authlogic 1.3.8 → 1.3.9

data/CHANGELOG.rdoc

@@ -1,4 +1,12 @@
-== 1.3.8 released 2008-11-30
+== 1.3.9 released 2009-1-9
+
+* Added the disable_perishable_token_maintenance option to disable the automatic resetting of the perishable_token, meaning you will have to maintain this yourself.
+* Changed shoulda macro to conform to standards so model is not required to be passed
+* Modified method definitions for the Session class to check for already defined methods, allowing you to write your own "credential" methods, and Authlogic will not overwrite your custom methods.
+* Fixed bug when passing :all to single_access_allowed_request_types
+* Added logout_on_timeout configuration option for Session::Base
+
+== 1.3.8 released 2008-12-24
 
 * Only change persistence token if the password is not blank
 * Normalize the last_request_at_threshold so that you can pass an integer or a date/time range.

data/Manifest

@@ -29,6 +29,7 @@ lib/authlogic/session/params.rb
 lib/authlogic/session/perishability.rb
 lib/authlogic/session/scopes.rb
 lib/authlogic/session/session.rb
+lib/authlogic/session/timeout.rb
 lib/authlogic/testing/test_unit_helpers.rb
 lib/authlogic/version.rb
 lib/authlogic.rb
@@ -67,4 +68,5 @@ test/session_tests/params_test.rb
 test/session_tests/perishability_test.rb
 test/session_tests/scopes_test.rb
 test/session_tests/session_test.rb
+test/session_tests/timeout_test.rb
 test/test_helper.rb

data/README.rdoc

@@ -2,13 +2,20 @@
 
 Authlogic is a clean, simple, and unobtrusive ruby authentication solution. Put simply, its the Chuck Norris of authentication solutions for your framework of choice.
 
-So what is Authlogic, and why would I create a solution to a problem that already has plenty of solutions? Because none of the solutions felt right to me, RESTful development and authentication just didn't seem to go well together. It was like trying to fit a square peg in a round hole. All of the current solutions, for both rails and merb, just seemed to force that square peg in the round hole for me. Just because they did it for me doesn't make it right. They were either too complicated, bloated, littered my application with tons of code, had no platform for reasonable updating, used an inferior encryption algorithm, or were just confusing. This is not the simple / elegant ruby we all fell in love with. We need a "ruby like" authentication solution. Authlogic is my attempt to satisfy that need...
+So what is Authlogic, and why would I create a solution to a problem that already has plenty of solutions? Because none of the current solutions feel right. The feel wrong because logic is not organized properly in the MVC structure. As you may know, a common misconception with the MVC design pattern is that the model "M" is only for data access logic, which is wrong. A model is a place for domain logic. This is why the RESTful design pattern and the current authentication solutions don't play nice, because the logic is not in the right spot. Authlogic solves this by placing the session maintenance logic into its own domain (aka "model"), where it belongs. Moving session maintenance into its own domain has its benefits:
 
-Let's take a rails application...
+1. It's easier to update and stay current with the latest security practices. Since authlogic sits in between you and your session it can assist in keeping your security top notch. Such as upgrading your hashing algorithm, helping you transition to a new algorithm, etc. Also, Authlogic is a gem, which means you get all of these benefits easily, through a rubygems update.
+2. It ties everything together on the domain level. Take a new user registration for example, no reason to manually log the user in, authlogic handles this for you via callbacks. The same applies to a user changing their password. Authlogic handles maintaining the session for you.
+3. Your application can stay clean and focused and free of redundant authentication code from app to app. Meaning generators are *NOT* necessary at all.
+4. A byproduct of #3 is that you don't have to test the same code over and over in each of your apps. You don't test the internals of ActiveRecord in each of your apps, so why would you test the internals of Authlogic? It's already been thoroughly tested for you. Focus on your application, and get rid of the noise by testing your application specific code and not generated code that you didn't write.
+5. You get to write your own code, just like you do for any other model. Meaning the code you write is specific to your application, the way you want it, and more importantly you understand it.
+6. You are not restricted to a single session. Think about Apple's me.com, where they need you to authenticate a second time before changing your billing information. Why not just create a second session for this? It works just like your initial session. Then your billing controller can require an "ultra secure" session.
+
+Authlogic can do all of this and much more, keep reading to see...
 
