RubyGems - authpwn_rails - Versions diffs - 0.20.0 → 0.21.0 - Mend

authpwn_rails 0.20.0 → 0.21.0

Files changed (46) hide show

checksums.yaml +4 -4
data/.travis.yml +2 -0
data/Gemfile +2 -0
data/Gemfile.lock +96 -60
data/Gemfile.rails4 +1 -0
data/Gemfile.rails41 +1 -0
data/Gemfile.rails42 +1 -0
data/Rakefile +2 -1
data/VERSION +1 -1
data/app/models/credentials/password.rb +3 -1
data/app/models/tokens/base.rb +5 -3
data/authpwn_rails.gemspec +10 -4
data/legacy/migrate_020_to_021.rb +15 -0
data/lib/authpwn_rails.rb +2 -2
data/lib/authpwn_rails/generators/templates/credentials.yml +7 -7
data/lib/authpwn_rails/generators/templates/users.yml +3 -3
data/lib/authpwn_rails/user_model.rb +3 -1
data/test/cookie_controller_test.rb +2 -2
data/test/credentials/api_token_test.rb +2 -2
data/test/credentials/email_credential_test.rb +1 -1
data/test/credentials/email_verification_token_test.rb +2 -2
data/test/credentials/omni_auth_uid_credential_test.rb +1 -1
data/test/credentials/one_time_token_credential_test.rb +4 -4
data/test/credentials/password_credential_test.rb +15 -1
data/test/credentials/password_reset_token_test.rb +2 -2
data/test/credentials/session_uid_token_test.rb +2 -2
data/test/credentials/token_crendential_test.rb +28 -18
data/test/helpers/rails.rb +0 -5
data/test/helpers/view_helpers.rb +1 -1
data/test/http_basic_controller_test.rb +1 -1
data/test/http_token_controller_test.rb +3 -3
data/test/initializer_test.rb +1 -1
data/test/routes_test.rb +2 -2
data/test/session_controller_api_test.rb +1 -1
data/test/session_controller_test.rb +1 -1
data/test/session_mailer_api_test.rb +1 -1
data/test/session_mailer_test.rb +1 -1
data/test/session_test.rb +1 -1
data/test/test_extensions_test.rb +1 -1
data/test/test_helper.rb +0 -1
data/test/user_extensions/api_token_field_test.rb +1 -1
data/test/user_extensions/email_field_test.rb +1 -1
data/test/user_extensions/password_field_test.rb +1 -1
data/test/user_test.rb +2 -2
metadata +31 -3
data/test/helpers/fbgraph.rb +0 -10

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e74b051ae5f60f59a12f722ab166d5fc2b263493
-  data.tar.gz: 390e8ffb67cd7094dd54da1006742f94f6bce1fc
+  metadata.gz: 675fbc46f9cd1ca6ec4ea6390fd648ec5ad4ab06
+  data.tar.gz: b5aa2f310aa8e5d7ece6df9912d3e3175f718de6
 SHA512:
-  metadata.gz: f7182e18579ef2e3bd789025dfdefede81eafa12ed40dd0ad24950ab9ea24f5c8b7d73a4b89b4b8291d32eed0129b6cd13a6327f997f8dbdad0fc3ba851b047e
-  data.tar.gz: 14b118e149594915b6d4f6b141a2099f819da1e26f798a7e95e7900fea0be7b2cbc2f4350b7e11d37b4cc5128a0de9d1d186e50f0214b4bf10cc8d51eea65e2f
+  metadata.gz: 5d7d1c4b50aab9281d6b15c4ea51af277f1c7f1e3a1e0cc9958d48dbc7e748eda3cf46e2fad755a6769dc1bb7291d897192cf9fa1017c41f6fca6876f41cb23a
+  data.tar.gz: 3742acf28e0abf4e46d7819ece0d18c09d717fbde22cdd8ae2c8b4d8914823767bdf8d806cfe15853330f8bdda71b1cbe0280cbbbccafb74c047b42e5eecf8a8

data/.travis.yml CHANGED Viewed

@@ -1,5 +1,7 @@
 sudo: false
 language: ruby
+services:
+  - postgresql
 addons:
   postgresql: "9.4"
 env:

