authlogic 2.0.1 → 2.1.2

data/lib/authlogic/controller_adapters/sinatra_adapter.rb

@@ -0,0 +1,61 @@
+# Authlogic bridge for Sinatra
+module Authlogic
+  module ControllerAdapters
+    module SinatraAdapter
+      class Cookies
+        attr_reader :request, :response
+
+        def initialize(request, response)
+          @request = request
+          @response = response
+        end
+
+        def delete(key, options = {})
+          @request.cookies.delete(key)
+        end
+
+        def []=(key, options)
+          @response.set_cookie(key, options)
+        end
+
+        def method_missing(meth, *args, &block)
+          @request.cookies.send(meth, *args, &block)
+        end
+      end
+
+      class Controller
+        attr_reader :request, :response, :cookies
+
+        def initialize(request, response)
+          @request = request
+          @cookies = Cookies.new(request, response)
+        end
+
+        def session
+          env['rack.session']
+        end
+
+        def method_missing(meth, *args, &block)
+          @request.send meth, *args, &block
+        end
+      end
+
+      class Adapter < AbstractAdapter
+        def cookie_domain
+          env['SERVER_NAME']
+        end
+
+        module Implementation
+          def self.included(klass)
+            klass.send :before do
+              controller = Controller.new(request, response)
+              Authlogic::Session::Base.controller = Adapter.new(controller)
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+Sinatra::Request.send(:include, Authlogic::ControllerAdapters::SinatraAdapter::Adapter::Implementation)

data/lib/authlogic/crypto_providers/aes256.rb

@@ -5,7 +5,7 @@ module Authlogic
     # This encryption method is reversible if you have the supplied key. So in order to use this encryption method you must supply it with a key first.
     # In an initializer, or before your application initializes, you should do the following:
     #
-    #   Authlogic::CryptoProviders::AES256.key = "my really long and unique key, preferrable a bunch of random characters"
+    #   Authlogic::CryptoProviders::AES256.key = "my really long and unique key, preferrably a bunch of random characters"
     #
     # My final comment is that this is a strong encryption method, but its main weakness is that its reversible. If you do not need to reverse the hash
     # then you should consider Sha512 or BCrypt instead.
@@ -34,7 +34,7 @@ module Authlogic
     
         private
           def aes
-            raise ArgumentError.new("You provide a key like #{name}.key = my_key before using the #{name}") if @key.blank?
+            raise ArgumentError.new("You must provide a key like #{name}.key = my_key before using the #{name}") if @key.blank?
             @aes ||= OpenSSL::Cipher::Cipher.new("AES-256-ECB")
           end
       end

data/lib/authlogic/crypto_providers/bcrypt.rb

@@ -35,7 +35,9 @@ module Authlogic
     #
     # Tell acts_as_authentic to use it:
     #
-    #   acts_as_authentic :crypto_provider => Authlogic::CryptoProviders::BCrypt
+    #   acts_as_authentic do |c|
+    #     c.crypto_provider = Authlogic::CryptoProviders::BCrypt
+    #   end
     #
     # You are good to go!
     class BCrypt

data/lib/authlogic/crypto_providers/sha1.rb

@@ -2,8 +2,8 @@ require "digest/sha1"
 
 module Authlogic
   module CryptoProviders
-    # This class was made for the users transitioning from restful_authentication. I highly discourage using this crypto provider as it inferior to your other options.
-    # Please use any other provider offered by Authlogic.
+    # This class was made for the users transitioning from restful_authentication. I highly discourage using this
+    # crypto provider as it inferior to your other options. Please use any other provider offered by Authlogic.
     class Sha1
       class << self
         def join_token

data/lib/authlogic/i18n/translator.rb

@@ -0,0 +1,15 @@
+module Authlogic
+  module I18n
+    class Translator
+      # If the I18n gem is present, calls +I18n.translate+ passing all 
+      # arguments, else returns +options[:default]+.
+      def translate(key, options = {})
+        if defined?(::I18n)
+          ::I18n.translate key, options
+        else
+          options[:default]
+        end
+      end
+    end
+  end
+end

