RubyGems - authpwn_rails - Versions diffs - 0.20.0 → 0.21.0 - Mend

authpwn_rails 0.20.0 → 0.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (46) hide show

checksums.yaml +4 -4
data/.travis.yml +2 -0
data/Gemfile +2 -0
data/Gemfile.lock +96 -60
data/Gemfile.rails4 +1 -0
data/Gemfile.rails41 +1 -0
data/Gemfile.rails42 +1 -0
data/Rakefile +2 -1
data/VERSION +1 -1
data/app/models/credentials/password.rb +3 -1
data/app/models/tokens/base.rb +5 -3
data/authpwn_rails.gemspec +10 -4
data/legacy/migrate_020_to_021.rb +15 -0
data/lib/authpwn_rails.rb +2 -2
data/lib/authpwn_rails/generators/templates/credentials.yml +7 -7
data/lib/authpwn_rails/generators/templates/users.yml +3 -3
data/lib/authpwn_rails/user_model.rb +3 -1
data/test/cookie_controller_test.rb +2 -2
data/test/credentials/api_token_test.rb +2 -2
data/test/credentials/email_credential_test.rb +1 -1
data/test/credentials/email_verification_token_test.rb +2 -2
data/test/credentials/omni_auth_uid_credential_test.rb +1 -1
data/test/credentials/one_time_token_credential_test.rb +4 -4
data/test/credentials/password_credential_test.rb +15 -1
data/test/credentials/password_reset_token_test.rb +2 -2
data/test/credentials/session_uid_token_test.rb +2 -2
data/test/credentials/token_crendential_test.rb +28 -18
data/test/helpers/rails.rb +0 -5
data/test/helpers/view_helpers.rb +1 -1
data/test/http_basic_controller_test.rb +1 -1
data/test/http_token_controller_test.rb +3 -3
data/test/initializer_test.rb +1 -1
data/test/routes_test.rb +2 -2
data/test/session_controller_api_test.rb +1 -1
data/test/session_controller_test.rb +1 -1
data/test/session_mailer_api_test.rb +1 -1
data/test/session_mailer_test.rb +1 -1
data/test/session_test.rb +1 -1
data/test/test_extensions_test.rb +1 -1
data/test/test_helper.rb +0 -1
data/test/user_extensions/api_token_field_test.rb +1 -1
data/test/user_extensions/email_field_test.rb +1 -1
data/test/user_extensions/password_field_test.rb +1 -1
data/test/user_test.rb +2 -2
metadata +31 -3
data/test/helpers/fbgraph.rb +0 -10

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e74b051ae5f60f59a12f722ab166d5fc2b263493
-  data.tar.gz: 390e8ffb67cd7094dd54da1006742f94f6bce1fc
+  metadata.gz: 675fbc46f9cd1ca6ec4ea6390fd648ec5ad4ab06
+  data.tar.gz: b5aa2f310aa8e5d7ece6df9912d3e3175f718de6
 SHA512:
-  metadata.gz: f7182e18579ef2e3bd789025dfdefede81eafa12ed40dd0ad24950ab9ea24f5c8b7d73a4b89b4b8291d32eed0129b6cd13a6327f997f8dbdad0fc3ba851b047e
-  data.tar.gz: 14b118e149594915b6d4f6b141a2099f819da1e26f798a7e95e7900fea0be7b2cbc2f4350b7e11d37b4cc5128a0de9d1d186e50f0214b4bf10cc8d51eea65e2f
+  metadata.gz: 5d7d1c4b50aab9281d6b15c4ea51af277f1c7f1e3a1e0cc9958d48dbc7e748eda3cf46e2fad755a6769dc1bb7291d897192cf9fa1017c41f6fca6876f41cb23a
+  data.tar.gz: 3742acf28e0abf4e46d7819ece0d18c09d717fbde22cdd8ae2c8b4d8914823767bdf8d806cfe15853330f8bdda71b1cbe0280cbbbccafb74c047b42e5eecf8a8

data/.travis.yml CHANGED Viewed

@@ -1,5 +1,7 @@
 sudo: false
 language: ruby
+services:
+  - postgresql
 addons:
   postgresql: "9.4"
 env:

data/Gemfile CHANGED Viewed

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
+gem 'base32', '>= 0.3.2'
 gem 'rails', '>= 4.0.13'
 group :development do
@@ -10,6 +11,7 @@ group :development do
   gem 'mysql2', '>= 0.3.20'
   gem 'omniauth', '>= 1.3.1'
   gem 'pg', '>= 0.18.4'
+  gem 'rake', '>= 11.1.1'
   gem 'sqlite3', '>= 1.3.11'
   gem 'rubysl', platforms: [:rbx]
   gem 'rubysl-bundler', platforms: [:rbx]

