authlogic 2.0.1 → 2.1.1

data/lib/authlogic/session/password.rb

@@ -29,40 +29,72 @@ module Authlogic
         #     end
         #   end
         #
-        # * <tt>Default:</tt> "find_by_#{login_field}"
+        # Now just specify the name of this method for this configuration option and you are all set. You can do anything you want here. Maybe you allow users to have multiple logins
+        # and you want to search a has_many relationship, etc. The sky is the limit.
+        #
+        # * <tt>Default:</tt> "find_by_smart_case_login_field"
         # * <tt>Accepts:</tt> Symbol or String
         def find_by_login_method(value = nil)
-          config(:find_by_login_method, value, "find_by_#{login_field}")
+          rw_config(:find_by_login_method, value, "find_by_smart_case_login_field")
         end
         alias_method :find_by_login_method=, :find_by_login_method
         
+        # The text used to identify credentials (username/password) combination when a bad login attempt occurs.
+        # When you show error messages for a bad login, it's considered good security practice to hide which field
+        # the user has entered incorrectly (the login field or the password field). For a full explanation, see
+        # http://www.gnucitizen.org/blog/username-enumeration-vulnerabilities/
+        #
+        # Example of use:
+        #
+        #   class UserSession < Authlogic::Session::Base
+        #     generalize_credentials_error_messages true
+        #   end
+        #
+        # This would make the error message for bad logins and bad passwords look identical:
+        #
+        #   Login/Password combination is not valid
+        #
+        # The downside to enabling this is that is can be too vague for a user that has a hard time remembering
+        # their username and password combinations. It also disables the ability to to highlight the field
+        # with the error when you use form_for.
+        #
+        # If you are developing an app where security is an extreme priority (such as a financial application),
+        # then you should enable this. Otherwise, leaving this off is fine.
+        # 
+        # * <tt>Default</tt> false
+        # * <tt>Accepts:</tt> Boolean
+        def generalize_credentials_error_messages(value = nil)
+          rw_config(:generalize_credentials_error_messages, value, false)
+        end
+        alias_method :generalize_credentials_error_messages=, :generalize_credentials_error_messages
+        
         # The name of the method you want Authlogic to create for storing the login / username. Keep in mind this is just for your
         # Authlogic::Session, if you want it can be something completely different than the field in your model. So if you wanted people to
         # login with a field called "login" and then find users by email this is compeltely doable. See the find_by_login_method configuration
         # option for more details.
         #
-        # * <tt>Default:</tt> Uses the configuration option in your model: User.login_field
+        # * <tt>Default:</tt> klass.login_field || klass.email_field
         # * <tt>Accepts:</tt> Symbol or String
         def login_field(value = nil)
-          config(:login_field, value, klass.login_field || klass.email_field)
+          rw_config(:login_field, value, klass.login_field || klass.email_field)
         end
         alias_method :login_field=, :login_field
         
-        # Works exactly like login_field, but for the password instead.
+        # Works exactly like login_field, but for the password instead. Returns :password if a login_field exists.
         #
         # * <tt>Default:</tt> :password
         # * <tt>Accepts:</tt> Symbol or String
         def password_field(value = nil)
-          config(:password_field, value, :password)
+          rw_config(:password_field, value, login_field && :password)
         end
         alias_method :password_field=, :password_field
         
         # The name of the method in your model used to verify the password. This should be an instance method. It should also be prepared to accept a raw password and a crytped password.
         #
-        # * <tt>Default:</tt> "valid_#{password_field}?"
+        # * <tt>Default:</tt> "valid_password?"
         # * <tt>Accepts:</tt> Symbol or String
         def verify_password_method(value = nil)
-          config(:verify_password_method, value, "valid_#{password_field}?")
+          rw_config(:verify_password_method, value, "valid_password?")
         end
         alias_method :verify_password_method=, :verify_password_method
       end
@@ -71,18 +103,23 @@ module Authlogic
       module InstanceMethods
         def initialize(*args)
           if !self.class.configured_password_methods
-            self.class.send(:attr_writer, login_field) if !respond_to?("#{login_field}=")
-            self.class.send(:attr_reader, login_field) if !respond_to?(login_field)
-            self.class.send(:attr_writer, password_field) if !respond_to?("#{password_field}=")
-            self.class.send(:define_method, password_field) {} if !respond_to?(password_field)
+            if login_field
+              self.class.send(:attr_writer, login_field) if !respond_to?("#{login_field}=")
+              self.class.send(:attr_reader, login_field) if !respond_to?(login_field)
+            end
+            
+            if password_field
+              self.class.send(:attr_writer, password_field) if !respond_to?("#{password_field}=")
+              self.class.send(:define_method, password_field) {} if !respond_to?(password_field)
 
