authlogic 2.0.1 → 2.1.2

data/lib/authlogic/session/http_auth.rb

@@ -1,23 +1,58 @@
 module Authlogic
   module Session
-    # Handles all authentication that deals with basic HTTP auth.
+    # Handles all authentication that deals with basic HTTP auth. Which is authentication built into the HTTP protocol:
+    #
+    #   http://username:password@whatever.com
+    #
+    # Also, if you are not comfortable letting users pass their raw username and password you can always use the single
+    # access token. See Authlogic::Session::Params for more info.
     module HttpAuth
       def self.included(klass)
-        klass.persist :persist_by_http_auth
+        klass.class_eval do
+          extend Config
+          include InstanceMethods
+          persist :persist_by_http_auth, :if => :persist_by_http_auth?
+        end
       end
       
-      private
-        def persist_by_http_auth
-          controller.authenticate_with_http_basic do |login, password|
-            if !login.blank? && !password.blank?
-              send("#{login_field}=", login)
-              send("#{password_field}=", password)
-              return valid?
+      # Configuration for the HTTP basic auth feature of Authlogic.
+      module Config
+        # Do you want to allow your users to log in via HTTP basic auth?
+        #
+        # I recommend keeping this enabled. The only time I feel this should be disabled is if you are not comfortable
+        # having your users provide their raw username and password. Whatever the reason, you can disable it here.
+        #
+        # * <tt>Default:</tt> true
+        # * <tt>Accepts:</tt> Boolean
+        def allow_http_basic_auth(value = nil)
+          rw_config(:allow_http_basic_auth, value, true)
+        end
+        alias_method :allow_http_basic_auth=, :allow_http_basic_auth
+      end
+      
+      # Instance methods for the HTTP basic auth feature of authlogic.
+      module InstanceMethods
+        private
+          def persist_by_http_auth?
+            allow_http_basic_auth? && login_field && password_field
+          end
+        
+          def persist_by_http_auth
+            controller.authenticate_with_http_basic do |login, password|
+              if !login.blank? && !password.blank?
+                send("#{login_field}=", login)
+                send("#{password_field}=", password)
+                return valid?
+              end
             end
+        
+            false
           end
         
-          false
-        end
+          def allow_http_basic_auth?
+            self.class.allow_http_basic_auth == true
+          end
+      end
     end
   end
 end

data/lib/authlogic/session/magic_columns.rb

@@ -15,22 +15,24 @@ module Authlogic
         klass.class_eval do
           extend Config
           include InstanceMethods
-          after_persisting :set_last_request_at
+          after_persisting :set_last_request_at, :if => :set_last_request_at?
           validate :increase_failed_login_count
           before_save :update_info
+          before_save :set_last_request_at, :if => :set_last_request_at?
         end
       end
       
       # Configuration for the magic columns feature.
       module Config
-        # Every time a session is found the last_request_at field for that record is updatd with the current time, if that field exists. If you want to limit how frequent that field is updated specify the threshold
-        # here. For example, if your user is making a request every 5 seconds, and you feel this is too frequent, and feel a minute is a good threashold. Set this to 1.minute. Once a minute has passed in between
-        # requests the field will be updated.
+        # Every time a session is found the last_request_at field for that record is updatd with the current time, if that field exists.
+        # If you want to limit how frequent that field is updated specify the threshold here. For example, if your user is making a
+        # request every 5 seconds, and you feel this is too frequent, and feel a minute is a good threashold. Set this to 1.minute.
+        # Once a minute has passed in between requests the field will be updated.
         #
         # * <tt>Default:</tt> 0
         # * <tt>Accepts:</tt> integer representing time in seconds
         def last_request_at_threshold(value = nil)
-          config(:last_request_at_threshold, value, 0)
+          rw_config(:last_request_at_threshold, value, 0)
         end
         alias_method :last_request_at_threshold=, :last_request_at_threshold
       end
@@ -39,7 +41,7 @@ module Authlogic
       module InstanceMethods
         private
           def increase_failed_login_count
-            if errors.on(password_field) && attempted_record.respond_to?(:failed_login_count)
+            if invalid_password? && attempted_record.respond_to?(:failed_login_count)
               attempted_record.failed_login_count ||= 0
               attempted_record.failed_login_count += 1
             end
@@ -59,11 +61,29 @@ module Authlogic
               record.current_login_ip = controller.request.remote_ip
             end
           end
+          
+          # This method lets authlogic know whether it should allow the last_request_at field to be updated
+          # with the current time (Time.now). One thing to note here is that it also checks for the existence of a
+          # last_request_update_allowed? method in your controller. This allows you to control this method pragmatically
+          # in your controller.
+          #
+          # For example, what if you had a javascript function that polled the server updating how much time is left in their
+          # session before it times out. Obviously you would want to ignore this request, because then the user would never time out.
+          # So you can do something like this in your controller:
+          #
+          #   def last_request_update_allowed?
+          #     action_name =! "update_session_time_left"
+          #   end
+          #
+          # You can do whatever you want with that method.
+          def set_last_request_at? # :doc:
+            return false if !record || !klass.column_names.include?("last_request_at")
+            return controller.last_request_update_allowed? if controller.responds_to_last_request_update_allowed?
+            record.last_request_at.blank? || last_request_at_threshold.to_i.seconds.ago >= record.last_request_at
+          end
         