data/Gemfile.lock CHANGED Viewed

@@ -1,34 +1,46 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (4.0.13)
-      actionpack (= 4.0.13)
+    actionmailer (4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
       mail (~> 2.5, >= 2.5.4)
-    actionpack (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-      erubis (~> 2.7.0)
-      rack (~> 1.5.2)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+    actionpack (4.2.6)
+      actionview (= 4.2.6)
+      activesupport (= 4.2.6)
+      rack (~> 1.6)
       rack-test (~> 0.6.2)
-    activemodel (4.0.13)
-      activesupport (= 4.0.13)
-      builder (~> 3.1.0)
-    activerecord (4.0.13)
-      activemodel (= 4.0.13)
-      activerecord-deprecated_finders (~> 1.0.2)
-      activesupport (= 4.0.13)
-      arel (~> 4.0.0)
-    activerecord-deprecated_finders (1.0.4)
-    activesupport (4.0.13)
-      i18n (~> 0.6, >= 0.6.9)
-      minitest (~> 4.2)
-      multi_json (~> 1.3)
-      thread_safe (~> 0.1)
-      tzinfo (~> 0.3.37)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    actionview (4.2.6)
+      activesupport (= 4.2.6)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+      rails-dom-testing (~> 1.0, >= 1.0.5)
+      rails-html-sanitizer (~> 1.0, >= 1.0.2)
+    activejob (4.2.6)
+      activesupport (= 4.2.6)
+      globalid (>= 0.3.0)
+    activemodel (4.2.6)
+      activesupport (= 4.2.6)
+      builder (~> 3.1)
+    activerecord (4.2.6)
+      activemodel (= 4.2.6)
+      activesupport (= 4.2.6)
+      arel (~> 6.0)
+    activesupport (4.2.6)
+      i18n (~> 0.7)
+      json (~> 1.7, >= 1.7.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.3, >= 0.3.4)
+      tzinfo (~> 1.1)
     addressable (2.4.0)
-    arel (4.0.2)
-    builder (3.1.4)
-    concurrent-ruby (1.0.0)
+    arel (6.0.3)
+    base32 (0.3.2)
+    builder (3.2.2)
+    concurrent-ruby (1.0.1)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
     docile (1.1.5)
@@ -36,7 +48,7 @@ GEM
     faraday (0.9.2)
       multipart-post (>= 1.2, < 3)
     ffi2-generators (0.1.1)
-    git (1.2.9.1)
+    git (1.3.0)
     github_api (0.13.1)
       addressable (~> 2.4.0)
       descendants_tracker (~> 0.0.4)
@@ -44,6 +56,8 @@ GEM
       hashie (>= 3.4)
       multi_json (>= 1.7.5, < 2.0)
       oauth2
+    globalid (0.3.6)
+      activesupport (>= 4.1.0)
     hashie (3.4.3)
     highline (1.7.8)
     i18n (0.7.0)
@@ -57,50 +71,66 @@ GEM
       rake
       rdoc
     json (1.8.3)
-    jwt (1.5.2)
-    mail (2.6.3)
-      mime-types (>= 1.16, < 3)
+    jwt (1.5.1)
+    loofah (2.0.3)
+      nokogiri (>= 1.5.9)
+    mail (2.6.4)
+      mime-types (>= 1.16, < 4)
     metaclass (0.0.4)
-    mime-types (2.99)
+    mime-types (3.0)
+      mime-types-data (~> 3.2015)
+    mime-types-data (3.2016.0221)
     mini_portile2 (2.0.0)
-    minitest (4.7.5)
+    minitest (5.8.4)
     mocha (1.1.0)
       metaclass (~> 0.0.1)
     multi_json (1.11.2)
     multi_xml (0.5.5)
     multipart-post (2.0.0)
-    mysql2 (0.3.20)
-    nokogiri (1.6.7.1)
+    mysql2 (0.4.3)
+    nokogiri (1.6.7.2)
       mini_portile2 (~> 2.0.0.rc2)
-    oauth2 (1.0.0)
+    oauth2 (1.1.0)
       faraday (>= 0.8, < 0.10)
-      jwt (~> 1.0)
+      jwt (~> 1.0, < 1.5.2)
       multi_json (~> 1.3)
       multi_xml (~> 0.5)
-      rack (~> 1.2)
+      rack (>= 1.2, < 3)
     omniauth (1.3.1)
       hashie (>= 1.2, < 4)
       rack (>= 1.0, < 3)
     pg (0.18.4)
-    rack (1.5.5)
+    rack (1.6.4)