-            self.class.class_eval <<-"end_eval", __FILE__, __LINE__
-              private
-                # The password should not be accessible publicly. This way forms using form_for don't fill the password with the attempted password. The prevent this we just create this method that is private.
-                def protected_#{password_field}
-                  @#{password_field}
-                end
-            end_eval
+              self.class.class_eval <<-"end_eval", __FILE__, __LINE__
+                private
+                  # The password should not be accessible publicly. This way forms using form_for don't fill the password with the attempted password. To prevent this we just create this method that is private.
+                  def protected_#{password_field}
+                    @#{password_field}
+                  end
+              end_eval
+            end
 
             self.class.configured_password_methods = true
           end
@@ -90,6 +127,7 @@ module Authlogic
           super
         end
         
+        # Returns the login_field / password_field credentials combination in hash form.
         def credentials
           if authenticating_with_password?
             details = {}
@@ -101,6 +139,7 @@ module Authlogic
           end
         end
         
+        # Accepts the login_field / password_field credentials combination in hash form.
         def credentials=(value)
           super
           values = value.is_a?(Array) ? value : [value]
@@ -112,29 +151,44 @@ module Authlogic
           end
         end
         
+        def invalid_password?
+          invalid_password == true
+        end
+        
         private
           def authenticating_with_password?
-            !send(login_field).nil? || !send("protected_#{password_field}").nil?
+            login_field && (!send(login_field).nil? || !send("protected_#{password_field}").nil?)
           end
           
           def validate_by_password
-            errors.add(login_field, I18n.t('error_messages.login_blank', :default => "can not be blank")) if send(login_field).blank?
-            errors.add(password_field, I18n.t('error_messages.password_blank', :default => "can not be blank")) if send("protected_#{password_field}").blank?
+            self.invalid_password = false
+            
+            errors.add(login_field, I18n.t('error_messages.login_blank', :default => "cannot be blank")) if send(login_field).blank?
+            errors.add(password_field, I18n.t('error_messages.password_blank', :default => "cannot be blank")) if send("protected_#{password_field}").blank?
             return if errors.count > 0
 
             self.attempted_record = search_for_record(find_by_login_method, send(login_field))
 
             if attempted_record.blank?
-              errors.add(login_field, I18n.t('error_messages.login_not_found', :default => "does not exist"))
+              generalize_credentials_error_messages? ? add_general_credentials_error : errors.add(login_field, I18n.t('error_messages.login_not_found', :default => "is not valid"))
               return
             end
 
             if !attempted_record.send(verify_password_method, send("protected_#{password_field}"))
-              errors.add(password_field, I18n.t('error_messages.password_invalid', :default => "is not valid"))
+              self.invalid_password = true
+              generalize_credentials_error_messages? ? add_general_credentials_error : errors.add(password_field, I18n.t('error_messages.password_invalid', :default => "is not valid"))
               return
             end
           end
           
+          def invalid_password
+            @invalid_password
+          end
+          
+          def invalid_password=(value)
+            @invalid_password = value
+          end
+          
           def find_by_login_method
             self.class.find_by_login_method
           end
@@ -143,6 +197,14 @@ module Authlogic
             self.class.login_field
           end
           
