authlogic 4.1.0 → 4.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.gitignore +1 -0
- data/.rubocop.yml +0 -4
- data/.rubocop_todo.yml +32 -33
- data/CHANGELOG.md +15 -0
- data/Rakefile +2 -4
- data/authlogic.gemspec +2 -1
- data/lib/authlogic/acts_as_authentic/base.rb +13 -13
- data/lib/authlogic/acts_as_authentic/logged_in_status.rb +3 -3
- data/lib/authlogic/acts_as_authentic/login.rb +4 -4
- data/lib/authlogic/acts_as_authentic/password.rb +99 -98
- data/lib/authlogic/acts_as_authentic/persistence_token.rb +3 -3
- data/lib/authlogic/acts_as_authentic/queries/find_with_case.rb +32 -32
- data/lib/authlogic/acts_as_authentic/restful_authentication.rb +14 -14
- data/lib/authlogic/acts_as_authentic/session_maintenance.rb +60 -60
- data/lib/authlogic/acts_as_authentic/single_access_token.rb +6 -6
- data/lib/authlogic/authenticates_many/association.rb +3 -3
- data/lib/authlogic/config.rb +9 -9
- data/lib/authlogic/controller_adapters/abstract_adapter.rb +28 -8
- data/lib/authlogic/controller_adapters/rails_adapter.rb +3 -3
- data/lib/authlogic/crypto_providers/aes256.rb +20 -20
- data/lib/authlogic/crypto_providers/bcrypt.rb +8 -8
- data/lib/authlogic/crypto_providers/scrypt.rb +8 -8
- data/lib/authlogic/session/activation.rb +3 -3
- data/lib/authlogic/session/brute_force_protection.rb +32 -32
- data/lib/authlogic/session/callbacks.rb +49 -35
- data/lib/authlogic/session/cookies.rb +58 -49
- data/lib/authlogic/session/foundation.rb +3 -3
- data/lib/authlogic/session/id.rb +9 -4
- data/lib/authlogic/session/klass.rb +6 -6
- data/lib/authlogic/session/magic_columns.rb +5 -17
- data/lib/authlogic/session/params.rb +3 -0
- data/lib/authlogic/session/password.rb +105 -104
- data/lib/authlogic/session/perishable_token.rb +5 -5
- data/lib/authlogic/session/persistence.rb +5 -4
- data/lib/authlogic/session/priority_record.rb +8 -8
- data/lib/authlogic/session/scopes.rb +23 -23
- data/lib/authlogic/session/timeout.rb +11 -11
- data/lib/authlogic/session/unauthorized_record.rb +6 -6
- data/lib/authlogic/session/validation.rb +9 -9
- data/lib/authlogic/test_case.rb +5 -0
- data/lib/authlogic/test_case/mock_request.rb +2 -2
- data/lib/authlogic/version.rb +4 -3
- data/test/acts_as_authentic_test/password_test.rb +23 -23
- data/test/test_helper.rb +96 -93
- metadata +18 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: c0ca1b9d96dbb4d00cf0cad78c6a10bfbc8f893c931834eb560e2fa1a2db10b5
|
4
|
+
data.tar.gz: 274d571aafec37f865edd29222343e88545877ef79caade6f87bfca9b27f50da
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 96c6ea47f5a5b6f98e4fadc427d0e1bbfa6b86f2d4a250757270fa375e0cda5a22a5e4fb7704a14e74a63ba87ef617a2adc489ea7ced107864635f98fa736c35
|
7
|
+
data.tar.gz: 7c3905f05ebb0c4e2694a57ef5e5c04a8cb2c2de97f8b4af965bbf5b41f71aba63646c9fcedc44d3e2916b178855ff56296ca97ecdd151a24d1abb72cc3133df
|
data/.gitignore
CHANGED
data/.rubocop.yml
CHANGED
@@ -28,10 +28,6 @@ AllCops:
|
|
28
28
|
Layout/AlignParameters:
