authlogic 3.2.0 → 3.3.0

data/Gemfile

@@ -1,2 +1,2 @@
-source :rubygems
+source "https://rubygems.org"
 gemspec

data/Gemfile.lock

@@ -1,34 +1,34 @@
 PATH
   remote: .
   specs:
-    authlogic (3.2.0)
-      activerecord (>= 3.0.0)
-      activesupport (>= 3.0.0)
+    authlogic (3.3.0)
+      activerecord (>= 3.2)
+      activesupport (>= 3.2)
 
 GEM
-  remote: http://rubygems.org/
+  remote: https://rubygems.org/
   specs:
-    activemodel (3.2.9)
-      activesupport (= 3.2.9)
+    activemodel (3.2.13)
+      activesupport (= 3.2.13)
       builder (~> 3.0.0)
-    activerecord (3.2.9)
-      activemodel (= 3.2.9)
-      activesupport (= 3.2.9)
+    activerecord (3.2.13)
+      activemodel (= 3.2.13)
+      activesupport (= 3.2.13)
       arel (~> 3.0.2)
       tzinfo (~> 0.3.29)
-    activesupport (3.2.9)
-      i18n (~> 0.6)
+    activesupport (3.2.13)
+      i18n (= 0.6.1)
       multi_json (~> 1.0)
     arel (3.0.2)
     bcrypt-ruby (3.0.1)
     builder (3.0.4)
     i18n (0.6.1)
-    multi_json (1.4.0)
-    rake (10.0.2)
+    multi_json (1.7.2)
+    rake (10.0.4)
     scrypt (1.1.0)
-    sqlite3 (1.3.6)
-    timecop (0.5.4)
-    tzinfo (0.3.35)
+    sqlite3 (1.3.7)
+    timecop (0.6.1)
+    tzinfo (0.3.37)
 
 PLATFORMS
   ruby
@@ -36,6 +36,7 @@ PLATFORMS
 DEPENDENCIES
   authlogic!
   bcrypt-ruby
+  i18n
   rake
   scrypt
   sqlite3

data/README.rdoc

@@ -1,6 +1,6 @@
 = Authlogic
 
-** Please note the latest version is compatible with rails 3 only. Please see the rails2 branch for Rails 2 compatibility.
+** Please note the latest version is compatible with rails 3.2 only. Please see the rails2 branch for Rails 2 compatibility.
 
 Authlogic is a clean, simple, and unobtrusive ruby authentication solution.
 
@@ -54,15 +54,9 @@ Authlogic is very flexible, it has a strong public API and a plethora of hooks t
 * <b>Documentation:</b> http://rdoc.info/projects/binarylogic/authlogic
 * <b>Repository:</b> http://github.com/binarylogic/authlogic/tree/master
 * <b>Railscasts Screencast:</b> http://railscasts.com/episodes/160-authlogic
-* <b>Live example with OpenID "add on":</b> http://authlogicexample.binarylogic.com
-* <b>Live example repository with tutorial in README:</b> http://github.com/binarylogic/authlogic_example/tree/master
+* <b>Example repository with tutorial in README:</b> http://github.com/binarylogic/authlogic_example/tree/master
 * <b>Tutorial: Reset passwords with Authlogic the RESTful way:</b> http://www.binarylogic.com/2008/11/16/tutorial-reset-passwords-with-authlogic
 * <b>Issues:</b> http://github.com/binarylogic/authlogic/issues
-* <b>Google group:</b> http://groups.google.com/group/authlogic
-
-<b>Before contacting me directly, please read:</b>
-
-If you find a bug or a problem please post it in the issues section. If you need help with something, please use google groups. I check both regularly and get emails when anything happens, so that is the best place to get help. This also benefits other people in the future with the same questions / problems. Thank you.
 
 == Authlogic "add ons"
 
@@ -78,10 +72,6 @@ If you find a bug or a problem please post it in the issues section. If you need
 
 If you create one of your own, please let me know about it so I can add it to this list. Or just fork the project, add your link, and send me a pull request.
 
-== Session bugs (please read if you are having issues with logging in / out)
-
-Apparently there is a bug with apache / passenger for v2.1.X with sessions not working properly. This is most likely your problem if you are having trouble logging in / out. This is *not* an Authlogic issue. This can be solved by updating passener or using an alternative session store solution, such as active record store.
-
 == Documentation explanation
 
 You can find anything you want about Authlogic in the {documentation}[http://rdoc.info/projects/binarylogic/authlogic], all that you need to do is understand the basic design behind it.
@@ -95,55 +85,6 @@ Each of the above has its various sub modules that contain common logic. The sub
 
 For example, if you want to timeout users after a certain period of inactivity, you would look in <b>Authlogic::Session::Timeout</b>. To help you out, I listed the following publicly relevant modules with short descriptions. For the sake of brevity, there are more modules than listed here, the ones not listed are more for internal use, but you can easily read up on them in the {documentation}[http://rdoc.info/projects/binarylogic/authlogic].
 