+          def add_general_credentials_error
+            errors.add(:base, I18n.t('error_messages.general_credentials_error', :default => "#{login_field.to_s.humanize}/Password combination is not valid"))
+          end
+          
+          def generalize_credentials_error_messages?
+            self.class.generalize_credentials_error_messages == true
+          end
+          
           def password_field
             self.class.password_field
           end

data/lib/authlogic/session/priority_record.rb

@@ -16,7 +16,7 @@ module Authlogic
       def credentials=(value)
         super
         values = value.is_a?(Array) ? value : [value]
-        self.priority_record = values.second if values.second.class < ::ActiveRecord::Base
+        self.priority_record = values[1] if values[1].class < ::ActiveRecord::Base
       end
       
       private

data/lib/authlogic/session/session.rb

@@ -20,7 +20,7 @@ module Authlogic
         # * <tt>Default:</tt> cookie_key
         # * <tt>Accepts:</tt> Symbol or String
         def session_key(value = nil)
-          config(:session_key, value, cookie_key)
+          rw_config(:session_key, value, cookie_key)
         end
         alias_method :session_key=, :session_key
       end
@@ -49,7 +49,7 @@ module Authlogic
           def session_key
             build_key(self.class.session_key)
           end
-        
+          
           def update_session
             controller.session[session_key] = record && record.persistence_token
             controller.session["#{session_key}_#{klass.primary_key}"] = record && record.send(record.class.primary_key)

data/lib/authlogic/session/timeout.rb

@@ -48,7 +48,7 @@ module Authlogic
         # * <tt>Default:</tt> false
         # * <tt>Accepts:</tt> Boolean
         def logout_on_timeout(value = nil)
-          config(:logout_on_timeout, value, false)
+          rw_config(:logout_on_timeout, value, false)
         end
         alias_method :logout_on_timeout=, :logout_on_timeout
       end

data/lib/authlogic/session/validation.rb

@@ -10,10 +10,14 @@ module Authlogic
       #     private
       #       def check_if_awesome
       #         errors.add(:login, "must contain awesome") if login && !login.include?("awesome")
-      #         errors.add_to_base("You must be awesome to log in") unless record.awesome?
+      #         errors.add(:base, "You must be awesome to log in") unless attempted_record.awesome?
       #       end
       #   end
       class Errors < ::ActiveRecord::Errors
+        def [](key)
+          value = super
+          value.is_a?(Array) ? value : [value].compact
+        end
       end
       
       # You should use this as a place holder for any records that you find during validation. The main reason for this is to
@@ -39,7 +43,7 @@ module Authlogic
       #    private
       #      def check_if_awesome
       #        errors.add(:login, "must contain awesome") if login && !login.include?("awesome")
-      #        errors.add_to_base("You must be awesome to log in") unless record.awesome?
+      #        errors.add(:base, "You must be awesome to log in") unless attempted_record.awesome?
       #      end
       #  end
       def errors
@@ -58,18 +62,18 @@ module Authlogic
         validate
         ensure_authentication_attempted
                 
-        if errors.empty?
+        if errors.size == 0
           new_session? ? after_validation_on_create : after_validation_on_update
           after_validation
         end
         
         save_record(attempted_record)
-        errors.empty?
+        errors.size == 0
       end
       
       private
         def ensure_authentication_attempted
-          errors.add_to_base(I18n.t('error_messages.no_authentication_details', :default => "You did not provide any details for authentication.")) if errors.empty? && attempted_record.nil?
+          errors.add(:base, I18n.t('error_messages.no_authentication_details', :default => "You did not provide any details for authentication.")) if errors.empty? && attempted_record.nil?
         end
     end
   end

data/lib/authlogic/test_case/mock_controller.rb

@@ -0,0 +1,45 @@
+module Authlogic
+  module TestCase
+    # Basically acts like a controller but doesn't do anything. Authlogic can interact with this, do it's thing and then you
+    # can look at the controller object to see if anything changed.
+    class MockController < ControllerAdapters::AbstractAdapter
+      attr_accessor :http_user, :http_password
+      attr_writer :request_content_type
+  
+      def initialize
+      end
+  
+      def authenticate_with_http_basic(&block)
+        yield http_user, http_password
+      end
+  
+      def cookies
+        @cookies ||= MockCookieJar.new
+      end
+  
+      def cookie_domain
+        nil
+      end
+      
+      def logger
+        @logger ||= MockLogger.new
+      end
+  
+      def params
+        @params ||= {}
+      end
+  
+      def request
+        @request ||= MockRequest.new(controller)
+      end
+  
+      def request_content_type
+        @request_content_type ||= "text/html"
+      end
+  
+      def session
+        @session ||= {}
+      end
+    end
+  end
+end