|
29
29
|
EnforcedStyle: with_fixed_indentation
|
30
30
|
|
31
|
-
# This project uses rails-style method indentation, ie. indent after `private`.
|
32
|
-
Layout/IndentationConsistency:
|
33
|
-
EnforcedStyle: rails
|
34
|
-
|
35
31
|
Layout/MultilineMethodCallIndentation:
|
36
32
|
EnforcedStyle: indented
|
37
33
|
|
data/.rubocop_todo.yml
CHANGED
@@ -1,25 +1,18 @@
|
|
1
1
|
# This configuration was generated by
|
2
2
|
# `rubocop --auto-gen-config`
|
3
|
-
# on
|
3
|
+
# on 2018-05-22 23:50:03 -0400 using RuboCop version 0.56.0.
|
4
4
|
# The point is for the user to remove these configuration records
|
5
5
|
# one by one as the offenses are removed from the code base.
|
6
6
|
# Note that changes in the inspected code, or installation of new
|
7
7
|
# versions of RuboCop, may require this file to be generated again.
|
8
8
|
|
9
|
-
# Offense count:
|
9
|
+
# Offense count: 10
|
10
10
|
Metrics/AbcSize:
|
11
|
-
Max:
|
11
|
+
Max: 18.5
|
12
12
|
|
13
|
-
# Offense count:
|
14
|
-
Metrics/PerceivedComplexity:
|
15
|
-
Max: 8
|
16
|
-
|
17
|
-
Naming/MemoizedInstanceVariableName:
|
18
|
-
Enabled: false
|
19
|
-
|
20
|
-
# Offense count: 60
|
13
|
+
# Offense count: 59
|
21
14
|
# Cop supports --auto-correct.
|
22
|
-
# Configuration parameters: EnforcedStyle
|
15
|
+
# Configuration parameters: EnforcedStyle.
|
23
16
|
# SupportedStyles: prefer_alias, prefer_alias_method
|
24
17
|
Style/Alias:
|
25
18
|
Enabled: false
|
@@ -29,38 +22,44 @@ Style/ClassVars:
|
|
29
22
|
Exclude:
|
30
23
|
- 'lib/authlogic/i18n.rb'
|
31
24
|
|
32
|
-
# Offense count:
|
25
|
+
# Offense count: 22
|
33
26
|
Style/Documentation:
|
34
27
|
Exclude:
|
35
|
-
# Permanent
|
36
|
-
- test/**/*
|
28
|
+
# Permanent
|
29
|
+
- 'test/**/*'
|
37
30
|
|
38
|
-
#
|
39
|
-
- lib/authlogic/config.rb
|
40
|
-
- lib/authlogic/controller_adapters/sinatra_adapter.rb
|
41
|
-
- lib/authlogic/crypto_providers.rb
|
42
|
-
- lib/authlogic/i18n/translator.rb
|
43
|
-
- lib/authlogic/session/activation.rb
|
44
|
-
- lib/authlogic/session/active_record_trickery.rb
|
45
|
-
- lib/authlogic/session/existence.rb
|
46
|
-
- lib/authlogic/session/foundation.rb
|
47
|
-
- lib/authlogic/session/klass.rb
|
48
|
-
- lib/authlogic/session/persistence.rb
|
49
|
-
- lib/authlogic/session/scopes.rb
|
50
|
-
- lib/authlogic/test_case.rb
|
51
|
-
- lib/authlogic/test_case/mock_cookie_jar.rb
|
52
|
-
- lib/authlogic/version.rb
|
31
|
+
# TODO
|
32
|
+
- 'lib/authlogic/config.rb'
|
33
|
+
- 'lib/authlogic/controller_adapters/sinatra_adapter.rb'
|
34
|
+
- 'lib/authlogic/crypto_providers.rb'
|
35
|
+
- 'lib/authlogic/i18n/translator.rb'
|
36
|
+
- 'lib/authlogic/session/activation.rb'
|
37
|
+
- 'lib/authlogic/session/active_record_trickery.rb'
|
38
|
+
- 'lib/authlogic/session/existence.rb'
|
39
|
+
- 'lib/authlogic/session/foundation.rb'
|
40
|
+
- 'lib/authlogic/session/klass.rb'
|
41
|
+
- 'lib/authlogic/session/persistence.rb'
|
42
|
+
- 'lib/authlogic/session/scopes.rb'
|
43
|
+
- 'lib/authlogic/test_case.rb'
|
44
|
+
- 'lib/authlogic/test_case/mock_cookie_jar.rb'
|
45
|
+
- 'lib/authlogic/version.rb'
|
53
46
|
|
54
47
|
# Offense count: 4
|
55
|
-
Style/
|
48
|
+
Style/MethodMissingSuper:
|
56
49
|
Exclude:
|
57
50
|
- 'lib/authlogic/controller_adapters/abstract_adapter.rb'
|
58
51
|
- 'lib/authlogic/controller_adapters/sinatra_adapter.rb'
|
59
52
|
- 'lib/authlogic/test_case/mock_request.rb'
|
60
53
|
|
61
|
-
# Offense count:
|
54
|
+
# Offense count: 3
|
55
|
+
Style/MissingRespondToMissing:
|
56
|
+
Exclude:
|
57
|
+
- 'lib/authlogic/controller_adapters/sinatra_adapter.rb'
|
58
|
+
- 'lib/authlogic/test_case/mock_request.rb'