data/Gemfile CHANGED Viewed

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
+gem 'base32', '>= 0.3.2'
 gem 'rails', '>= 4.0.13'
 group :development do
@@ -10,6 +11,7 @@ group :development do
   gem 'mysql2', '>= 0.3.20'
   gem 'omniauth', '>= 1.3.1'
   gem 'pg', '>= 0.18.4'
+  gem 'rake', '>= 11.1.1'
   gem 'sqlite3', '>= 1.3.11'
   gem 'rubysl', platforms: [:rbx]
   gem 'rubysl-bundler', platforms: [:rbx]

data/Gemfile.lock CHANGED Viewed

@@ -1,34 +1,46 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (4.0.13)
-      actionpack (= 4.0.13)
+    actionmailer (4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
       mail (~> 2.5, >= 2.5.4)
-    actionpack (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-      erubis (~> 2.7.0)
-      rack (~> 1.5.2)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (4.2.6)
+      actionview (= 4.2.6)
+      activesupport (= 4.2.6)
+      rack (~> 1.6)
       rack-test (~> 0.6.2)
-    activemodel (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-    activerecord (4.0.13)
-      activemodel (= 4.0.13)
-      activerecord-deprecated_finders (~> 1.0.2)
-      activesupport (= 4.0.13)
-      arel (~> 4.0.0)
-    activerecord-deprecated_finders (1.0.4)
-    activesupport (4.0.13)
-      i18n (~> 0.6, >= 0.6.9)
-      minitest (~> 4.2)
-      multi_json (~> 1.3)
-      thread_safe (~> 0.1)
-      tzinfo (~> 0.3.37)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (4.2.6)
+      activesupport (= 4.2.6)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (4.2.6)
+      activesupport (= 4.2.6)
+      globalid (>= 0.3.0)
+    activemodel (4.2.6)
+      activesupport (= 4.2.6)
+      builder (~> 3.1)
+    activerecord (4.2.6)
+      activemodel (= 4.2.6)
+      activesupport (= 4.2.6)
+      arel (~> 6.0)
+    activesupport (4.2.6)
+      i18n (~> 0.7)
+      json (~> 1.7, >= 1.7.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.3, >= 0.3.4)
+      tzinfo (~> 1.1)
     addressable (2.4.0)
-    arel (4.0.2)
-    builder (3.1.4)
-    concurrent-ruby (1.0.0)
+    arel (6.0.3)
+    base32 (0.3.2)
+    builder (3.2.2)
+    concurrent-ruby (1.0.1)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
     docile (1.1.5)
@@ -36,7 +48,7 @@ GEM
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
     ffi2-generators (0.1.1)
-    git (1.2.9.1)
+    git (1.3.0)
     github_api (0.13.1)
       addressable (~> 2.4.0)
       descendants_tracker (~> 0.0.4)
@@ -44,6 +56,8 @@ GEM
       hashie (>= 3.4)
       multi_json (>= 1.7.5, < 2.0)
       oauth2
+    globalid (0.3.6)
+      activesupport (>= 4.1.0)
     hashie (3.4.3)
     highline (1.7.8)
     i18n (0.7.0)
@@ -57,50 +71,66 @@ GEM
       rake
       rdoc
     json (1.8.3)
-    jwt (1.5.2)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    jwt (1.5.1)
+    loofah (2.0.3)
+      nokogiri (>= 1.5.9)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
     metaclass (0.0.4)
-    mime-types (2.99)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
     mini_portile2 (2.0.0)
-    minitest (4.7.5)
+    minitest (5.8.4)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
     multi_json (1.11.2)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
-    mysql2 (0.3.20)
-    nokogiri (1.6.7.1)
+    mysql2 (0.4.3)
+    nokogiri (1.6.7.2)
       mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (1.0.0)
+    oauth2 (1.1.0)
       faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
+      jwt (~> 1.0, < 1.5.2)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
-      rack (~> 1.2)
+      rack (>= 1.2, < 3)
     omniauth (1.3.1)
       hashie (>= 1.2, < 4)