-=== Authlogic::ActsAsAuthentic sub modules
-
-These modules are for the ActiveRecord side of things, the models that call acts_as_authentic.
-
-* <b>Authlogic::ActsAsAuthentic::Base</b> - Provides the acts_as_authentic class method and includes all of the submodules.
-* <b>Authlogic::ActsAsAuthentic::Email</b> - Handles everything related to the email field.
-* <b>Authlogic::ActsAsAuthentic::LoggedInStatus</b> - Provides handy named scopes and methods for determining if the user is logged in or out.
-* <b>Authlogic::ActsAsAuthentic::Login</b> - Handles everything related to the login field.
-* <b>Authlogic::ActsAsAuthentic::MagicColumns</b> - Handles everything related to the "magic" fields: login_count, failed_login_count, last_request_at, etc.
-* <b>Authlogic::ActsAsAuthentic::Password</b> - This one is important. It handles encrypting your password, salting it, etc. It also has support for transitioning password algorithms.
-* <b>Authlogic::ActsAsAuthentic::PerishableToken</b> - Handles maintaining the perishable token field, also provides a class level method for finding record using the token.
-* <b>Authlogic::ActsAsAuthentic::PersistenceToken</b> - Handles maintaining the persistence token. This is the token stored in cookies and sessions to persist the users session.
-* <b>Authlogic::ActsAsAuthentic::RestfulAuthentication</b> - Provides configuration options to easily migrate from the restful_authentication plugin.
-* <b>Authlogic::ActsAsAuthentic::SessionMaintenance</b> - Handles automatic session maintenance. EX: a new user registers, automatically log them in. Or a user changes their password, update their session.
-* <b>Authlogic::ActsAsAuthentic::SingleAccessToken</b> - Handles maintaining the single access token.
-* <b>Authlogic::ActsAsAuthentic::ValidationsScope</b> - Allows you to scope all validations, etc. Just like the :scope option for validates_uniqueness_of
-
-=== Authlogic::Session sub modules
-
-These modules are for the models that extend Authlogic::Session::Base.
-
-* <b>Authlogic::Session::BruteForceProtection</b> - Disables accounts after a certain number of consecutive failed logins attempted.
-* <b>Authlogic::Session::Callbacks</b> - Your tools to extend, change, or add onto Authlogic. Lets you hook in and do just about anything you want. Start here if you want to write a plugin or add-on for Authlogic
-* <b>Authlogic::Session::Cookies</b> - Authentication via cookies.
-* <b>Authlogic::Session::Existence</b> - Creating, saving, and destroying objects.
-* <b>Authlogic::Session::HttpAuth</b> - Authentication via basic HTTP authentication.
-* <b>Authlogic::Session::Id</b> - Allows sessions to be separated by an id, letting you have multiple sessions for a single user.
-* <b>Authlogic::Session::MagicColumns</b> - Maintains "magic" database columns, similar to created_at and updated_at for ActiveRecord.
-* <b>Authlogic::Session::MagicStates</b> - Automatically validates based on the records states: active?, approved?, and confirmed?. If those methods exist for the record.
-* <b>Authlogic::Session::Params</b> - Authentication via params, aka single access token.
-* <b>Authlogic::Session::Password</b> - Authentication via a traditional username and password.
-* <b>Authlogic::Session::Persistence</b> - Persisting sessions / finding sessions.
-* <b>Authlogic::Session::Session</b> - Authentication via the session, the controller session that is.
-* <b>Authlogic::Session::Timeout</b> - Automatically logging out after a certain period of inactivity.
-* <b>Authlogic::Session::UnauthorizedRecord</b> - Handles authentication by passing an ActiveRecord object directly.
-* <b>Authlogic::Session::Validation</b> - Validation / errors.
-
-=== Miscellaneous modules
-
-Miscellaneous modules that shared across the authentication process and are more "utility" modules and classes.
-
-* <b>Authlogic::AuthenticatesMany</b> - Responsible for allowing you to scope sessions to a parent record. Similar to a has_many and belongs_to relationship. This lets you do the same thing with sessions.
-* <b>Authlogic::CryptoProviders</b> - Contains various encryption algorithms that Authlogic uses, allowing you to choose your encryption method.
-* <b>Authlogic::I18n</b> - Acts JUST LIKE the rails I18n library, and provides internationalization to Authlogic.
-* <b>Authlogic::Random</b> - A simple class to generate random tokens.
-* <b>Authlogic::Regex</b> - Contains regular expressions used in Authlogic. Such as those to validate the format of the log or email.
-* <b>Authlogic::TestCase</b> - Various helper methods for testing frameworks to help you test your code.
-* <b>Authlogic::Version</b> - A handy class for determine the version of Authlogic in a number of ways.
-
 == Quick Rails example
 
 What if creating sessions worked like an ORM library on the surface...
@@ -211,39 +152,13 @@ Or how about persisting the session...
       end
   end
 
-== Install & Use
-
-Add to your gem file
-
-  gem 'authlogic'
-
-== Detailed Setup Tutorial
-
-See the {authlogic example}[http://github.com/binarylogic/authlogic_example/tree/master] for a detailed setup tutorial. I did this because not only do you have a tutorial to go by, but you have an example app that uses the same tutorial, so you can play around with with the code. If you have problems you can compare the code to see what you are doing differently.
-
 == Testing
 