     rack-test (0.6.3)
       rack (>= 1.0)
-    rails (4.0.13)
-      actionmailer (= 4.0.13)
-      actionpack (= 4.0.13)
-      activerecord (= 4.0.13)
-      activesupport (= 4.0.13)
+    rails (4.2.6)
+      actionmailer (= 4.2.6)
+      actionpack (= 4.2.6)
+      actionview (= 4.2.6)
+      activejob (= 4.2.6)
+      activemodel (= 4.2.6)
+      activerecord (= 4.2.6)
+      activesupport (= 4.2.6)
       bundler (>= 1.3.0, < 2.0)
-      railties (= 4.0.13)
-      sprockets-rails (~> 2.0)
-    railties (4.0.13)
-      actionpack (= 4.0.13)
-      activesupport (= 4.0.13)
+      railties (= 4.2.6)
+      sprockets-rails
+    rails-deprecated_sanitizer (1.0.3)
+      activesupport (>= 4.2.0.alpha)
+    rails-dom-testing (1.0.7)
+      activesupport (>= 4.2.0.beta, < 5.0)
+      nokogiri (~> 1.6.0)
+      rails-deprecated_sanitizer (>= 1.0.1)
+    rails-html-sanitizer (1.0.3)
+      loofah (~> 2.0)
+    railties (4.2.6)
+      actionpack (= 4.2.6)
+      activesupport (= 4.2.6)
       rake (>= 0.8.7)
       thor (>= 0.18.1, < 2.0)
-    rake (10.4.2)
-    rdoc (4.2.0)
-    rubysl (2.1.0)
+    rake (11.1.1)
+    rdoc (4.2.2)
+      json (~> 1.4)
+    rubysl (2.2.0)
       rubysl-abbrev (~> 2.0)
       rubysl-base64 (~> 2.0)
       rubysl-benchmark (~> 2.0)
@@ -185,6 +215,7 @@ GEM
       rubysl-tmpdir (~> 2.0)
       rubysl-tsort (~> 2.0)
       rubysl-un (~> 2.0)
+      rubysl-unicode_normalize (~> 2.0)
       rubysl-uri (~> 2.0)
       rubysl-weakref (~> 2.0)
       rubysl-webrick (~> 2.0)
@@ -265,11 +296,11 @@ GEM
     rubysl-observer (2.0.0)
     rubysl-open-uri (2.0.0)
     rubysl-open3 (2.0.0)
-    rubysl-openssl (2.4.0)
+    rubysl-openssl (2.8.0)
     rubysl-optparse (2.0.1)
       rubysl-shellwords (~> 2.0)
     rubysl-ostruct (2.1.0)
-    rubysl-pathname (2.1.0)
+    rubysl-pathname (2.3)
     rubysl-prettyprint (2.0.3)
     rubysl-prime (2.0.1)
     rubysl-profile (2.0.0)
@@ -299,8 +330,9 @@ GEM
     rubysl-set (2.0.1)
     rubysl-shellwords (2.0.0)
     rubysl-singleton (2.0.0)
-    rubysl-socket (2.0.1)
-    rubysl-stringio (2.0.0)
+    rubysl-socket (2.1.1)
+      rubysl-fcntl (~> 2.0)
+    rubysl-stringio (2.1.0)
     rubysl-strscan (2.0.0)
     rubysl-sync (2.0.0)
     rubysl-syslog (2.1.0)
@@ -315,13 +347,14 @@ GEM
     rubysl-un (2.0.0)
       rubysl-fileutils (~> 2.0)
       rubysl-optparse (~> 2.0)
+    rubysl-unicode_normalize (2.0)
     rubysl-uri (2.0.0)
     rubysl-weakref (2.0.0)
     rubysl-webrick (2.0.0)
     rubysl-xmlrpc (2.0.0)
     rubysl-yaml (2.1.0)
     rubysl-zlib (2.0.1)
-    simplecov (0.11.1)
+    simplecov (0.11.2)
       docile (~> 1.1.0)
       json (~> 1.8)
       simplecov-html (~> 0.10.0)
@@ -329,19 +362,21 @@ GEM
     sprockets (3.5.2)
       concurrent-ruby (~> 1.0)
       rack (> 1, < 3)
-    sprockets-rails (2.3.3)
-      actionpack (>= 3.0)
-      activesupport (>= 3.0)
-      sprockets (>= 2.8, < 4.0)
+    sprockets-rails (3.0.4)
+      actionpack (>= 4.0)
+      activesupport (>= 4.0)
+      sprockets (>= 3.0.0)
     sqlite3 (1.3.11)
     thor (0.19.1)
     thread_safe (0.3.5)
-    tzinfo (0.3.46)
+    tzinfo (1.2.2)
+      thread_safe (~> 0.1)
 PLATFORMS
   ruby
 DEPENDENCIES
+  base32 (>= 0.3.2)
   bundler (>= 1.6.6)
   jeweler (>= 2.0.1)
   mocha (>= 1.1.0)
@@ -349,6 +384,7 @@ DEPENDENCIES
   omniauth (>= 1.3.1)
   pg (>= 0.18.4)
   rails (>= 4.0.13)
+  rake (>= 11.1.1)
   rubysl
   rubysl-bundler
   rubysl-rake