       rack (>= 1.0, < 3)
     pg (0.18.4)
-    rack (1.5.5)
+    rack (1.6.4)
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.0.13)
-      actionmailer (= 4.0.13)
-      actionpack (= 4.0.13)
-      activerecord (= 4.0.13)
-      activesupport (= 4.0.13)
+    rails (4.2.6)
+      actionmailer (= 4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
+      activemodel (= 4.2.6)
+      activerecord (= 4.2.6)
+      activesupport (= 4.2.6)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.0.13)
-      sprockets-rails (~> 2.0)
-    railties (4.0.13)
-      actionpack (= 4.0.13)
-      activesupport (= 4.0.13)
+      railties (= 4.2.6)
+      sprockets-rails
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.7)
+      activesupport (>= 4.2.0.beta, < 5.0)
+      nokogiri (~> 1.6.0)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.0.3)
+      loofah (~> 2.0)
+    railties (4.2.6)
+      actionpack (= 4.2.6)
+      activesupport (= 4.2.6)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
-    rubysl (2.1.0)
+    rake (11.1.1)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    rubysl (2.2.0)
       rubysl-abbrev (~> 2.0)
       rubysl-base64 (~> 2.0)
       rubysl-benchmark (~> 2.0)
@@ -185,6 +215,7 @@ GEM
       rubysl-tmpdir (~> 2.0)
       rubysl-tsort (~> 2.0)
       rubysl-un (~> 2.0)
+      rubysl-unicode_normalize (~> 2.0)
       rubysl-uri (~> 2.0)
       rubysl-weakref (~> 2.0)
       rubysl-webrick (~> 2.0)
@@ -265,11 +296,11 @@ GEM
     rubysl-observer (2.0.0)
     rubysl-open-uri (2.0.0)
     rubysl-open3 (2.0.0)
-    rubysl-openssl (2.4.0)
+    rubysl-openssl (2.8.0)
     rubysl-optparse (2.0.1)
       rubysl-shellwords (~> 2.0)
     rubysl-ostruct (2.1.0)
-    rubysl-pathname (2.1.0)
+    rubysl-pathname (2.3)
     rubysl-prettyprint (2.0.3)
     rubysl-prime (2.0.1)
     rubysl-profile (2.0.0)
@@ -299,8 +330,9 @@ GEM
     rubysl-set (2.0.1)
     rubysl-shellwords (2.0.0)
     rubysl-singleton (2.0.0)
-    rubysl-socket (2.0.1)
-    rubysl-stringio (2.0.0)
+    rubysl-socket (2.1.1)
+      rubysl-fcntl (~> 2.0)
+    rubysl-stringio (2.1.0)
     rubysl-strscan (2.0.0)
     rubysl-sync (2.0.0)
     rubysl-syslog (2.1.0)
@@ -315,13 +347,14 @@ GEM
     rubysl-un (2.0.0)
       rubysl-fileutils (~> 2.0)
       rubysl-optparse (~> 2.0)
+    rubysl-unicode_normalize (2.0)
     rubysl-uri (2.0.0)
     rubysl-weakref (2.0.0)
     rubysl-webrick (2.0.0)
     rubysl-xmlrpc (2.0.0)
     rubysl-yaml (2.1.0)
     rubysl-zlib (2.0.1)
-    simplecov (0.11.1)
+    simplecov (0.11.2)
       docile (~> 1.1.0)
       json (~> 1.8)
       simplecov-html (~> 0.10.0)
@@ -329,19 +362,21 @@ GEM
     sprockets (3.5.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (2.3.3)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
+    sprockets-rails (3.0.4)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
     sqlite3 (1.3.11)
     thor (0.19.1)
     thread_safe (0.3.5)
-    tzinfo (0.3.46)
+    tzinfo (1.2.2)
+      thread_safe (~> 0.1)
 PLATFORMS
   ruby
 DEPENDENCIES
+  base32 (>= 0.3.2)
   bundler (>= 1.6.6)
   jeweler (>= 2.0.1)
   mocha (>= 1.1.0)
@@ -349,6 +384,7 @@ DEPENDENCIES
   omniauth (>= 1.3.1)
   pg (>= 0.18.4)
   rails (>= 4.0.13)
+  rake (>= 11.1.1)
   rubysl
   rubysl-bundler
   rubysl-rake

data/Gemfile.rails4 CHANGED Viewed

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
+gem 'base32', '>= 0.3.2'
 gem 'rails', '~> 4.0.13'
 group :development do

data/Gemfile.rails41 CHANGED Viewed

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
+gem 'base32', '>= 0.3.2'
 gem 'rails', '~> 4.1.10'
 group :development do