-I think one of the best aspects of Authlogic is testing. For one, it cuts out <b>a lot</b> of redundant tests in your applications because Authlogic is already thoroughly tested for you. It doesn't include a bunch of tests into your application, because it comes tested, just like any other library.
-
-For example, think about ActiveRecord. You don't test the internals of ActiveRecord, because the creators of ActiveRecord have already tested the internals for you. It wouldn't make sense for ActiveRecord to copy it's hundreds of tests into your applications. The same concept applies to Authlogic. You only need to test code you write that is specific to your application, just like everything else in your application.
-
-That being said, testing your code that uses Authlogic is easy. Since everyone uses different testing suites, I created a helpful module called Authlogic::TestCase, which is basically a set of tools for testing code using Authlogic. I explain testing Authlogic thoroughly in the {Authlogic::TestCase section of the documentation}[http://rdoc.info/rdoc/binarylogic/authlogic/blob/f2f6988d3b97e11770b00b72a7a9733df69ffa5b/Authlogic/TestCase.html]. It should answer any questions you have in regards to testing Authlogic.
+See Authlogic::TestCase
 
 == Tell me quickly how Authlogic works
 
 Interested in how all of this all works? Think about an ActiveRecord model. A database connection must be established before you can use it. In the case of Authlogic, a controller connection must be established before you can use it. It uses that controller connection to modify cookies, the current session, login with HTTP basic, etc. It connects to the controller through a before filter that is automatically set in your controller which lets Authlogic know about the current controller object. Then Authlogic leverages that to do everything, it's a pretty simple design. Nothing crazy going on, Authlogic is just leveraging the tools your framework provides in the controller object.
 
-== What sets Authlogic apart and why I created it
-
-What inspired me to create Authlogic was the messiness of the current authentication solutions. Put simply, they just didn't feel right, because the logic was not organized properly. As you may know, a common misconception with the MVC design pattern is that the model "M" is only for data access logic, which is wrong. A model is a place for domain logic. This is why the RESTful design pattern and the current authentication solutions don't play nice. Authlogic solves this by placing the session maintenance logic into its own domain (aka "model"). Moving session maintenance into its own domain has its benefits:
-
-1. <b>It's cleaner.</b> There are no generators in Authlogic. Authlogic provides a class that you can use, it's plain and simple ruby. More importantly, the code in your app is code you write, written the way you want, nice and clean. It's code that should be in your app and is specific to your app, not a redundant authentication pattern.
-2. <b>Easier to stay up-to-date.</b> To make my point, take a look at the commits to any other authentication solution, then look at the {commits for authlogic}[http://github.com/binarylogic/authlogic/commits/master]. How many commits could you easily start using if you already had an app using that solution? With an alternate solution, very few, if any. All of those cool new features and bug fixes are going to have be manually added or wait for your next application. Which is the main reason a generator is not suitable as an authentication solution. With Authlogic you can start using the latest code with a simple update of a gem. No generators, no mess.
-3. <b>It ties everything together on the domain level.</b> Take a new user registration for example, no reason to manually log the user in, authlogic handles this for you via callbacks. The same applies to a user changing their password. Authlogic handles maintaining the session for you.
-4. <b>No redundant tests.</b> Because Authlogic doesn't use generators, #1 also applies to tests. Authlogic is *thoroughly* tested for you. You don't go and test the internals of ActiveRecord in each of your apps do you? So why do the same for Authlogic? Your application tests should be for application specific code. Get rid of the noise and make your tests focused and concise, no reason to copy tests from app to app.
-5. <b>Framework agnostic</b>. Authlogic can be used in *any* ruby framework you want: Rails, Merb, Sinatra, Mack, your own framework, whatever. It's not tied down to Rails. It does this by abstracting itself from these framework's controllers by using a controller adapter. Thanks to {Rack}[http://rack.rubyforge.org/], there is a defined standard for controller structure, and that's what Authlogic's abstract adapter follows. So if your controller follows the rack standards, you don't need to do anything. Any place it deviates from this is solved by a simple adapter for your framework that closes these gaps. For an example, checkout the Authlogic::ControllerAdapters::MerbAdapter.
-5. <b>You are not restricted to a single session.</b> Think about Apple's me.com, where they need you to authenticate a second time before changing your billing information. Why not just create a second session for this? It works just like your initial session. Then your billing controller can require an "ultra secure" session.
-6. <b>Easily extendable.</b> One of the distinct advantages of using a library is the ability to use its API, assuming it has one. Authlogic has an *excellent* public API, meaning it can easily be extended and grow beyond the core library. Checkout the "add ons" list above to see what I mean.
-
 
 Copyright (c) 2012 {Ben Johnson of Binary Logic}[http://www.binarylogic.com], released under the MIT license

data/authlogic.gemspec

@@ -3,7 +3,7 @@ $:.push File.expand_path("../lib", __FILE__)
 
 Gem::Specification.new do |s|
   s.name        = "authlogic"
-  s.version     = "3.2.0"
+  s.version     = "3.3.0"
   s.platform    = Gem::Platform::RUBY
   s.authors     = ["Ben Johnson"]
   s.email       = ["bjohnson@binarylogic.com"]
@@ -11,13 +11,14 @@ Gem::Specification.new do |s|
   s.summary     = %q{A clean, simple, and unobtrusive ruby authentication solution.}
   s.description = %q{A clean, simple, and unobtrusive ruby authentication solution.}
 