data/Gemfile.rails4 CHANGED Viewed

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
+gem 'base32', '>= 0.3.2'
 gem 'rails', '~> 4.0.13'
 group :development do

data/Gemfile.rails41 CHANGED Viewed

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
+gem 'base32', '>= 0.3.2'
 gem 'rails', '~> 4.1.10'
 group :development do

data/Gemfile.rails42 CHANGED Viewed

@@ -1,5 +1,6 @@
 source 'https://rubygems.org'
+gem 'base32', '>= 0.3.2'
 gem 'rails', '~> 4.2.5'
 group :development do

data/Rakefile CHANGED Viewed

@@ -28,7 +28,8 @@ require 'rake/testtask'
 Rake::TestTask.new(:test) do |test|
   test.libs << 'lib' << 'test'
   test.pattern = 'test/**/*_test.rb'
-  test.verbose = true
+  test.warning = false
+  test.verbose = false
 end
 task :default => :test

data/VERSION CHANGED Viewed

	@@ -1 +1 @@
1	- 0.20.0
1	+ 0.21.0

data/app/models/credentials/password.rb CHANGED Viewed

@@ -1,3 +1,5 @@
+require 'securerandom'
 # :namespace
 module Credentials
@@ -78,7 +80,7 @@ class Password < ::Credential
   # Generates a random salt value.
   def self.random_salt
-    [(0...12).map { |i| 1 + rand(255) }.pack('C*')].pack('m').strip
+    [SecureRandom.random_bytes(12)].pack('m').strip
   end
 end  # class Credentials::Password

data/app/models/tokens/base.rb CHANGED Viewed

@@ -1,5 +1,8 @@
 require 'securerandom'
+require 'base32'
 # :namespace
 module Tokens
@@ -12,8 +15,7 @@ class Base < ::Credential
   # Token names are random, so we can expect they'll be unique across the
   # entire namespace. We need this check to enforce name uniqueness across
   # different token types.
-  validates :name, format: /\A[A-Za-z0-9\_\-]+\Z/, presence: true,
-                   uniqueness: true
+  validates :name, format: /\A[a-z0-9]+\Z/, presence: true, uniqueness: true
   # Tokens can expire. This is a good idea most of the time, because token
   # codes are supposed to be used quickly.
@@ -93,7 +95,7 @@ class Base < ::Credential
   # Generates a random token code.
   def self.random_code
-    SecureRandom.urlsafe_base64(32)
+    Base32.encode(SecureRandom.random_bytes(32)).downcase.sub(/=*$/, '')
   end
   # Use codes instead of exposing ActiveRecord IDs.

