casino 1.3.2 → 2.0.0

data/.gitignore

@@ -19,6 +19,9 @@
 
 /pkg
 
+# http://yehudakatz.com/2010/12/16/clarifying-the-roles-of-the-gemspec-and-gemfile/
+/Gemfile.lock
+
 # Dummy application crap
 /spec/dummy/log/*.log
 /spec/dummy/tmp

data/.travis.yml

@@ -1,6 +1,6 @@
 language: ruby
 before_script:
-  - "cd spec/dummy && RAILS_ENV=test rake casino_core:db:schema:load && cd ../.."
+  - "bundle exec rake"
 rvm:
   - 1.9.3
   - 2.0.0

data/README.md

@@ -1,16 +1,9 @@
-# CASino [![Build Status](https://secure.travis-ci.org/rbCAS/CASino.png?branch=master)](https://travis-ci.org/rbCAS/CASino)
+# CASino [![Build Status](https://secure.travis-ci.org/rbCAS/CASino.png?branch=master)](https://travis-ci.org/rbCAS/CASino) [![Coverage Status](https://coveralls.io/repos/rbCAS/CASino/badge.png?branch=master)](https://coveralls.io/r/rbCAS/CASino?branch=master)
 
 CASino Rails Engine (used in CASinoApp).
 
 It currently supports [CAS 1.0 and CAS 2.0](http://www.jasig.org/cas/protocol) as well as [CAS 3.1 Single Sign Out](https://wiki.jasig.org/display/CASUM/Single+Sign+Out) and [CAS RESTful API](https://wiki.jasig.org/display/CASUM/RESTful+API).
 
-CASino is separated into a web app and core components:
-
-* CASino is the web application (using the Rails framework)
-* CASinoCore contains all the CAS server logic
-
-This simplifies the creation of a CAS server implementation for other developers.
-
 ## Setup
 
 Please check our [documentation](http://casino.rbcas.com/) for setup and configuration instructions.

data/Rakefile

@@ -4,8 +4,6 @@ require 'rake'
 require 'bundler/gem_tasks'
 require 'rspec/core/rake_task'
 
-require 'casino_core'
-
 task :default => :spec
 
 desc 'Run all specs'

data/app/assets/javascripts/casino/application.js

@@ -0,0 +1 @@
+// Place all the behaviors and hooks related to the matching controller here.

data/app/assets/javascripts/casino/index.js

@@ -10,6 +10,4 @@
 // WARNING: THE FIRST BLANK LINE MARKS THE END OF WHAT'S TO BE PROCESSED, ANY BLANK LINE SHOULD
 // GO AFTER THE REQUIRES BELOW.
 //
-//= require jquery
-//= require jquery_ujs
 //= require_tree .

data/app/assets/javascripts/casino/sessions.js

@@ -0,0 +1,32 @@
+(function(win, doc) {
+  var url = '/login',
+      cookie_regex = /(^|;)\s*tgt=/,
+      ready_bound = false;
+
+  function checkCookieExists() {
+    var serviceEl = doc.getElementById('service'),
+        service = serviceEl ? serviceEl.getAttribute('value') : null;
+
+    if(cookie_regex.test(document.cookie)) {
+      url = '/login';
+      if(service) {
+        url += '?service=' + encodeURIComponent(service);
+      }
+      window.location = url;
+    } else {
+      setTimeout(checkCookieExists, 1000);
+    }
+  }
+
+  // Auto-login when logged-in in other browser window (9887c4e)
+  document.addEventListener('DOMContentLoaded', function() {
+    if(ready_bound) {
+      return;
+    }
+    ready_bound = true;
+    if(doc.getElementById('login-form')) {
+      checkCookieExists();
+    }
+  });
+
+})(this, document);

data/app/authenticators/casino/static_authenticator.rb

@@ -0,0 +1,23 @@
+require 'casino/authenticator'
+
+# The static authenticator is just a simple example.
+# Never ever us this authenticator in a productive environment!
+class CASino::StaticAuthenticator < CASino::Authenticator
+
+  # @param [Hash] options
+  def initialize(options)
+    @users = options[:users] || {}
+  end
+
+  def validate(username, password)
+    username = :"#{username}"
+    if @users.include?(username) && @users[username][:password] == password
+      {
+        username: "#{username}",
+        extra_attributes: @users[username].except(:password)
+      }
+    else
+      false
+    end
+  end
+end

