cbsorcery 0.8.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- data/.document +5 -0
- data/.gitignore +56 -0
- data/.rspec +1 -0
- data/.travis.yml +40 -0
- data/CHANGELOG.md +263 -0
- data/Gemfile +6 -0
- data/LICENSE.txt +20 -0
- data/README.md +360 -0
- data/Rakefile +6 -0
- data/gemfiles/active_record-rails40.gemfile +7 -0
- data/gemfiles/active_record-rails41.gemfile +7 -0
- data/lib/generators/sorcery/USAGE +22 -0
- data/lib/generators/sorcery/helpers.rb +40 -0
- data/lib/generators/sorcery/install_generator.rb +95 -0
- data/lib/generators/sorcery/templates/initializer.rb +451 -0
- data/lib/generators/sorcery/templates/migration/activity_logging.rb +10 -0
- data/lib/generators/sorcery/templates/migration/brute_force_protection.rb +9 -0
- data/lib/generators/sorcery/templates/migration/core.rb +13 -0
- data/lib/generators/sorcery/templates/migration/external.rb +12 -0
- data/lib/generators/sorcery/templates/migration/remember_me.rb +8 -0
- data/lib/generators/sorcery/templates/migration/reset_password.rb +9 -0
- data/lib/generators/sorcery/templates/migration/user_activation.rb +9 -0
- data/lib/sorcery.rb +85 -0
- data/lib/sorcery/adapters/active_record_adapter.rb +120 -0
- data/lib/sorcery/adapters/base_adapter.rb +30 -0
- data/lib/sorcery/controller.rb +157 -0
- data/lib/sorcery/controller/config.rb +65 -0
- data/lib/sorcery/controller/submodules/activity_logging.rb +82 -0
- data/lib/sorcery/controller/submodules/brute_force_protection.rb +38 -0
- data/lib/sorcery/controller/submodules/external.rb +199 -0
- data/lib/sorcery/controller/submodules/http_basic_auth.rb +74 -0
- data/lib/sorcery/controller/submodules/remember_me.rb +81 -0
- data/lib/sorcery/controller/submodules/session_timeout.rb +56 -0
- data/lib/sorcery/crypto_providers/aes256.rb +51 -0
- data/lib/sorcery/crypto_providers/bcrypt.rb +97 -0
- data/lib/sorcery/crypto_providers/common.rb +35 -0
- data/lib/sorcery/crypto_providers/md5.rb +19 -0
- data/lib/sorcery/crypto_providers/sha1.rb +28 -0
- data/lib/sorcery/crypto_providers/sha256.rb +36 -0
- data/lib/sorcery/crypto_providers/sha512.rb +36 -0
- data/lib/sorcery/engine.rb +21 -0
- data/lib/sorcery/model.rb +183 -0
- data/lib/sorcery/model/config.rb +96 -0
- data/lib/sorcery/model/submodules/activity_logging.rb +70 -0
- data/lib/sorcery/model/submodules/brute_force_protection.rb +125 -0
- data/lib/sorcery/model/submodules/external.rb +100 -0
- data/lib/sorcery/model/submodules/remember_me.rb +62 -0
- data/lib/sorcery/model/submodules/reset_password.rb +131 -0
- data/lib/sorcery/model/submodules/user_activation.rb +149 -0
- data/lib/sorcery/model/temporary_token.rb +30 -0
- data/lib/sorcery/protocols/certs/ca-bundle.crt +5182 -0
- data/lib/sorcery/protocols/oauth.rb +42 -0
- data/lib/sorcery/protocols/oauth2.rb +47 -0
- data/lib/sorcery/providers/base.rb +27 -0
- data/lib/sorcery/providers/facebook.rb +63 -0
- data/lib/sorcery/providers/github.rb +51 -0
- data/lib/sorcery/providers/google.rb +51 -0
- data/lib/sorcery/providers/jira.rb +77 -0
- data/lib/sorcery/providers/linkedin.rb +66 -0
- data/lib/sorcery/providers/liveid.rb +53 -0
- data/lib/sorcery/providers/twitter.rb +59 -0
- data/lib/sorcery/providers/vk.rb +63 -0
- data/lib/sorcery/providers/xing.rb +64 -0