data/authpwn_rails.gemspec CHANGED Viewed

@@ -2,16 +2,16 @@
 # DO NOT EDIT THIS FILE DIRECTLY
 # Instead, edit Jeweler::Tasks in Rakefile, and run 'rake gemspec'
 # -*- encoding: utf-8 -*-
-# stub: authpwn_rails 0.20.0 ruby lib
+# stub: authpwn_rails 0.21.0 ruby lib
 Gem::Specification.new do |s|
   s.name = "authpwn_rails"
-  s.version = "0.20.0"
+  s.version = "0.21.0"
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.require_paths = ["lib"]
   s.authors = ["Victor Costan"]
-  s.date = "2016-02-02"
+  s.date = "2016-03-27"
   s.description = "Works with Facebook."
   s.email = "victor@costan.us"
   s.extra_rdoc_files = [
@@ -43,6 +43,7 @@ Gem::Specification.new do |s|
     "app/models/tokens/session_uid.rb",
     "authpwn_rails.gemspec",
     "legacy/migrate_011_to_012.rb",
+    "legacy/migrate_020_to_021.rb",
     "legacy/migrate_09_to_010.rb",
     "lib/authpwn_rails.rb",
     "lib/authpwn_rails/credential_model.rb",
@@ -107,7 +108,6 @@ Gem::Specification.new do |s|
     "test/helpers/application_controller.rb",
     "test/helpers/autoload_path.rb",
     "test/helpers/db_setup.rb",
-    "test/helpers/fbgraph.rb",
     "test/helpers/i18n.rb",
     "test/helpers/rails.rb",
     "test/helpers/rails_undo.rb",
@@ -139,6 +139,7 @@ Gem::Specification.new do |s|
     s.specification_version = 4
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+      s.add_runtime_dependency(%q<base32>, [">= 0.3.2"])
       s.add_runtime_dependency(%q<rails>, [">= 4.0.13"])
       s.add_development_dependency(%q<bundler>, [">= 1.6.6"])
       s.add_development_dependency(%q<mocha>, [">= 1.1.0"])
@@ -147,11 +148,13 @@ Gem::Specification.new do |s|
       s.add_development_dependency(%q<mysql2>, [">= 0.3.20"])
       s.add_development_dependency(%q<omniauth>, [">= 1.3.1"])
       s.add_development_dependency(%q<pg>, [">= 0.18.4"])
+      s.add_development_dependency(%q<rake>, [">= 11.1.1"])
       s.add_development_dependency(%q<sqlite3>, [">= 1.3.11"])
       s.add_development_dependency(%q<rubysl>, [">= 0"])
       s.add_development_dependency(%q<rubysl-bundler>, [">= 0"])
       s.add_development_dependency(%q<rubysl-rake>, [">= 0"])
     else
+      s.add_dependency(%q<base32>, [">= 0.3.2"])
       s.add_dependency(%q<rails>, [">= 4.0.13"])
       s.add_dependency(%q<bundler>, [">= 1.6.6"])
       s.add_dependency(%q<mocha>, [">= 1.1.0"])
@@ -160,12 +163,14 @@ Gem::Specification.new do |s|
       s.add_dependency(%q<mysql2>, [">= 0.3.20"])
       s.add_dependency(%q<omniauth>, [">= 1.3.1"])
       s.add_dependency(%q<pg>, [">= 0.18.4"])
+      s.add_dependency(%q<rake>, [">= 11.1.1"])
       s.add_dependency(%q<sqlite3>, [">= 1.3.11"])
       s.add_dependency(%q<rubysl>, [">= 0"])
       s.add_dependency(%q<rubysl-bundler>, [">= 0"])
       s.add_dependency(%q<rubysl-rake>, [">= 0"])
     end
   else
+    s.add_dependency(%q<base32>, [">= 0.3.2"])
     s.add_dependency(%q<rails>, [">= 4.0.13"])
     s.add_dependency(%q<bundler>, [">= 1.6.6"])
     s.add_dependency(%q<mocha>, [">= 1.1.0"])
@@ -174,6 +179,7 @@ Gem::Specification.new do |s|
     s.add_dependency(%q<mysql2>, [">= 0.3.20"])
     s.add_dependency(%q<omniauth>, [">= 1.3.1"])
     s.add_dependency(%q<pg>, [">= 0.18.4"])
+    s.add_dependency(%q<rake>, [">= 11.1.1"])
     s.add_dependency(%q<sqlite3>, [">= 1.3.11"])
     s.add_dependency(%q<rubysl>, [">= 0"])
     s.add_dependency(%q<rubysl-bundler>, [">= 0"])

data/legacy/migrate_020_to_021.rb ADDED Viewed

@@ -0,0 +1,15 @@
+# This script migrates the authpwn 0.20 token codes and user IDs to the new
+# 0.21 format.
+# It should be run in a rails console.
+User.all.each do |user|
+  user.exuid = nil
+  user.set_default_exuid
+  user.save!
+end
+Credential.all.each do |token|
+  next unless token.kind_of? Tokens::Base
+  token.code = Tokens::Base.random_code
+  token.save!
+end

data/lib/authpwn_rails.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require 'active_support'
+require 'active_support/dependencies'
 # :nodoc: namespace
 module Authpwn
@@ -31,6 +31,6 @@ if defined?(Rails)
   # HACK(pwnall): this works around a known Rails bug
   #     https://rails.lighthouseapp.com/projects/8994/tickets/1905-apphelpers-within-plugin-not-being-mixed-in
-  require File.expand_path('../../app/helpers/session_helper.rb', __FILE__)
+  require_relative '../app/helpers/session_helper.rb'
   ActionController::Base.helper SessionHelper
 end

data/lib/authpwn_rails/generators/templates/credentials.yml CHANGED Viewed

@@ -23,28 +23,28 @@ john_password:
 jane_token:
   user: jane
   type: Tokens::OneTime
-  name: 6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c
+  name: skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa
 john_token:
   user: john
   type: Tokens::Base
-  name: YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A
+  name: ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq
 john_email_token:
   user: john
   type: Tokens::EmailVerification
-  name: bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE
+  name: qid3ipai5be3bcilygdztwvtlpiyrfzxks2solmetndb4vzuvkca
   key: john@gmail.com
 jane_password_token:
   user: jane
   type: Tokens::PasswordReset
-  name: nbMLTKN18tYy9plBAbsrwT6zdE2jZqoKPk6Ze4lHMSQ
+  name: 5pfbsvdcxaf3wrj2mf5h4j2skk3q7vni4dc4iqs6okqv2km3zrga
 john_session_token:
   user: john
   type: Tokens::SessionUid
-  name: iyHvfTnYoF1f1jL9Vnb55hnXobf2Ld6HxIW-PXya6dw
+  name: gordzvlpnvwyjy53jklfcwcjxdjvvhwnfwenqql4tzotma5c7k7a
   key: <%= { :browser_ip => '18.241.1.121',
              :browser_ua => 'Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1'
            }.to_yaml.inspect %>
@@ -52,7 +52,7 @@ john_session_token:
 jane_session_token:
   user: jane
   type: Tokens::SessionUid
-  name: sNIfh6UavUSceL0TpubJ-DnZRuxPSTAddoHBb-twEIg
+  name: nnn4cz75nta35aqu34c3kozxokszfaxt46vvvpq6gxxfnh3fvbuq
   key: <%= { :browser_ip => '18.70.0.160',
              :browser_ua => 'Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1'
            }.to_yaml.inspect %>
@@ -72,4 +72,4 @@ jane_omniauth_developer:
 john_api_token:
   user: john
   type: Tokens::Api
-  name: WViSwbTAEMe0dzB_IHXyNG3UJ4VgDW3_6nKM_FLrc6w
+  name: k2cof7wjyi3672laumnajizwax73x262gfmoqoiau3cgap7z3pdq