data/Gemfile.rails42 CHANGED Viewed

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
+gem 'base32', '>= 0.3.2'
 gem 'rails', '~> 4.2.5'
 group :development do

data/Rakefile CHANGED Viewed

@@ -28,7 +28,8 @@ require 'rake/testtask'
 Rake::TestTask.new(:test) do |test|
   test.libs << 'lib' << 'test'
   test.pattern = 'test/**/*_test.rb'
-  test.verbose = true
+  test.warning = false
+  test.verbose = false
 end
 task :default => :test

data/VERSION CHANGED Viewed

	@@ -1 +1 @@
1	- 0.20.0
1	+ 0.21.0

data/app/models/credentials/password.rb CHANGED Viewed

@@ -1,3 +1,5 @@
+require 'securerandom'
 # :namespace
 module Credentials
@@ -78,7 +80,7 @@ class Password < ::Credential
   # Generates a random salt value.
   def self.random_salt
-    [(0...12).map { |i| 1 + rand(255) }.pack('C*')].pack('m').strip
+    [SecureRandom.random_bytes(12)].pack('m').strip
   end
 end  # class Credentials::Password

data/app/models/tokens/base.rb CHANGED Viewed

@@ -1,5 +1,8 @@
 require 'securerandom'
+require 'base32'
 # :namespace
 module Tokens
@@ -12,8 +15,7 @@ class Base < ::Credential
   # Token names are random, so we can expect they'll be unique across the
   # entire namespace. We need this check to enforce name uniqueness across
   # different token types.
-  validates :name, format: /\A[A-Za-z0-9\_\-]+\Z/, presence: true,
-                   uniqueness: true
+  validates :name, format: /\A[a-z0-9]+\Z/, presence: true, uniqueness: true
   # Tokens can expire. This is a good idea most of the time, because token
   # codes are supposed to be used quickly.
@@ -93,7 +95,7 @@ class Base < ::Credential
   # Generates a random token code.
   def self.random_code
-    SecureRandom.urlsafe_base64(32)
+    Base32.encode(SecureRandom.random_bytes(32)).downcase.sub(/=*$/, '')
   end
   # Use codes instead of exposing ActiveRecord IDs.