-  s.add_dependency 'activerecord', '>= 3.0.0'
-  s.add_dependency 'activesupport', '>= 3.0.0'
+  s.add_dependency 'activerecord', '>= 3.2'
+  s.add_dependency 'activesupport', '>= 3.2'
   s.add_development_dependency 'rake'
   s.add_development_dependency 'bcrypt-ruby'
   s.add_development_dependency 'scrypt'
   s.add_development_dependency 'sqlite3'
   s.add_development_dependency 'timecop'
+  s.add_development_dependency 'i18n'
 
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- {test,spec,features}/*`.split("\n")

data/lib/authlogic.rb

@@ -1,14 +1,14 @@
 require "active_record"
 
-AUTHLOGIC_PATH = File.dirname(__FILE__) + "/authlogic/"
+path = File.dirname(__FILE__) + "/authlogic/"
 
 [
  "i18n",
  "random",
  "regex",
- 
+
  "controller_adapters/abstract_adapter",
- 
+
  "crypto_providers/md5",
  "crypto_providers/sha1",
  "crypto_providers/sha256",
@@ -16,10 +16,10 @@ AUTHLOGIC_PATH = File.dirname(__FILE__) + "/authlogic/"
  "crypto_providers/bcrypt",
  "crypto_providers/aes256",
  "crypto_providers/scrypt",
- 
+
  "authenticates_many/base",
  "authenticates_many/association",
- 
+
  "acts_as_authentic/email",
  "acts_as_authentic/logged_in_status",
  "acts_as_authentic/login",
@@ -32,7 +32,7 @@ AUTHLOGIC_PATH = File.dirname(__FILE__) + "/authlogic/"
  "acts_as_authentic/single_access_token",
  "acts_as_authentic/validations_scope",
  "acts_as_authentic/base",
- 
+
  "session/activation",
  "session/active_record_trickery",
  "session/brute_force_protection",
@@ -57,9 +57,8 @@ AUTHLOGIC_PATH = File.dirname(__FILE__) + "/authlogic/"
  "session/validation",
  "session/base"
 ].each do |library|
-   require AUTHLOGIC_PATH + library
+   require path + library
  end
 
-require AUTHLOGIC_PATH + "controller_adapters/rails_adapter"   if defined?( Rails   )
-require AUTHLOGIC_PATH + "controller_adapters/merb_adapter"    if defined?( Merb    )
-require AUTHLOGIC_PATH + "controller_adapters/sinatra_adapter" if defined?( Sinatra )
+require path + "controller_adapters/rails_adapter"   if defined?( Rails   )
+require path + "controller_adapters/sinatra_adapter" if defined?( Sinatra )

data/lib/authlogic/acts_as_authentic/email.rb

@@ -62,10 +62,10 @@ module Authlogic
         # merge options into it. Checkout the convenience function merge_validates_format_of_email_field_options to merge
         # options.</b>
         #
-        # * <tt>Default:</tt> {:with => Authlogic::Regex.email, :message => lambda {I18n.t('error_messages.email_invalid', :default => "should look like an email address.")}}
+        # * <tt>Default:</tt> {:with => Authlogic::Regex.email, :message => Proc.new {I18n.t('error_messages.email_invalid', :default => "should look like an email address.")}}
         # * <tt>Accepts:</tt> Hash of options accepted by validates_format_of
         def validates_format_of_email_field_options(value = nil)
-          rw_config(:validates_format_of_email_field_options, value, {:with => Authlogic::Regex.email, :message => I18n.t('error_messages.email_invalid', :default => "should look like an email address.")})
+          rw_config(:validates_format_of_email_field_options, value, {:with => Authlogic::Regex.email, :message => Proc.new{I18n.t('error_messages.email_invalid', :default => "should look like an email address.")}})
         end
         alias_method :validates_format_of_email_field_options=, :validates_format_of_email_field_options
 

data/lib/authlogic/acts_as_authentic/login.rb

@@ -90,21 +90,19 @@ module Authlogic
         end
 
         # This method allows you to find a record with the given login. If you notice, with Active Record you have the
-        # validates_uniqueness_of validation function. They give you a :case_sensitive option. I handle this in the same
-        # manner that they handle that. If you are using the login field and set false for the :case_sensitive option in
-        # validates_uniqueness_of_login_field_options this method will modify the query to look something like:
+        # UniquenessValidator class. They give you a :case_sensitive option. I handle this in the same
+        # manner that they handle that. If you are using the login field, set false for the :case_sensitive option in
+        # validates_uniqueness_of_login_field_options and the column doesn't have a case-insensitive collation,
+        # this method will modify the query to look something like:
         #
-        #   where("LOWER(#{quoted_table_name}.#{login_field}) = ?", login.downcase).first
+        #   "LOWER(#{quoted_table_name}.#{login_field}) = LOWER(#{login})"
         #
-        # If you don't specify this it calls the good old find_by_* method:
+        # If you don't specify this it just uses a regular case-sensitive search (with the binary modifier if necessary):
         #
-        #   find_by_login(login)
+        #   "BINARY #{login_field} = #{login}"
         #
         # The above also applies for using email as your login, except that you need to set the :case_sensitive in
         # validates_uniqueness_of_email_field_options to false.
-        #
-        # The only reason I need to do the above is for Postgres and SQLite since they perform case sensitive searches with the
-        # find_by_* methods.
         def find_by_smart_case_login_field(login)
           if login_field
             find_with_case(login_field, login, validates_uniqueness_of_login_field_options[:case_sensitive] != false)
@@ -115,11 +113,14 @@ module Authlogic
 
