auto_hash 0.1.0

data/.document

@@ -0,0 +1,5 @@
+README.rdoc
+lib/**/*.rb
+bin/*
+features/**/*.feature
+LICENSE

data/.gitignore

@@ -0,0 +1,22 @@
+## MAC OS
+.DS_Store
+
+## TEXTMATE
+*.tmproj
+tmtags
+
+## EMACS
+*~
+\#*
+.\#*
+
+## VIM
+*.swp
+
+## PROJECT::GENERAL
+coverage
+rdoc
+pkg
+
+## PROJECT::SPECIFIC
+README.html

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2009 Kevin Swope
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,54 @@
+= auto_hash
+
+A Ruby on Rails plugin to automate hashing an activerecord field and
+saving as a salt and digest in a single field.
+
+Works with both rails 2x and 3x
+
+== Synopsis
+
+   # In Model
+   class User < ActiveRecord::Base
+     auto_hash :password
+   end
+
+   # Elsewhere
+   user = User.new(:username => "kevin", :password => "asdf")
+   user.password #=> "6cc4ce889e770343f4b0d3708851f6624b5c1dda4bc4b6dd23ace50328fcd3e0-b99d218de031fad5df71"
+   user.password_hash_match?("asdf") # => true
+
+   # works with updating fields also
+   user = User.find_by_username("kevin")
+   user.password = "better_password"
+   user.password_hash_match?("better_password") # => true
+
+== Installing
+
+   sudo gem install auto_hash
+
+For rails 2x, in environment.rb
+    Rails::Initializer.run do |config| do
+      config.gem "auto_hash"
+    end
+
+For rails 3x, in Gemfile
+   gem "auto_hash"
+
+
+== Details
+
+The hashing is pretty simple, you'll find something like this in the source:
+
+    salt = ActiveSupport::SecureRandom.hex(10)
+    hash = Digest::SHA2.new.update(value + salt).to_s
+
+The value stored in the database field is a hash appended with its salt, as
+"hash-salt"
+
+In case you weren't sure, a salt is not necessarily a secret - its
+simply a way to defeat dictionary attacks by adding huge variety to
+the hashed value.
+
+== Copyright
+
+Copyright (c) 2010 Kevin Swope. See LICENSE for details.

data/Rakefile

@@ -0,0 +1,41 @@
+require 'rubygems'
+require 'rake'
+require 'rake/testtask'
+
+begin
+  require 'jeweler'
+  Jeweler::Tasks.new do |gem|
+    summary = %Q{Ruby on Rails plugin to automate hashing an activerecord field and saving as a salt and digest in a single field.}
+    gem.name = "auto_hash"
+    gem.summary = summary
+    gem.description = summary
+    gem.email = "gems-kevdev@snkmail.com"
+    gem.homepage = "http://github.com/kswope/auto_hash"
+    gem.authors = ["Kevin Swope"]
+    # gem is a Gem::Specification... see http://www.rubygems.org/read/chapter/20 for additional settings
+  end
+  Jeweler::GemcutterTasks.new
+rescue LoadError
+  puts "Jeweler (or a dependency) not available. Install it with: gem install jeweler"
+end
+
+desc "build README.html from README.doc (for previewing in browser)"
+task :readme do
+  system "rdoc README.rdoc --one-file > README.html"
+end
+
+task :default => :test
+task :test => [:test_rails2x, :test_rails3x]
+
+task :test_rails2x do |t|
+  chdir "test/rails2x_root" do
+    system "rake"
+  end
+end
+
+task :test_rails3x do |t|
+  chdir "test/rails3x_root" do
+    system "rake"
+  end
+end
+