data/lib/authlogic/test_case/mock_cookie_jar.rb

@@ -0,0 +1,14 @@
+module Authlogic
+  module TestCase
+    class MockCookieJar < Hash # :nodoc:
+      def [](key)
+        hash = super
+        hash && hash[:value]
+      end
+  
+      def delete(key, options = {})
+        super(key)
+      end
+    end
+  end
+end

data/lib/authlogic/test_case/mock_logger.rb

@@ -0,0 +1,10 @@
+module Authlogic
+  module TestCase
+    # Simple class to replace real loggers, so that we can raise any errors being logged.
+    class MockLogger
+      def error(message)
+        raise message
+      end
+    end
+  end
+end

data/lib/authlogic/test_case/mock_request.rb

@@ -0,0 +1,19 @@
+module Authlogic
+  module TestCase
+    class MockRequest # :nodoc:
+      attr_accessor :controller
+      
+      def initialize(controller)
+        self.controller = controller
+      end
+      
+      def remote_ip
+        (controller && controller.respond_to?(:env) && controller.env.is_a?(Hash) && controller.env['REMOTE_ADDR']) || "1.1.1.1"
+      end
+      
+      private
+        def method_missing(*args, &block)
+        end
+    end
+  end
+end

data/lib/authlogic/test_case/rails_request_adapter.rb

@@ -0,0 +1,30 @@
+module Authlogic
+  module TestCase
+    # Adapts authlogic to work with the @request object when testing. This way Authlogic can set cookies and what not before
+    # a request is made, ultimately letting you log in users in functional tests.
+    class RailsRequestAdapter < ControllerAdapters::AbstractAdapter
+      def authenticate_with_http_basic(&block)
+      end
+      
+      def cookies
+        new_cookies = MockCookieJar.new
+        super.each do |key, value|
+          new_cookies[key] = value[:value]
+        end
+        new_cookies
+      end
+      
+      def cookie_domain
+        nil
+      end
+      
+      def request
+        @request ||= MockRequest.new(controller)
+      end
+      
+      def request_content_type
+        request.format.to_s
+      end
+    end
+  end
+end