data/lib/authlogic/i18n.rb

@@ -1,3 +1,5 @@
+require "authlogic/i18n/translator"
+
 module Authlogic
   # This class allows any message in Authlogic to use internationalization. In earlier versions of Authlogic each message was translated via configuration.
   # This cluttered up the configuration and cluttered up Authlogic. So all translation has been extracted out into this class. Now all messages pass through
@@ -11,25 +13,24 @@ module Authlogic
   #
   #   Authlogic::I18n.t('error_messages.password_invalid', :default => "is invalid")
   #
-  # If you use a different I18n library or plugin just redefine the t method in the Authlogic::I18n class to do whatever you want with those options. For example:
+  # If you use a different I18n library just replace the build-in I18n::Translator class with your own. For example:
   #
-  #   # config/initializers/authlogic.rb
-  #   module MyAuthlogicI18nAdapter
-  #     def t(key, options = {})
+  #   class MyAuthlogicI18nTranslator
+  #     def translate(key, options = {})
   #       # you will have key which will be something like: "error_messages.password_invalid"
   #       # you will also have options[:default], which will be the default english version of the message
   #       # do whatever you want here with the arguments passed to you.
   #     end
   #   end
   #   
-  #   Authlogic::I18n.extend MyAuthlogicI18nAdapter
+  #   Authlogic::I18n.translator = MyAuthlogicI18nTranslator.new
   #
   # That it's! Here is a complete list of the keys that are passed. Just define these however you wish:
   #
   #   authlogic:
   #     error_messages:
   #       login_blank: can not be blank
-  #       login_not_found: does not exist
+  #       login_not_found: is not valid
   #       login_invalid: should use only letters, numbers, spaces, and .-_@ please.
   #       consecutive_failed_logins_limit_exceeded: Consecutive failed logins limit exceeded, account is disabled.
   #       email_invalid: should look like an email address.
@@ -39,16 +40,44 @@ module Authlogic
   #       not_confirmed: Your account is not confirmed
   #       not_approved: Your account is not approved
   #       no_authentication_details: You did not provide any details for authentication.
-  class I18n
+  #     models:
+  #       user_session: UserSession (or whatever name you are using)
+  #     attributes:
+  #       user_session: (or whatever name you are using)
+  #         login: login
+  #         email: email
+  #         password: password
+  #         remember_me: remember me
+  module I18n
+    @@scope = :authlogic
+    @@translator = nil
+    
     class << self
+      # Returns the current scope. Defaults to :authlogic
+      def scope
+        @@scope
+      end
+   
+      # Sets the current scope. Used to set a custom scope.
+      def scope=(scope)
+        @@scope = scope
+      end
+      
+      # Returns the current translator. Defaults to +Translator+.
+      def translator
+        @@translator ||= Translator.new
+      end
+      
+      # Sets the current translator. Used to set a custom translator.
+      def translator=(translator)
+        @@translator = translator
+      end
+    
       # All message translation is passed to this method. The first argument is the key for the message. The second is options, see the rails I18n library for a list of options used.
-      def t(key, options = {})
-        if defined?(::I18n)
-          ::I18n.t(key, options.merge(:scope => :authlogic))
-        else
-          options[:default]
-        end
+      def translate(key, options = {})
+        translator.translate key, { :scope => I18n.scope }.merge(options)
       end
+      alias :t :translate
     end
   end
-end
+end