           def set_last_request_at
-            if record && record.class.column_names.include?("last_request_at") && (record.last_request_at.blank? || last_request_at_threshold.to_i.seconds.ago >= record.last_request_at)
-              record.last_request_at = klass.default_timezone == :utc ? Time.now.utc : Time.now
-            end
+            record.last_request_at = klass.default_timezone == :utc ? Time.now.utc : Time.now
           end
           
           def last_request_at_threshold

data/lib/authlogic/session/magic_states.rb

@@ -9,7 +9,8 @@ module Authlogic
     #
     # Authlogic does nothing to define these methods for you, its up to you to define what they mean. If your object responds to these methods Authlogic will use them, otherwise they are ignored.
     #
-    # What's neat about this is that these are checked upon any type of login. When logging in explicitly, by cookie, session, or basic http auth. So if you mark a user inactive in the middle of their session they wont be logged back in next time they refresh the page. Giving you complete control.
+    # What's neat about this is that these are checked upon any type of login. When logging in explicitly, by cookie, session, or basic http auth.
+    # So if you mark a user inactive in the middle of their session they wont be logged back in next time they refresh the page. Giving you complete control.
     #
     # Need Authlogic to check your own "state"? No problem, check out the hooks section below. Add in a before_validation to do your own checking. The sky is the limit.
     module MagicStates
@@ -17,7 +18,7 @@ module Authlogic
         klass.class_eval do
           extend Config
           include InstanceMethods
-          validate :validate_magic_states
+          validate :validate_magic_states, :unless => :disable_magic_states?
         end
       end
       
@@ -30,7 +31,7 @@ module Authlogic
         # * <tt>Default:</tt> false
         # * <tt>Accepts:</tt> Boolean
         def disable_magic_states(value = nil)
-          config(:disable_magic_states, value, false)
+          rw_config(:disable_magic_states, value, false)
         end
         alias_method :disable_magic_states=, :disable_magic_states
       end
@@ -43,10 +44,10 @@ module Authlogic
           end
         
           def validate_magic_states
-            return true if disable_magic_states? || attempted_record.nil?
+            return true if attempted_record.nil?
             [:active, :approved, :confirmed].each do |required_status|
               if attempted_record.respond_to?("#{required_status}?") && !attempted_record.send("#{required_status}?")
-                errors.add_to_base(I18n.t("error_messages.not_#{required_status}", :default => "Your account is not #{required_status}"))
+                errors.add(:base, I18n.t("error_messages.not_#{required_status}", :default => "Your account is not #{required_status}"))
                 return false
               end
             end

data/lib/authlogic/session/params.rb

@@ -43,17 +43,18 @@ module Authlogic
         # * <tt>Default:</tt> cookie_key
         # * <tt>Accepts:</tt> String
         def params_key(value = nil)
-          config(:params_key, value, cookie_key)
+          rw_config(:params_key, value, cookie_key)
         end
         alias_method :params_key=, :params_key
         