data/lib/authlogic/test_case.rb

@@ -0,0 +1,114 @@
+require File.dirname(__FILE__) + "/test_case/rails_request_adapter"
+require File.dirname(__FILE__) + "/test_case/mock_cookie_jar"
+require File.dirname(__FILE__) + "/test_case/mock_controller"
+require File.dirname(__FILE__) + "/test_case/mock_logger"
+require File.dirname(__FILE__) + "/test_case/mock_request"
+
+module Authlogic
+  # This module is a collection of methods and classes that help you easily test Authlogic. In fact,
+  # I use these same tools to test the internals of Authlogic.
+  #
+  # === The quick and dirty
+  #
+  #   require "authlogic/test_case" # include at the top of test_helper.rb
+  #   setup :activate_authlogic # run before tests are executed
+  #   UserSession.create(users(:whomever)) # logs a user in
+  #
+  # For a more detailed explanation, see below.
+  #
+  # === Setting up
+  #
+  # Authlogic comes with some simple testing tools. To get these, you need to first require Authlogic's TestCase. If
+  # you are doing this in a rails app, you would require this file at the top of your test_helper.rb file:
+  #
+  #   require "authlogic/test_case"
+  #
+  # If you are using Test::Unit::TestCase, the standard testing library that comes with ruby, then you can skip this next part.
+  # If you are not, you need to include the Authlogic::TestCase into your testing suite as follows:
+  #
+  #   include Authlogic::TestCase
+  #
+  # Now that everything is ready to go, let's move onto actually testing. Here is the basic idea behind testing:
+  #
+  # Authlogic requires a "connection" to your controller to activate it. In the same manner that ActiveRecord requires a connection to
+  # your database. It can't do anything until it gets connnected. That being said, Authlogic will raise an
+  # Authlogic::Session::Activation::NotActivatedError any time you try to instantiate an object without a "connection".
+  # So before you do anything with Authlogic, you need to activate / connect Authlogic. Let's walk through how to do this in tests:
+  #
+  # === Fixtures / Factories
+  #
+  # Creating users via fixtures / factories is easy. Here's an example of a fixture:
+  #
+  #   ben:
+  #     email: whatever@whatever.com
+  #     password_salt: <%= salt = Authlogic::Random.hex_token %>
+  #     crypted_password: <%= Authlogic::CryptoProviders::Sha512.encrypt("benrocks" + salt) %>
+  #     persistence_token: <%= Authlogic::Random.hex_token %>
+  #     single_access_token: <%= Authlogic::Random.friendly_token %>
+  #     perishable_token: <%= Authlogic::Random.friendly_token %>
+  #
+  # Notice the crypted_password value. Just supplement that with whatever crypto provider you are using, if you are not using the default.
+  #
+  # === Functional tests
+  #
+  # Activating Authlogic isn't a problem here, because making a request will activate Authlogic for you. The problem is
+  # logging users in so they can access restricted areas. Solving this is simple, just do this:
+  #
+  #   setup :activate_authlogic
+  #
+  # For those of you unfamiliar with TestUnit, the setup method bascially just executes a method before any test is ran.
+  # It is essentially "setting up" your tests.
+  #
+  # Once you have done this, just log users in like usual:
+  #
+  #   UserSession.create(users(:whomever))
+  #   # access my restricted area here
+  #
+  # Do this before you make your request and it will act as if that user is logged in.
+  #
+  # === Integration tests
+  #
+  # Again, just like functional tests, you don't have to do anything. As soon as you make a request, Authlogic will be
+  # conntected. If you want to activate Authlogic before making a request follow the same steps described in the
+  # "functional tests" section above. It works in the same manner.
+  #
+  # === Unit tests
+  #
+  # The only time you need to do any trickiness here is if you want to test Authlogic models. Maybe you added some custom
+  # code or methods in your Authlogic models. Maybe you are writing a plugin or a library that extends Authlogic.
+  #
+  # That being said, in this environment there is no controller. So you need to use a "mock" controller. Something
+  # that looks like a controller, acts like a controller, but isn't a "real" controller. You are essentially connecting
+  # Authlogic to your "mock" controller, then you can test off of the mock controller to make sure everything is functioning
+  # properly.
+  # 
+  # I use a mock controller to test Authlogic myself. It's part of the Authlogic library that you can easily use. It's as simple
+  # as functional and integration tests. Just do the following:
+  #
+  #   setup :activate_authlogic
+  #
+  # You also get a controller method that you can test off of. For example:
+  #
+  #   ben = users(:ben)
+  #   assert_nil controller.session["user_credentials"]
+  #   assert UserSession.create(ben)
+  #   assert_equal controller.session["user_credentials"], ben.persistence_token
+  #
+  # See how I am checking that Authlogic is interacting with the controller properly? That's the idea here.
+  module TestCase
+    # Activates authlogic so that you can use it in your tests. You should call this method in your test's setup. Ex:
+    #
+    #   setup :activate_authlogic
+    def activate_authlogic
+      Authlogic::Session::Base.controller = (@request && Authlogic::TestCase::RailsRequestAdapter.new(@request)) || controller
+    end
+    
+    # The Authlogic::TestCase::MockController object passed to Authlogic to activate it. You can access this in your test.
+    # See the module description for an example.
+    def controller
+      @controller ||= Authlogic::TestCase::MockController.new
+    end
+  end
+  
+  ::Test::Unit::TestCase.send(:include, TestCase) if defined?(::Test::Unit::TestCase)
+end

data/lib/authlogic.rb

@@ -1,8 +1,8 @@
 require "active_support"
 