-Wouldn't it be nice to keep your app up to date with the latest and greatest security techniques with a simple update of a gem?
+== Quick example
 
-What if you could have authentication up and running in minutes without having to run a generator? All because it's simple, like everything else.
+Let's take a rails application...
 
 What if creating a user session could be as simple as...
 
@@ -60,14 +67,12 @@ Or how about persisting the session...
         @current_user_session = UserSession.find
       end
       
-      end current_user
+      def current_user
         return @current_user if defined?(@current_user)
         @current_user = current_user_session && current_user_session.user
       end
   end
 
-Authlogic and REST are like peas and carrots, as Forrest Gump would say. But This is just the tip of the ice berg. Keep reading to find out everything Authlogic can do.
-
 == Helpful links
 
 *	<b>Documentation:</b> http://authlogic.rubyforge.org
@@ -116,7 +121,7 @@ The user model needs to have the following columns. The names of these columns c
 
     t.string    :login,                 :null => false
     t.string    :crypted_password,      :null => false
-    t.string    :password_salt,         :null => false # not needed if you are encrypting your pw instead of using a hash algorithm.
+    t.string    :password_salt,         :null => false
     t.string    :persistence_token,     :null => false
     t.string    :single_access_token,   :null => false # optional, see the tokens section below.
     t.string    :perishable_token,      :null => false # optional, see the tokens section below.
@@ -354,7 +359,7 @@ Now mix and match the above, it can get pretty hairy. Fear not, because Authlogi
 
 I will describe each below, in order.
 
-=== Scoping your model
+=== 1. Scoping your model
 
 This scopes your login field validation, so that users are allowed to have the same login, just not in the same account.
 
@@ -363,7 +368,7 @@ This scopes your login field validation, so that users are allowed to have the s
     acts_as_authentic :scope => :account_id
   end
 
-=== Scoping your session
+=== 2. Scoping your session
 
 When the session tries to validate it searches for a record. You want to scope that search. No problem...
 
@@ -380,7 +385,7 @@ This works just like ActiveRecord, so it should come natural. Here is how you ge
     authenticates_many :user_sessions
   end
 
-=== Scoping cookies
+=== 3. Scoping cookies
 
 What's neat about cookies is that if you use sub domains they automatically scope their self. Meaning if you create a cookie in whatever.yourdomain.com it will not exist in another.yourdomain.com. So if you are using subdomains to scope your users, you don't have to do anything.
 
@@ -414,6 +419,22 @@ The errors in Authlogic work JUST LIKE ActiveRecord. In fact, it uses the exact
       end
   end
 
+== Timing Out Sessions
+
+Think about financial websites, if you are inactive for a certain period of time you will be asked to log back in on your next request. You can do this with Authlogic easily, there are 2 parts to this:
+
+1. Define the timeout threshold:
+
+  acts_as_authentic :logged_in_timeout => 10.minutes # default is 10.minutes
+
+2. Enable logging out on timeouts
+
+  class UserSession < Authlogic::Session::Base
+    logout_on_timeout true # default if false
+  end
+
+This will require a user to log back in if they are inactive for more than 10 minutes. In order for this feature to be used you must have a last_request_at datetime field in your data for whatever model you are authenticating with.
+
 == Automatic Session Updating
 
 This is one of my favorite features that I think is pretty cool. It's things like this that make a library great and let you know you are on the right track.

data/Rakefile

@@ -1,19 +1,13 @@
 require 'rubygems'
 require File.dirname(__FILE__) << "/lib/authlogic/version"
-
-begin
-  require 'echoe'
+require 'echoe'
   