-        # Authentication is allowed via a single access token, but maybe this is something you don't want for your application as a whole. Maybe this is something you only want for specific request types.
-        # Specify a list of allowed request types and single access authentication will only be allowed for the ones you specify. Checkout the "Single Access / Private Feeds Access" section in the README.
+        # Authentication is allowed via a single access token, but maybe this is something you don't want for your application as a whole. Maybe this is
+        # something you only want for specific request types. Specify a list of allowed request types and single access authentication will only be
+        # allowed for the ones you specify.
         #
-        # * <tt>Default:</tt> "application/rss+xml", "application/atom+xml"
-        # * <tt>Accepts:</tt> String of request type, or :all to allow single access authentication for any and all request types
+        # * <tt>Default:</tt> ["application/rss+xml", "application/atom+xml"]
+        # * <tt>Accepts:</tt> String of a request type, or :all or :any to allow single access authentication for any and all request types
         def single_access_allowed_request_types(value = nil)
-          config(:single_access_allowed_request_types, value, ["application/rss+xml", "application/atom+xml"])
+          rw_config(:single_access_allowed_request_types, value, ["application/rss+xml", "application/atom+xml"])
         end
         alias_method :single_access_allowed_request_types=, :single_access_allowed_request_types
       end
@@ -68,10 +69,15 @@ module Authlogic
           end
           
           def params_enabled?
-            params_credentials && klass.column_names.include?("single_access_token") &&
-              (single_access_allowed_request_types.include?(controller.request_content_type) ||
-                single_access_allowed_request_types.include?(:all) ||
-                  controller.single_access_allowed?)
+            return false if !params_credentials || !klass.column_names.include?("single_access_token")
+            return controller.single_access_allowed? if controller.responds_to_single_access_allowed?
+            
+            case single_access_allowed_request_types
+            when Array
+              single_access_allowed_request_types.include?(controller.request_content_type) || single_access_allowed_request_types.include?(:all)
+            else
+              [:all, :any].include?(single_access_allowed_request_types)
+            end
           end
           
           def params_key

data/lib/authlogic/session/password.rb

@@ -16,12 +16,15 @@ module Authlogic
       
       # Password configuration
       module Config
-        # Authlogic tries to validate the credentials passed to it. One part of validation is actually finding the user and making sure it exists. What method it uses the do this is up to you.
+        # Authlogic tries to validate the credentials passed to it. One part of validation is actually finding the user and
+        # making sure it exists. What method it uses the do this is up to you.
         #
-        # Let's say you have a UserSession that is authenticating a User. By default UserSession will call User.find_by_login(login). You can change what method UserSession calls by specifying it here. Then
-        # in your User model you can make that method do anything you want, giving you complete control of how users are found by the UserSession.
+        # Let's say you have a UserSession that is authenticating a User. By default UserSession will call User.find_by_login(login).
+        # You can change what method UserSession calls by specifying it here. Then in your User model you can make that method do
+        # anything you want, giving you complete control of how users are found by the UserSession.
         #
-        # Let's take an example: You want to allow users to login by username or email. Set this to the name of the class method that does this in the User model. Let's call it "find_by_username_or_email"
+        # Let's take an example: You want to allow users to login by username or email. Set this to the name of the class method
+        # that does this in the User model. Let's call it "find_by_username_or_email"
         #
         #   class User < ActiveRecord::Base
         #     def self.find_by_username_or_email(login)
@@ -29,40 +32,81 @@ module Authlogic
         #     end
         #   end
         #
-        # * <tt>Default:</tt> "find_by_#{login_field}"
+        # Now just specify the name of this method for this configuration option and you are all set. You can do anything you
+        # want here. Maybe you allow users to have multiple logins and you want to search a has_many relationship, etc. The sky is the limit.
+        #
+        # * <tt>Default:</tt> "find_by_smart_case_login_field"
         # * <tt>Accepts:</tt> Symbol or String
         def find_by_login_method(value = nil)
-          config(:find_by_login_method, value, "find_by_#{login_field}")
+          rw_config(:find_by_login_method, value, "find_by_smart_case_login_field")
         end
         alias_method :find_by_login_method=, :find_by_login_method
         