data/lib/authlogic/regex.rb

@@ -0,0 +1,25 @@
+module Authlogic
+  # This is a module the contains regular expressions used throughout Authlogic. The point of extracting
+  # them out into their own module is to make them easily available to you for other uses. Ex:
+  #
+  #   validates_format_of :my_email_field, :with => Authlogic::Regex.email
+  module Regex
+    # A general email regular expression. It allows top level domains (TLD) to be from 2 - 4 in length, any
+    # TLD longer than that must be manually specified. The decisions behind this regular expression were made
+    # by reading this website: http://www.regular-expressions.info/email.html, which is an excellent resource
+    # for regular expressions.
+    def self.email
+      return @email_regex if @email_regex
+      email_name_regex  = '[A-Z0-9_\.%\+\-]+'
+      domain_head_regex = '(?:[A-Z0-9\-]+\.)+'
+      domain_tld_regex  = '(?:[A-Z]{2,4}|museum|travel)'
+      @email_regex = /\A#{email_name_regex}@#{domain_head_regex}#{domain_tld_regex}\z/i
+    end
+    
+    # A simple regular expression that only allows for letters, numbers, spaces, and .-_@. Just a standard login / username
+    # regular expression.
+    def self.login
+      /\A\w[\w\.+\-_@ ]+\z/
+    end
+  end
+end

data/lib/authlogic/session/activation.rb

@@ -29,6 +29,8 @@ module Authlogic
         # This accepts a controller object wrapped with the Authlogic controller adapter. The controller adapters close the gap
         # between the different controllers in each framework. That being said, Authlogic is expecting your object's class to
         # extend Authlogic::ControllerAdapters::AbstractAdapter. See Authlogic::ControllerAdapters for more info.
+        #
+        # Lastly, this is thread safe.
         def controller=(value)
           Thread.current[:authlogic_controller] = value
         end

data/lib/authlogic/session/active_record_trickery.rb

@@ -11,12 +11,21 @@ module Authlogic
       end
       
       module ClassMethods
-        def human_attribute_name(*args)
-          klass.human_attribute_name(*args)
+        # How to name the attributes of Authlogic, works JUST LIKE ActiveRecord, but instead it uses the following
+        # namespace:
+        #
+        #   authlogic.attributes.user_session.login
+        def human_attribute_name(attribute_key_name, options = {})
+          options[:count] ||= 1
+          options[:default] ||= attribute_key_name.to_s.humanize
+          I18n.t("attributes.#{name.underscore}.#{attribute_key_name}", options)
         end
         
+        # How to name the class, works JUST LIKE ActiveRecord, except it uses the following namespace:
+        #
+        #   authlogic.models.user_session
         def human_name(*args)
-          klass.human_name(*args)
+          I18n.t("models.#{name.underscore}", {:count => 1, :default => name.humanize})
         end
         
         # For rails < 2.3, mispelled
@@ -24,17 +33,29 @@ module Authlogic
           [self]
         end
         
-        # For Rails >2.3, fix mispelling
+        # For rails >= 2.3, mispelling fixed
         def self_and_descendants_from_active_record
           [self]
         end
+        
+        # For rails >= 3.0
+        def model_name
+          clazz = defined?(::ActiveModel) ? ::ActiveModel::Name : ::ActiveSupport::ModelName
+          clazz.new(self.to_s)
+        end
       end
       
       module InstanceMethods
+        # Don't use this yourself, this is to just trick some of the helpers since this is the method it calls.
         def new_record?
           new_session?
         end
+        
+        # For rails >= 3.0
+        def to_model
+          self
+        end
       end
     end
   end
-end
+end

data/lib/authlogic/session/brute_force_protection.rb

@@ -19,7 +19,8 @@ module Authlogic
         klass.class_eval do
           extend Config
           include InstanceMethods
-          validate :validate_failed_logins, :if => :protect_from_brute_force_attacks?
+          validate :reset_failed_login_count, :if => :reset_failed_login_count?
+          validate :validate_failed_logins, :if => :being_brute_force_protected?
         end
       end
       
@@ -36,7 +37,7 @@ module Authlogic
         # * <tt>Default:</tt> 50
         # * <tt>Accepts:</tt> Integer, set to 0 to disable
         def consecutive_failed_logins_limit(value = nil)
-          config(:consecutive_failed_logins_limit, value, 50)
+          rw_config(:consecutive_failed_logins_limit, value, 50)
         end
         alias_method :consecutive_failed_logins_limit=, :consecutive_failed_logins_limit
         