data/lib/authpwn_rails/generators/templates/users.yml CHANGED Viewed

@@ -1,8 +1,8 @@
 jane:
-  exuid: 12345
+  exuid: jane000exuid
 john:
-  exuid: 56789
+  exuid: john000exuid
 bill:
-  exuid: 98765
+  exuid: bill000exuid

data/lib/authpwn_rails/user_model.rb CHANGED Viewed

@@ -1,6 +1,8 @@
 require 'securerandom'
 require 'active_model'
 require 'active_support'
+require 'base32'
 # :nodoc: namespace
@@ -109,7 +111,7 @@ module UserModel
   # :nodoc: sets exuid to a (hopefully) unique value before validations occur.
   def set_default_exuid
     self.exuid ||=
-        SecureRandom.random_bytes(8).unpack('Q').first & 0x7fffffffffffffff
+        Base32.encode(SecureRandom.random_bytes(16)).downcase.sub(/=*$/, '')
   end
 end  # namespace Authpwn::UserModel

data/test/cookie_controller_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Mock controller used for testing session handling.
 class CookieController < ApplicationController
@@ -190,7 +190,7 @@ class CookieControllerTest < ActionController::TestCase
     assert_equal nil, assigns(:current_user)
   end
-  test "set_session_current_user behaves when no user is logged off" do
+  test "set_session_current_user behavhttps://appear.in/pwnalles when no user is logged off" do
     assert_no_difference 'Credential.count' do
       put :update, exuid: ''
     end

data/test/credentials/api_token_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class ApiTokenTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::Api.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.user = users(:bill)
   end

data/test/credentials/email_credential_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class EmailCredentialTest < ActiveSupport::TestCase
   def setup

data/test/credentials/email_verification_token_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class EmailVerificationTokenTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::EmailVerification.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.key = 'jane@gmail.com'
     @credential.user = users(:jane)
   end

data/test/credentials/omni_auth_uid_credential_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class OmniAuthUidCredentialTest < ActiveSupport::TestCase
   def setup

data/test/credentials/one_time_token_credential_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class OneTimeTokenCredentialTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::OneTime.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.user = users(:bill)
   end
@@ -37,7 +37,7 @@ class OneTimeTokenCredentialTest < ActiveSupport::TestCase
   end
   test 'authenticate spends the token' do
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
     bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
     assert_difference 'Credential.count', -1, 'token spent' do
       assert_equal users(:jane), Tokens::Base.authenticate(jane)
@@ -48,7 +48,7 @@ class OneTimeTokenCredentialTest < ActiveSupport::TestCase
   end
   test 'authenticate calls User#auth_bounce_reason' do
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
     with_blocked_credential credentials(:jane_token), :reason do
       assert_no_difference 'Credential.count', 'no token spent' do

data/test/credentials/password_credential_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class PasswordCredentialTest < ActiveSupport::TestCase
   def setup
@@ -42,6 +42,20 @@ class PasswordCredentialTest < ActiveSupport::TestCase
     assert !@credential.valid?
   end
+  test 'generates salt' do
+    assert @credential.valid?
+    assert_match(/^[^|]{12,16}\|.+$/, @credential.key)
+  end
+  test 'generates random salts' do
+    salts = []
+    1000.times do
+      @credential.password = 'password'
+      salts << @credential.key.split('|').first
+    end
+    assert_equal salts.length, salts.uniq.length, 'Salts are not random enough'
+  end
   test 'old_password always returns nil' do
     assert_equal @credential.old_password, nil
     @credential.old_password = 'old password'

data/test/credentials/password_reset_token_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class PasswordVerificationTokenTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::PasswordReset.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.user = users(:john)
   end

data/test/credentials/session_uid_token_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class SessionUidTokenTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::SessionUid.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.browser_ip = '18.70.0.160'
     @credential.browser_ua =
         'Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20100101 Firefox/15.0.1'

