > 0 then we are using an "transition from" crypto provider.
+            # If the encryptor has a cost and the cost it outdated.
+            # If we aren't using database values
+            # If we are using database values, only if the password hasnt change so we don't overwrite any changes
+            def transition_password?(index, encryptor, crypted, check_against_database)
+              (index > 0 || (encryptor.respond_to?(:cost_matches?) && !encryptor.cost_matches?(send(crypted_password_field)))) &&
+                (!check_against_database || !send("#{crypted_password_field}_changed?"))
+            end
+            
+            def transition_password(attempted_password)
+              self.password = attempted_password
+              save(false)
             end
-          end
           
-          def require_password?
-            new_record? || (password_salt_field && send("#{password_salt_field}_changed?")) || send(crypted_password_field).blank?
-          end
+            def require_password?
+              new_record? || password_changed? || send(crypted_password_field).blank?
+            end
           
-          def crypted_password_field
-            self.class.crypted_password_field
-          end
+            def ignore_blank_passwords?
+              self.class.ignore_blank_passwords == true
+            end
           
-          def password_salt_field
-            self.class.password_salt_field
-          end
+            def password_changed?
+              @password_changed == true
+            end
+            
+            def reset_password_changed
+              @password_changed = nil
+            end
           
-          def crypto_provider
-            self.class.crypto_provider
-          end
+            def crypted_password_field
+              self.class.crypted_password_field
+            end
           
-          def transition_from_crypto_providers
-            self.class.transition_from_crypto_providers
-          end
+            def password_salt_field
+              self.class.password_salt_field
+            end
+          
+            def crypto_provider
+              self.class.crypto_provider
+            end
+          
+            def transition_from_crypto_providers
+              self.class.transition_from_crypto_providers
+            end
+        end
       end
     end
   end

data/lib/authlogic/acts_as_authentic/perishable_token.rb

@@ -20,7 +20,7 @@ module Authlogic
         # * <tt>Default:</tt> 10.minutes
         # * <tt>Accepts:</tt> Fixnum
         def perishable_token_valid_for(value = nil)
-          config(:perishable_token_valid_for, (!value.nil? && value.to_i) || value, 10.minutes.to_i)
+          rw_config(:perishable_token_valid_for, (!value.nil? && value.to_i) || value, 10.minutes.to_i)
         end
         alias_method :perishable_token_valid_for=, :perishable_token_valid_for
         
@@ -31,7 +31,7 @@ module Authlogic
         # * <tt>Default:</tt> false
         # * <tt>Accepts:</tt> Boolean
         def disable_perishable_token_maintenance(value = nil)
-          config(:disable_perishable_token_maintenance, value, false)
+          rw_config(:disable_perishable_token_maintenance, value, false)
         end
         alias_method :disable_perishable_token_maintenance=, :disable_perishable_token_maintenance
       end
@@ -60,7 +60,7 @@ module Authlogic
           # If you want to use a different timeout value, just pass it as the second parameter:
           #
           #   User.find_using_perishable_token(token, 1.hour)
-          def find_using_perishable_token(token, age = perishable_token_valid_for)
+          def find_using_perishable_token(token, age = self.perishable_token_valid_for)
             return if token.blank?
             age = age.to_i
             
@@ -74,6 +74,11 @@ module Authlogic
             
             find(:first, :conditions => [conditions_sql, *conditions_subs])
           end
+          
+          # This method will raise ActiveRecord::NotFound if no record is found.
+          def find_using_perishable_token!(token, age = perishable_token_valid_for)
+            find_using_perishable_token(token, age) || raise(ActiveRecord::RecordNotFound)
+          end
         end
         
         # Instance level methods for the perishable token.
@@ -97,4 +102,4 @@ module Authlogic
       end
     end
   end
-end
+end

data/lib/authlogic/acts_as_authentic/persistence_token.rb

@@ -16,8 +16,10 @@ module Authlogic
             extend ClassMethods
             include InstanceMethods
             
-            after_password_set :reset_persistence_token
-            after_password_verification :reset_persistence_token!, :if => :reset_persistence_token?
+            if respond_to?(:after_password_set) && respond_to?(:after_password_verification)
+              after_password_set :reset_persistence_token
+              after_password_verification :reset_persistence_token!, :if => :reset_persistence_token?
+            end
             
             validates_presence_of :persistence_token
             validates_uniqueness_of :persistence_token, :if => :persistence_token_changed?

