binarylogic-authlogic 2.1.0

data/lib/authlogic/controller_adapters/abstract_adapter.rb

@@ -0,0 +1,67 @@
+module Authlogic
+  module ControllerAdapters # :nodoc:
+    # Allows you to use Authlogic in any framework you want, not just rails. See the RailsAdapter or MerbAdapter
+    # for an example of how to adapt Authlogic to work with your framework.
+    class AbstractAdapter
+      attr_accessor :controller
+
+      def initialize(controller)
+        self.controller = controller
+      end
+      
+      def authenticate_with_http_basic(&block)
+        @auth = Rack::Auth::Basic::Request.new(controller.request.env)
+        if @auth.provided? and @auth.basic?
+          block.call(*@auth.credentials)
+        else
+          false
+        end
+      end
+      
+      def cookies
+        controller.cookies
+      end
+      
+      def cookie_domain
+        raise NotImplementedError.new("The cookie_domain method has not been implemented by the controller adapter")
+      end
+
+      def params
+        controller.params
+      end
+
+      def request
+        controller.request
+      end
+
+      def request_content_type
+        request.content_type
+      end
+
+      def session
+        controller.session
+      end
+      
+      def responds_to_single_access_allowed?
+        controller.respond_to?(:single_access_allowed?, true)
+      end
+      
+      def single_access_allowed?
+        controller.send(:single_access_allowed?)
+      end
+      
+      def responds_to_last_request_update_allowed?
+        controller.respond_to?(:last_request_update_allowed?, true)
+      end
+      
+      def last_request_update_allowed?
+        controller.send(:last_request_update_allowed?)
+      end
+      
+      private
+        def method_missing(id, *args, &block)
+          controller.send(id, *args, &block)
+        end
+    end
+  end
+end

data/lib/authlogic/controller_adapters/merb_adapter.rb

@@ -0,0 +1,30 @@
+module Authlogic
+  module ControllerAdapters
+    # Adapts authlogic to work with merb. The point is to close the gap between what authlogic expects and what the merb controller object
+    # provides. Similar to how ActiveRecord has an adapter for MySQL, PostgreSQL, SQLite, etc.
+    class MerbAdapter < AbstractAdapter
+      # Lets Authlogic know about the controller object via a before filter, AKA "activates" authlogic.
+      module MerbImplementation
+        def self.included(klass) # :nodoc:
+          klass.before :activate_authlogic
+        end
+        
+        def cookie_domain
+          Merb::Config[:session_cookie_domain]
+        end
+
+        private
+          def activate_authlogic
+            Authlogic::Session::Base.controller = MerbAdapter.new(self)
+          end
+      end
+    end
+  end
+end
+ 
+# make sure we're running inside Merb
+if defined?(Merb::Plugins)
+  Merb::BootLoader.before_app_loads do
+    Merb::Controller.send(:include, Authlogic::ControllerAdapters::MerbAdapter::MerbImplementation)
+  end
+end

data/lib/authlogic/controller_adapters/rails_adapter.rb

@@ -0,0 +1,38 @@
+module Authlogic
+  module ControllerAdapters
+    # Adapts authlogic to work with rails. The point is to close the gap between what authlogic expects and what the rails controller object
+    # provides. Similar to how ActiveRecord has an adapter for MySQL, PostgreSQL, SQLite, etc.
+    class RailsAdapter < AbstractAdapter
+      def authenticate_with_http_basic(&block)
+        controller.authenticate_with_http_basic(&block)
+      end
+      
+      def cookies
+        controller.send(:cookies)
+      end
+      
+      def cookie_domain
+        @cookie_domain_key ||= (Rails::VERSION::MAJOR >= 2 && Rails::VERSION::MINOR >= 3) ? :domain : :session_domain
+        ActionController::Base.session_options[@cookie_domain_key]
+      end
+      
+      def request_content_type
+        request.format.to_s
+      end
+      
+      # Lets Authlogic know about the controller object via a before filter, AKA "activates" authlogic.
+      module RailsImplementation
+        def self.included(klass) # :nodoc:
+          klass.prepend_before_filter :activate_authlogic
+        end
+
+        private
+          def activate_authlogic
+            Authlogic::Session::Base.controller = RailsAdapter.new(self)
+          end
+      end
+    end
+  end
+end
+
+ActionController::Base.send(:include, Authlogic::ControllerAdapters::RailsAdapter::RailsImplementation)