data/authpwn_rails.gemspec CHANGED Viewed

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: authpwn_rails 0.20.0 ruby lib
+# stub: authpwn_rails 0.21.0 ruby lib
 Gem::Specification.new do |s|
   s.name = "authpwn_rails"
-  s.version = "0.20.0"
+  s.version = "0.21.0"
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Victor Costan"]
-  s.date = "2016-02-02"
+  s.date = "2016-03-27"
   s.description = "Works with Facebook."
   s.email = "victor@costan.us"
   s.extra_rdoc_files = [
@@ -43,6 +43,7 @@ Gem::Specification.new do |s|
     "app/models/tokens/session_uid.rb",
     "authpwn_rails.gemspec",
     "legacy/migrate_011_to_012.rb",
+    "legacy/migrate_020_to_021.rb",
     "legacy/migrate_09_to_010.rb",
     "lib/authpwn_rails.rb",
     "lib/authpwn_rails/credential_model.rb",
@@ -107,7 +108,6 @@ Gem::Specification.new do |s|
     "test/helpers/application_controller.rb",
     "test/helpers/autoload_path.rb",
     "test/helpers/db_setup.rb",
-    "test/helpers/fbgraph.rb",
     "test/helpers/i18n.rb",
     "test/helpers/rails.rb",
     "test/helpers/rails_undo.rb",
@@ -139,6 +139,7 @@ Gem::Specification.new do |s|
     s.specification_version = 4
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<base32>, [">= 0.3.2"])
       s.add_runtime_dependency(%q<rails>, [">= 4.0.13"])
       s.add_development_dependency(%q<bundler>, [">= 1.6.6"])
       s.add_development_dependency(%q<mocha>, [">= 1.1.0"])
@@ -147,11 +148,13 @@ Gem::Specification.new do |s|
       s.add_development_dependency(%q<mysql2>, [">= 0.3.20"])
       s.add_development_dependency(%q<omniauth>, [">= 1.3.1"])
       s.add_development_dependency(%q<pg>, [">= 0.18.4"])
+      s.add_development_dependency(%q<rake>, [">= 11.1.1"])
       s.add_development_dependency(%q<sqlite3>, [">= 1.3.11"])
       s.add_development_dependency(%q<rubysl>, [">= 0"])
       s.add_development_dependency(%q<rubysl-bundler>, [">= 0"])
       s.add_development_dependency(%q<rubysl-rake>, [">= 0"])
     else
+      s.add_dependency(%q<base32>, [">= 0.3.2"])
       s.add_dependency(%q<rails>, [">= 4.0.13"])
       s.add_dependency(%q<bundler>, [">= 1.6.6"])
       s.add_dependency(%q<mocha>, [">= 1.1.0"])
@@ -160,12 +163,14 @@ Gem::Specification.new do |s|
       s.add_dependency(%q<mysql2>, [">= 0.3.20"])
       s.add_dependency(%q<omniauth>, [">= 1.3.1"])
       s.add_dependency(%q<pg>, [">= 0.18.4"])
+      s.add_dependency(%q<rake>, [">= 11.1.1"])
       s.add_dependency(%q<sqlite3>, [">= 1.3.11"])
       s.add_dependency(%q<rubysl>, [">= 0"])
       s.add_dependency(%q<rubysl-bundler>, [">= 0"])
       s.add_dependency(%q<rubysl-rake>, [">= 0"])
     end
   else
+    s.add_dependency(%q<base32>, [">= 0.3.2"])
     s.add_dependency(%q<rails>, [">= 4.0.13"])
     s.add_dependency(%q<bundler>, [">= 1.6.6"])
     s.add_dependency(%q<mocha>, [">= 1.1.0"])
@@ -174,6 +179,7 @@ Gem::Specification.new do |s|
     s.add_dependency(%q<mysql2>, [">= 0.3.20"])
     s.add_dependency(%q<omniauth>, [">= 1.3.1"])
     s.add_dependency(%q<pg>, [">= 0.18.4"])
+    s.add_dependency(%q<rake>, [">= 11.1.1"])
     s.add_dependency(%q<sqlite3>, [">= 1.3.11"])
     s.add_dependency(%q<rubysl>, [">= 0"])
     s.add_dependency(%q<rubysl-bundler>, [">= 0"])

data/legacy/migrate_020_to_021.rb ADDED Viewed

@@ -0,0 +1,15 @@
+# This script migrates the authpwn 0.20 token codes and user IDs to the new
+# 0.21 format.
+# It should be run in a rails console.
+User.all.each do |user|
+  user.exuid = nil
+  user.set_default_exuid
+  user.save!
+end
+Credential.all.each do |token|
+  next unless token.kind_of? Tokens::Base
+  token.code = Tokens::Base.random_code
+  token.save!
+end

data/lib/authpwn_rails.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require 'active_support'
+require 'active_support/dependencies'
 # :nodoc: namespace
 module Authpwn
@@ -31,6 +31,6 @@ if defined?(Rails)
   # HACK(pwnall): this works around a known Rails bug
   #     https://rails.lighthouseapp.com/projects/8994/tickets/1905-apphelpers-within-plugin-not-being-mixed-in
-  require File.expand_path('../../app/helpers/session_helper.rb', __FILE__)
+  require_relative '../app/helpers/session_helper.rb'
   ActionController::Base.helper SessionHelper
 end