|
59
|
+
|
60
|
+
# Offense count: 10
|
62
61
|
# Cop supports --auto-correct.
|
63
|
-
# Configuration parameters:
|
62
|
+
# Configuration parameters: .
|
64
63
|
# SupportedStyles: compact, exploded
|
65
64
|
Style/RaiseArgs:
|
66
65
|
EnforcedStyle: compact
|
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,10 @@
|
|
1
1
|
# Changelog
|
2
2
|
|
3
|
+
All notable changes to this project will be documented in this file.
|
4
|
+
|
5
|
+
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
|
6
|
+
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
|
7
|
+
|
3
8
|
## Unreleased
|
4
9
|
|
5
10
|
* Breaking Changes
|
@@ -9,6 +14,16 @@
|
|
9
14
|
* Fixed
|
10
15
|
* None
|
11
16
|
|
17
|
+
## 4.1.1 (2018-05-23)
|
18
|
+
|
19
|
+
* Breaking Changes
|
20
|
+
* None
|
21
|
+
* Added
|
22
|
+
* None
|
23
|
+
* Fixed
|
24
|
+
* [#606](https://github.com/binarylogic/authlogic/pull/606) - Interpreter
|
25
|
+
warnings about undefined instance variables
|
26
|
+
|
12
27
|
## 4.1.0 (2018-04-24)
|
13
28
|
|
14
29
|
* Breaking Changes
|
data/Rakefile
CHANGED
@@ -9,10 +9,8 @@ Rake::TestTask.new(:test) do |test|
|
|
9
9
|
test.pattern = "test/**/*_test.rb"
|
10
10
|
test.verbose = false
|
11
11
|
|
12
|
-
# Set interpreter warning level to
|
13
|
-
|
14
|
-
# TODO: Find a good way to deal with the level 2 warnings.
|
15
|
-
test.ruby_opts += ["-W1"]
|
12
|
+
# Set interpreter warning level to 2 (verbose)
|
13
|
+
test.ruby_opts += ["-W2"]
|
16
14
|
end
|
17
15
|
|
18
16
|
require "rubocop/rake_task"
|
data/authlogic.gemspec
CHANGED
@@ -27,7 +27,8 @@ require "authlogic/version"
|
|
27
27
|
s.add_dependency "scrypt", ">= 1.2", "< 4.0"
|
28
28
|
s.add_development_dependency "bcrypt", "~> 3.1"
|
29
29
|
s.add_development_dependency "byebug", "~> 10.0"
|
30
|
-
s.add_development_dependency "
|
30
|
+
s.add_development_dependency "minitest-reporters", "~> 1.2"
|
31
|
+
s.add_development_dependency "rubocop", "~> 0.56.0"
|
31
32
|
s.add_development_dependency "timecop", "~> 0.7"
|
32
33
|
|
33
34
|
s.files = `git ls-files`.split("\n")
|
@@ -76,23 +76,23 @@ module Authlogic
|
|
76
76
|
|
77
77
|
private
|
78
78
|
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
79
|
+
def db_setup?
|
80
|
+
column_names
|
81
|
+
true
|
82
|
+
rescue StandardError
|
83
|
+
false
|
84
|
+
end
|
85
85
|
|
86
|
-
|
87
|
-
|
88
|
-
|
89
|
-
|
90
|
-
|
91
|
-
end
|
86
|
+
def first_column_to_exist(*columns_to_check)
|
87
|
+
if db_setup?