data/lib/authlogic/crypto_providers/aes256.rb

@@ -0,0 +1,43 @@
+require "openssl"
+
+module Authlogic
+  module CryptoProviders
+    # This encryption method is reversible if you have the supplied key. So in order to use this encryption method you must supply it with a key first.
+    # In an initializer, or before your application initializes, you should do the following:
+    #
+    #   Authlogic::CryptoProviders::AES256.key = "my really long and unique key, preferrably a bunch of random characters"
+    #
+    # My final comment is that this is a strong encryption method, but its main weakness is that its reversible. If you do not need to reverse the hash
+    # then you should consider Sha512 or BCrypt instead.
+    #
+    # Keep your key in a safe place, some even say the key should be stored on a separate server.
+    # This won't hurt performance because the only time it will try and access the key on the separate server is during initialization, which only
+    # happens once. The reasoning behind this is if someone does compromise your server they won't have the key also. Basically, you don't want to
+    # store the key with the lock.
+    class AES256
+      class << self
+        attr_writer :key
+    
+        def encrypt(*tokens)
+          aes.encrypt
+          aes.key = @key
+          [aes.update(tokens.join) + aes.final].pack("m").chomp
+        end
+    
+        def matches?(crypted, *tokens)
+          aes.decrypt
+          aes.key = @key
+          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
+        rescue OpenSSL::CipherError
+          false
+        end
+    
+        private
+          def aes
+            raise ArgumentError.new("You must provide a key like #{name}.key = my_key before using the #{name}") if @key.blank?
+            @aes ||= OpenSSL::Cipher::Cipher.new("AES-256-ECB")
+          end
+      end
+    end
+  end
+end

data/lib/authlogic/crypto_providers/bcrypt.rb

@@ -0,0 +1,89 @@
+begin
+  require "bcrypt"
+rescue LoadError
+end
+
+module Authlogic
+  module CryptoProviders
+    # For most apps Sha512 is plenty secure, but if you are building an app that stores nuclear launch codes you might want to consier BCrypt. This is an extremely
+    # secure hashing algorithm, mainly because it is slow. A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a
+    # password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this, generating a password takes exponentially longer than any
+    # of the Sha algorithms. I did some benchmarking to save you some time with your decision:
+    #
+    #   require "bcrypt"
+    #   require "digest"
+    #   require "benchmark"
+    #
+    #   Benchmark.bm(18) do |x|
+    #     x.report("BCrypt (cost = 10:") { 100.times { BCrypt::Password.create("mypass", :cost => 10) } }
+    #     x.report("BCrypt (cost = 2:") { 100.times { BCrypt::Password.create("mypass", :cost => 2) } }
+    #     x.report("Sha512:") { 100.times { Digest::SHA512.hexdigest("mypass") } }
+    #     x.report("Sha1:") { 100.times { Digest::SHA1.hexdigest("mypass") } }
+    #   end
+    #
+    #                           user     system      total        real
+    #   BCrypt (cost = 10): 10.780000   0.060000  10.840000 ( 11.100289)
+    #   BCrypt (cost = 2):  0.180000   0.000000   0.180000 (  0.181914)
+    #   Sha512:             0.000000   0.000000   0.000000 (  0.000829)
+    #   Sha1:               0.000000   0.000000   0.000000 (  0.000395)
+    #
+    # You can play around with the cost to get that perfect balance between performance and security.
+    #
+    # Decided BCrypt is for you? Just insall the bcrypt gem:
+    #
+    #   gem install bcrypt-ruby
+    #
+    # Tell acts_as_authentic to use it:
+    #
+    #   acts_as_authentic do |c|
+    #     c.crypto_provider = Authlogic::CryptoProviders::BCrypt
+    #   end
+    #
+    # You are good to go!
+    class BCrypt
+      class << self
+        # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
+        # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
+        def cost
+          @cost ||= 10
+        end
+        attr_writer :cost
+        
+        # Creates a BCrypt hash for the password passed.
+        def encrypt(*tokens)
+          ::BCrypt::Password.create(join_tokens(tokens), :cost => cost)
+        end
+        
+        # Does the hash match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(hash, *tokens)
+          hash = new_from_hash(hash)
+          return false if hash.blank?
+          hash == join_tokens(tokens)
+        end
+        
+        # This method is used as a flag to tell Authlogic to "resave" the password upon a successful login, using the new cost
+        def cost_matches?(hash)
+          hash = new_from_hash(hash)
+          if hash.blank?
+            false
+          else
+            hash.cost == cost
+          end
+        end
+        
+        private
+          def join_tokens(tokens)
+            tokens.flatten.join
+          end
+          
+          def new_from_hash(hash)
+            begin
+              ::BCrypt::Password.new(hash)
+            rescue ::BCrypt::Errors::InvalidHash
+              return nil
+            end
+          end
+      end
+    end
+  end
+end