+        # The text used to identify credentials (username/password) combination when a bad login attempt occurs.
+        # When you show error messages for a bad login, it's considered good security practice to hide which field
+        # the user has entered incorrectly (the login field or the password field). For a full explanation, see
+        # http://www.gnucitizen.org/blog/username-enumeration-vulnerabilities/
+        #
+        # Example of use:
+        #
+        #   class UserSession < Authlogic::Session::Base
+        #     generalize_credentials_error_messages true
+        #   end
+        #
+        #   This would make the error message for bad logins and bad passwords look identical:
+        #
+        #   Login/Password combination is not valid
+        #  
+        #   Alternatively you may use a custom message:
+        # 
+        #   class UserSession < AuthLogic::Session::Base
+        #     generalize_credentials_error_messages "Your login information is invalid"
+        #   end
+        #
+        #   This will instead show your custom error message when the UserSession is invalid.
+        #
+        # The downside to enabling this is that is can be too vague for a user that has a hard time remembering
+        # their username and password combinations. It also disables the ability to to highlight the field
+        # with the error when you use form_for.
+        #
+        # If you are developing an app where security is an extreme priority (such as a financial application),
+        # then you should enable this. Otherwise, leaving this off is fine.
+        # 
+        # * <tt>Default</tt> false
+        # * <tt>Accepts:</tt> Boolean
+        def generalize_credentials_error_messages(value = nil)
+          rw_config(:generalize_credentials_error_messages, value, false)
+        end
+        alias_method :generalize_credentials_error_messages=, :generalize_credentials_error_messages
+        
         # The name of the method you want Authlogic to create for storing the login / username. Keep in mind this is just for your
         # Authlogic::Session, if you want it can be something completely different than the field in your model. So if you wanted people to
         # login with a field called "login" and then find users by email this is compeltely doable. See the find_by_login_method configuration
         # option for more details.
         #
-        # * <tt>Default:</tt> Uses the configuration option in your model: User.login_field
+        # * <tt>Default:</tt> klass.login_field || klass.email_field
         # * <tt>Accepts:</tt> Symbol or String
         def login_field(value = nil)
-          config(:login_field, value, klass.login_field || klass.email_field)
+          rw_config(:login_field, value, klass.login_field || klass.email_field)
         end
         alias_method :login_field=, :login_field
         
-        # Works exactly like login_field, but for the password instead.
+        # Works exactly like login_field, but for the password instead. Returns :password if a login_field exists.
         #
         # * <tt>Default:</tt> :password
         # * <tt>Accepts:</tt> Symbol or String
         def password_field(value = nil)
-          config(:password_field, value, :password)
+          rw_config(:password_field, value, login_field && :password)
         end
         alias_method :password_field=, :password_field
         
-        # The name of the method in your model used to verify the password. This should be an instance method. It should also be prepared to accept a raw password and a crytped password.
+        # The name of the method in your model used to verify the password. This should be an instance method. It should also
+        # be prepared to accept a raw password and a crytped password.
         #
-        # * <tt>Default:</tt> "valid_#{password_field}?"
+        # * <tt>Default:</tt> "valid_password?"
         # * <tt>Accepts:</tt> Symbol or String
         def verify_password_method(value = nil)
-          config(:verify_password_method, value, "valid_#{password_field}?")
+          rw_config(:verify_password_method, value, "valid_password?")
         end
         alias_method :verify_password_method=, :verify_password_method
       end
@@ -71,18 +115,24 @@ module Authlogic
       module InstanceMethods
         def initialize(*args)
           if !self.class.configured_password_methods
-            self.class.send(:attr_writer, login_field) if !respond_to?("#{login_field}=")
-            self.class.send(:attr_reader, login_field) if !respond_to?(login_field)
-            self.class.send(:attr_writer, password_field) if !respond_to?("#{password_field}=")
-            self.class.send(:define_method, password_field) {} if !respond_to?(password_field)
+            if login_field
+              self.class.send(:attr_writer, login_field) if !respond_to?("#{login_field}=")
+              self.class.send(:attr_reader, login_field) if !respond_to?(login_field)
+            end
+            
+            if password_field
+              self.class.send(:attr_writer, password_field) if !respond_to?("#{password_field}=")
+              self.class.send(:define_method, password_field) {} if !respond_to?(password_field)
 
-            self.class.class_eval <<-"end_eval", __FILE__, __LINE__
-              private
-                # The password should not be accessible publicly. This way forms using form_for don't fill the password with the attempted password. The prevent this we just create this method that is private.
-                def protected_#{password_field}
-                  @#{password_field}
-                end
-            end_eval
+              self.class.class_eval <<-"end_eval", __FILE__, __LINE__
+                private
+                  # The password should not be accessible publicly. This way forms using form_for don't fill the password with the
+                  # attempted password. To prevent this we just create this method that is private.
+                  def protected_#{password_field}
+                    @#{password_field}
+                  end
+              end_eval
+            end
 
             self.class.configured_password_methods = true
           end
@@ -90,6 +140,7 @@ module Authlogic
           super
         end
         
+        # Returns the login_field / password_field credentials combination in hash form.
         def credentials
           if authenticating_with_password?
             details = {}
@@ -101,6 +152,7 @@ module Authlogic
           end
         end
         