|
88
|
+
columns_to_check.each do |column_name|
|
89
|
+
if column_names.include?(column_name.to_s)
|
90
|
+
return column_name.to_sym
|
92
91
|
end
|
93
92
|
end
|
94
|
-
columns_to_check.first && columns_to_check.first.to_sym
|
95
93
|
end
|
94
|
+
columns_to_check.first && columns_to_check.first.to_sym
|
95
|
+
end
|
96
96
|
end
|
97
97
|
end
|
98
98
|
end
|
@@ -186,10 +186,10 @@ module Authlogic
|
|
186
186
|
|
187
187
|
private
|
188
188
|
|
189
|
-
|
190
|
-
|
191
|
-
|
192
|
-
|
189
|
+
# @api private
|
190
|
+
def find_with_case(field, value, sensitive)
|
191
|
+
Queries::FindWithCase.new(self, field, value, sensitive).execute
|
192
|
+
end
|
193
193
|
end
|
194
194
|
|
195
195
|
# All methods relating to the login field
|
@@ -303,6 +303,7 @@ module Authlogic
|
|
303
303
|
module InstanceMethods
|
304
304
|
# The password
|
305
305
|
def password
|
306
|
+
return nil unless defined?(@password)
|
306
307
|
@password
|
307
308
|
end
|
308
309
|
|
@@ -376,124 +377,124 @@ module Authlogic
|
|
376
377
|
|
377
378
|
private
|
378
379
|
|
379
|
-
|
380
|
-
|
381
|
-
|
382
|
-
|
383
|
-
|
384
|
-
end
|
380
|
+
def crypted_password_to_validate_against(check_against_database)
|
381
|
+
if check_against_database && send("#{crypted_password_field}_changed?")
|
382
|
+
send("#{crypted_password_field}_was")
|
383
|
+
else
|
384
|
+
send(crypted_password_field)
|
385
385
|
end
|
386
|
+
end
|
386
387
|
|
387
|
-
|
388
|
-
|
389
|
-
|
388
|
+
def check_passwords_against_database?
|
389
|
+
self.class.check_passwords_against_database == true
|
390
|
+
end
|
390
391
|
|
391
|
-
|
392
|
-
|
393
|
-
|
392
|
+
def crypto_providers
|
393
|
+
[crypto_provider] + transition_from_crypto_providers
|
394
|
+
end
|
394
395
|
|
395
|
-
|
396
|
-
|
397
|
-
|
398
|
-
|
399
|
-
|
400
|
-
|
401
|
-
|
402
|
-
|
403
|
-
|
404
|
-
|
405
|
-
|
406
|
-
|
396
|
+
# Returns an array of arguments to be passed to a crypto provider, either its
|
397
|
+
# `matches?` or its `encrypt` method.
|
398
|
+
def encrypt_arguments(raw_password, check_against_database, arguments_type = nil)
|
399
|
+
salt = nil
|
400
|
+
if password_salt_field
|
401
|
+
salt =
|
402
|
+
if check_against_database && send("#{password_salt_field}_changed?")
|
403
|
+
send("#{password_salt_field}_was")
|
404
|
+
else
|
405
|
+
send(password_salt_field)
|
406
|
+
end
|
407
|
+
end
|
407
408
|
|
408
|
-
|
409
|
-
|
410
|
-
|
411
|
-
|
412
|
-
|
413
|
-
|
414
|
-
|
415
|
-
end
|
409
|
+
case arguments_type
|
410
|
+
when :restful_authentication
|
411
|
+
[REST_AUTH_SITE_KEY, salt, raw_password, REST_AUTH_SITE_KEY].compact
|
412
|
+
when nil
|
413
|
+
[raw_password, salt].compact
|
414
|
+
else
|
415
|
+
raise "Invalid encryptor arguments_type: #{arguments_type}"
|
416
416
|
end
|
417
|
+
end
|
417
418
|
|
418
|
-
|
419
|
-
|
420
|
-
|
421
|
-
|
422
|
-
|
419
|
+
# Given `encryptor`, does `attempted_password` match the `crypted` password?
|
420
|
+
def encryptor_matches?(
|
421
|
+
crypted,
|
422
|
+
encryptor,
|
423
|
+
index,
|
424
|
+
attempted_password,
|
425
|
+
check_against_database
|
426
|
+
)
|
427
|
+
# The arguments_type for the transitioning from restful_authentication
|
428
|
+
acting_restful = act_like_restful_authentication? && index.zero?