         private
           def find_with_case(field, value, sensitivity = true)
-            if sensitivity
-              send("find_by_#{field}", value)
+            relation = if not sensitivity
+              connection.case_insensitive_comparison(arel_table, field.to_s, columns_hash[field.to_s], value)
             else
-              where("LOWER(#{quoted_table_name}.#{field}) = ?", value.mb_chars.downcase).first
+              value    = connection.case_sensitive_modifier(value) if value
+              relation = arel_table[field.to_s].eq(value)
             end
+
+            where(relation).first
           end
       end
 

data/lib/authlogic/acts_as_authentic/perishable_token.rb

@@ -52,7 +52,7 @@ module Authlogic
 
         # Class level methods for the perishable token
         module ClassMethods
-          # Use this methdo to find a record with a perishable token. This method does 2 things for you:
+          # Use this method to find a record with a perishable token. This method does 2 things for you:
           #
           # 1. It ignores blank tokens
           # 2. It enforces the perishable_token_valid_for configuration option.

data/lib/authlogic/controller_adapters/abstract_adapter.rb

@@ -1,6 +1,6 @@
 module Authlogic
   module ControllerAdapters # :nodoc:
-    # Allows you to use Authlogic in any framework you want, not just rails. See the RailsAdapter or MerbAdapter
+    # Allows you to use Authlogic in any framework you want, not just rails. See the RailsAdapter
     # for an example of how to adapt Authlogic to work with your framework.
     class AbstractAdapter
       attr_accessor :controller
@@ -8,7 +8,7 @@ module Authlogic
       def initialize(controller)
         self.controller = controller
       end
-      
+
       def authenticate_with_http_basic(&block)
         @auth = Rack::Auth::Basic::Request.new(controller.request.env)
         if @auth.provided? and @auth.basic?
@@ -17,11 +17,11 @@ module Authlogic
           false
         end
       end
-      
+
       def cookies
         controller.cookies
       end
-      
+
       def cookie_domain
         raise NotImplementedError.new("The cookie_domain method has not been implemented by the controller adapter")
       end
@@ -41,23 +41,23 @@ module Authlogic
       def session
         controller.session
       end
-      
+
       def responds_to_single_access_allowed?
         controller.respond_to?(:single_access_allowed?, true)
       end
-      
+
       def single_access_allowed?
         controller.send(:single_access_allowed?)
       end
-      
+
       def responds_to_last_request_update_allowed?
         controller.respond_to?(:last_request_update_allowed?, true)
       end
-      
+
       def last_request_update_allowed?
         controller.send(:last_request_update_allowed?)
       end
-      
+
       private
         def method_missing(id, *args, &block)
           controller.send(id, *args, &block)

data/lib/authlogic/controller_adapters/rack_adapter.rb

@@ -0,0 +1,63 @@
+module Authlogic
+  module ControllerAdapters
+    # Adapter for authlogic to make it function as a Rack middleware.
+    # First you'll have write your own Rack adapter where you have to set your cookie domain.
+    #
+    #     class YourRackAdapter < Authlogic::ControllerAdapters::RackAdapter
+    #       def cookie_domain
+    #         'your_cookie_domain_here.com'
+    #       end
+    #     end
+    #
+    # Next you need to set up a rack middleware like this:
+    #
+    #     class AuthlogicMiddleware
+    #       def initialize(app)
+    #         @app = app
+    #       end
+    #
+    #       def call(env)
+    #         YourRackAdapter.new(env)
+    #         @app.call(env)
+    #       end
+    #     end
+    #
+    # And that is all! Now just load this middleware into rack:
+    #
+    #     use AuthlogicMiddleware
+    #
+    # Authlogic will expect a User and a UserSession object to be present:
+    #
+    #     class UserSession < Authlogic::Session::Base
+    #       # Authlogic options go here
+    #     end
+    #
+    #     class User < ActiveRecord::Base
+    #       acts_as_authentic
+    #     end
+    #
+    class RackAdapter < AbstractAdapter
+
+      def initialize(env)
+        # We use the Rack::Request object as the controller object.
+        # For this to work, we have to add some glue.
+        request = Rack::Request.new(env)
+
+        request.instance_eval do
+          def request; self; end
+          def remote_ip; self.ip; end
+        end
+
+        super(request)
+        Authlogic::Session::Base.controller = self
+      end
+
+      # Rack Requests stores cookies with not just the value, but also with flags and expire information in the hash.
+      # Authlogic does not like this, so we drop everything except the cookie value
+      def cookies
+        controller.cookies.map{|key, value_hash| {key => value_hash[:value]} }.inject(:merge) || {}
+      end
+    end
+  end
+
+end

