authlogic 4.4.2 → 4.4.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 4b4e547d67102fc738dbad4fcbdfc00c68dd3efd
-  data.tar.gz: cd63b81ab7a2d498ac4a360d62b9db5ae672f634
+SHA256:
+  metadata.gz: 2ddee07d72769ceaa9ba7e1cb47f8f4642df0ab981de7bac607f69796c9d0d6f
+  data.tar.gz: b1ee15e2637cf3379e6c24b1dda35abcf05527fb848c0d73ed25cf64633cf5fb
 SHA512:
-  metadata.gz: f038e670ad640d9e2e601f35977629a6bc82f4d658fc1939e3633077fb0b5ce7ceafb49bbed462620dd34b153e8aa364127bb68e9712ddfdad7f28227cc2dd29
-  data.tar.gz: 7b97ce1b31c9abe5bdae7cfaa364f14f905f790a52d6160a18a7312c748cb81775d176d49bfeddab27ac2e89e04be032a8f55bd084725185c2e6f30386252bc0
+  metadata.gz: e9f6bab4ddc5418fc74229a12912ef3411cf6252f8c9b22f88343ee9d8241bf7b3f4b82b159ea1375b1f69c107ebfb37cefb8503d8ba8971f9446994f21016dd
+  data.tar.gz: b8da5a086e0bb4b9047d16dda29877a2ddd5c791a2fa7998d1ffbd1d56dec04cb78026525070d008f05b7267e2a16c49810e688131c725b625499ecda53af0cf

data/CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
-## 5.0.0 (Unreleased)
+## [5.0.0](https://github.com/binarylogic/authlogic/blob/5-0-stable/CHANGELOG.md)
 
 * Breaking Changes
   * Drop AES256 crypto provider, deprecated in 4.2.0
@@ -16,6 +16,16 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 * Fixed
   * None
 
+## 4.4.3 (2019-03-23)
+
+* Breaking Changes
+  * None
+* Added
+  * [#660](https://github.com/binarylogic/authlogic/pull/660) -
+    Authlogic::Session::Cookies.encrypt_cookie option
+* Fixed
+  * Restrict sqlite3 version so tests can run normally
+
 ## 4.4.2 (2018-09-23)
 
 * Breaking Changes

data/Gemfile

@@ -3,4 +3,4 @@
 source "https://rubygems.org"
 gemspec
 
-gem "sqlite3", platforms: :ruby
+gem "sqlite3", "~> 1.3.6", platforms: :ruby

data/README.md

@@ -15,7 +15,7 @@ A clean, simple, and unobtrusive ruby authentication solution.
 | Version     | Documentation |
 | ----------- | ------------- |
 | Unreleased  | https://github.com/binarylogic/authlogic/blob/master/README.md |
-| 4.4.2       | https://github.com/binarylogic/authlogic/blob/v4.4.2/README.md |
+| 4.4.3       | https://github.com/binarylogic/authlogic/blob/v4.4.3/README.md |
 | 3.7.0       | https://github.com/binarylogic/authlogic/blob/v3.7.0/README.md |
 | 2.1.11      | https://github.com/binarylogic/authlogic/blob/v2.1.11/README.rdoc |
 | 1.4.3       | https://github.com/binarylogic/authlogic/blob/v1.4.3/README.rdoc |

data/gemfiles/Gemfile.rails-4.2.x

@@ -3,4 +3,4 @@ gemspec :path => ".."
 
 gem "activerecord", "~> 4.2.8.rc1"
 gem "activesupport", "~> 4.2.8.rc1"
-gem 'sqlite3', :platforms => :ruby
+gem "sqlite3", "~> 1.3.6", platforms: :ruby

data/gemfiles/Gemfile.rails-5.1.x

@@ -3,4 +3,4 @@ gemspec :path => ".."
 
 gem "activerecord", "~> 5.1.0"
 gem "activesupport", "~> 5.1.0"
-gem 'sqlite3', :platforms => :ruby
+gem "sqlite3", "~> 1.3.6", platforms: :ruby

data/gemfiles/Gemfile.rails-5.2.x

@@ -3,4 +3,4 @@ gemspec :path => ".."
 
 gem "activerecord", "~> 5.2.x"
 gem "activesupport", "~> 5.2.x"
-gem 'sqlite3', :platforms => :ruby
+gem "sqlite3", "~> 1.3.6", platforms: :ruby

data/lib/authlogic/session/cookies.rb

@@ -96,6 +96,20 @@ module Authlogic
           rw_config(:sign_cookie, value, false)
         end
         alias_method :sign_cookie=, :sign_cookie
+
+        # Should the cookie be encrypted? If the controller adapter supports it, this is a
+        # measure to hide the contents of the cookie (e.g. persistence_token)"
+        def encrypt_cookie(value = nil)
+          if value && !controller.cookies.respond_to?(:encrypted)
+            raise "Encrypted cookies not supported with #{controller.class}!"
+          end
+          if value && sign_cookie
+            raise "It is recommended to use encrypt_cookie instead of sign_cookie. " \
+                  "You may not enable both options."
+          end
+          rw_config(:encrypt_cookie, value, false)
+        end
+        alias_method :encrypt_cookie=, :encrypt_cookie
       end
 