-  Echoe.new 'authlogic' do |p|
-    p.version = Authlogic::Version::STRING
-    p.author = "Ben Johnson of Binary Logic"
-    p.email  = 'bjohnson@binarylogic.com'
-    p.project = 'authlogic'
-    p.summary = "A clean, simple, and unobtrusive ruby authentication solution."
-    p.url = "http://github.com/binarylogic/authlogic"
-    p.dependencies = %w(activesupport echoe)
-  end
-rescue LoadError => boom
-  puts "You are missing a dependency required for meta-operations on this gem."
-  puts "#{boom.to_s.capitalize}."
+Echoe.new 'authlogic' do |p|
+  p.version = Authlogic::Version::STRING
+  p.author = "Ben Johnson of Binary Logic"
+  p.email  = 'bjohnson@binarylogic.com'
+  p.project = 'authlogic'
+  p.summary = "A clean, simple, and unobtrusive ruby authentication solution."
+  p.url = "http://github.com/binarylogic/authlogic"
+  p.dependencies = %w(activesupport echoe)
 end

data/authlogic.gemspec

@@ -2,15 +2,15 @@
 
 Gem::Specification.new do |s|
   s.name = %q{authlogic}
-  s.version = "1.3.8"
+  s.version = "1.3.9"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 1.2") if s.respond_to? :required_rubygems_version=
   s.authors = ["Ben Johnson of Binary Logic"]
-  s.date = %q{2008-12-24}
+  s.date = %q{2009-01-09}
   s.description = %q{A clean, simple, and unobtrusive ruby authentication solution.}
   s.email = %q{bjohnson@binarylogic.com}
-  s.extra_rdoc_files = ["CHANGELOG.rdoc", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/aes256.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/testing/test_unit_helpers.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "README.rdoc"]
-  s.files = ["CHANGELOG.rdoc", "generators/session/session_generator.rb", "generators/session/templates/session.rb", "init.rb", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/aes256.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/testing/test_unit_helpers.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "Manifest", "MIT-LICENSE", "Rakefile", "README.rdoc", "shoulda_macros/authlogic.rb", "test/crypto_provider_tests/aes256_test.rb", "test/crypto_provider_tests/bcrypt_test.rb", "test/crypto_provider_tests/sha1_test.rb", "test/crypto_provider_tests/sha512_test.rb", "test/fixtures/companies.yml", "test/fixtures/employees.yml", "test/fixtures/projects.yml", "test/fixtures/users.yml", "test/libs/mock_controller.rb", "test/libs/mock_cookie_jar.rb", "test/libs/mock_request.rb", "test/libs/ordered_hash.rb", "test/libs/user.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/credentials_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/logged_in_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/perishability_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/persistence_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/session_maintenance_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/single_access_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/authenticates_many_test.rb", "test/session_tests/active_record_trickery_test.rb", "test/session_tests/authenticates_many_association_test.rb", "test/session_tests/base_test.rb", "test/session_tests/config_test.rb", "test/session_tests/cookies_test.rb", "test/session_tests/params_test.rb", "test/session_tests/perishability_test.rb", "test/session_tests/scopes_test.rb", "test/session_tests/session_test.rb", "test/test_helper.rb", "authlogic.gemspec"]
+  s.extra_rdoc_files = ["CHANGELOG.rdoc", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/aes256.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/session/timeout.rb", "lib/authlogic/testing/test_unit_helpers.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "README.rdoc"]
+  s.files = ["CHANGELOG.rdoc", "generators/session/session_generator.rb", "generators/session/templates/session.rb", "init.rb", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/aes256.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/session/timeout.rb", "lib/authlogic/testing/test_unit_helpers.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "Manifest", "MIT-LICENSE", "Rakefile", "README.rdoc", "shoulda_macros/authlogic.rb", "test/crypto_provider_tests/aes256_test.rb", "test/crypto_provider_tests/bcrypt_test.rb", "test/crypto_provider_tests/sha1_test.rb", "test/crypto_provider_tests/sha512_test.rb", "test/fixtures/companies.yml", "test/fixtures/employees.yml", "test/fixtures/projects.yml", "test/fixtures/users.yml", "test/libs/mock_controller.rb", "test/libs/mock_cookie_jar.rb", "test/libs/mock_request.rb", "test/libs/ordered_hash.rb", "test/libs/user.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/credentials_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/logged_in_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/perishability_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/persistence_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/session_maintenance_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/single_access_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/authenticates_many_test.rb", "test/session_tests/active_record_trickery_test.rb", "test/session_tests/authenticates_many_association_test.rb", "test/session_tests/base_test.rb", "test/session_tests/config_test.rb", "test/session_tests/cookies_test.rb", "test/session_tests/params_test.rb", "test/session_tests/perishability_test.rb", "test/session_tests/scopes_test.rb", "test/session_tests/session_test.rb", "test/session_tests/timeout_test.rb", "test/test_helper.rb", "authlogic.gemspec"]
   s.has_rdoc = true
   s.homepage = %q{http://github.com/binarylogic/authlogic}
   s.rdoc_options = ["--line-numbers", "--inline-source", "--title", "Authlogic", "--main", "README.rdoc"]
@@ -18,7 +18,7 @@ Gem::Specification.new do |s|
   s.rubyforge_project = %q{authlogic}
   s.rubygems_version = %q{1.3.1}
   s.summary = %q{A clean, simple, and unobtrusive ruby authentication solution.}
-  s.test_files = ["test/crypto_provider_tests/aes256_test.rb", "test/crypto_provider_tests/bcrypt_test.rb", "test/crypto_provider_tests/sha1_test.rb", "test/crypto_provider_tests/sha512_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/credentials_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/logged_in_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/perishability_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/persistence_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/session_maintenance_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/single_access_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/authenticates_many_test.rb", "test/session_tests/active_record_trickery_test.rb", "test/session_tests/authenticates_many_association_test.rb", "test/session_tests/base_test.rb", "test/session_tests/config_test.rb", "test/session_tests/cookies_test.rb", "test/session_tests/params_test.rb", "test/session_tests/perishability_test.rb", "test/session_tests/scopes_test.rb", "test/session_tests/session_test.rb", "test/test_helper.rb"]
+  s.test_files = ["test/crypto_provider_tests/aes256_test.rb", "test/crypto_provider_tests/bcrypt_test.rb", "test/crypto_provider_tests/sha1_test.rb", "test/crypto_provider_tests/sha512_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/credentials_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/logged_in_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/perishability_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/persistence_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/session_maintenance_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/single_access_test.rb", "test/orm_adapters_tests/active_record_adapter_tests/authenticates_many_test.rb", "test/session_tests/active_record_trickery_test.rb", "test/session_tests/authenticates_many_association_test.rb", "test/session_tests/base_test.rb", "test/session_tests/config_test.rb", "test/session_tests/cookies_test.rb", "test/session_tests/params_test.rb", "test/session_tests/perishability_test.rb", "test/session_tests/scopes_test.rb", "test/session_tests/session_test.rb", "test/session_tests/timeout_test.rb", "test/test_helper.rb"]
 