data/lib/authlogic/acts_as_authentic/restful_authentication.rb

@@ -18,7 +18,7 @@ module Authlogic
         # * <tt>Default:</tt> false
         # * <tt>Accepts:</tt> Boolean
         def act_like_restful_authentication(value = nil)
-          r = config(:act_like_restful_authentication, value, false)
+          r = rw_config(:act_like_restful_authentication, value, false)
           set_restful_authentication_config if value
           r
         end
@@ -26,9 +26,10 @@ module Authlogic
         
         # This works just like act_like_restful_authentication except that it will start transitioning your users to the algorithm you
         # specify with the crypto provider option. The next time they log in it will resave their password with the new algorithm
-        # and any new record will use the new algorithm as well.
+        # and any new record will use the new algorithm as well. Make sure to update your users table if you are using the default
+        # migration since it will set crypted_password and salt columns to a maximum width of 40 characters which is not enough. 
         def transition_from_restful_authentication(value = nil)
-          r = config(:transition_from_restful_authentication, value, false)
+          r = rw_config(:transition_from_restful_authentication, value, false)
           set_restful_authentication_config if value
           r
         end
@@ -39,7 +40,7 @@ module Authlogic
             crypto_provider_key = act_like_restful_authentication ? :crypto_provider : :transition_from_crypto_providers
             self.send("#{crypto_provider_key}=", CryptoProviders::Sha1)
             if !defined?(::REST_AUTH_SITE_KEY) || ::REST_AUTH_SITE_KEY.nil?
-              class_eval("::REST_AUTH_SITE_KEY = nil") if !defined?(::REST_AUTH_SITE_KEY)
+              class_eval("::REST_AUTH_SITE_KEY = ''") if !defined?(::REST_AUTH_SITE_KEY)
               CryptoProviders::Sha1.stretches = 1
             end
           end

data/lib/authlogic/acts_as_authentic/session_maintenance.rb

@@ -5,7 +5,7 @@ module Authlogic
     #
     # Just to clear up any confusion, Authlogic stores both the record id and the persistence token in the session.
     # Why? So stale sessions can not be persisted. It stores the id so it can quickly find the record, and the
-    # persistence token to ensure no sessions are stale. So if the persistence token changes, the user muct log
+    # persistence token to ensure no sessions are stale. So if the persistence token changes, the user must log
     # back in.
     #
     # Well, the persistence token changes with the password. What happens if the user changes his own password?
@@ -26,6 +26,17 @@ module Authlogic
       end
       
       module Config
+        # This is more of a convenience method. In order to turn off automatic maintenance of sessions just
+        # set this to false, or you can also set the session_ids method to a blank array. Both accomplish
+        # the same thing. This method is a little clearer in it's intentions though.
+        #
+        # * <tt>Default:</tt> true
+        # * <tt>Accepts:</tt> Boolean
+        def maintain_sessions(value = nil)
+          rw_config(:maintain_sessions, value, true)
+        end
+        alias_method :maintain_sessions=, :maintain_sessions
+        
         # As you may know, authlogic sessions can be separate by id (See Authlogic::Session::Base#id). You can
         # specify here what session ids you want auto maintained. By default it is the main session, which has
         # an id of nil.
@@ -33,7 +44,7 @@ module Authlogic
         # * <tt>Default:</tt> [nil]
         # * <tt>Accepts:</tt> Array
         def session_ids(value = nil)
-          config(:session_ids, value, [nil])
+          rw_config(:session_ids, value, [nil])
         end
         alias_method :session_ids=, :session_ids
         
@@ -42,7 +53,8 @@ module Authlogic
         # * <tt>Default:</tt> "#{klass.name}Session".constantize
         # * <tt>Accepts:</tt> Class
         def session_class(value = nil)
-          config(:session_class, value, "#{name}Session".constantize)
+          const = "#{base_class.name}Session".constantize rescue nil
+          rw_config(:session_class, value, const)
         end
         alias_method :session_class=, :session_class
       end
@@ -73,7 +85,7 @@ module Authlogic
           end
           
           def update_sessions?
-            !skip_session_maintenance && session_class.activated? && !session_ids.blank? && persistence_token_changed?
+            !skip_session_maintenance && session_class && session_class.activated? && self.class.maintain_sessions == true && !session_ids.blank? && persistence_token_changed?
           end
           