data/test/credentials/token_crendential_test.rb CHANGED Viewed

@@ -1,9 +1,9 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class TokenCredentialTest < ActiveSupport::TestCase
   def setup
     @credential = Tokens::Base.new
-    @credential.code = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    @credential.code = 'fitobg6hzsk7odiiw3ca45ltghget4tlbbapxikgdsugfa36llwq'
     @credential.user = users(:bill)
   end
@@ -44,11 +44,21 @@ class TokenCredentialTest < ActiveSupport::TestCase
     assert_operator users(:jane).credentials, :include?, token
   end
+  test 'random_for randomness' do
+    codes = []
+    1000.times do
+      token = Tokens::Base.random_for users(:jane)
+      codes << token.code
+    end
+    assert_equal codes.length, codes.uniq.length,
+        'Token codes are not random enough'
+  end
   test 'with_code' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    john_email = 'bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE'
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
-    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    john_email = 'qid3ipai5be3bcilygdztwvtlpiyrfzxks2solmetndb4vzuvkca'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
+    bogus = '3bl3iypby25bqooia7hpskihlrzjkt7opz5vgdp7i3mkaopdjcza'
     assert_equal credentials(:john_token),
                  Tokens::Base.with_code(john).first
     assert_equal credentials(:jane_token),
@@ -76,10 +86,10 @@ class TokenCredentialTest < ActiveSupport::TestCase
   end
   test 'class authenticate' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    john_email = 'bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE'
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
-    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    john_email = 'qid3ipai5be3bcilygdztwvtlpiyrfzxks2solmetndb4vzuvkca'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
+    bogus = '3bl3iypby25bqooia7hpskihlrzjkt7opz5vgdp7i3mkaopdjcza'
     assert_equal users(:john), Tokens::Base.authenticate(john)
     assert_equal users(:john), Tokens::Base.authenticate(john_email)
@@ -88,9 +98,9 @@ class TokenCredentialTest < ActiveSupport::TestCase
   end
   test 'class authenticate with non-base class' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    john_email = 'bDSU4tzfjuob79e3R0ykLcOGTBBYvuBWWJ9V06tQrCE'
-    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    john_email = 'qid3ipai5be3bcilygdztwvtlpiyrfzxks2solmetndb4vzuvkca'
+    bogus = '3bl3iypby25bqooia7hpskihlrzjkt7opz5vgdp7i3mkaopdjcza'
     assert_equal :invalid, Tokens::EmailVerification.authenticate(john)
     assert_equal users(:john),
@@ -99,8 +109,8 @@ class TokenCredentialTest < ActiveSupport::TestCase
   end
   test 'class authenticate on expired tokens' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
     Tokens::Base.all.each do |token|
       token.updated_at = Time.now - 1.year
@@ -120,9 +130,9 @@ class TokenCredentialTest < ActiveSupport::TestCase
   end
   test 'class authenticate calls User#auth_bounce_reason' do
-    john = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
-    jane = '6TXe1vv7BgOw0BkJ1hzUKO6G08fLk4sVfJ3wPDZHS-c'
-    bogus = 'AyCMIixa5C7BBqU-XFI7l7IaUFJ4zQZPmcK6oNb3FLo'
+    john = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
+    jane = 'skygyoxxmnerxwe4zbi3p5yjtg7zpjl2peyfcwh5wnc37fyfc4xa'
+    bogus = '3bl3iypby25bqooia7hpskihlrzjkt7opz5vgdp7i3mkaopdjcza'
     with_blocked_credential credentials(:john_token), :reason do
       assert_equal :reason, Tokens::Base.authenticate(john)

data/test/helpers/rails.rb CHANGED Viewed

@@ -15,10 +15,5 @@ module Rails
     def application
       @_app ||= AuthpwnApp::Application.new
     end
-    # Used by fbgraph.
-    def root
-      File.expand_path '../..', File.dirname(__FILE__)
-    end
   end
 end

data/test/helpers/view_helpers.rb CHANGED Viewed

@@ -1,2 +1,2 @@
-require File.expand_path('../../../app/helpers/session_helper.rb', __FILE__)
+require_relative '../../app/helpers/session_helper.rb'
 ActionController::Base.helper SessionHelper

data/test/http_basic_controller_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Mock controller used for testing session handling.
 class HttpBasicController < ApplicationController

data/test/http_token_controller_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Mock controller used for testing session handling.
 class HttpTokenController < ApplicationController
@@ -57,9 +57,9 @@ class HttpTokenControllerTest < ActionController::TestCase
   end
   test "uses Tokens::Api.authenticate" do
-    Tokens::Api.expects(:authenticate).at_least_once.with('ap1-c0d3').
+    Tokens::Api.expects(:authenticate).at_least_once.with('ap1c0d3').
         returns @user
-    set_http_token_user @user, 'ap1-c0d3'
+    set_http_token_user @user, 'ap1c0d3'
     get :show
     assert_equal @user, assigns(:current_user)
     assert_equal nil, session_current_user,