   if s.respond_to? :specification_version then
     current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION

data/lib/authlogic.rb

@@ -33,6 +33,7 @@ require File.dirname(__FILE__) + "/authlogic/session/params"
 require File.dirname(__FILE__) + "/authlogic/session/perishability"
 require File.dirname(__FILE__) + "/authlogic/session/session"
 require File.dirname(__FILE__) + "/authlogic/session/scopes"
+require File.dirname(__FILE__) + "/authlogic/session/timeout"
 require File.dirname(__FILE__) + "/authlogic/session/base"
 
 module Authlogic
@@ -45,6 +46,7 @@ module Authlogic
       include Perishability
       include Session
       include Scopes
+      include Timeout
     end
   end
 end

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb

@@ -71,6 +71,11 @@ module Authlogic
         #   Authlogic gives you a sepcial method for finding records by the perishable token (see Authlogic::ORMAdapters::ActiveRecordAdapter::ActcsAsAuthentic::Perishability). In this method
         #   it checks for the age of the token. If the token is older than whatever you specify here, a record will NOT be returned. This way the tokens are perishable, thus making this system much
         #   more secure.
+        #
+        # * <tt>disable_perishble_token_maintenance</tt> - default: false,
+        #   Authlogic automatically maintains when to reset the perishable_token. This token should reset frequently because it is "perishable", but how frequent depends on your app.
+        #   By default it tries to reset this token as much as possible, which is done via a before_validation callback. If for some reason you want to maintain this yourself just
+        #   set this to true and use the reset_perishable_token and reset_perishable_token! methods to maintain it yourself.
         #   
         # * <tt>persistence_field</tt> - default: :persistence_token, :remember_token, or :cookie_tokien, depending on which column is present,
         #   defaults to :persistence_token if none are present,