-require File.dirname(__FILE__) + "/authlogic/version"
 require File.dirname(__FILE__) + "/authlogic/i18n"
 require File.dirname(__FILE__) + "/authlogic/random"
+require File.dirname(__FILE__) + "/authlogic/regex"
 
 require File.dirname(__FILE__) + "/authlogic/controller_adapters/abstract_adapter"
 require File.dirname(__FILE__) + "/authlogic/controller_adapters/rails_adapter" if defined?(Rails)

data/rails/init.rb

@@ -0,0 +1 @@
+require "authlogic"

data/shoulda_macros/authlogic.rb

@@ -4,7 +4,8 @@ module Authlogic
       def self.should_be_authentic
         klass = model_class
         should "acts as authentic" do
-          assert klass.respond_to?(:acts_as_authentic_config)
+          assert klass.new.respond_to?(:password=)
+          assert klass.new.respond_to?(:valid_password?)
         end
       end
     end

data/test/acts_as_authentic_test/base_test.rb

@@ -8,5 +8,11 @@ module ActsAsAuthenticTest
         end
       end
     end
+    
+    def test_acts_as_authentic_with_old_config
+      assert_raise(ArgumentError) do
+        User.acts_as_authentic({})
+      end
+    end
   end
 end

data/test/acts_as_authentic_test/email_test.rb

@@ -33,7 +33,7 @@ module ActsAsAuthenticTest
     end
     
     def test_validates_format_of_email_field_options_config
-      default = {:with => User.send(:email_regex), :message => I18n.t('error_messages.email_invalid', :default => "should look like an email address.")}
+      default = {:with => Authlogic::Regex.email, :message => I18n.t('error_messages.email_invalid', :default => "should look like an email address.")}
       assert_equal default, User.validates_format_of_email_field_options
       assert_equal default, Employee.validates_format_of_email_field_options
       
@@ -43,37 +43,55 @@ module ActsAsAuthenticTest
       assert_equal default, User.validates_format_of_email_field_options
     end
     
+    def test_validates_uniqueness_of_email_field_options_config
+      default = {:case_sensitive => false, :scope => Employee.validations_scope, :if => "#{Employee.email_field}_changed?".to_sym}
+      assert_equal default, Employee.validates_uniqueness_of_email_field_options
+      
+      Employee.validates_uniqueness_of_email_field_options = {:yes => "no"}
+      assert_equal({:yes => "no"}, Employee.validates_uniqueness_of_email_field_options)
+      Employee.validates_uniqueness_of_email_field_options default
+      assert_equal default, Employee.validates_uniqueness_of_email_field_options
+    end
+    
     def test_validates_length_of_email_field
       u = User.new
       u.email = "a@a.a"
       assert !u.valid?
-      assert u.errors.on(:email)
+      assert u.errors[:email].size > 0
       
       u.email = "a@a.com"
       assert !u.valid?
-      assert !u.errors.on(:email)
+      assert u.errors[:email].size == 0
     end
     
     def test_validates_format_of_email_field
       u = User.new
       u.email = "aaaaaaaaaaaaa"
       assert !u.valid?
-      assert u.errors.on(:email)
+      assert u.errors[:email].size > 0 
       
       u.email = "a@a.com"
       assert !u.valid?
-      assert !u.errors.on(:email)
+      assert u.errors[:email].size == 0
+      
+      u.email = "dakota.dux+1@gmail.com"
+      assert !u.valid?
+      assert u.errors[:email].size == 0
     end
     
     def test_validates_uniqueness_of_email_field
       u = User.new
       u.email = "bjohnson@binarylogic.com"
       assert !u.valid?
-      assert u.errors.on(:email)
+      assert u.errors[:email].size > 0
+      
+      u.email = "BJOHNSON@binarylogic.com"
+      assert !u.valid?
+      assert u.errors[:email].size > 0
       
       u.email = "a@a.com"
       assert !u.valid?
-      assert !u.errors.on(:email)
+      assert u.errors[:email].size == 0
     end
   end
 end