data/test/initializer_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class InitializerTest < ActiveSupport::TestCase
   test 'password set correctly' do

data/test/routes_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 require 'authpwn_rails/generators/templates/session_controller.rb'
@@ -24,7 +24,7 @@ class RoutesTest < ActionController::TestCase
     assert_routing({path: '/session/reset_password', method: :post},
                    {controller: 'session', action: 'reset_password'})
-    code = 'YZ-Fo8HX6_NyU6lVZXYi6cMDLV5eAgt35UTF5l8bD6A'
+    code = 'ue5tqbx3u4z7jxxglickknirxroy7c3bgig4e2yccbmwqvf3r2vq'
     assert_routing({path: "/session/token/#{code}", method: :get},
         {controller: 'session', action: 'token', code: code})

data/test/session_controller_api_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class BareSessionController < ApplicationController
   include Authpwn::SessionController

data/test/session_controller_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Run the tests in the generator, to make sure they pass.
 require 'authpwn_rails/generators/templates/session_controller_test.rb'

data/test/session_mailer_api_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class SessionMailerApiTest < ActionMailer::TestCase
   setup do

data/test/session_mailer_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 # Run the tests in the generator, to make sure they pass.
 require 'authpwn_rails/generators/templates/session_mailer_test.rb'

data/test/session_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class SessionTest < ActiveSupport::TestCase
   def setup

data/test/test_extensions_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class TestExtensionsTest < ActionController::TestCase
   def setup

data/test/test_helper.rb CHANGED Viewed

@@ -20,7 +20,6 @@ require 'helpers/application_controller.rb'
 require 'helpers/action_mailer.rb'
 require 'helpers/autoload_path.rb'
 require 'helpers/db_setup.rb'
-require 'helpers/fbgraph.rb'
 require 'helpers/i18n.rb'
 require 'helpers/rails.rb'
 require 'helpers/routes.rb'

data/test/user_extensions/api_token_field_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class UserWithApiToken < User
   include Authpwn::UserExtensions::ApiTokenField

data/test/user_extensions/email_field_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class UserWithEmail < User
   include Authpwn::UserExtensions::EmailField

data/test/user_extensions/password_field_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../../test_helper', __FILE__)
+require_relative '../test_helper'
 class UserWithPassword < User
   include Authpwn::UserExtensions::PasswordField

data/test/user_test.rb CHANGED Viewed

@@ -1,4 +1,4 @@
-require File.expand_path('../test_helper', __FILE__)
+require_relative 'test_helper'
 class UserTest < ActiveSupport::TestCase
   def setup
@@ -37,7 +37,7 @@ class UserTest < ActiveSupport::TestCase
   end
   test 'to_param' do
-    assert_equal '56789', users(:john).to_param
+    assert_equal 'john000exuid', users(:john).to_param
   end
   test 'with_param' do

metadata CHANGED Viewed

@@ -1,15 +1,29 @@
 --- !ruby/object:Gem::Specification
 name: authpwn_rails
 version: !ruby/object:Gem::Version
-  version: 0.20.0
+  version: 0.21.0
 platform: ruby
 authors:
 - Victor Costan
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-02-02 00:00:00.000000000 Z
+date: 2016-03-27 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base32
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 0.3.2
 - !ruby/object:Gem::Dependency
   name: rails
   requirement: !ruby/object:Gem::Requirement
@@ -122,6 +136,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 0.18.4
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 11.1.1
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: 11.1.1
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -210,6 +238,7 @@ files:
 - app/models/tokens/session_uid.rb
 - authpwn_rails.gemspec
 - legacy/migrate_011_to_012.rb
+- legacy/migrate_020_to_021.rb
 - legacy/migrate_09_to_010.rb
 - lib/authpwn_rails.rb
 - lib/authpwn_rails/credential_model.rb
@@ -274,7 +303,6 @@ files:
 - test/helpers/application_controller.rb
 - test/helpers/autoload_path.rb
 - test/helpers/db_setup.rb
-- test/helpers/fbgraph.rb
 - test/helpers/i18n.rb
 - test/helpers/rails.rb
 - test/helpers/rails_undo.rb

data/test/helpers/fbgraph.rb DELETED Viewed

@@ -1,10 +0,0 @@
-# :nodoc: stub FBGraphRails.config because it depends on Rails.root
-module FBGraphRails
-  def self.config
-    {
-      'id' => '320998114580911',
-      'secret' => '7ded389d3c226e1f5d363b2df695be2f',
-      'scope' => []
-    }
-  end
-end