data/app/builders/casino/ticket_validation_response_builder.rb

@@ -0,0 +1,84 @@
+require 'builder'
+
+class CASino::TicketValidationResponseBuilder
+  def initialize(success, options)
+    @success = success
+    @options = options
+  end
+
+  def build
+    xml = Builder::XmlMarkup.new(indent: 2)
+    xml.cas :serviceResponse, 'xmlns:cas' => 'http://www.yale.edu/tp/cas' do |service_response|
+      if @success
+        ticket = @options[:ticket]
+        if ticket.is_a?(CASino::ProxyTicket)
+          proxies = []
+          service_ticket = ticket
+          while service_ticket.is_a?(CASino::ProxyTicket)
+            proxy_granting_ticket = ticket.proxy_granting_ticket
+            proxies << proxy_granting_ticket.pgt_url
+            service_ticket = proxy_granting_ticket.granter
+          end
+          ticket_granting_ticket = service_ticket.ticket_granting_ticket
+        else
+          service_ticket = ticket
+          ticket_granting_ticket = ticket.ticket_granting_ticket
+        end
+
+        build_success_xml(service_response, ticket, service_ticket, ticket_granting_ticket, proxies)
+      else
+        build_failure_xml(service_response)
+      end
+    end
+    xml.target!
+  end
+
+  private
+  def serialize_extra_attribute(builder, key, value)
+    if value.kind_of?(String) || value.kind_of?(Numeric) || value.kind_of?(Symbol)
+      builder.cas key, "#{value}"
+    else
+      builder.cas key do |container|
+        container.cdata! value.to_yaml
+      end
+    end
+  end
+
+  def build_success_xml(service_response, ticket, service_ticket, ticket_granting_ticket, proxies)
+    user = ticket_granting_ticket.user
+    service_response.cas :authenticationSuccess do |authentication_success|
+      authentication_success.cas :user, user.username
+      unless user.extra_attributes.blank?
+        authentication_success.cas :attributes do |attributes|
+          attributes.cas :authenticationDate, ticket_granting_ticket.created_at.iso8601
+          attributes.cas :longTermAuthenticationRequestTokenUsed, ticket_granting_ticket.long_term?
+          attributes.cas :isFromNewLogin, service_ticket.issued_from_credentials?
+          # This would probably be the correct way, but current clients do not support this:
+          # attributes.cas :userAttributes do |user_attributes|
+          #   user.extra_attributes.each do |key, value|
+          #     serialize_extra_attribute(user_attributes, key, value)
+          #   end
+          # end
+          user.extra_attributes.each do |key, value|
+            serialize_extra_attribute(attributes, key, value)
+          end
+        end
+      end
+      if @options[:proxy_granting_ticket]
+        proxy_granting_ticket = @options[:proxy_granting_ticket]
+        authentication_success.cas :proxyGrantingTicket, proxy_granting_ticket.iou
+      end
+      if ticket.is_a?(CASino::ProxyTicket)
+        authentication_success.cas :proxies do |proxies_container|
+          proxies.each do |proxy|
+            proxies_container.cas :proxy, proxy
+          end
+        end
+      end
+    end
+  end
+
+  def build_failure_xml(service_response)
+    service_response.cas :authenticationFailure, @options[:error_message], code: @options[:error_code]
+  end
+end

data/app/controllers/casino/api/v1/tickets_controller.rb

@@ -1,18 +1,18 @@
-class CASino::API::V1::TicketsController < CASino::ApplicationController
+class CASino::Api::V1::TicketsController < CASino::ApplicationController
 
   # POST /cas/v1/tickets
   def create
-    CASinoCore::Processor::API::LoginCredentialAcceptor.new(self).process(params, request.user_agent)
+    CASino::API::LoginCredentialAcceptorProcessor.new(self).process(params, request.user_agent)
   end
 
   # POST /cas/v1/tickets/{TGT id}
   def update
-    CASinoCore::Processor::API::ServiceTicketProvider.new(self).process(params[:id], params, request.user_agent)
+    CASino::API::ServiceTicketProviderProcessor.new(self).process(params[:id], params, request.user_agent)
   end
 