data/lib/authlogic/crypto_providers/md5.rb

@@ -0,0 +1,34 @@
+require "digest/md5"
+ 
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from md5 based systems. 
+    # I highly discourage using this crypto provider as it superbly inferior 
+    # to your other options.
+    #
+    # Please use any other provider offered by Authlogic.
+    class MD5
+      class << self
+        attr_accessor :join_token
+        
+        # The number of times to loop through the encryption.
+        def stretches
+          @stretches ||= 1
+        end
+        attr_writer :stretches
+        
+        # Turns your raw password into a MD5 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::MD5.hexdigest(digest) }
+          digest
+        end
+        
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/authlogic/crypto_providers/sha1.rb

@@ -0,0 +1,35 @@
+require "digest/sha1"
+
+module Authlogic
+  module CryptoProviders
+    # This class was made for the users transitioning from restful_authentication. I highly discourage using this
+    # crypto provider as it inferior to your other options. Please use any other provider offered by Authlogic.
+    class Sha1
+      class << self
+        def join_token
+          @join_token ||= "--"
+        end
+        attr_writer :join_token
+        
+        # The number of times to loop through the encryption. This is ten because that is what restful_authentication defaults to.
+        def stretches
+          @stretches ||= 10
+        end
+        attr_writer :stretches
+        
+        # Turns your raw password into a Sha1 hash.
+        def encrypt(*tokens)
+          tokens = tokens.flatten
+          digest = tokens.shift
+          stretches.times { digest = Digest::SHA1.hexdigest([digest, *tokens].join(join_token)) }
+          digest
+        end
+        
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/authlogic/crypto_providers/sha512.rb