- data/lib/sorcery/railties/tasks.rake +6 -0
- data/lib/sorcery/test_helpers/internal.rb +78 -0
- data/lib/sorcery/test_helpers/internal/rails.rb +68 -0
- data/lib/sorcery/test_helpers/rails/controller.rb +21 -0
- data/lib/sorcery/test_helpers/rails/integration.rb +26 -0
- data/lib/sorcery/version.rb +3 -0
- data/sorcery.gemspec +34 -0
- data/spec/active_record/user_activation_spec.rb +18 -0
- data/spec/active_record/user_activity_logging_spec.rb +17 -0
- data/spec/active_record/user_brute_force_protection_spec.rb +16 -0
- data/spec/active_record/user_oauth_spec.rb +16 -0
- data/spec/active_record/user_remember_me_spec.rb +16 -0
- data/spec/active_record/user_reset_password_spec.rb +16 -0
- data/spec/active_record/user_spec.rb +37 -0
- data/spec/controllers/controller_activity_logging_spec.rb +124 -0
- data/spec/controllers/controller_brute_force_protection_spec.rb +43 -0
- data/spec/controllers/controller_http_basic_auth_spec.rb +68 -0
- data/spec/controllers/controller_oauth2_spec.rb +407 -0
- data/spec/controllers/controller_oauth_spec.rb +240 -0
- data/spec/controllers/controller_remember_me_spec.rb +117 -0
- data/spec/controllers/controller_session_timeout_spec.rb +80 -0
- data/spec/controllers/controller_spec.rb +215 -0
- data/spec/orm/active_record.rb +21 -0
- data/spec/rails_app/app/active_record/authentication.rb +3 -0
- data/spec/rails_app/app/active_record/user.rb +5 -0
- data/spec/rails_app/app/active_record/user_provider.rb +3 -0
- data/spec/rails_app/app/controllers/sorcery_controller.rb +265 -0
- data/spec/rails_app/app/helpers/application_helper.rb +2 -0
- data/spec/rails_app/app/mailers/sorcery_mailer.rb +32 -0
- data/spec/rails_app/app/views/application/index.html.erb +17 -0
- data/spec/rails_app/app/views/layouts/application.html.erb +14 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_email.html.erb +17 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_email.text.erb +9 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_needed_email.html.erb +17 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_success_email.html.erb +17 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_success_email.text.erb +9 -0
- data/spec/rails_app/app/views/sorcery_mailer/reset_password_email.html.erb +16 -0
- data/spec/rails_app/app/views/sorcery_mailer/reset_password_email.text.erb +8 -0
- data/spec/rails_app/app/views/sorcery_mailer/send_unlock_token_email.text.erb +1 -0
- data/spec/rails_app/config.ru +4 -0
- data/spec/rails_app/config/application.rb +56 -0
- data/spec/rails_app/config/boot.rb +4 -0
- data/spec/rails_app/config/database.yml +22 -0
- data/spec/rails_app/config/environment.rb +5 -0
- data/spec/rails_app/config/environments/test.rb +37 -0
- data/spec/rails_app/config/initializers/backtrace_silencers.rb +7 -0
- data/spec/rails_app/config/initializers/inflections.rb +10 -0
- data/spec/rails_app/config/initializers/mime_types.rb +5 -0
- data/spec/rails_app/config/initializers/secret_token.rb +7 -0
- data/spec/rails_app/config/initializers/session_store.rb +12 -0
- data/spec/rails_app/config/locales/en.yml +5 -0
- data/spec/rails_app/config/routes.rb +48 -0
- data/spec/rails_app/db/migrate/activation/20101224223622_add_activation_to_users.rb +17 -0
- data/spec/rails_app/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb +19 -0