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb

@@ -27,6 +27,7 @@ module Authlogic
                 named_scope :logged_out, lambda { {:conditions => ["last_request_at is NULL or last_request_at <= ?", #{options[:logged_in_timeout]}.seconds.ago]} }
                 
                 def logged_in?
+                  raise "Can not determine the records login state because there is no last_request_at column" if !respond_to?(:last_request_at)
                   !last_request_at.nil? && last_request_at > #{options[:logged_in_timeout]}.seconds.ago
                 end
               

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb

@@ -26,7 +26,7 @@ module Authlogic
             class_eval <<-"end_eval", __FILE__, __LINE__
               validates_uniqueness_of :#{options[:perishable_token_field]}, :if => :#{options[:perishable_token_field]}_changed?
               
-              before_validation :reset_#{options[:perishable_token_field]}
+              before_validation :reset_#{options[:perishable_token_field]}, :unless => :disable_#{options[:perishable_token_field]}_maintenance?
               
               def self.find_using_#{options[:perishable_token_field]}(token, age = #{options[:perishable_token_valid_for]})
                 return if token.blank?
@@ -51,6 +51,10 @@ module Authlogic
                 reset_#{options[:perishable_token_field]}
                 save_without_session_maintenance(false)
               end
+              
+              def disable_#{options[:perishable_token_field]}_maintenance?
+                #{options[:disable_perishable_token_maintenance].inspect} == true
+              end
             end_eval
           end
         end

data/lib/authlogic/session/base.rb

@@ -7,6 +7,8 @@ module Authlogic
       include Config
       
       class << self
+        attr_accessor :methods_configured
+        
         # Returns true if a controller have been set and can be used properly. This MUST be set before anything can be done. Similar to how ActiveRecord won't allow you to do anything
         # without establishing a DB connection. In your framework environment this is done for you, but if you are using Authlogic outside of your frameword, you need to assign a controller
         # object to Authlogic via Authlogic::Session::Base.controller = obj.
@@ -190,12 +192,6 @@ module Authlogic
         find_with.each do |find_method|
           if send("valid_#{find_method}?")
             self.new_session = false
-            
-            if record.class.column_names.include?("last_request_at") && (record.last_request_at.blank? || last_request_at_threshold.to_i.seconds.ago >= record.last_request_at)
-              record.last_request_at = Time.now
-              record.save_without_session_maintenance(false)
-            end
-            
             return record
           end
         end
@@ -353,25 +349,35 @@ module Authlogic
           self.class.controller
         end
         
+        # The goal with Authlogic is to feel as natural as possible. As a result, this method creates methods on the fly
+        # based on the configuration set. By default the configuration is based off of the columns names in the authenticating
+        # model. Thus allowing you to call user_session.username instead of user_session.login if you have a username column
+        # instead of a login column. Since class configuration can change during initialization it makes the most sense to enforce
+        # this configuration during the first initialization. At this point, all configuration should be set.
+        #
+        # Lastly, each method is defined individually to allow the user to provide their own "custom" method and this makes sure
+        # we don't replace their method.
         def create_configurable_methods!
-          return if respond_to?(login_field) # already created these methods
+          return if self.class.methods_configured == true
+          
+          self.class.send(:alias_method, klass_name.demodulize.underscore.to_sym, :record)
+          self.class.send(:attr_writer, login_field) if !respond_to?("#{login_field}=")
+          self.class.send(:attr_reader, login_field) if !respond_to?(login_field)
+          self.class.send(:attr_writer, password_field) if !respond_to?("#{password_field}=")
+          self.class.send(:define_method, password_field) {} if !respond_to?(password_field)
           
           self.class.class_eval <<-"end_eval", __FILE__, __LINE__
-            alias_method :#{klass_name.demodulize.underscore}, :record
-            
-            attr_reader :#{login_field}
-            
-            def #{login_field}=(value)
+            def #{login_field}_with_authentication_flag=(value)
               self.authenticating_with = :password
-              @#{login_field} = value
+              self.#{login_field}_without_authentication_flag = value
             end
+            alias_method_chain :#{login_field}=, :authentication_flag
             