data/VERSION

@@ -0,0 +1 @@
+0.1.0

data/auto_hash.gemspec

@@ -0,0 +1,160 @@
+# Generated by jeweler
+# DO NOT EDIT THIS FILE DIRECTLY
+# Instead, edit Jeweler::Tasks in Rakefile, and run the gemspec command
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = %q{auto_hash}
+  s.version = "0.1.0"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Kevin Swope"]
+  s.date = %q{2010-08-05}
+  s.description = %q{Ruby on Rails plugin to automate hashing an activerecord field and saving as a salt and digest in a single field.}
+  s.email = %q{gems-kevdev@snkmail.com}
+  s.extra_rdoc_files = [
+    "LICENSE",
+     "README.html",
+     "README.rdoc"
+  ]
+  s.files = [
+    ".document",
+     ".gitignore",
+     "LICENSE",
+     "README.rdoc",
+     "Rakefile",
+     "VERSION",
+     "auto_hash.gemspec",
+     "created.rid",
+     "init.rb",
+     "lib/auto_hash.rb",
+     "log/test.log",
+     "test/common/user_test.rb",
+     "test/rails2x_root/Rakefile",
+     "test/rails2x_root/app/controllers/application_controller.rb",
+     "test/rails2x_root/app/helpers/application_helper.rb",
+     "test/rails2x_root/app/models/user.rb",
+     "test/rails2x_root/config/boot.rb",
+     "test/rails2x_root/config/database.yml",
+     "test/rails2x_root/config/environment.rb",
+     "test/rails2x_root/config/environments/development.rb",
+     "test/rails2x_root/config/environments/production.rb",
+     "test/rails2x_root/config/environments/test.rb",
+     "test/rails2x_root/config/initializers/backtrace_silencers.rb",
+     "test/rails2x_root/config/initializers/cookie_verification_secret.rb",
+     "test/rails2x_root/config/initializers/inflections.rb",
+     "test/rails2x_root/config/initializers/mime_types.rb",
+     "test/rails2x_root/config/initializers/new_rails_defaults.rb",
+     "test/rails2x_root/config/initializers/session_store.rb",
+     "test/rails2x_root/config/locales/en.yml",
+     "test/rails2x_root/config/routes.rb",
+     "test/rails2x_root/db/development.sqlite3",
+     "test/rails2x_root/db/migrate/20100803040436_create_users.rb",
+     "test/rails2x_root/db/schema.rb",
+     "test/rails2x_root/db/seeds.rb",
+     "test/rails2x_root/db/test.sqlite3",
+     "test/rails2x_root/log/development.log",
+     "test/rails2x_root/log/production.log",
+     "test/rails2x_root/log/server.log",
+     "test/rails2x_root/log/test.log",
+     "test/rails2x_root/script/about",
+     "test/rails2x_root/script/console",
+     "test/rails2x_root/script/dbconsole",
+     "test/rails2x_root/script/destroy",
+     "test/rails2x_root/script/generate",
+     "test/rails2x_root/script/performance/benchmarker",
+     "test/rails2x_root/script/performance/profiler",
+     "test/rails2x_root/script/plugin",
+     "test/rails2x_root/script/runner",
+     "test/rails2x_root/script/server",
+     "test/rails2x_root/test/test_helper.rb",
+     "test/rails2x_root/test/unit/user_test.rb",
+     "test/rails3x_root/.gitignore",
+     "test/rails3x_root/Gemfile",
+     "test/rails3x_root/Gemfile.lock",
+     "test/rails3x_root/Rakefile",
+     "test/rails3x_root/app/controllers/application_controller.rb",
+     "test/rails3x_root/app/helpers/application_helper.rb",
+     "test/rails3x_root/app/models/user.rb",
+     "test/rails3x_root/app/views/layouts/application.html.erb",
+     "test/rails3x_root/config/application.rb",
+     "test/rails3x_root/config/boot.rb",
+     "test/rails3x_root/config/database.yml",
+     "test/rails3x_root/config/environment.rb",
+     "test/rails3x_root/config/environments/development.rb",
+     "test/rails3x_root/config/environments/production.rb",