- data/spec/rails_app/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb +13 -0
- data/spec/rails_app/db/migrate/core/20101224223620_create_users.rb +16 -0
- data/spec/rails_app/db/migrate/external/20101224223628_create_authentications_and_user_providers.rb +22 -0
- data/spec/rails_app/db/migrate/remember_me/20101224223623_add_remember_me_token_to_users.rb +15 -0
- data/spec/rails_app/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb +13 -0
- data/spec/rails_app/db/schema.rb +23 -0
- data/spec/rails_app/db/seeds.rb +7 -0
- data/spec/shared_examples/user_activation_shared_examples.rb +242 -0
- data/spec/shared_examples/user_activity_logging_shared_examples.rb +97 -0
- data/spec/shared_examples/user_brute_force_protection_shared_examples.rb +156 -0
- data/spec/shared_examples/user_oauth_shared_examples.rb +36 -0
- data/spec/shared_examples/user_remember_me_shared_examples.rb +57 -0
- data/spec/shared_examples/user_reset_password_shared_examples.rb +263 -0
- data/spec/shared_examples/user_shared_examples.rb +467 -0
- data/spec/sorcery_crypto_providers_spec.rb +198 -0
- data/spec/spec.opts +2 -0
- data/spec/spec_helper.rb +41 -0
- metadata +350 -0
data/.document
ADDED
data/.gitignore
ADDED
|
@@ -0,0 +1,56 @@
|
|
|
1
|
+
# rcov generated
|
|
2
|
+
coverage
|
|
3
|
+
|
|
4
|
+
# rdoc generated
|
|
5
|
+
rdoc
|
|
6
|
+
|
|
7
|
+
# yard generated
|
|
8
|
+
doc
|
|
9
|
+
.yardoc
|
|
10
|
+
|
|
11
|
+
# bundler
|
|
12
|
+
.bundle
|
|
13
|
+
|
|
14
|
+
# jeweler generated
|
|
15
|
+
pkg
|
|
16
|
+
|
|
17
|
+
# for RVM
|
|
18
|
+
.rvmrc
|
|
19
|
+
|
|
20
|
+
# for RubyMine
|
|
21
|
+
.idea
|
|
22
|
+
|
|
23
|
+
# Have editor/IDE/OS specific files you need to ignore? Consider using a global gitignore:
|
|
24
|
+
#
|
|
25
|
+
# * Create a file at ~/.gitignore
|
|
26
|
+
# * Include files you want ignored
|
|
27
|
+
# * Run: git config --global core.excludesfile ~/.gitignore
|
|
28
|
+
#
|
|
29
|
+
# After doing this, these files will be ignored in all your git projects,
|
|
30
|
+
# saving you from having to 'pollute' every project you touch with them
|
|
31
|
+
#
|
|
32
|
+
# Not sure what to needs to be ignored for particular editors/OSes? Here's some ideas to get you started. (Remember, remove the leading # of the line)
|
|
33
|
+
#
|
|
34
|
+
# For MacOS:
|
|
35
|
+
#
|
|
36
|
+
#.DS_Store
|
|
37
|
+
#
|
|
38
|
+
# For TextMate
|
|
39
|
+
#*.tmproj
|
|
40
|
+
tmtags
|
|
41
|
+
#
|
|
42
|
+
# For emacs:
|
|
43
|
+
#*~
|
|
44
|
+
#\#*
|
|
45
|
+
#.\#*
|
|
46
|
+
#
|
|
47
|
+
# For vim:
|
|
48
|
+
#*.swp
|
|
49
|
+
#
|
|
50
|
+
spec/rails_app/log/*
|
|
51
|
+
*.log
|
|
52
|
+
*.sqlite3
|
|
53
|
+
Gemfile*.lock
|
|
54
|
+
gemfiles/*.lock
|
|
55
|
+
.ruby-version
|
|
56
|
+
tags
|
data/.rspec
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
--color
|
data/.travis.yml
ADDED
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
language: ruby
|
|
2
|
+
rvm:
|
|
3
|
+
- 1.9.3
|
|
4
|
+
- 2.0.0
|
|
5
|
+
- 2.1
|
|
6
|
+
|
|
7
|
+
gemfile:
|
|
8
|
+
- Gemfile
|
|
9
|
+
|
|
10
|
+
before_script:
|
|
11
|
+
- mysql -e 'create database sorcery_test;'
|
|
12
|
+
|
|
13
|
+
matrix:
|
|
14
|
+
allow_failures:
|
|
15
|
+
- rvm: :jruby
|
|
16
|
+
|
|
17
|
+
include:
|
|
18
|
+
- rvm: 1.9.3