           def get_session_information

data/lib/authlogic/acts_as_authentic/single_access_token.rb

@@ -12,8 +12,15 @@ module Authlogic
       
       # All configuration for the single_access token aspect of acts_as_authentic.
       module Config
+        # The single access token is used for authentication via URLs, such as a private feed. That being said,
+        # if the user changes their password, that token probably shouldn't change. If it did, the user would have
+        # to update all of their URLs. So be default this is option is disabled, if you need it, feel free to turn
+        # it on.
+        #
+        # * <tt>Default:</tt> false
+        # * <tt>Accepts:</tt> Boolean
         def change_single_access_token_with_password(value = nil)
-          config(:change_single_access_token_with_password, value, false)
+          rw_config(:change_single_access_token_with_password, value, false)
         end
         alias_method :change_single_access_token_with_password=, :change_single_access_token_with_password
       end
@@ -22,12 +29,12 @@ module Authlogic
       module Methods
         def self.included(klass)
           return if !klass.column_names.include?("single_access_token")
-            
+          
           klass.class_eval do
             include InstanceMethods
             validates_uniqueness_of :single_access_token, :if => :single_access_token_changed?
             before_validation :reset_single_access_token, :if => :reset_single_access_token?
-            after_password_set :reset_single_access_token, :if => :change_single_access_token_with_password?
+            after_password_set(:reset_single_access_token, :if => :change_single_access_token_with_password?) if respond_to?(:after_password_set)
           end
         end
         

data/lib/authlogic/acts_as_authentic/validations_scope.rb

@@ -23,7 +23,7 @@ module Authlogic
         # * <tt>Default:</tt> nil
         # * <tt>Accepts:</tt> Symbol or Array of symbols
         def validations_scope(value = nil)
-          config(:validations_scope, value)
+          rw_config(:validations_scope, value)
         end
         alias_method :validations_scope=, :validations_scope
       end

data/lib/authlogic/controller_adapters/abstract_adapter.rb

@@ -42,8 +42,20 @@ module Authlogic
         controller.session
       end
       
+      def responds_to_single_access_allowed?
+        controller.respond_to?(:single_access_allowed?, true)
+      end
+      
       def single_access_allowed?
-        controller.respond_to?(:single_access_allowed?, true) && controller.send(:single_access_allowed?)
+        controller.send(:single_access_allowed?)
+      end
+      
+      def responds_to_last_request_update_allowed?
+        controller.respond_to?(:last_request_update_allowed?, true)
+      end
+      
+      def last_request_update_allowed?
+        controller.send(:last_request_update_allowed?)
       end
       
       private

data/lib/authlogic/controller_adapters/rails_adapter.rb

@@ -3,6 +3,8 @@ module Authlogic
     # Adapts authlogic to work with rails. The point is to close the gap between what authlogic expects and what the rails controller object
     # provides. Similar to how ActiveRecord has an adapter for MySQL, PostgreSQL, SQLite, etc.
     class RailsAdapter < AbstractAdapter
+      class AuthlogicLoadedTooLateError < StandardError; end
+      
       def authenticate_with_http_basic(&block)
         controller.authenticate_with_http_basic(&block)
       end
@@ -12,8 +14,8 @@ module Authlogic
       end
       
       def cookie_domain
-        @cookie_domain_key ||= (Rails::VERSION::MAJOR >= 2 && Rails::VERSION::MINOR >= 3) ? :domain : :session_domain
-        controller.class.session_options[@cookie_domain_key]
+        @cookie_domain_key ||= Rails::VERSION::STRING >= '2.3' ? :domain : :session_domain
+        ActionController::Base.session_options[@cookie_domain_key]
       end
       
       def request_content_type
@@ -23,9 +25,17 @@ module Authlogic
       # Lets Authlogic know about the controller object via a before filter, AKA "activates" authlogic.
       module RailsImplementation
         def self.included(klass) # :nodoc:
+          if defined?(::ApplicationController)
+            raise AuthlogicLoadedTooLateError.new("Authlogic is trying to prepend a before_filter in ActionController::Base to active itself" +
+              ", the problem is that ApplicationController has already been loaded meaning the before_filter won't get copied into your" +
+              " application. Generally this is due to another gem or plugin requiring your ApplicationController prematurely, such as" +
+              " the resource_controller plugin. The solution is to require Authlogic before these other gems / plugins. Please require" +
+              " authlogic first to get rid of this error.")
+          end
+          
           klass.prepend_before_filter :activate_authlogic
         end
-
+        
         private
           def activate_authlogic
             Authlogic::Session::Base.controller = RailsAdapter.new(self)
@@ -35,4 +45,4 @@ module Authlogic
   end
 end
 
-ActionController::Base.send(:include, Authlogic::ControllerAdapters::RailsAdapter::RailsImplementation)
+ActionController::Base.send(:include, Authlogic::ControllerAdapters::RailsAdapter::RailsImplementation)