+     "test/rails3x_root/config/environments/test.rb",
+     "test/rails3x_root/config/initializers/backtrace_silencers.rb",
+     "test/rails3x_root/config/initializers/inflections.rb",
+     "test/rails3x_root/config/initializers/mime_types.rb",
+     "test/rails3x_root/config/initializers/secret_token.rb",
+     "test/rails3x_root/config/initializers/session_store.rb",
+     "test/rails3x_root/config/locales/en.yml",
+     "test/rails3x_root/config/routes.rb",
+     "test/rails3x_root/db/migrate/20100804020911_create_users.rb",
+     "test/rails3x_root/db/schema.rb",
+     "test/rails3x_root/db/seeds.rb",
+     "test/rails3x_root/script/rails",
+     "test/rails3x_root/test/test_helper.rb",
+     "test/rails3x_root/test/unit/user_test.rb"
+  ]
+  s.homepage = %q{http://github.com/kswope/auto_hash}
+  s.rdoc_options = ["--charset=UTF-8"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = %q{1.3.7}
+  s.summary = %q{Ruby on Rails plugin to automate hashing an activerecord field and saving as a salt and digest in a single field.}
+  s.test_files = [
+    "test/common/user_test.rb",
+     "test/rails2x_root/app/controllers/application_controller.rb",
+     "test/rails2x_root/app/helpers/application_helper.rb",
+     "test/rails2x_root/app/models/user.rb",
+     "test/rails2x_root/config/boot.rb",
+     "test/rails2x_root/config/environment.rb",
+     "test/rails2x_root/config/environments/development.rb",
+     "test/rails2x_root/config/environments/production.rb",
+     "test/rails2x_root/config/environments/test.rb",
+     "test/rails2x_root/config/initializers/backtrace_silencers.rb",
+     "test/rails2x_root/config/initializers/cookie_verification_secret.rb",
+     "test/rails2x_root/config/initializers/inflections.rb",
+     "test/rails2x_root/config/initializers/mime_types.rb",
+     "test/rails2x_root/config/initializers/new_rails_defaults.rb",
+     "test/rails2x_root/config/initializers/session_store.rb",
+     "test/rails2x_root/config/routes.rb",
+     "test/rails2x_root/db/migrate/20100803040436_create_users.rb",
+     "test/rails2x_root/db/schema.rb",
+     "test/rails2x_root/db/seeds.rb",
+     "test/rails2x_root/test/test_helper.rb",
+     "test/rails2x_root/test/unit/user_test.rb",
+     "test/rails3x_root/app/controllers/application_controller.rb",
+     "test/rails3x_root/app/helpers/application_helper.rb",
+     "test/rails3x_root/app/models/user.rb",
+     "test/rails3x_root/config/application.rb",
+     "test/rails3x_root/config/boot.rb",
+     "test/rails3x_root/config/environment.rb",
+     "test/rails3x_root/config/environments/development.rb",
+     "test/rails3x_root/config/environments/production.rb",
+     "test/rails3x_root/config/environments/test.rb",
+     "test/rails3x_root/config/initializers/backtrace_silencers.rb",
+     "test/rails3x_root/config/initializers/inflections.rb",
+     "test/rails3x_root/config/initializers/mime_types.rb",
+     "test/rails3x_root/config/initializers/secret_token.rb",
+     "test/rails3x_root/config/initializers/session_store.rb",
+     "test/rails3x_root/config/routes.rb",
+     "test/rails3x_root/db/migrate/20100804020911_create_users.rb",
+     "test/rails3x_root/db/schema.rb",
+     "test/rails3x_root/db/seeds.rb",
+     "test/rails3x_root/test/test_helper.rb",
+     "test/rails3x_root/test/unit/user_test.rb"
+  ]
+
+  if s.respond_to? :specification_version then
+    current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
+    s.specification_version = 3
+
+    if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
+    else
+    end
+  else
+  end
+end
+

