authpwn_rails 0.9.6 → 0.10.0

data/.travis.yml

@@ -0,0 +1,6 @@
+rvm:
+  - 1.8.7
+  - 1.9.2
+  - 1.9.3
+  - rbx-2.0
+  - jruby

data/Gemfile

@@ -1,10 +1,11 @@
 source "http://rubygems.org"
 gem "fbgraph_rails", ">= 0.2.2"
-gem "rails", ">= 3.1.0"
+gem "rails", ">= 3.1.3"
 
 group :development do
   gem "bundler", "~> 1.0.0"
+  gem "flexmock", "~> 0.9.0"
   gem "jeweler", "~> 1.6.0"
-  gem "rcov", ">= 0"
+  gem "rcov", ">= 0", :platform => :mri
   gem "sqlite3", ">= 1.3.3"
 end

data/Gemfile.lock

@@ -1,33 +1,33 @@
 GEM
   remote: http://rubygems.org/
   specs:
-    actionmailer (3.1.1)
-      actionpack (= 3.1.1)
+    actionmailer (3.1.3)
+      actionpack (= 3.1.3)
       mail (~> 2.3.0)
-    actionpack (3.1.1)
-      activemodel (= 3.1.1)
-      activesupport (= 3.1.1)
+    actionpack (3.1.3)
+      activemodel (= 3.1.3)
+      activesupport (= 3.1.3)
       builder (~> 3.0.0)
       erubis (~> 2.7.0)
       i18n (~> 0.6)
-      rack (~> 1.3.2)
+      rack (~> 1.3.5)
       rack-cache (~> 1.1)
       rack-mount (~> 0.8.2)
       rack-test (~> 0.6.1)
-      sprockets (~> 2.0.2)
-    activemodel (3.1.1)
-      activesupport (= 3.1.1)
+      sprockets (~> 2.0.3)
+    activemodel (3.1.3)
+      activesupport (= 3.1.3)
       builder (~> 3.0.0)
       i18n (~> 0.6)
-    activerecord (3.1.1)
-      activemodel (= 3.1.1)
-      activesupport (= 3.1.1)
+    activerecord (3.1.3)
+      activemodel (= 3.1.3)
+      activesupport (= 3.1.3)
       arel (~> 2.2.1)
       tzinfo (~> 0.3.29)
-    activeresource (3.1.1)
-      activemodel (= 3.1.1)
-      activesupport (= 3.1.1)
-    activesupport (3.1.1)
+    activeresource (3.1.3)
+      activemodel (= 3.1.3)
+      activesupport (= 3.1.3)
+    activesupport (3.1.3)
       multi_json (~> 1.0)
     addressable (2.2.6)
     arel (2.2.1)
@@ -37,7 +37,7 @@ GEM
       addressable (~> 2.2.6)
       multipart-post (~> 1.1.3)
       rack (>= 1.1.0, < 2)
-    fbgraph (1.8.4)
+    fbgraph (1.9.0)
       activesupport
       faraday (>= 0.7.5)
       hashie (>= 1.0.0)
@@ -51,8 +51,9 @@ GEM
       json (>= 1.6.1)
       oauth2 (>= 0.5.0)
       rails (>= 3.1.0)
+    flexmock (0.9.0)
     git (1.2.5)
-    hashie (1.1.0)
+    hashie (1.2.0)
     hike (1.2.1)
     i18n (0.6.0)
     jeweler (1.6.4)
@@ -64,14 +65,14 @@ GEM
       i18n (>= 0.4.0)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
-    mime-types (1.16)
+    mime-types (1.17.2)
     multi_json (1.0.3)
     multipart-post (1.1.3)
     oauth2 (0.5.1)
       faraday (~> 0.7.4)
       multi_json (~> 1.0.3)
-    polyglot (0.3.2)
-    rack (1.3.4)
+    polyglot (0.3.3)
+    rack (1.3.5)
     rack-cache (1.1)
       rack (>= 0.4)
     rack-mount (0.8.3)
@@ -80,28 +81,28 @@ GEM
       rack
     rack-test (0.6.1)
       rack (>= 1.0)
-    rails (3.1.1)
-      actionmailer (= 3.1.1)
-      actionpack (= 3.1.1)
-      activerecord (= 3.1.1)
-      activeresource (= 3.1.1)
-      activesupport (= 3.1.1)
+    rails (3.1.3)
+      actionmailer (= 3.1.3)
+      actionpack (= 3.1.3)
+      activerecord (= 3.1.3)
+      activeresource (= 3.1.3)
+      activesupport (= 3.1.3)
       bundler (~> 1.0)
-      railties (= 3.1.1)
-    railties (3.1.1)
-      actionpack (= 3.1.1)
-      activesupport (= 3.1.1)
+      railties (= 3.1.3)
+    railties (3.1.3)
+      actionpack (= 3.1.3)
+      activesupport (= 3.1.3)
       rack-ssl (~> 1.3.2)
       rake (>= 0.8.7)
       rdoc (~> 3.4)
       thor (~> 0.14.6)
-    rake (0.9.2)
+    rake (0.9.2.2)
     rcov (0.9.11)
-    rdoc (3.10)
+    rdoc (3.11)
       json (~> 1.4)
     rest-client (1.6.7)
       mime-types (>= 1.16)
-    sprockets (2.0.2)
+    sprockets (2.0.3)
       hike (~> 1.2)
       rack (~> 1.0)
       tilt (~> 1.1, != 1.3.0)
@@ -111,7 +112,7 @@ GEM
     treetop (1.4.10)
       polyglot
       polyglot (>= 0.3.1)
-    tzinfo (0.3.30)
+    tzinfo (0.3.31)
 