data/lib/authlogic/crypto_providers/bcrypt.rb

@@ -17,16 +17,16 @@ module Authlogic
     #
     #   Benchmark.bm(18) do |x|
     #     x.report("BCrypt (cost = 10:") { 100.times { BCrypt::Password.create("mypass", :cost => 10) } }
-    #     x.report("BCrypt (cost = 2:") { 100.times { BCrypt::Password.create("mypass", :cost => 2) } }
+    #     x.report("BCrypt (cost = 4:") { 100.times { BCrypt::Password.create("mypass", :cost => 4) } }
     #     x.report("Sha512:") { 100.times { Digest::SHA512.hexdigest("mypass") } }
     #     x.report("Sha1:") { 100.times { Digest::SHA1.hexdigest("mypass") } }
     #   end
     #
-    #                           user     system      total        real
-    #   BCrypt (cost = 10): 10.780000   0.060000  10.840000 ( 11.100289)
-    #   BCrypt (cost = 2):  0.180000   0.000000   0.180000 (  0.181914)
-    #   Sha512:             0.000000   0.000000   0.000000 (  0.000829)
-    #   Sha1:               0.000000   0.000000   0.000000 (  0.000395)
+    #                            user     system      total        real
+    #   BCrypt (cost = 10):  37.360000   0.020000  37.380000 ( 37.558943)
+    #   BCrypt (cost = 4):    0.680000   0.000000   0.680000 (  0.677460)
+    #   Sha512:               0.000000   0.000000   0.000000 (  0.000672)
+    #   Sha1:                 0.000000   0.000000   0.000000 (  0.000454)
     #
     # You can play around with the cost to get that perfect balance between performance and security.
     #
@@ -44,11 +44,16 @@ module Authlogic
     class BCrypt
       class << self
         # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
-        # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
+        # Set this to any value >= the engine's minimum (currently 4), play around with it to get that perfect balance between security and performance.
         def cost
           @cost ||= 10
         end
-        attr_writer :cost
+        def cost=(val)
+          if val < ::BCrypt::Engine::MIN_COST
+            raise ArgumentError.new("Authlogic's bcrypt cost cannot be set below the engine's min cost (#{::BCrypt::Engine::MIN_COST})")
+          end
+          @cost = val
+        end
         
         # Creates a BCrypt hash for the password passed.
         def encrypt(*tokens)

data/lib/authlogic/session/active_record_trickery.rb

@@ -27,17 +27,7 @@ module Authlogic
         def human_name(*args)
           I18n.t("models.#{name.underscore}", {:count => 1, :default => name.humanize})
         end
-        
-        # For rails < 2.3, mispelled
-        def self_and_descendents_from_active_record
-          [self]
-        end
-        
-        # For rails >= 2.3, mispelling fixed
-        def self_and_descendants_from_active_record
-          [self]
-        end
-        
+
         # For rails >= 3.0
         def model_name
           if defined?(::ActiveModel)

data/lib/authlogic/session/magic_columns.rb

@@ -8,7 +8,7 @@ module Authlogic
     #   last_request_at       Updates every time the user logs in, either by explicitly logging in, or logging in by cookie, session, or http auth
     #   current_login_at      Updates with the current time when an explicit login is made.
     #   last_login_at         Updates with the value of current_login_at before it is reset.
-    #   current_login_ip      Updates with the request remote_ip when an explicit login is made.
+    #   current_login_ip      Updates with the request ip when an explicit login is made.
     #   last_login_ip         Updates with the value of current_login_ip before it is reset.
     module MagicColumns
       def self.included(klass)
@@ -58,7 +58,7 @@ module Authlogic
           
             if record.respond_to?(:current_login_ip)
               record.last_login_ip = record.current_login_ip if record.respond_to?(:last_login_ip)
-              record.current_login_ip = controller.request.remote_ip
+              record.current_login_ip = controller.request.ip
             end
           end
           
@@ -92,4 +92,4 @@ module Authlogic
       end
     end
   end
-end
+end

data/lib/authlogic/session/session.rb

@@ -35,8 +35,8 @@ module Authlogic
               # Allow finding by persistence token, because when records are created the session is maintained in a before_save, when there is no id.
               # This is done for performance reasons and to save on queries.
               record = record_id.nil? ?
-                search_for_record("find_by_persistence_token", persistence_token) :
-                search_for_record("find_by_#{klass.primary_key}", record_id)
+                search_for_record("find_by_persistence_token", persistence_token.to_s) :
+                search_for_record("find_by_#{klass.primary_key}", record_id.to_s)
               self.unauthorized_record = record if record && record.persistence_token == persistence_token
               valid?
             else

data/lib/authlogic/test_case/mock_request.rb

@@ -7,7 +7,7 @@ module Authlogic
         self.controller = controller
       end
       
-      def remote_ip
+      def ip
         (controller && controller.respond_to?(:env) && controller.env.is_a?(Hash) && controller.env['REMOTE_ADDR']) || "1.1.1.1"
       end
       