@@ -45,31 +46,49 @@ module Authlogic
         # * <tt>Default:</tt> 2.hours
         # * <tt>Accepts:</tt> Fixnum, set to 0 for permanent ban
         def failed_login_ban_for(value = nil)
-          config(:failed_login_ban_for, (!value.nil? && value) || value, 2.hours.to_i)
+          rw_config(:failed_login_ban_for, (!value.nil? && value) || value, 2.hours.to_i)
         end
         alias_method :failed_login_ban_for=, :failed_login_ban_for
       end
       
       # The methods available for an Authlogic::Session::Base object that make up the brute force protection feature.
       module InstanceMethods
+        # Returns true when the consecutive_failed_logins_limit has been exceeded and is being temporarily banned.
+        # Notice the word temporary, the user will not be permanently banned unless you choose to do so with configuration.
+        # By default they will be banned for 2 hours. During that 2 hour period this method will return true.
+        def being_brute_force_protected?
+          exceeded_failed_logins_limit? && (failed_login_ban_for <= 0 ||
+            (attempted_record.respond_to?(:updated_at) && attempted_record.updated_at >= failed_login_ban_for.seconds.ago))
+        end
+        
         private
-          def protect_from_brute_force_attacks?
+          def exceeded_failed_logins_limit?
             !attempted_record.nil? && attempted_record.respond_to?(:failed_login_count) && consecutive_failed_logins_limit > 0 &&
-              attempted_record.failed_login_count && attempted_record.failed_login_count >= consecutive_failed_logins_limit &&
-              (failed_login_ban_for <= 0 || (attempted_record.respond_to?(:updated_at) && attempted_record.updated_at >= failed_login_ban_for.seconds.ago))
+              attempted_record.failed_login_count && attempted_record.failed_login_count >= consecutive_failed_logins_limit
           end
           
-          def consecutive_failed_logins_limit
-            self.class.consecutive_failed_logins_limit
+          def reset_failed_login_count?
+            exceeded_failed_logins_limit? && !being_brute_force_protected?
           end
           
-          def failed_login_ban_for
-            self.class.failed_login_ban_for
+          def reset_failed_login_count
+            attempted_record.failed_login_count = 0
           end
         
           def validate_failed_logins
             errors.clear # Clear all other error messages, as they are irrelevant at this point and can only provide additional information that is not needed
-            errors.add_to_base(I18n.t('error_messages.consecutive_failed_logins_limit_exceeded', :default => "Consecutive failed logins limit exceeded, account is disabled."))
+            errors.add(:base, I18n.t(
+              'error_messages.consecutive_failed_logins_limit_exceeded', 
+              :default => "Consecutive failed logins limit exceeded, account has been" + (failed_login_ban_for == 0 ? "" : " temporarily") + " disabled."
+            ))
+          end
+          
+          def consecutive_failed_logins_limit
+            self.class.consecutive_failed_logins_limit
+          end
+          
+          def failed_login_ban_for
+            self.class.failed_login_ban_for
           end
       end
     end