 PLATFORMS
   ruby
@@ -119,7 +120,8 @@ PLATFORMS
 DEPENDENCIES
   bundler (~> 1.0.0)
   fbgraph_rails (>= 0.2.2)
+  flexmock (~> 0.9.0)
   jeweler (~> 1.6.0)
-  rails (>= 3.1.0)
+  rails (>= 3.1.3)
   rcov
   sqlite3 (>= 1.3.3)

data/README.rdoc

@@ -4,17 +4,12 @@ User authentication for a Ruby on Rails 3 application. Works with Facebook.
 
 == Integration
 
-Scaffold user accounts, session controller views, and Facebook extensions.
-    rails g authpwn:users
-    rails g authpwn:session
-    rails g authpwn:facebook
+Scaffold user accounts, and session controller views.
+    rails g authpwn:all
     
 Wire authentication into your ApplicationController.
     authenticates_using_session
-    authenticates_using_facebook
-
-Point the default route to the sessions controller in config/routes.rb
-    root :to => "session#show" 
+    authenticates_using_facebook     
 
 Note: the code inside the models and controllers is tucked away in the plug-in.
 The scaffold models and controllers are there as extension points. You will be
@@ -24,12 +19,12 @@ able to update the plug-in without regenerating the scaffolds.
  
 * Fork the project.
 * Make your feature addition or bug fix.
-* Add tests for it. This is important so I don't break it in a
-  future version unintentionally.
+* Add tests for it. This is important so I don't break it in a future version
+  unintentionally.
 * Commit, do not mess with rakefile, version, or history.
   (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
 * Send me a pull request. Bonus points for topic branches.
 
 == Copyright
 
-Copyright (c) 2010 Victor Costan, released under the MIT license
+Copyright (c) 2010-2012 Victor Costan, released under the MIT license