+        # Accepts the login_field / password_field credentials combination in hash form.
         def credentials=(value)
           super
           values = value.is_a?(Array) ? value : [value]
@@ -112,29 +164,47 @@ module Authlogic
           end
         end
         
+        def invalid_password?
+          invalid_password == true
+        end
+        
         private
           def authenticating_with_password?
-            !send(login_field).nil? || !send("protected_#{password_field}").nil?
+            login_field && (!send(login_field).nil? || !send("protected_#{password_field}").nil?)
           end
           
           def validate_by_password
-            errors.add(login_field, I18n.t('error_messages.login_blank', :default => "can not be blank")) if send(login_field).blank?
-            errors.add(password_field, I18n.t('error_messages.password_blank', :default => "can not be blank")) if send("protected_#{password_field}").blank?
+            self.invalid_password = false
+            
+            errors.add(login_field, I18n.t('error_messages.login_blank', :default => "cannot be blank")) if send(login_field).blank?
+            errors.add(password_field, I18n.t('error_messages.password_blank', :default => "cannot be blank")) if send("protected_#{password_field}").blank?
             return if errors.count > 0
 
             self.attempted_record = search_for_record(find_by_login_method, send(login_field))
-
             if attempted_record.blank?
-              errors.add(login_field, I18n.t('error_messages.login_not_found', :default => "does not exist"))
+              generalize_credentials_error_messages? ?
+                add_general_credentials_error :
+                errors.add(login_field, I18n.t('error_messages.login_not_found', :default => "is not valid"))
               return
             end
 
             if !attempted_record.send(verify_password_method, send("protected_#{password_field}"))
-              errors.add(password_field, I18n.t('error_messages.password_invalid', :default => "is not valid"))
+              self.invalid_password = true
+              generalize_credentials_error_messages? ?
+                add_general_credentials_error :
+                errors.add(password_field, I18n.t('error_messages.password_invalid', :default => "is not valid"))
               return
             end
           end
           
+          def invalid_password
+            @invalid_password
+          end
+          
+          def invalid_password=(value)
+            @invalid_password = value
+          end
+          
           def find_by_login_method
             self.class.find_by_login_method
           end
@@ -143,6 +213,20 @@ module Authlogic
             self.class.login_field
           end
           
+          def add_general_credentials_error
+            error_message = 
+            if self.class.generalize_credentials_error_messages.is_a? String
+              self.class.generalize_credentials_error_messages
+            else
+              "#{login_field.to_s.humanize}/Password combination is not valid"
+            end
+            errors.add(:base, I18n.t('error_messages.general_credentials_error', :default => error_message))
+          end
+          
+          def generalize_credentials_error_messages?
+            self.class.generalize_credentials_error_messages
+          end
+          
           def password_field
             self.class.password_field
           end
@@ -153,4 +237,4 @@ module Authlogic
       end
     end
   end
-end
+end

data/lib/authlogic/session/priority_record.rb

@@ -16,7 +16,7 @@ module Authlogic
       def credentials=(value)
         super
         values = value.is_a?(Array) ? value : [value]
-        self.priority_record = values.second if values.second.class < ::ActiveRecord::Base
+        self.priority_record = values[1] if values[1].class < ::ActiveRecord::Base
       end
       
       private

data/lib/authlogic/session/session.rb

@@ -20,7 +20,7 @@ module Authlogic
         # * <tt>Default:</tt> cookie_key
         # * <tt>Accepts:</tt> Symbol or String
         def session_key(value = nil)
-          config(:session_key, value, cookie_key)
+          rw_config(:session_key, value, cookie_key)
         end
         alias_method :session_key=, :session_key
       end
@@ -34,7 +34,9 @@ module Authlogic
             if !persistence_token.nil?
               # Allow finding by persistence token, because when records are created the session is maintained in a before_save, when there is no id.
               # This is done for performance reasons and to save on queries.
-              record = record_id.nil? ? search_for_record("find_by_persistence_token", persistence_token) : search_for_record("find_by_#{klass.primary_key}", record_id)
+              record = record_id.nil? ?
+                search_for_record("find_by_persistence_token", persistence_token) :
+                search_for_record("find_by_#{klass.primary_key}", record_id)
               self.unauthorized_record = record if record && record.persistence_token == persistence_token
               valid?
             else
@@ -49,7 +51,7 @@ module Authlogic
           def session_key
             build_key(self.class.session_key)
           end
-        
+          
           def update_session
             controller.session[session_key] = record && record.persistence_token
             controller.session["#{session_key}_#{klass.primary_key}"] = record && record.send(record.class.primary_key)