   # DELETE /cas/v1/tickets/TGT-fdsjfsdfjkalfewrihfdhfaie
   def destroy
-    CASinoCore::Processor::API::Logout.new(self).process(params[:id], request.user_agent)
+    CASino::API::LogoutProcessor.new(self).process(params[:id], request.user_agent)
   end
 
   # callbacks
@@ -50,3 +50,6 @@ class CASino::API::V1::TicketsController < CASino::ApplicationController
   end
 
 end
+
+# Inflector alias
+CASino::API = CASino::Api

data/app/controllers/casino/application_controller.rb

@@ -1,5 +1,4 @@
 require 'casino'
-require 'casino_core'
 require 'http_accept_language'
 
 class CASino::ApplicationController < ::ApplicationController
@@ -15,8 +14,8 @@ class CASino::ApplicationController < ::ApplicationController
   protected
   def processor(processor_name, listener_name = nil)
     listener_name ||= processor_name
-    listener = CASino::Listener.const_get(listener_name).new(self)
-    @processor = CASinoCore::Processor.const_get(processor_name).new(listener)
+    listener = CASino.const_get(:"#{listener_name}Listener").new(self)
+    @processor = CASino.const_get(:"#{processor_name}Processor").new(listener)
   end
 
   def set_locale

data/{lib/casino/listener/legacy_validator.rb → app/listeners/casino/legacy_validator_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::LegacyValidator < CASino::Listener
+class CASino::LegacyValidatorListener < CASino::Listener
   def validation_failed(text)
     @controller.render text: text, content_type: 'text/plain'
   end

data/app/listeners/casino/listener.rb

@@ -0,0 +1,16 @@
+module CASino
+  class Listener
+
+    # include helpers to have the route path methods (like sessions_path)
+    include CASino::Engine.routes.url_helpers
+
+    def initialize(controller)
+      @controller = controller
+    end
+
+    protected
+    def assign(name, value)
+      @controller.instance_variable_set("@#{name}", value)
+    end
+  end
+end

data/{lib/casino/listener/login_credential_acceptor.rb → app/listeners/casino/login_credential_acceptor_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::LoginCredentialAcceptor < CASino::Listener
+class CASino::LoginCredentialAcceptorListener < CASino::Listener
   def user_logged_in(url, ticket_granting_ticket, cookie_expiry_time = nil)
     @controller.cookies[:tgt] = { value: ticket_granting_ticket, expires: cookie_expiry_time }
     if url.nil?

data/{lib/casino/listener/login_credential_requestor.rb → app/listeners/casino/login_credential_requestor_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::LoginCredentialRequestor < CASino::Listener
+class CASino::LoginCredentialRequestorListener < CASino::Listener
   def user_not_logged_in(login_ticket)
     assign(:login_ticket, login_ticket)
     @controller.cookies.delete :tgt

data/{lib/casino/listener/logout.rb → app/listeners/casino/logout_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::Logout < CASino::Listener
+class CASino::LogoutListener < CASino::Listener
   def user_logged_out(url, redirect_immediately = false)
     if redirect_immediately
       @controller.redirect_to url, status: :see_other

data/{lib/casino/listener/other_sessions_destroyer.rb → app/listeners/casino/other_sessions_destroyer_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::OtherSessionsDestroyer < CASino::Listener
+class CASino::OtherSessionsDestroyerListener < CASino::Listener
   def other_sessions_destroyed(url)
     @controller.redirect_to(url || sessions_path)
   end

data/{lib/casino/listener/proxy_ticket_provider.rb → app/listeners/casino/proxy_ticket_provider_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::ProxyTicketProvider < CASino::Listener
+class CASino::ProxyTicketProviderListener < CASino::Listener
   def request_failed(xml)
     @controller.render xml: xml
   end

data/{lib/casino/listener/second_factor_authentication_acceptor.rb → app/listeners/casino/second_factor_authentication_acceptor_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::SecondFactorAuthenticationAcceptor < CASino::Listener
+class CASino::SecondFactorAuthenticationAcceptorListener < CASino::Listener
 