data/lib/authlogic/session/callbacks.rb

@@ -1,8 +1,15 @@
 module Authlogic
   module Session
-    # Just like in ActiveRecord you have before_save, before_validation, etc. You have similar callbacks with Authlogic, see the METHODS constant below. The order of execution is as follows:
+    # Between these callsbacks and the configuration, this is the contract between me and you to safely
+    # modify Authlogic's behavior. I will do everything I can to make sure these do not change.
     #
-    # Here is the order they execute
+    # Check out the sub modules of Authlogic::Session. They are very concise, clear, and to the point. More
+    # importantly they use the same API that you would use to extend Authlogic. That being said, they are great
+    # examples of how to extend Authlogic and add / modify behavior to Authlogic. These modules could easily be pulled out
+    # into their own plugin and become an "add on" without any change.
+    #
+    # Now to the point of this module. Just like in ActiveRecord you have before_save, before_validation, etc.
+    # You have similar callbacks with Authlogic, see the METHODS constant below. The order of execution is as follows:
     #
     #   before_persisting
     #   persist
@@ -27,11 +34,13 @@ module Authlogic
     #   [save record if record.changed?]
     #   
     #   before_destroy
+    #   [save record if record.changed?]
     #   destroy
     #   after_destroy
     #
-    # Notice the "save record if changed?" lines above. This helps with performance. If you need to make changes to the associated record, there is no need to save the record, Authlogic will do it for you.
-    # This allow multiple modules to modify the record and execute as few queries as possible.
+    # Notice the "save record if changed?" lines above. This helps with performance. If you need to make
+    # changes to the associated record, there is no need to save the record, Authlogic will do it for you.
+    # This allows multiple modules to modify the record and execute as few queries as possible.
     #
     # **WARNING**: unlike ActiveRecord, these callbacks must be set up on the class level:
     #
@@ -41,11 +50,13 @@ module Authlogic
     #     # ..etc
     #   end
     #
-    # You can NOT define a "before_validation" method, this is bad practice and does not allow Authlogic to extend properly with multiple extensions. Please ONLY use the method above.
+    # You can NOT define a "before_validation" method, this is bad practice and does not allow Authlogic
+    # to extend properly with multiple extensions. Please ONLY use the method above.
     module Callbacks
       METHODS = [
         "before_persisting", "persist", "after_persisting",
-        "before_validation", "before_validation_on_create", "before_validation_on_update", "validate", "after_validation_on_update", "after_validation_on_create", "after_validation",
+        "before_validation", "before_validation_on_create", "before_validation_on_update", "validate",
+        "after_validation_on_update", "after_validation_on_create", "after_validation",
         "before_save", "before_create", "before_update", "after_update", "after_create", "after_save",
         "before_destroy", "after_destroy"
       ]
@@ -70,7 +81,7 @@ module Authlogic
         
         def save_record(alternate_record = nil)
           r = alternate_record || record
-          r.save_without_session_maintenance(false) if r && r.changed?
+          r.save_without_session_maintenance(false) if r && r.changed? && !r.readonly?
         end
     end
   end

data/lib/authlogic/session/cookies.rb

@@ -1,6 +1,6 @@
 module Authlogic
   module Session
-    # Handles all authentication that deals with cookies, such as persisting a session and saving / destroying a session.
+    # Handles all authentication that deals with cookies, such as persisting, saving, and destroying.
     module Cookies
       def self.included(klass)
         klass.class_eval do
@@ -26,7 +26,7 @@ module Authlogic
         # * <tt>Default:</tt> "#{klass_name.underscore}_credentials"
         # * <tt>Accepts:</tt> String
         def cookie_key(value = nil)
-          config(:cookie_key, value, "#{klass_name.underscore}_credentials")
+          rw_config(:cookie_key, value, "#{klass_name.underscore}_credentials")
         end
         alias_method :cookie_key=, :cookie_key
         
@@ -35,7 +35,7 @@ module Authlogic
         # * <tt>Default:</tt> false
         # * <tt>Accepts:</tt> Boolean
         def remember_me(value = nil)
-          config(:remember_me, value, false)
+          rw_config(:remember_me, value, false)
         end
         alias_method :remember_me=, :remember_me
         
@@ -44,36 +44,38 @@ module Authlogic
         # * <tt>Default:</tt> 3.months
         # * <tt>Accepts:</tt> Integer, length of time in seconds, such as 60 or 3.months
         def remember_me_for(value = :_read)
-          config(:remember_me_for, value, 3.months, :_read)
+          rw_config(:remember_me_for, value, 3.months, :_read)
         end
         alias_method :remember_me_for=, :remember_me_for
       end
       