-            def #{password_field}=(value)
+            def #{password_field}_with_authentication_flag=(value)
               self.authenticating_with = :password
-              @#{password_field} = value
+              self.#{password_field}_without_authentication_flag = value
             end
-
-            def #{password_field}; end
+            alias_method_chain :#{password_field}=, :authentication_flag
             
             private
               # The password should not be accessible publicly. This way forms using form_for don't fill the password with the attempted password. The prevent this we just create this method that is private.
@@ -379,6 +385,8 @@ module Authlogic
                 @#{password_field}
               end
           end_eval
+          
+          self.class.methods_configured = true
         end
         
         def klass

data/lib/authlogic/session/config.rb

@@ -176,6 +176,26 @@ module Authlogic
         end
         alias_method :login_field=, :login_field
         
+        # With acts_as_authentic you get a :logged_in_timeout configuration option. If this is set, after this amount of time has passed the user
+        # will be marked as logged out. Obviously, since web based apps are on a per request basis, we have to define a time limit threshold that
+        # determines when we consider a user to be "logged out". Meaning, if they login and then leave the website, when do mark them as logged out?
+        # I recommend just using this as a fun feature on your website or reports, giving you a ballpark number of users logged in and active. This is
+        # not meant to be a dead accurate representation of a users logged in state, since there is really no real way to do this with web based apps.
+        #
+        # That being said, you can use that feature to require a login if their session timesout. Similar to how financial sites work. Just set this option to
+        # true and if your record returns true for logged_out? then they will be required to log back in.
+        #
+        # * <tt>Default:</tt> false
+        # * <tt>Accepts:</tt> Boolean
+        def logout_on_timeout(value = nil)
+          if value.nil?
+            read_inheritable_attribute(:logout_on_timeout) || logout_on_timeout(false)
+          else
+            write_inheritable_attribute(:logout_on_timeout, value)
+          end
+        end
+        alias_method :logout_on_timeout=, :logout_on_timeout
+        
         # The error message used when the record returns false to active?
         #
         # * <tt>Default:</tt> "Your account is not active"
@@ -315,7 +335,7 @@ module Authlogic
         # Specify a list of allowed request types and single access authentication will only be allowed for the ones you specify. Checkout the "Single Access / Private Feeds Access" section in the README.
         #
         # * <tt>Default:</tt> "application/rss+xml", "application/atom+xml"
-        # * <tt>Accepts:</tt> String, or :all to allow single access authentication for any and all request types
+        # * <tt>Accepts:</tt> String of request type, or :all to allow single access authentication for any and all request types
         def single_access_allowed_request_types(*values)
           if values.blank?
             read_inheritable_attribute(:single_access_allowed_request_types) || single_access_allowed_request_types("application/rss+xml", "application/atom+xml")
@@ -376,6 +396,10 @@ module Authlogic
           self.class.login_field
         end
         
+        def logout_on_timeout?
+          self.class.logout_on_timeout == true
+        end
+        
         def not_active_message
           self.class.not_active_message
         end

data/lib/authlogic/session/cookies.rb

@@ -13,10 +13,10 @@ module Authlogic
       def valid_cookie?
         if cookie_credentials
           self.unauthorized_record = search_for_record("find_by_#{persistence_token_field}", cookie_credentials)
-          return valid?
+          valid? && !stale?
+        else
+          false
         end
-        
-        false
       end
       