data/created.rid

@@ -0,0 +1 @@
+Thu, 05 Aug 2010 03:08:52 -0400

data/init.rb

@@ -0,0 +1,4 @@
+
+# NOTE: this file is for rails 2x only
+
+require "auto_hash"

data/lib/auto_hash.rb

@@ -0,0 +1,85 @@
+
+module AutoHash
+
+  def self.included(base)
+    base.send :extend, ClassMethods
+  end
+
+  module ClassMethods
+
+    # This is the macro style class method called from the AR model
+    def auto_hash(*args)
+
+      # Create a setter and "comparer" for each arg
+      args.each do |field_name|
+
+        # Dynamically define a new setter
+        define_method "#{field_name}=" do |value|
+
+          value = AutoHashBuilder.auto_hash_create(value)
+
+          # write_attribute() is the documented way to write to a AR
+          # field after you've overridden the setter,
+          # http://ar.rubyonrails.org/classes/ActiveRecord/Base.html
+          write_attribute(field_name, value)
+
+        end
+
+        # Dynamically define the "comparer"
+        define_method "#{field_name}_hash_match?".to_sym do |match|
+          existing = send(field_name)
+          value = AutoHashBuilder.auto_hash_compare(existing, match.to_s)
+        end
+
+      end
+
+    end
+
+    # This nested class is here only to avoid exposing the autohash
+    # inner api to the AR model. It has no other excuse to be a class.
+    class AutoHashBuilder
+
+      class << self
+
+        def auto_hash_create(value)
+          salt = ActiveSupport::SecureRandom.hex(10)
+          hash = create_hash(value, salt)
+          "#{hash}-#{salt}"
+        end
+
+        def auto_hash_compare(hash, value)
+          salt = extract_salt_part(hash)
+          hash_old = extract_hash_part(hash)
+          hash_new = create_hash(value, salt) # try to recreate same hash
+          hash_new == hash_old
+        end
+
+        private #~*~*~*~*~*~*~*~*~*~*
+
+        def create_hash(value, salt)
+          Digest::SHA2.new.update(value + salt).to_s
+        end
+
+        def extract_hash_part(hash)
+          hash.split(/-/)[0]
+        end
+
+        def extract_salt_part(hash)
+          hash.split(/-/)[1]
+        end
+
+      end # << class << self
+
+    end
+
+    #send :include, InstanceMethods
+
+  end
+
+  # module InstanceMethods
+  # end
+
+end
+
+
+ActiveRecord::Base.send :include, AutoHash

data/test/common/user_test.rb

@@ -0,0 +1,59 @@
+require 'test_helper'
+
+# Note: all these test depend on "autotest :password" being in the User model
+
+class UserTest < ActiveSupport::TestCase
+
+  test "simple instantiation" do
+
+    @user = User.new(:username => "kevin", :password => "asdf")
+    assert @user
+
+  end
+
+  # We can't exactly test if the new password is a correctly hashed
+  # password until running the comparer method, but we can check if
+  # its nil or blank, or its not still the clear text password - which
+  # would be quite a bug.
+  test "password hashed" do
+
+    original_password = "asdf"
+    @user = User.new(:username => "kevin", :password => original_password)
+
+    assert_equal "kevin", @user.username # make sure other fields untouched
+    assert_not_equal nil, @user.password
+    assert_not_equal "", @user.password
+    assert_not_equal original_password, @user.password
+
+  end
+
+  # Finally test the comparer method
+  test "matching" do
+
+    original_password = "asdf"
+    @user = User.new(:username => "kevin", :password => original_password)
+
+    assert @user.password_hash_match?(original_password)
+    assert ! @user.password_hash_match?("banana")
+    assert ! @user.password_hash_match?("")
+    assert ! @user.password_hash_match?(nil)
+
+  end
+
+  # Test whole circuit, including writing and reading from database.
+  test "write, find, match" do
+
+    original_password = "asdf"
+    @user = User.new(:username => "kevin", :password => original_password)
+    @user.save
+
+    user = User.find_by_username("kevin")
+
+    assert user.password_hash_match?(original_password)
+    assert ! user.password_hash_match?("banana")
+    assert ! user.password_hash_match?("")
+    assert ! user.password_hash_match?(nil)
+
+  end
+
+end