       # The methods available for an Authlogic::Session::Base object that make up the cookie feature set.
-      module InstanceMethods  
+      module InstanceMethods
+        # Allows you to set the remember_me option when passing credentials.
         def credentials=(value)
           super
           values = value.is_a?(Array) ? value : [value]
           case values.first
           when Hash
-            self.remember_me = values.first.with_indifferent_access[:remember_me]
+            self.remember_me = values.first.with_indifferent_access[:remember_me] if values.first.with_indifferent_access.key?(:remember_me)
           else
             r = values.find { |value| value.is_a?(TrueClass) || value.is_a?(FalseClass) }
             self.remember_me = r if !r.nil?
           end
         end
         
-        def remember_me # :nodoc:
+        # Is the cookie going to expire after the session is over, or will it stick around?
+        def remember_me
           return @remember_me if defined?(@remember_me)
           @remember_me = self.class.remember_me
         end
-      
+        
         # Accepts a boolean as a flag to remember the session or not. Basically to expire the cookie at the end of the session or keep it for "remember_me_until".
         def remember_me=(value)
           @remember_me = value
         end
-      
-        # Allows users to be remembered via a cookie.
+        
+        # See remember_me
         def remember_me?
           remember_me == true || remember_me == "true" || remember_me == "1"
         end
@@ -83,7 +85,7 @@ module Authlogic
           return unless remember_me?
           self.class.remember_me_for
         end
-      
+        
         # When to expire the cookie. See remember_me_for configuration option to change this.
         def remember_me_until
           return unless remember_me?
@@ -96,27 +98,29 @@ module Authlogic
           end
           
           def cookie_credentials
-            controller.cookies[cookie_key]
+            controller.cookies[cookie_key] && controller.cookies[cookie_key].split("::")
           end
           
           # Tries to validate the session from information in the cookie
           def persist_by_cookie
-            if cookie_credentials
-              self.unauthorized_record = search_for_record("find_by_persistence_token", cookie_credentials)
+            persistence_token, record_id = cookie_credentials
+            if !persistence_token.nil?
+              record = record_id.nil? ? search_for_record("find_by_persistence_token", persistence_token) : search_for_record("find_by_#{klass.primary_key}", record_id)
+              self.unauthorized_record = record if record && record.persistence_token == persistence_token
               valid?
             else
               false
             end
           end
-        
+          
           def save_cookie
             controller.cookies[cookie_key] = {
-              :value => record.persistence_token,
+              :value => "#{record.persistence_token}::#{record.send(record.class.primary_key)}",
               :expires => remember_me_until,
               :domain => controller.cookie_domain
             }
           end
-        
+          
           def destroy_cookie
             controller.cookies.delete cookie_key, :domain => controller.cookie_domain
           end

data/lib/authlogic/session/existence.rb

@@ -20,7 +20,7 @@ module Authlogic
         # A convenince method. The same as:
         #
         #   session = UserSession.new(*args)
-        #   session.create
+        #   session.save
         #
         # Instead you can do:
         #
@@ -28,12 +28,14 @@ module Authlogic
         def create(*args, &block)
           session = new(*args)
           session.save(&block)
+          session
         end
         
         # Same as create but calls create!, which raises an exception when validation fails.
         def create!(*args)
           session = new(*args)
           session.save!
+          session
         end
       end
       
@@ -42,13 +44,15 @@ module Authlogic
         # the user to authenticate again if it is needed.
         def destroy
           before_destroy
+          save_record
           errors.clear
           @record = nil
           after_destroy
           true
         end
         
-        # Returns true if the session has not been saved yet.
+        # Returns true if the session is new, meaning no action has been taken on it and a successful save
+        # has not taken place.
         def new_session?
           new_session != false
         end

data/lib/authlogic/session/foundation.rb

@@ -13,7 +13,7 @@ module Authlogic
       
       module ClassMethods
         private
-          def config(key, value, default_value = nil, read_value = nil)
+          def rw_config(key, value, default_value = nil, read_value = nil)
             if value == read_value
               return read_inheritable_attribute(key) if inheritable_attributes.include?(key)
               write_inheritable_attribute(key, default_value)