@@ -16,4 +16,4 @@ module Authlogic
         end
     end
   end
-end
+end

data/test/acts_as_authentic_test/email_test.rb

@@ -33,9 +33,21 @@ module ActsAsAuthenticTest
     end
 
     def test_validates_format_of_email_field_options_config
-      default = {:with => Authlogic::Regex.email, :message => I18n.t('error_messages.email_invalid', :default => "should look like an email address.")}
-      assert_equal default, User.validates_format_of_email_field_options
-      assert_equal default, Employee.validates_format_of_email_field_options
+      default = {:with => Authlogic::Regex.email, :message => Proc.new{I18n.t('error_messages.email_invalid', :default => "should look like an email address.")}}
+      dmessage = default.delete(:message).call
+
+      options = User.validates_format_of_email_field_options
+      message = options.delete(:message)
+      assert message.kind_of?(Proc)     
+      assert_equal dmessage, message.call
+      assert_equal default, options
+
+      options = Employee.validates_format_of_email_field_options
+      message = options.delete(:message)
+      assert message.kind_of?(Proc)     
+      assert_equal dmessage, message.call
+      assert_equal default, options
+
 
       User.validates_format_of_email_field_options = {:yes => "no"}
       assert_equal({:yes => "no"}, User.validates_format_of_email_field_options)
@@ -43,6 +55,31 @@ module ActsAsAuthenticTest
       assert_equal default, User.validates_format_of_email_field_options
     end
 
+    def test_deferred_error_message_translation
+
+      # ensure we successfully loaded the test locale
+      assert I18n.available_locales.include?(:lol), "Test locale failed to load"
+
+      original_locale = I18n.locale
+      I18n.locale = 'lol'
+      message = I18n.t("authlogic.error_messages.email_invalid")
+
+      begin
+        cat = User.new
+        cat.email = 'meow'
+        cat.valid?
+
+        # filter duplicate error messages
+        error = cat.errors[:email]
+        error = error.first if error.is_a?(Array)
+
+        assert_equal message, error
+
+      ensure
+        I18n.locale = original_locale
+      end
+    end
+
     def test_validates_uniqueness_of_email_field_options_config
       default = {:case_sensitive => false, :scope => Employee.validations_scope, :if => "#{Employee.email_field}_changed?".to_sym}
       assert_equal default, Employee.validates_uniqueness_of_email_field_options

data/test/crypto_provider_test/bcrypt_test.rb

@@ -10,5 +10,13 @@ module CryptoProviderTest
       hash = Authlogic::CryptoProviders::BCrypt.encrypt("mypass")
       assert Authlogic::CryptoProviders::BCrypt.matches?(hash, "mypass")
     end
+
+    def test_minimum_cost
+      Authlogic::CryptoProviders::BCrypt.cost = 4
+      assert_equal 4, Authlogic::CryptoProviders::BCrypt.cost
+
+      assert_raises(ArgumentError) { Authlogic::CryptoProviders::BCrypt.cost = 2 }
+      assert_equal 4, Authlogic::CryptoProviders::BCrypt.cost
+    end
   end
 end

data/test/i18n/lol.yml

@@ -0,0 +1,4 @@
+lol:
+  authlogic:
+    error_messages:
+      email_invalid: LOL email should be valid.

data/test/session_test/active_record_trickery_test.rb

@@ -12,14 +12,6 @@ module SessionTest
         assert_equal "Usersession", UserSession.human_name
       end
     
-      def test_self_and_descendents_from_active_record
-        assert_equal [UserSession], UserSession.self_and_descendents_from_active_record
-      end
-    
-      def test_self_and_descendants_from_active_record
-        assert_equal [UserSession], UserSession.self_and_descendants_from_active_record
-      end
-
       def test_i18n_of_human_name
         I18n.backend.store_translations 'en', :authlogic => {:models => {:user_session => "MySession" } }
         assert_equal "MySession", UserSession.human_name

data/test/session_test/session_test.rb

@@ -20,6 +20,24 @@ module SessionTest
         assert_equal ben, session.record
         assert_equal ben.persistence_token, controller.session["user_credentials"]
       end
+
+      def test_persist_persist_by_session_with_session_fixation_attack
+        ben = users(:ben)
+        controller.session["user_credentials"] = 'neo'
+        controller.session["user_credentials_id"] = {:select => " *,'neo' AS persistence_token FROM users WHERE id = #{ben.id} limit 1 -- "}
+        @user_session = UserSession.find
+        assert @user_session.blank?
+      end
+
+      def test_persist_persist_by_session_with_sql_injection_attack
+        ben = users(:ben)
+        controller.session["user_credentials"] = {:select => "ABRA CADABRA"}
+        controller.session["user_credentials_id"] = nil
+        assert_nothing_raised do
+          @user_session = UserSession.find
+        end
+        assert @user_session.blank?
+      end
       
       def test_persist_persist_by_session_with_token_only
         ben = users(:ben)

data/test/test_helper.rb

@@ -3,6 +3,9 @@ require "rubygems"
 require "active_record"
 require "active_record/fixtures"
 require "timecop"
+require "i18n"
+
+I18n.load_path << File.dirname(__FILE__) + '/i18n/lol.yml'
 