data/lib/authpwn_rails/generators/templates/credentials.yml CHANGED Viewed

@@ -23,28 +23,28 @@ john_password:
 jane_token:
   user: jane
   type: Tokens::OneTime
-  name: 6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c
+  name: skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa
 john_token:
   user: john
   type: Tokens::Base
-  name: YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A
+  name: ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq
 john_email_token:
   user: john
   type: Tokens::EmailVerification
-  name: bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE
+  name: qid3ipai5be3bcilygdztwvtlpiyrfzxks2solmetndb4vzuvkca
   key: john@gmail.com
 jane_password_token:
   user: jane
   type: Tokens::PasswordReset
-  name: nbMLTKN18tYy9plBAbsrwT6zdE2jZqoKPk6Ze4lHMSQ
+  name: 5pfbsvdcxaf3wrj2mf5h4j2skk3q7vni4dc4iqs6okqv2km3zrga
 john_session_token:
   user: john
   type: Tokens::SessionUid
-  name: iyHvfTnYoF1f1jL9Vnb55hnXobf2Ld6HxIW-PXya6dw
+  name: gordzvlpnvwyjy53jklfcwcjxdjvvhwnfwenqql4tzotma5c7k7a
   key: <%= { :browser_ip => '18.241.1.121',
              :browser_ua => 'Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1'
            }.to_yaml.inspect %>
@@ -52,7 +52,7 @@ john_session_token:
 jane_session_token:
   user: jane
   type: Tokens::SessionUid
-  name: sNIfh6UavUSceL0TpubJ-DnZRuxPSTAddoHBb-twEIg
+  name: nnn4cz75nta35aqu34c3kozxokszfaxt46vvvpq6gxxfnh3fvbuq
   key: <%= { :browser_ip => '18.70.0.160',
              :browser_ua => 'Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1'
            }.to_yaml.inspect %>
@@ -72,4 +72,4 @@ jane_omniauth_developer:
 john_api_token:
   user: john
   type: Tokens::Api
-  name: WViSwbTAEMe0dzB_IHXyNG3UJ4VgDW3_6nKM_FLrc6w
+  name: k2cof7wjyi3672laumnajizwax73x262gfmoqoiau3cgap7z3pdq

data/lib/authpwn_rails/generators/templates/users.yml CHANGED Viewed

@@ -1,8 +1,8 @@
 jane:
-  exuid: 12345
+  exuid: jane000exuid
 john:
-  exuid: 56789
+  exuid: john000exuid
 bill:
-  exuid: 98765
+  exuid: bill000exuid

data/lib/authpwn_rails/user_model.rb CHANGED Viewed

@@ -1,6 +1,8 @@
 require 'securerandom'
 require 'active_model'
 require 'active_support'
+require 'base32'
 # :nodoc: namespace
@@ -109,7 +111,7 @@ module UserModel
   # :nodoc: sets exuid to a (hopefully) unique value before validations occur.
   def set_default_exuid
     self.exuid ||=
-        SecureRandom.random_bytes(8).unpack('Q').first & 0x7fffffffffffffff
+        Base32.encode(SecureRandom.random_bytes(16)).downcase.sub(/=*$/, '')
   end
 end  # namespace Authpwn::UserModel

data/test/cookie_controller_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Mock controller used for testing session handling.
 class CookieController < ApplicationController
@@ -190,7 +190,7 @@ class CookieControllerTest < ActionController::TestCase
     assert_equal nil, assigns(:current_user)
   end
-  test "set_session_current_user behaves when no user is logged off" do
+  test "set_session_current_user behavhttps://appear.in/pwnalles when no user is logged off" do
     assert_no_difference 'Credential.count' do
       put :update, exuid: ''
     end

data/test/credentials/api_token_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class ApiTokenTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::Api.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.user = users(:bill)
   end

data/test/credentials/email_credential_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class EmailCredentialTest < ActiveSupport::TestCase
   def setup

data/test/credentials/email_verification_token_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class EmailVerificationTokenTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::EmailVerification.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.key = 'jane@gmail.com'
     @credential.user = users(:jane)
   end

data/test/credentials/omni_auth_uid_credential_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class OmniAuthUidCredentialTest < ActiveSupport::TestCase
   def setup

data/test/credentials/one_time_token_credential_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class OneTimeTokenCredentialTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::OneTime.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.user = users(:bill)
   end
@@ -37,7 +37,7 @@ class OneTimeTokenCredentialTest < ActiveSupport::TestCase
   end
   test 'authenticate spends the token' do
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
     bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
     assert_difference 'Credential.count', -1, 'token spent' do
       assert_equal users(:jane), Tokens::Base.authenticate(jane)
@@ -48,7 +48,7 @@ class OneTimeTokenCredentialTest < ActiveSupport::TestCase
   end
   test 'authenticate calls User#auth_bounce_reason' do
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
     with_blocked_credential credentials(:jane_token), :reason do
       assert_no_difference 'Credential.count', 'no token spent' do

data/test/credentials/password_credential_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class PasswordCredentialTest < ActiveSupport::TestCase
   def setup
@@ -42,6 +42,20 @@ class PasswordCredentialTest < ActiveSupport::TestCase
     assert !@credential.valid?
   end
+  test 'generates salt' do
+    assert @credential.valid?
+    assert_match(/^[^|]{12,16}\|.+$/, @credential.key)
+  end
+  test 'generates random salts' do
+    salts = []
+    1000.times do
+      @credential.password = 'password'
+      salts << @credential.key.split('|').first
+    end
+    assert_equal salts.length, salts.uniq.length, 'Salts are not random enough'
+  end
   test 'old_password always returns nil' do
     assert_equal @credential.old_password, nil
     @credential.old_password = 'old password'