       private

data/lib/authlogic/session/params.rb

@@ -12,14 +12,14 @@ module Authlogic
     module Params
       # Tries to validate the session from information in the params token
       def valid_params?
-        if params_credentials && single_access_token_field && single_access_allowed_request_types.include?(controller.request_content_type)
+        if params_credentials && single_access_token_field && (single_access_allowed_request_types.include?(controller.request_content_type) || single_access_allowed_request_types.include?(:all))
           self.unauthorized_record = search_for_record("find_by_#{single_access_token_field}", params_credentials)
           self.persisting = false
           return true if valid?
           self.persisting = true
+        else
+          false
         end
-        
-        false
       end
       
       private

data/lib/authlogic/session/perishability.rb

@@ -11,7 +11,7 @@ module Authlogic
       
       private
         def reset_perishable_token!
-          record.send("reset_#{perishable_token_field}!") if record.respond_to?("reset_#{perishable_token_field}!")
+          record.send("reset_#{perishable_token_field}!") if record.respond_to?("reset_#{perishable_token_field}!") && !record.send("disable_#{perishable_token_field}_maintenance?")
         end
     end
   end

data/lib/authlogic/session/session.rb

@@ -25,10 +25,10 @@ module Authlogic
               self.unauthorized_record = record
             end
           end
-          return valid?
+          valid? && !stale?
+        else
+          false
         end
-        
-        false
       end
       
       private

data/lib/authlogic/session/timeout.rb

@@ -0,0 +1,28 @@
+module Authlogic
+  module Session
+    # = Timeout
+    #
+    # This is reponsibile for determining if the session is stale or fresh. It is also responsible for maintaining the last_request_at value if the column is present.
+    #
+    # Think about how financial websites work. If you are inactive after a certain period of time you must log back in. By default this is disabled, but if enabled this
+    # module kicks in. See the logout_on_timeout configuration option for how to turn this on.
+    module Timeout
+      def self.included(klass)
+        klass.after_find :update_last_request_at!
+        klass.after_save :update_last_request_at!
+      end
+      
+      def stale?
+        logout_on_timeout? && record && record.logged_out?
+      end
+      
+      private
+        def update_last_request_at!
+          if record.class.column_names.include?("last_request_at") && (record.last_request_at.blank? || last_request_at_threshold.to_i.seconds.ago >= record.last_request_at)
+            record.last_request_at = Time.now
+            record.save_without_session_maintenance(false)
+          end
+        end
+    end
+  end
+end

data/lib/authlogic/version.rb

@@ -44,7 +44,7 @@ module Authlogic # :nodoc:
 
     MAJOR = 1
     MINOR = 3
-    TINY  = 8
+    TINY  = 9
 
     # The current version as a Version instance
     CURRENT = new(MAJOR, MINOR, TINY)

data/shoulda_macros/authlogic.rb

@@ -2,9 +2,10 @@ require "test/unit"
 
 module Authlogic
   module ShouldaMacros
-    def should_be_authentic(model)
+    def should_be_authentic
+      klass = model_class
       should "acts as authentic" do
-        assert model.respond_to?(:acts_as_authentic_config)
+        assert klass.respond_to?(:acts_as_authentic_config)
       end
     end
   end

data/test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb

@@ -112,6 +112,16 @@ module ORMAdaptersTests
           #assert !user.errors.on(:password)
         end
         
+        def test_disable_perishable_token_maintenance
+          ben = users(:ben)
+          assert !ben.disable_perishable_token_maintenance?
+          User.acts_as_authentic(:disable_perishable_token_maintenance => true)
+          assert ben.disable_perishable_token_maintenance?
+          old_perishable_token = ben.perishable_token
+          assert ben.valid?
+          assert_equal old_perishable_token, ben.perishable_token
+        end
+        
         private
           def get_default_configuration
             @default_configuration = User.acts_as_authentic_config

data/test/session_tests/base_test.rb

@@ -48,22 +48,6 @@ module SessionTests
       set_session_for(ben)
       session = UserSession.find
       assert session
-      assert !session.record.last_request_at.nil?
-      
-      UserSession.last_request_at_threshold = 2.seconds
-      assert_equal 2.seconds, UserSession.last_request_at_threshold
-      
-      assert UserSession.find
-      last_request_at = ben.reload.last_request_at
-      sleep(0.5)
-      assert UserSession.find
-      assert_equal last_request_at, ben.reload.last_request_at
-      sleep(2)
-      assert UserSession.find
-      assert_not_equal last_request_at, ben.reload.last_request_at
-      
-      UserSession.last_request_at_threshold 0
-      assert_equal 0, UserSession.last_request_at_threshold
     end
     