       # The methods available for an Authlogic::Session::Base object that make up the
@@ -220,6 +234,23 @@ module Authlogic
           sign_cookie == true || sign_cookie == "true" || sign_cookie == "1"
         end
 
+        # If the cookie should be encrypted
+        def encrypt_cookie
+          return @encrypt_cookie if defined?(@encrypt_cookie)
+          @encrypt_cookie = self.class.encrypt_cookie
+        end
+
+        # Accepts a boolean as to whether the cookie should be encrypted.  If true
+        # the cookie will be saved in an encrypted state.
+        def encrypt_cookie=(value)
+          @encrypt_cookie = value
+        end
+
+        # See encrypt_cookie
+        def encrypt_cookie?
+          encrypt_cookie == true || encrypt_cookie == "true" || encrypt_cookie == "1"
+        end
+
         private
 
         def cookie_key
@@ -241,7 +272,9 @@ module Authlogic
         end
 
         def cookie_jar
-          if self.class.sign_cookie
+          if self.class.encrypt_cookie
+            controller.cookies.encrypted
+          elsif self.class.sign_cookie
             controller.cookies.signed
           else
             controller.cookies
@@ -263,22 +296,13 @@ module Authlogic
         end
 
         def save_cookie
-          if sign_cookie?
-            controller.cookies.signed[cookie_key] = generate_cookie_for_saving
-          else
-            controller.cookies[cookie_key] = generate_cookie_for_saving
-          end
+          cookie_jar[cookie_key] = generate_cookie_for_saving
+          true
         end
 
         def generate_cookie_for_saving
-          value = format(
-            "%s::%s%s",
-            record.persistence_token,
-            record.send(record.class.primary_key),
-            remember_me? ? "::#{remember_me_until.iso8601}" : ""
-          )
           {
-            value: value,
+            value: generate_cookie_value,
             expires: remember_me_until,
             secure: secure,
             httponly: httponly,
@@ -287,6 +311,15 @@ module Authlogic
           }
         end
 
+        def generate_cookie_value
+          format(
+            "%s::%s%s",
+            record.persistence_token.to_s,
+            record.send(record.class.primary_key).to_s,
+            remember_me? ? "::#{remember_me_until.iso8601}" : ""
+          )
+        end
+
         def destroy_cookie
           controller.cookies.delete cookie_key, domain: controller.cookie_domain
         end

data/lib/authlogic/test_case/mock_cookie_jar.rb

@@ -21,6 +21,10 @@ module Authlogic
       def signed
         @signed ||= MockSignedCookieJar.new(self)
       end
+
+      def encrypted
+        @encrypted ||= MockEncryptedCookieJar.new(self)
+      end
     end
 
     class MockSignedCookieJar < MockCookieJar
@@ -28,6 +32,7 @@ module Authlogic
 
       def initialize(parent_jar)
         @parent_jar = parent_jar
+        parent_jar.each { |k, v| self[k] = v }
       end
 
       def [](val)
@@ -44,5 +49,35 @@ module Authlogic
         @parent_jar[key] = options
       end
     end
+
+    class MockEncryptedCookieJar < MockCookieJar
+      attr_reader :parent_jar # helper for testing
+
+      def initialize(parent_jar)
+        @parent_jar = parent_jar
+        parent_jar.each { |k, v| self[k] = v }
+      end
+
+      def [](val)
+        encrypted_message = @parent_jar[val]
+        if encrypted_message
+          self.class.decrypt(encrypted_message)
+        end
+      end
+
+      def []=(key, options)
+        options[:value] = self.class.encrypt(options[:value])
+        @parent_jar[key] = options
+      end
+
+      # simple caesar cipher for testing
+      def self.encrypt(str)
+        str.unpack("U*").map(&:succ).pack("U*")
+      end
+
+      def self.decrypt(str)
+        str.unpack("U*").map(&:pred).pack("U*")
+      end
+    end
   end
 end

data/lib/authlogic/version.rb

@@ -16,6 +16,6 @@ module Authlogic
   #
   # @api public
   def self.gem_version
-    ::Gem::Version.new("4.4.2")
+    ::Gem::Version.new("4.4.3")
   end
 end

data/test/session_test/cookies_test.rb

@@ -174,6 +174,22 @@ module SessionTest
         )
       end
 
+      def test_after_save_save_cookie_encrypted
+        ben = users(:ben)
+
+        assert_nil controller.cookies["user_credentials"]
+        payload = "#{ben.persistence_token}::#{ben.id}"
+
+        session = UserSession.new(ben)
+        session.encrypt_cookie = true
+        assert session.save
+        assert_equal payload, controller.cookies.encrypted["user_credentials"]
+        assert_equal(
+          Authlogic::TestCase::MockEncryptedCookieJar.encrypt(payload),
+          controller.cookies.encrypted.parent_jar["user_credentials"]
+        )
+      end
+
       def test_after_save_save_cookie_signed
         ben = users(:ben)
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authlogic
 version: !ruby/object:Gem::Version
-  version: 4.4.2
+  version: 4.4.3
 platform: ruby
 authors:
 - Ben Johnson
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-09-23 00:00:00.000000000 Z
+date: 2019-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activerecord
@@ -327,7 +327,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2.3
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: A clean, simple, and unobtrusive ruby authentication solution.