|
|
19
|
+
gemfile: gemfiles/active_record-rails41.gemfile
|
|
20
|
+
|
|
21
|
+
- rvm: 2.0.0
|
|
22
|
+
gemfile: gemfiles/active_record-rails41.gemfile
|
|
23
|
+
|
|
24
|
+
- rvm: 2.1
|
|
25
|
+
gemfile: gemfiles/active_record-rails41.gemfile
|
|
26
|
+
|
|
27
|
+
- rvm: jruby
|
|
28
|
+
gemfile: gemfiles/active_record-rails41.gemfile
|
|
29
|
+
|
|
30
|
+
- rvm: 1.9.3
|
|
31
|
+
gemfile: gemfiles/active_record-rails40.gemfile
|
|
32
|
+
|
|
33
|
+
- rvm: 2.0.0
|
|
34
|
+
gemfile: gemfiles/active_record-rails40.gemfile
|
|
35
|
+
|
|
36
|
+
- rvm: 2.1
|
|
37
|
+
gemfile: gemfiles/active_record-rails40.gemfile
|
|
38
|
+
|
|
39
|
+
- rvm: jruby
|
|
40
|
+
gemfile: gemfiles/active_record-rails40.gemfile
|
data/CHANGELOG.md
ADDED
|
@@ -0,0 +1,263 @@
|
|
|
1
|
+
# Changelog
|
|
2
|
+
|
|
3
|
+
## 1.0 (not released yet)
|
|
4
|
+
|
|
5
|
+
* Adapters (Mongoid, MongoMapper, DataMapper) are now separated from the core Sorcery repo and moved under `sorcery-rails` organization. Special thanks to @juike!
|
|
6
|
+
|
|
7
|
+
## 0.8.7 (not released yet)
|
|
8
|
+
|
|
9
|
+
* `find_by_provider_and_uid` method was replaced with `find_by_oauth_credentials`
|
|
10
|
+
* Sorcery::VERSION constant was added to allow easy version check
|
|
11
|
+
* `@user.setup_activation` method was made to be public
|
|
12
|
+
* `current_users` method is deprecated
|
|
13
|
+
* Fetching email from VK auth, thanks to @makaroni4
|
|
14
|
+
* Add logged_in? method to test_helpers
|
|
15
|
+
* #locked? method is now public API
|
|
16
|
+
* Introduces a new User instance method `generate_reset_password_token` to generate a new reset password token without sending an email
|
|
17
|
+
|
|
18
|
+
## 0.8.6
|
|
19
|
+
|
|
20
|
+
* `current_user` returns `nil` instead of `false` if there's no user loggd in (#493)
|
|
21
|
+
* MongoMapper adapter does not override `save!` method anymore. However due to ORM's lack of support for `validate: false` in `save!`, the combination of `validate: false` and `raise_on_failure: true` is not possible in MongoMapper. The errors will not be raised in this situation. (#151)
|
|
22
|
+
* Fixed rename warnings for bcrypt-ruby
|
|
23
|
+
* The way Sorcery adapters are included has been changed due to problem with multiple `included` blocks error in `ActiveSupport::Concern` class (#527)
|
|
24
|
+
* Session timeout works with new cookie serializer introduced in Rails 4.1
|
|
25
|
+
* Rails 4.1 compatibility bugs were fixed, this version is fully supported (#538)
|
|
26
|
+
* VK providers now supports `scope` option
|
|
27
|
+
* Support for DataMapper added
|
|
28
|
+
* Helpers for integration tests were added
|
|
29
|
+
* Fixed problems with special characters in user login attributes (MongoMapper & Mongoid)
|
|
30
|
+
* Fixed remaining `password_confirmation` value - it is now cleared just like `password`
|
|
31
|
+
|
|
32
|
+
## 0.8.5
|
|
33
|
+
* Fixed add_provider_to_user with CamelCased authentications_class model (#382)
|
|
34
|
+
* Fixed unlock_token_mailer_disabled to only disable automatic mailing (#467)
|
|
35
|
+
* Make send_email_* methods easier to overwrite (#473)
|
|
36
|
+
* Don't add `:username` field for User. Config option `username_attribute_names` is now `:email` by default instead of `:username`.