data/lib/authlogic/session/timeout.rb

@@ -48,7 +48,7 @@ module Authlogic
         # * <tt>Default:</tt> false
         # * <tt>Accepts:</tt> Boolean
         def logout_on_timeout(value = nil)
-          config(:logout_on_timeout, value, false)
+          rw_config(:logout_on_timeout, value, false)
         end
         alias_method :logout_on_timeout=, :logout_on_timeout
       end

data/lib/authlogic/session/validation.rb

@@ -10,10 +10,16 @@ module Authlogic
       #     private
       #       def check_if_awesome
       #         errors.add(:login, "must contain awesome") if login && !login.include?("awesome")
-      #         errors.add_to_base("You must be awesome to log in") unless record.awesome?
+      #         errors.add(:base, "You must be awesome to log in") unless attempted_record.awesome?
       #       end
       #   end
-      class Errors < ::ActiveRecord::Errors
+      class Errors < (defined?(::ActiveModel) ? ::ActiveModel::Errors : ::ActiveRecord::Errors)
+        unless defined?(::ActiveModel)
+          def [](key)
+            value = super
+            value.is_a?(Array) ? value : [value].compact
+          end
+        end
       end
       
       # You should use this as a place holder for any records that you find during validation. The main reason for this is to
@@ -39,7 +45,7 @@ module Authlogic
       #    private
       #      def check_if_awesome
       #        errors.add(:login, "must contain awesome") if login && !login.include?("awesome")
-      #        errors.add_to_base("You must be awesome to log in") unless record.awesome?
+      #        errors.add(:base, "You must be awesome to log in") unless attempted_record.awesome?
       #      end
       #  end
       def errors
@@ -58,19 +64,19 @@ module Authlogic
         validate
         ensure_authentication_attempted
                 
-        if errors.empty?
+        if errors.size == 0
           new_session? ? after_validation_on_create : after_validation_on_update
           after_validation
         end
         
         save_record(attempted_record)
-        errors.empty?
+        errors.size == 0
       end
       
       private
         def ensure_authentication_attempted
-          errors.add_to_base(I18n.t('error_messages.no_authentication_details', :default => "You did not provide any details for authentication.")) if errors.empty? && attempted_record.nil?
+          errors.add(:base, I18n.t('error_messages.no_authentication_details', :default => "You did not provide any details for authentication.")) if errors.empty? && attempted_record.nil?
         end
     end
   end
-end
+end

data/lib/authlogic/test_case/mock_controller.rb

@@ -0,0 +1,45 @@
+module Authlogic
+  module TestCase
+    # Basically acts like a controller but doesn't do anything. Authlogic can interact with this, do it's thing and then you
+    # can look at the controller object to see if anything changed.
+    class MockController < ControllerAdapters::AbstractAdapter
+      attr_accessor :http_user, :http_password
+      attr_writer :request_content_type
+  
+      def initialize
+      end
+  
+      def authenticate_with_http_basic(&block)
+        yield http_user, http_password
+      end
+  
+      def cookies
+        @cookies ||= MockCookieJar.new
+      end
+  
+      def cookie_domain
+        nil
+      end
+      
+      def logger
+        @logger ||= MockLogger.new
+      end
+  
+      def params
+        @params ||= {}
+      end
+  
+      def request
+        @request ||= MockRequest.new(controller)
+      end
+  
+      def request_content_type
+        @request_content_type ||= "text/html"
+      end
+  
+      def session
+        @session ||= {}
+      end
+    end
+  end
+end

data/lib/authlogic/test_case/mock_cookie_jar.rb

@@ -0,0 +1,14 @@
+module Authlogic
+  module TestCase
+    class MockCookieJar < Hash # :nodoc:
+      def [](key)
+        hash = super
+        hash && hash[:value]
+      end
+  
+      def delete(key, options = {})
+        super(key)
+      end
+    end
+  end
+end

data/lib/authlogic/test_case/mock_logger.rb

@@ -0,0 +1,10 @@
+module Authlogic
+  module TestCase
+    # Simple class to replace real loggers, so that we can raise any errors being logged.
+    class MockLogger
+      def error(message)
+        raise message
+      end
+    end
+  end
+end