   def user_not_logged_in
     @controller.redirect_to login_path

data/{lib/casino/listener/session_destroyer.rb → app/listeners/casino/session_destroyer_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::SessionDestroyer < CASino::Listener
+class CASino::SessionDestroyerListener < CASino::Listener
   def ticket_deleted
     @controller.redirect_to(sessions_path)
   end

data/{lib/casino/listener/session_overview.rb → app/listeners/casino/session_overview_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::SessionOverview < CASino::Listener
+class CASino::SessionOverviewListener < CASino::Listener
   def user_not_logged_in
     @controller.redirect_to login_path
   end

data/{lib/casino/listener/ticket_validator.rb → app/listeners/casino/ticket_validator_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::TicketValidator < CASino::Listener
+class CASino::TicketValidatorListener < CASino::Listener
   def validation_failed(xml)
     @controller.render xml: xml
   end

data/{lib/casino/listener/two_factor_authenticator_activator.rb → app/listeners/casino/two_factor_authenticator_activator_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::TwoFactorAuthenticatorActivator < CASino::Listener
+class CASino::TwoFactorAuthenticatorActivatorListener < CASino::Listener
   def user_not_logged_in
     @controller.redirect_to login_path
   end

data/{lib/casino/listener/two_factor_authenticator_destroyer.rb → app/listeners/casino/two_factor_authenticator_destroyer_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::TwoFactorAuthenticatorDestroyer < CASino::Listener
+class CASino::TwoFactorAuthenticatorDestroyerListener < CASino::Listener
   def user_not_logged_in
     @controller.redirect_to login_path
   end

data/{lib/casino/listener/two_factor_authenticator_overview.rb → app/listeners/casino/two_factor_authenticator_overview_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::TwoFactorAuthenticatorOverview < CASino::Listener
+class CASino::TwoFactorAuthenticatorOverviewListener < CASino::Listener
   def user_not_logged_in
     # nothing to do here
   end

data/{lib/casino/listener/two_factor_authenticator_registrator.rb → app/listeners/casino/two_factor_authenticator_registrator_listener.rb}

@@ -1,6 +1,6 @@
-require 'casino/listener'
+require_relative 'listener'
 
-class CASino::Listener::TwoFactorAuthenticatorRegistrator < CASino::Listener
+class CASino::TwoFactorAuthenticatorRegistratorListener < CASino::Listener
   def user_not_logged_in
     @controller.redirect_to login_path
   end

data/app/models/casino/login_ticket.rb

@@ -0,0 +1,12 @@
+class CASino::LoginTicket < ActiveRecord::Base
+  attr_accessible :ticket
+  validates :ticket, uniqueness: true
+
+  def self.cleanup
+    self.delete_all(['created_at < ?', CASino.config.login_ticket[:lifetime].seconds.ago])
+  end
+
+  def to_s
+    self.ticket
+  end
+end

data/app/models/casino/proxy_granting_ticket.rb

@@ -0,0 +1,8 @@
+
+class CASino::ProxyGrantingTicket < ActiveRecord::Base
+  attr_accessible :iou, :ticket, :pgt_url
+  validates :ticket, uniqueness: true
+  validates :iou, uniqueness: true
+  belongs_to :granter, polymorphic: true
+  has_many :proxy_tickets, dependent: :destroy
+end

data/app/models/casino/proxy_ticket.rb

@@ -0,0 +1,25 @@
+require 'addressable/uri'
+
+class CASino::ProxyTicket < ActiveRecord::Base
+  attr_accessible :ticket, :service
+  validates :ticket, uniqueness: true
+  belongs_to :proxy_granting_ticket
+  has_many :proxy_granting_tickets, as: :granter, dependent: :destroy
+
+  def self.cleanup_unconsumed
+    self.destroy_all(['created_at < ? AND consumed = ?', CASino.config.proxy_ticket[:lifetime_unconsumed].seconds.ago, false])
+  end
+
+  def self.cleanup_consumed
+    self.destroy_all(['created_at < ? AND consumed = ?', CASino.config.proxy_ticket[:lifetime_consumed].seconds.ago, true])
+  end
+
+  def expired?
+    lifetime = if consumed?
+      CASino.config.proxy_ticket[:lifetime_consumed]
+    else
+      CASino.config.proxy_ticket[:lifetime_unconsumed]
+    end
+    (Time.now - (self.created_at || Time.now)) > lifetime
+  end
+end