 #ActiveRecord::Schema.verbose = false
 ActiveRecord::Base.establish_connection(:adapter => "sqlite3", :database => ":memory:")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authlogic
 version: !ruby/object:Gem::Version
-  version: 3.2.0
+  version: 3.3.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-07 00:00:00.000000000 Z
+date: 2013-04-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -18,7 +18,7 @@ dependencies:
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -26,7 +26,7 @@ dependencies:
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '3.2'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -34,7 +34,7 @@ dependencies:
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -42,7 +42,7 @@ dependencies:
     requirements:
     - - ! '>='
       - !ruby/object:Gem::Version
-        version: 3.0.0
+        version: '3.2'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -123,6 +123,22 @@ dependencies:
     - - ! '>='
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: i18n
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
 description: A clean, simple, and unobtrusive ruby authentication solution.
 email:
 - bjohnson@binarylogic.com
@@ -137,7 +153,6 @@ files:
 - README.rdoc
 - Rakefile
 - authlogic.gemspec
-- init.rb
 - lib/authlogic.rb
 - lib/authlogic/acts_as_authentic/base.rb
 - lib/authlogic/acts_as_authentic/email.rb
@@ -154,7 +169,7 @@ files:
 - lib/authlogic/authenticates_many/association.rb
 - lib/authlogic/authenticates_many/base.rb
 - lib/authlogic/controller_adapters/abstract_adapter.rb
-- lib/authlogic/controller_adapters/merb_adapter.rb
+- lib/authlogic/controller_adapters/rack_adapter.rb
 - lib/authlogic/controller_adapters/rails_adapter.rb
 - lib/authlogic/controller_adapters/sinatra_adapter.rb
 - lib/authlogic/crypto_providers/aes256.rb
@@ -198,7 +213,6 @@ files:
 - lib/authlogic/test_case/mock_logger.rb
 - lib/authlogic/test_case/mock_request.rb
 - lib/authlogic/test_case/rails_request_adapter.rb
-- shoulda_macros/authlogic.rb
 - test/acts_as_authentic_test/base_test.rb
 - test/acts_as_authentic_test/email_test.rb
 - test/acts_as_authentic_test/logged_in_status_test.rb
@@ -221,6 +235,7 @@ files:
 - test/fixtures/employees.yml
 - test/fixtures/projects.yml
 - test/fixtures/users.yml
+- test/i18n/lol.yml
 - test/i18n_test.rb
 - test/libs/affiliate.rb
 - test/libs/company.rb
@@ -274,7 +289,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.24
+rubygems_version: 1.8.25
 signing_key: 
 specification_version: 3
 summary: A clean, simple, and unobtrusive ruby authentication solution.
@@ -301,6 +316,7 @@ test_files:
 - test/fixtures/employees.yml
 - test/fixtures/projects.yml
 - test/fixtures/users.yml
+- test/i18n/lol.yml
 - test/i18n_test.rb
 - test/libs/affiliate.rb
 - test/libs/company.rb

data/init.rb

@@ -1 +0,0 @@
-require File.dirname(__FILE__) + "/rails/init.rb"

data/lib/authlogic/controller_adapters/merb_adapter.rb

@@ -1,30 +0,0 @@
-module Authlogic
-  module ControllerAdapters
-    # Adapts authlogic to work with merb. The point is to close the gap between what authlogic expects and what the merb controller object
-    # provides. Similar to how ActiveRecord has an adapter for MySQL, PostgreSQL, SQLite, etc.
-    class MerbAdapter < AbstractAdapter
-      # Lets Authlogic know about the controller object via a before filter, AKA "activates" authlogic.
-      module MerbImplementation
-        def self.included(klass) # :nodoc:
-          klass.before :activate_authlogic
-        end
-        
-        def cookie_domain
-          Merb::Config[:session_cookie_domain]
-        end
-
-        private
-          def activate_authlogic
-            Authlogic::Session::Base.controller = MerbAdapter.new(self)
-          end
-      end
-    end
-  end
-end
- 
-# make sure we're running inside Merb
-if defined?(Merb::Plugins)
-  Merb::BootLoader.before_app_loads do
-    Merb::Controller.send(:include, Authlogic::ControllerAdapters::MerbAdapter::MerbImplementation)
-  end
-end

data/shoulda_macros/authlogic.rb

@@ -1,69 +0,0 @@
-# Test::Unit
-# Place this file into your test/shoulda_macros directory
-#
-# Example:
-# 
-# class UserTest
-#   should_have_authlogic
-# end
-#
-# Rspec
-# Place this file into your spec/support/shoulda directory
-#
-# Example:
-#
-# describe User do
-#   it { should have_authlogic }
-# end
-
-module Authlogic
-  module Shoulda
-
-    module Matchers
-      def have_authlogic
-        HaveAuthlogic.new
-      end
-      alias_method :be_authentic, :have_authlogic
-
-      class HaveAuthlogic
-
-        def matches?(subject)
-          subject.respond_to?(:password=) && subject.respond_to?(:valid_password?)
-        end
-
-        def failure_message
-          "Add the line 'acts_as_authentic' to your model"
-        end
-
-        def description
-          "have Authlogic"
-        end
-      end
-      
-    end
-    
-    module Macros
-      include Matchers
-      
-      def should_have_authlogic
-        klass = described_type rescue model_class
-        matcher = HaveAuthlogic.new
-        
-        should matcher.description do
-          assert matcher.matches?(klass.new), matcher.failure_message
-        end
-      end
-      alias_method :should_be_authentic, :should_have_authlogic
-      
-    end
-    
-  end
-end
-
-if defined? Spec
-  Spec::Runner.configure do |config|
-    config.include(Authlogic::Shoulda::Matchers)
-  end
-else
-  Test::Unit::TestCase.class_eval { extend Authlogic::Shoulda::Macros }
-end