data/VERSION

@@ -1 +1 @@
-0.9.6
+0.10.0

data/authpwn_rails.gemspec

@@ -4,14 +4,14 @@
 # -*- encoding: utf-8 -*-
 
 Gem::Specification.new do |s|
-  s.name = %q{authpwn_rails}
-  s.version = "0.9.6"
+  s.name = "authpwn_rails"
+  s.version = "0.10.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
-  s.authors = [%q{Victor Costan}]
-  s.date = %q{2011-10-12}
-  s.description = %q{Works with Facebook.}
-  s.email = %q{victor@costan.us}
+  s.authors = ["Victor Costan"]
+  s.date = "2011-11-21"
+  s.description = "Works with Facebook."
+  s.email = "victor@costan.us"
   s.extra_rdoc_files = [
     "LICENSE",
     "README.rdoc"
@@ -19,6 +19,7 @@ Gem::Specification.new do |s|
   s.files = [
     ".document",
     ".project",
+    ".travis.yml",
     "Gemfile",
     "Gemfile.lock",
     "LICENSE",
@@ -28,15 +29,18 @@ Gem::Specification.new do |s|
     "app/helpers/session_helper.rb",
     "authpwn_rails.gemspec",
     "lib/authpwn_rails.rb",
+    "lib/authpwn_rails/credential_model.rb",
+    "lib/authpwn_rails/credentials.rb",
+    "lib/authpwn_rails/credentials/email.rb",
+    "lib/authpwn_rails/credentials/facebook.rb",
+    "lib/authpwn_rails/credentials/password.rb",
     "lib/authpwn_rails/engine.rb",
     "lib/authpwn_rails/facebook_session.rb",
-    "lib/authpwn_rails/facebook_token_model.rb",
-    "lib/authpwn_rails/generators/facebook_generator.rb",
-    "lib/authpwn_rails/generators/session_generator.rb",
+    "lib/authpwn_rails/generators/all_generator.rb",
     "lib/authpwn_rails/generators/templates/001_create_users.rb",
-    "lib/authpwn_rails/generators/templates/002_create_facebook_tokens.rb",
-    "lib/authpwn_rails/generators/templates/facebook_token.rb",
-    "lib/authpwn_rails/generators/templates/facebook_tokens.yml",
+    "lib/authpwn_rails/generators/templates/002_create_credentials.rb",
+    "lib/authpwn_rails/generators/templates/credential.rb",
+    "lib/authpwn_rails/generators/templates/credentials.yml",
     "lib/authpwn_rails/generators/templates/session/forbidden.html.erb",
     "lib/authpwn_rails/generators/templates/session/home.html.erb",
     "lib/authpwn_rails/generators/templates/session/new.html.erb",
@@ -45,51 +49,55 @@ Gem::Specification.new do |s|
     "lib/authpwn_rails/generators/templates/session_controller_test.rb",
     "lib/authpwn_rails/generators/templates/user.rb",
     "lib/authpwn_rails/generators/templates/users.yml",
-    "lib/authpwn_rails/generators/users_generator.rb",
     "lib/authpwn_rails/session.rb",
     "lib/authpwn_rails/session_controller.rb",
     "lib/authpwn_rails/test_extensions.rb",
     "lib/authpwn_rails/user_model.rb",
     "test/cookie_controller_test.rb",
+    "test/email_credential_test.rb",
     "test/facebook_controller_test.rb",
-    "test/facebook_token_test.rb",
+    "test/facebook_credential_test.rb",
     "test/helpers/application_controller.rb",
     "test/helpers/db_setup.rb",
     "test/helpers/fbgraph.rb",
     "test/helpers/routes.rb",
     "test/helpers/view_helpers.rb",
+    "test/password_credential_test.rb",
     "test/session_controller_api_test.rb",
     "test/test_helper.rb",
     "test/user_test.rb"
   ]
-  s.homepage = %q{http://github.com/pwnall/authpwn_rails}
-  s.licenses = [%q{MIT}]
-  s.require_paths = [%q{lib}]
-  s.rubygems_version = %q{1.8.6}
-  s.summary = %q{User authentication for Rails 3 applications.}
+  s.homepage = "http://github.com/pwnall/authpwn_rails"
+  s.licenses = ["MIT"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = "1.8.11"
+  s.summary = "User authentication for Rails 3 applications."
 