     def test_klass

data/test/session_tests/config_test.rb

@@ -102,6 +102,7 @@ module SessionTests
     end
     
     def test_login_field
+      UserSession.methods_configured = false
       UserSession.login_field = :saweet
       assert_equal :saweet, UserSession.login_field
       session = UserSession.new
@@ -176,6 +177,7 @@ module SessionTests
     end
   
     def test_password_field
+      UserSession.methods_configured = false
       UserSession.password_field = :saweet
       assert_equal :saweet, UserSession.password_field
       session = UserSession.new

data/test/session_tests/timeout_test.rb

@@ -0,0 +1,48 @@
+require File.dirname(__FILE__) + '/../test_helper.rb'
+
+module SessionTests
+  class TimeoutTest < ActiveSupport::TestCase
+    def test_after_find
+      ben = users(:ben)
+      set_session_for(ben)
+      session = UserSession.find
+      assert session
+      assert !session.record.last_request_at.nil?
+      
+      UserSession.last_request_at_threshold = 2.seconds
+      assert_equal 2.seconds, UserSession.last_request_at_threshold
+
+      assert UserSession.find
+      last_request_at = ben.reload.last_request_at
+      sleep(0.5)
+      assert UserSession.find
+      assert_equal last_request_at, ben.reload.last_request_at
+      sleep(2)
+      assert UserSession.find
+      assert_not_equal last_request_at, ben.reload.last_request_at
+
+      UserSession.last_request_at_threshold 0
+      assert_equal 0, UserSession.last_request_at_threshold
+    end
+    
+    def test_after_save
+      ben = users(:ben)
+      session = UserSession.new(ben)
+      assert session.save
+      assert !session.record.last_request_at.nil?
+      assert !session.stale?
+    end
+    
+    def test_stale
+      UserSession.logout_on_timeout = true
+      ben = users(:ben)
+      ben.update_attribute(:last_request_at, Time.now)
+      set_session_for(ben)
+      session = UserSession.find
+      assert !session.stale?
+      session.record.last_request_at = 3.years.ago
+      assert session.stale?
+      UserSession.logout_on_timeout = false
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: authlogic
 version: !ruby/object:Gem::Version 
-  version: 1.3.8
+  version: 1.3.9
 platform: ruby
 authors: 
 - Ben Johnson of Binary Logic
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2008-12-24 00:00:00 -06:00
+date: 2009-01-09 00:00:00 -05:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -77,6 +77,7 @@ extra_rdoc_files:
 - lib/authlogic/session/perishability.rb
 - lib/authlogic/session/scopes.rb
 - lib/authlogic/session/session.rb
+- lib/authlogic/session/timeout.rb
 - lib/authlogic/testing/test_unit_helpers.rb
 - lib/authlogic/version.rb
 - lib/authlogic.rb
@@ -113,6 +114,7 @@ files:
 - lib/authlogic/session/perishability.rb
 - lib/authlogic/session/scopes.rb
 - lib/authlogic/session/session.rb
+- lib/authlogic/session/timeout.rb
 - lib/authlogic/testing/test_unit_helpers.rb
 - lib/authlogic/version.rb
 - lib/authlogic.rb
@@ -151,6 +153,7 @@ files:
 - test/session_tests/perishability_test.rb
 - test/session_tests/scopes_test.rb
 - test/session_tests/session_test.rb
+- test/session_tests/timeout_test.rb
 - test/test_helper.rb
 - authlogic.gemspec
 has_rdoc: true
@@ -206,4 +209,5 @@ test_files:
 - test/session_tests/perishability_test.rb
 - test/session_tests/scopes_test.rb
 - test/session_tests/session_test.rb
+- test/session_tests/timeout_test.rb
 - test/test_helper.rb