@@ -0,0 +1,50 @@
+require "digest/sha2"
+
+module Authlogic
+  # The acts_as_authentic method has a crypto_provider option. This allows you to use any type of encryption you like.
+  # Just create a class with a class level encrypt and matches? method. See example below.
+  #
+  # === Example
+  #
+  #   class MyAwesomeEncryptionMethod
+  #     def self.encrypt(*tokens)
+  #       # the tokens passed will be an array of objects, what type of object is irrelevant,
+  #       # just do what you need to do with them and return a single encrypted string.
+  #       # for example, you will most likely join all of the objects into a single string and then encrypt that string
+  #     end
+  #
+  #     def self.matches?(crypted, *tokens)
+  #       # return true if the crypted string matches the tokens.
+  #       # depending on your algorithm you might decrypt the string then compare it to the token, or you might
+  #       # encrypt the tokens and make sure it matches the crypted string, its up to you
+  #     end
+  #   end
+  module CryptoProviders
+    # = Sha512
+    #
+    # Uses the Sha512 hash algorithm to encrypt passwords.
+    class Sha512
+      class << self
+        attr_accessor :join_token
+        
+        # The number of times to loop through the encryption. This is ten because that is what restful_authentication defaults to.
+        def stretches
+          @stretches ||= 20
+        end
+        attr_writer :stretches
+        
+        # Turns your raw password into a Sha512 hash.
+        def encrypt(*tokens)
+          digest = tokens.flatten.join(join_token)
+          stretches.times { digest = Digest::SHA512.hexdigest(digest) }
+          digest
+        end
+        
+        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+        def matches?(crypted, *tokens)
+          encrypt(*tokens) == crypted
+        end
+      end
+    end
+  end
+end

data/lib/authlogic/i18n.rb

@@ -0,0 +1,63 @@
+module Authlogic
+  # This class allows any message in Authlogic to use internationalization. In earlier versions of Authlogic each message was translated via configuration.
+  # This cluttered up the configuration and cluttered up Authlogic. So all translation has been extracted out into this class. Now all messages pass through
+  # this class, making it much easier to implement in I18n library / plugin you want. Use this as a layer that sits between Authlogic and whatever I18n
+  # library you want to use.
+  #
+  # By default this uses the rails I18n library, if it exists. If it doesnt exist it just returns the default english message. The Authlogic I18n class
+  # works EXACTLY like the rails I18n class. This is because the arguments are delegated to this class.
+  #
+  # Here is how all messages are translated internally with Authlogic:
+  #
+  #   Authlogic::I18n.t('error_messages.password_invalid', :default => "is invalid")
+  #
+  # If you use a different I18n library or plugin just redefine the t method in the Authlogic::I18n class to do whatever you want with those options. For example:
+  #
+  #   # config/initializers/authlogic.rb
+  #   module MyAuthlogicI18nAdapter
+  #     def t(key, options = {})
+  #       # you will have key which will be something like: "error_messages.password_invalid"
+  #       # you will also have options[:default], which will be the default english version of the message
+  #       # do whatever you want here with the arguments passed to you.
+  #     end
+  #   end
+  #   
+  #   Authlogic::I18n.extend MyAuthlogicI18nAdapter
+  #
+  # That it's! Here is a complete list of the keys that are passed. Just define these however you wish:
+  #
+  #   authlogic:
+  #     error_messages:
+  #       login_blank: can not be blank
+  #       login_not_found: is not valid
+  #       login_invalid: should use only letters, numbers, spaces, and .-_@ please.
+  #       consecutive_failed_logins_limit_exceeded: Consecutive failed logins limit exceeded, account is disabled.
+  #       email_invalid: should look like an email address.
+  #       password_blank: can not be blank
+  #       password_invalid: is not valid
+  #       not_active: Your account is not active
+  #       not_confirmed: Your account is not confirmed
+  #       not_approved: Your account is not approved
+  #       no_authentication_details: You did not provide any details for authentication.
+  #     models:
+  #       user_session: UserSession (or whatever name you are using)
+  #     attributes:
+  #       user_session: (or whatever name you are using)
+  #         login: login
+  #         email: email
+  #         password: password
+  #         remember_me: remember me
+  class I18n
+    class << self
+      # All message translation is passed to this method. The first argument is the key for the message. The second is options, see the rails I18n library for a list of options used.
+      def t(key, options = {})
+        if defined?(::I18n)
+          ::I18n.t(key, options.merge(:scope => :authlogic))
+        else
+          options[:default]
+        end
+      end
+      alias_method :translate, :t
+    end
+  end
+end