   if s.respond_to? :specification_version then
     s.specification_version = 3
 
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
       s.add_runtime_dependency(%q<fbgraph_rails>, [">= 0.2.2"])
-      s.add_runtime_dependency(%q<rails>, [">= 3.1.0"])
+      s.add_runtime_dependency(%q<rails>, [">= 3.1.3"])
       s.add_development_dependency(%q<bundler>, ["~> 1.0.0"])
+      s.add_development_dependency(%q<flexmock>, ["~> 0.9.0"])
       s.add_development_dependency(%q<jeweler>, ["~> 1.6.0"])
       s.add_development_dependency(%q<rcov>, [">= 0"])
       s.add_development_dependency(%q<sqlite3>, [">= 1.3.3"])
     else
       s.add_dependency(%q<fbgraph_rails>, [">= 0.2.2"])
-      s.add_dependency(%q<rails>, [">= 3.1.0"])
+      s.add_dependency(%q<rails>, [">= 3.1.3"])
       s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+      s.add_dependency(%q<flexmock>, ["~> 0.9.0"])
       s.add_dependency(%q<jeweler>, ["~> 1.6.0"])
       s.add_dependency(%q<rcov>, [">= 0"])
       s.add_dependency(%q<sqlite3>, [">= 1.3.3"])
     end
   else
     s.add_dependency(%q<fbgraph_rails>, [">= 0.2.2"])
-    s.add_dependency(%q<rails>, [">= 3.1.0"])
+    s.add_dependency(%q<rails>, [">= 3.1.3"])
     s.add_dependency(%q<bundler>, ["~> 1.0.0"])
+    s.add_dependency(%q<flexmock>, ["~> 0.9.0"])
     s.add_dependency(%q<jeweler>, ["~> 1.6.0"])
     s.add_dependency(%q<rcov>, [">= 0"])
     s.add_dependency(%q<sqlite3>, [">= 1.3.3"])

data/lib/authpwn_rails.rb

@@ -1,9 +1,9 @@
 # :nodoc: namespace
-module AuthpwnRails
+module Authpwn
 end
 
+require 'authpwn_rails/credential_model.rb'
 require 'authpwn_rails/facebook_session.rb'
-require 'authpwn_rails/facebook_token_model.rb'
 require 'authpwn_rails/session.rb'
 require 'authpwn_rails/session_controller.rb'
 require 'authpwn_rails/test_extensions.rb'

data/lib/authpwn_rails/credential_model.rb

@@ -0,0 +1,38 @@
+require 'active_support'
+
+# :nodoc: namespace
+module Authpwn
+
+# Included by the model class that represents facebook tokens.
+#
+# Parts of the codebase assume the model will be named Credential.
+module CredentialModel
+  extend ActiveSupport::Concern
+
+  included do
+    # The user whose token this is.
+    belongs_to :user, :inverse_of => :credentials
+    validates :user, :presence => true
+    
+    # Name that can be used to find the token.
+    validates :name, :length => { :in => 1..128, :allow_nil => true },
+                     :uniqueness => { :scope => [:type], :allow_nil => true }
+  
+    # Secret information associated with the token.
+    validates :key, :length => { :in => 1..2.kilobytes, :allow_nil => true }
+  end
+
+  # Included in the metaclass of models that call pwnauth_facebook_token_model.
+  module ClassMethods
+    
+  end  # module Authpwn::FacebookTokenModel::ClassMethods
+
+  
+  # Included in models that include Authpwn::FacebookTokenModel.
+  module InstanceMethods
+    
+  end  # module Authpwn::FacebookTokenModel::InstanceMethods
+  
+end  # namespace Authpwn::FacebookTokenModel
+
+end  # namespace Authpwn

data/lib/authpwn_rails/credentials.rb

@@ -0,0 +1,10 @@
+# Loads sub-classes of the Credential model.
+#
+# We allow the Credential model to be defined in the Rails application, so the
+# application can choose the storage model (ActiveRecord vs Mongoid etc.). This
+# means that we have to load the classes that inherit from Credential after it's
+# defined, which is long after the authpwn_rails engine is loaded.
+
+require 'authpwn_rails/credentials/email.rb'
+require 'authpwn_rails/credentials/facebook.rb'
+require 'authpwn_rails/credentials/password.rb'