|
429
|
+
transitioning = transition_from_restful_authentication? &&
|
430
|
+
index > 0 &&
|
431
|
+
encryptor == Authlogic::CryptoProviders::Sha1
|
432
|
+
restful = acting_restful || transitioning
|
433
|
+
arguments_type = restful ? :restful_authentication : nil
|
434
|
+
encryptor_args = encrypt_arguments(
|
423
435
|
attempted_password,
|
424
|
-
check_against_database
|
436
|
+
check_against_database,
|
437
|
+
arguments_type
|
425
438
|
)
|
426
|
-
|
427
|
-
|
428
|
-
transitioning = transition_from_restful_authentication? &&
|
429
|
-
index > 0 &&
|
430
|
-
encryptor == Authlogic::CryptoProviders::Sha1
|
431
|
-
restful = acting_restful || transitioning
|
432
|
-
arguments_type = restful ? :restful_authentication : nil
|
433
|
-
encryptor_args = encrypt_arguments(
|
434
|
-
attempted_password,
|
435
|
-
check_against_database,
|
436
|
-
arguments_type
|
437
|
-
)
|
438
|
-
encryptor.matches?(crypted, *encryptor_args)
|
439
|
-
end
|
439
|
+
encryptor.matches?(crypted, *encryptor_args)
|
440
|
+
end
|
440
441
|
|
441
|
-
|
442
|
-
|
443
|
-
|
444
|
-
|
445
|
-
|
446
|
-
|
447
|
-
|
448
|
-
|
449
|
-
|
442
|
+
# Determines if we need to transition the password.
|
443
|
+
#
|
444
|
+
# - If the index > 0 then we are using an "transition from" crypto
|
445
|
+
# provider.
|
446
|
+
# - If the encryptor has a cost and the cost it outdated.
|
447
|
+
# - If we aren't using database values
|
448
|
+
# - If we are using database values, only if the password hasn't
|
449
|
+
# changed so we don't overwrite any changes
|
450
|
+
def transition_password?(index, encryptor, check_against_database)
|
451
|
+
(
|
452
|
+
index > 0 ||
|
453
|
+
(encryptor.respond_to?(:cost_matches?) &&
|
454
|
+
!encryptor.cost_matches?(send(crypted_password_field)))
|
455
|
+
) &&
|
450
456
|
(
|
451
|
-
|
452
|
-
(
|
453
|
-
|
454
|
-
|
455
|
-
(
|
456
|
-
!check_against_database ||
|
457
|
-
!send("#{crypted_password_field}_changed?")
|
458
|
-
)
|
459
|
-
end
|
457
|
+
!check_against_database ||
|
458
|
+
!send("#{crypted_password_field}_changed?")
|
459
|
+
)
|
460
|
+
end
|
460
461
|
|
461
|
-
|
462
|
-
|
463
|
-
|
464
|
-
|
462
|
+
def transition_password(attempted_password)
|
463
|
+
self.password = attempted_password
|
464
|
+
save(validate: false)
|
465
|
+
end
|
465
466
|
|
466
|
-
|
467
|
-
|
468
|
-
|
467
|
+
def require_password?
|
468
|
+
new_record? || password_changed? || send(crypted_password_field).blank?
|
469
|
+
end
|
469
470
|
|
470
|
-
|
471
|
-
|
472
|
-
|
471
|
+
def ignore_blank_passwords?
|
472
|
+
self.class.ignore_blank_passwords == true
|
473
|
+
end
|
473
474
|
|
474
|
-
|
475
|
-
|
476
|
-
|
475
|
+
def password_changed?
|
476
|
+
defined?(@password_changed) && @password_changed == true
|
477
|
+
end
|
477
478
|
|
478
|
-
|
479
|
-
|
480
|
-
|
479
|
+
def reset_password_changed
|
480
|
+
@password_changed = nil
|
481
|
+
end
|
481
482
|
|
482
|
-
|
483
|
-
|
484
|
-
|
483
|
+
def crypted_password_field
|
484
|
+
self.class.crypted_password_field
|
485
|
+
end
|
485
486
|
|
486
|
-
|
487
|
-
|
488
|
-
|
487
|
+
def password_salt_field
|
488
|
+
self.class.password_salt_field
|
489
|
+
end
|
489
490
|
|
490
|
-
|
491
|
-
|
492
|
-
|
491
|
+
def crypto_provider
|
492
|
+
self.class.crypto_provider
|
493
|
+
end
|
493
494
|
|
494
|
-
|
495
|
-
|
496
|
-
|
495
|
+
def transition_from_crypto_providers
|
496
|
+
self.class.transition_from_crypto_providers
|
497
|
+
end
|
497
498
|
end
|
498
499
|
end
|
499
500
|
end
|