data/test/credentials/password_reset_token_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class PasswordVerificationTokenTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::PasswordReset.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.user = users(:john)
   end

data/test/credentials/session_uid_token_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class SessionUidTokenTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::SessionUid.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.browser_ip = '18.70.0.160'
     @credential.browser_ua =
         'Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1'

data/test/credentials/token_crendential_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class TokenCredentialTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::Base.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.user = users(:bill)
   end
@@ -44,11 +44,21 @@ class TokenCredentialTest < ActiveSupport::TestCase
     assert_operator users(:jane).credentials, :include?, token
   end
+  test 'random_for randomness' do
+    codes = []
+    1000.times do
+      token = Tokens::Base.random_for users(:jane)
+      codes << token.code
+    end
+    assert_equal codes.length, codes.uniq.length,
+        'Token codes are not random enough'
+  end
   test 'with_code' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    john_email = 'bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE'
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
-    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    john_email = 'qid3ipai5be3bcilygdztwvtlpiyrfzxks2solmetndb4vzuvkca'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
+    bogus = '3bl3iypby25bqooia7hpskihlrzjkt7opz5vgdp7i3mkaopdjcza'
     assert_equal credentials(:john_token),
                  Tokens::Base.with_code(john).first
     assert_equal credentials(:jane_token),
@@ -76,10 +86,10 @@ class TokenCredentialTest < ActiveSupport::TestCase
   end
   test 'class authenticate' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    john_email = 'bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE'
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
-    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    john_email = 'qid3ipai5be3bcilygdztwvtlpiyrfzxks2solmetndb4vzuvkca'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
+    bogus = '3bl3iypby25bqooia7hpskihlrzjkt7opz5vgdp7i3mkaopdjcza'
     assert_equal users(:john), Tokens::Base.authenticate(john)
     assert_equal users(:john), Tokens::Base.authenticate(john_email)
@@ -88,9 +98,9 @@ class TokenCredentialTest < ActiveSupport::TestCase
   end
   test 'class authenticate with non-base class' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    john_email = 'bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE'
-    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    john_email = 'qid3ipai5be3bcilygdztwvtlpiyrfzxks2solmetndb4vzuvkca'
+    bogus = '3bl3iypby25bqooia7hpskihlrzjkt7opz5vgdp7i3mkaopdjcza'
     assert_equal :invalid, Tokens::EmailVerification.authenticate(john)
     assert_equal users(:john),
@@ -99,8 +109,8 @@ class TokenCredentialTest < ActiveSupport::TestCase
   end
   test 'class authenticate on expired tokens' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
     Tokens::Base.all.each do |token|
       token.updated_at = Time.now - 1.year
@@ -120,9 +130,9 @@ class TokenCredentialTest < ActiveSupport::TestCase
   end
   test 'class authenticate calls User#auth_bounce_reason' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
-    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
+    bogus = '3bl3iypby25bqooia7hpskihlrzjkt7opz5vgdp7i3mkaopdjcza'
     with_blocked_credential credentials(:john_token), :reason do
       assert_equal :reason, Tokens::Base.authenticate(john)

data/test/helpers/rails.rb CHANGED Viewed

@@ -15,10 +15,5 @@ module Rails
     def application
       @_app ||= AuthpwnApp::Application.new
     end
-    # Used by fbgraph.
-    def root
-      File.expand_path '../..', File.dirname(__FILE__)
-    end
   end
 end

data/test/helpers/view_helpers.rb CHANGED Viewed

@@ -1,2 +1,2 @@
-require File.expand_path('../../../app/helpers/session_helper.rb', __FILE__)
+require_relative '../../app/helpers/session_helper.rb'
 ActionController::Base.helper SessionHelper

data/test/http_basic_controller_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Mock controller used for testing session handling.
 class HttpBasicController < ApplicationController