data/lib/authpwn_rails/credentials/email.rb

@@ -0,0 +1,30 @@
+# :namespace
+module Credentials
+  
+# Associates an e-mail address with the user account.
+class Email < ::Credential
+  # The e-mail address.
+  alias_attribute :email, :name
+  validates :name, :format => /^[A-Za-z0-9.+_]+@[^@]*\.(\w+)$/,
+       :presence => true, :uniqueness => { :scope => [:type],
+       :message => 'This e-mail address is already claimed by an account' }
+
+  # '1' if the user proved ownership of the e-mail address.
+  alias_attribute :verified, :key
+  validates :verified, :presence => true
+
+  before_validation :set_verified_to_false, :on => :create
+  # :nodoc: by default, e-mail addresses are not verified
+  def set_verified_to_false
+    self.verified ||= '0' if self.key.nil?
+  end
+end  # class Credentials::Email 
+
+end  # namespace Credentials
+
+# :nodoc: adds e-mail integration to the user model
+module Authpwn::UserModel::InstanceMethods
+  def email_credential
+    credentials.find { |c| c.instance_of?(Credentials::Email) }
+  end
+end  # module Authpwn::UserModel::InstanceMethods

data/lib/authpwn_rails/credentials/facebook.rb

@@ -0,0 +1,77 @@
+# :namespace
+module Credentials
+  
+# Associates a Facebook account and OAuth2 token with an account.
+class Facebook < ::Credential
+  # The Graph API object ID of the Facebook account.
+  alias_attribute :facebook_uid, :name
+  validates :name, :format => /^\d+$/, :presence => true,
+       :uniqueness => { :scope => [:type],
+       :message => 'Your Facebook user is already associated to an account' }
+
+  # A user can be associated to a single Facebook account.
+  validates :user_id, :uniqueness => {
+      :message => 'Your account is already associated to a Facebook user' }
+
+  # OAuth2 token issued by Facebook.
+  alias_attribute :access_token, :key
+  validates :key, :presence => true
+
+  # FBGraph client loaded with this access token.
+  def facebook_client
+    @client ||= FBGraphRails.fbclient(access_token)
+  end  
+
+  # Finds or creates the model containing a token.
+  #
+  # If a model for the same user exists, the model is updated with the given
+  # token. Otherwise, a new model will be created, together with a user.
+  def self.for(access_token)
+    uid = uid_from_token access_token
+    credential = self.where(:name => uid.to_str).first
+    if credential
+      credential.update_attributes! :key => access_token
+    else
+      User.transaction do
+        user = User.create!
+        credential = self.create! :name => uid, :key => access_token,
+                                  :user => user
+      end
+    end
+    credential
+  end
+  
+  # Extracts the Facebook user ID from a OAuth2 token.
+  #
+  # This used to be a hack that pulled the UID out of an OAuth2 token. The new
+  # encrypted OAuth2 tokens don't have UIDs anymore, so this method is an
+  # interim hack for old code that still depends on it.
+  def self.uid_from_token(access_token)
+    FBGraphRails.fbclient(access_token).selection.me.info!.id.to_s
+  end
+end  # class Credentials::Facebook 
+
+end  # namespace Credentials
+
+# :nodoc: adds Facebook integration methods to the User model.
+module Authpwn::UserModel::ClassMethods
+  # Fills out a new user's information based on a Facebook access token.
+  def create_with_facebook_token(token)
+    self.create! :email => "#{token.external_uid}@graph.facebook.com"
+  end
+  
+  # The user that owns a given Facebook OAuth2 token.
+  #
+  # A new user will be created if the token doesn't belong to any user. This
+  # is the case for a new visitor.
+  def for_facebook_token(access_token)
+    Credentials::Facebook.for(access_token).user
+  end
+end  # module Authpwn::UserModel::ClassMethods
+
+# :nodoc: adds Facebook integration methods to the User model.
+module Authpwn::UserModel::InstanceMethods
+  def facebook_credential
+    credentials.find { |c| c.instance_of?(Credentials::Facebook) }
+  end
+end  # module Authpwn::UserModel::InstanceMethods