data/test/http_token_controller_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Mock controller used for testing session handling.
 class HttpTokenController < ApplicationController
@@ -57,9 +57,9 @@ class HttpTokenControllerTest < ActionController::TestCase
   end
   test "uses Tokens::Api.authenticate" do
-    Tokens::Api.expects(:authenticate).at_least_once.with('ap1-c0d3').
+    Tokens::Api.expects(:authenticate).at_least_once.with('ap1c0d3').
         returns @user
-    set_http_token_user @user, 'ap1-c0d3'
+    set_http_token_user @user, 'ap1c0d3'
     get :show
     assert_equal @user, assigns(:current_user)
     assert_equal nil, session_current_user,

data/test/initializer_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class InitializerTest < ActiveSupport::TestCase
   test 'password set correctly' do

data/test/routes_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 require 'authpwn_rails/generators/templates/session_controller.rb'
@@ -24,7 +24,7 @@ class RoutesTest < ActionController::TestCase
     assert_routing({path: '/session/reset_password', method: :post},
                    {controller: 'session', action: 'reset_password'})
-    code = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
+    code = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
     assert_routing({path: "/session/token/#{code}", method: :get},
         {controller: 'session', action: 'token', code: code})

data/test/session_controller_api_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class BareSessionController < ApplicationController
   include Authpwn::SessionController

data/test/session_controller_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Run the tests in the generator, to make sure they pass.
 require 'authpwn_rails/generators/templates/session_controller_test.rb'

data/test/session_mailer_api_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class SessionMailerApiTest < ActionMailer::TestCase
   setup do

data/test/session_mailer_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Run the tests in the generator, to make sure they pass.
 require 'authpwn_rails/generators/templates/session_mailer_test.rb'

data/test/session_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class SessionTest < ActiveSupport::TestCase
   def setup

data/test/test_extensions_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class TestExtensionsTest < ActionController::TestCase
   def setup

data/test/test_helper.rb CHANGED Viewed

@@ -20,7 +20,6 @@ require 'helpers/application_controller.rb'
 require 'helpers/action_mailer.rb'
 require 'helpers/autoload_path.rb'
 require 'helpers/db_setup.rb'
-require 'helpers/fbgraph.rb'
 require 'helpers/i18n.rb'
 require 'helpers/rails.rb'
 require 'helpers/routes.rb'

data/test/user_extensions/api_token_field_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class UserWithApiToken < User
   include Authpwn::UserExtensions::ApiTokenField

data/test/user_extensions/email_field_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class UserWithEmail < User
   include Authpwn::UserExtensions::EmailField

data/test/user_extensions/password_field_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class UserWithPassword < User
   include Authpwn::UserExtensions::PasswordField

data/test/user_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class UserTest < ActiveSupport::TestCase
   def setup
@@ -37,7 +37,7 @@ class UserTest < ActiveSupport::TestCase
   end
   test 'to_param' do
-    assert_equal '56789', users(:john).to_param
+    assert_equal 'john000exuid', users(:john).to_param
   end
   test 'with_param' do

metadata CHANGED Viewed

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: authpwn_rails
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.21.0
 platform: ruby
 authors:
 - Victor Costan
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-02-02 00:00:00.000000000 Z
+date: 2016-03-27 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base32
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.2
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -122,6 +136,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.18.4
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 11.1.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 11.1.1
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -210,6 +238,7 @@ files:
 - app/models/tokens/session_uid.rb
 - authpwn_rails.gemspec
 - legacy/migrate_011_to_012.rb
+- legacy/migrate_020_to_021.rb
 - legacy/migrate_09_to_010.rb
 - lib/authpwn_rails.rb
 - lib/authpwn_rails/credential_model.rb
@@ -274,7 +303,6 @@ files:
 - test/helpers/application_controller.rb
 - test/helpers/autoload_path.rb
 - test/helpers/db_setup.rb
-- test/helpers/fbgraph.rb
 - test/helpers/i18n.rb
 - test/helpers/rails.rb
 - test/helpers/rails_undo.rb

data/test/helpers/fbgraph.rb DELETED Viewed

@@ -1,10 +0,0 @@
-# :nodoc: stub FBGraphRails.config because it depends on Rails.root
-module FBGraphRails
-  def self.config
-    {
-      'id' => '320998114580911',
-      'secret' => '7ded389d3c226e1f5d363b2df695be2f',
-      'scope' => []
-    }
-  end
-end