|
|
37
|
+
|
|
38
|
+
If you're using `username` as main field for users to login, you'll need to tune your Sorcery config:
|
|
39
|
+
|
|
40
|
+
```ruby
|
|
41
|
+
config.user_config do |user|
|
|
42
|
+
# ...
|
|
43
|
+
user.username_attribute_names = [:username]
|
|
44
|
+
end
|
|
45
|
+
```
|
|
46
|
+
* `rails generate sorcery:install` now works inside Rails engine
|
|
47
|
+
|
|
48
|
+
## 0.8.4
|
|
49
|
+
|
|
50
|
+
* Few security fixes in `external` module
|
|
51
|
+
|
|
52
|
+
## 0.8.3 (yanked because of bad Jeweler release)
|
|
53
|
+
|
|
54
|
+
## 0.8.2
|
|
55
|
+
|
|
56
|
+
* Activity logging feature has a new column called `last_login_from_ip_address` (string type). If you use ActiveRecord, you will have to add this column to DB ([#465](https://github.com/NoamB/sorcery/issues/465))
|
|
57
|
+
|
|
58
|
+
## 0.8.1
|
|
59
|
+
<!-- TO BE WRITTEN -->
|
|
60
|
+
|
|
61
|
+
## 0.8.0
|
|
62
|
+
<!-- TO BE WRITTEN -->
|
|
63
|
+
|
|
64
|
+
## 0.7.13
|
|
65
|
+
<!-- TO BE WRITTEN -->
|
|
66
|
+
|
|
67
|
+
## 0.7.12
|
|
68
|
+
<!-- TO BE WRITTEN -->
|
|
69
|
+
|
|
70
|
+
## 0.7.11
|
|
71
|
+
<!-- TO BE WRITTEN -->
|
|
72
|
+
|
|
73
|
+
## 0.7.10
|
|
74
|
+
<!-- TO BE WRITTEN -->
|
|
75
|
+
|
|
76
|
+
## 0.7.9
|
|
77
|
+
<!-- TO BE WRITTEN -->
|
|
78
|
+
|
|
79
|
+
## 0.7.8
|
|
80
|
+
<!-- TO BE WRITTEN -->
|
|
81
|
+
|
|
82
|
+
## 0.7.7
|
|
83
|
+
<!-- TO BE WRITTEN -->
|
|
84
|
+
|
|
85
|
+
## 0.7.6
|
|
86
|
+
<!-- TO BE WRITTEN -->
|
|
87
|
+
|
|
88
|
+
## 0.7.5
|
|
89
|
+
<!-- TO BE WRITTEN -->
|
|
90
|
+
|
|
91
|
+
## 0.7.1-0.7.4
|
|
92
|
+
|
|
93
|
+
* Fixed a bug in the new generator
|
|
94
|
+
* Many bugfixes
|
|
95
|
+
* MongoMapper added to supported ORMs list, thanks @kbighorse
|
|
96
|
+
* Sinatra support discontinued!
|
|
97
|
+
* New generator contributed by @ahazem
|
|
98
|
+
* Cookie domain setting contributed by @Highcode
|
|
99
|
+
|
|
100
|
+
|
|
101
|
+
## 0.7.0
|
|
102
|
+
|
|
103
|
+
* Many bugfixes
|
|
104
|
+
* Added default SSL certificate for oauth2
|
|
105
|
+
* Added multi-username ability
|
|
106
|
+
* Security fixes (CSRF, cookie digesting)
|
|
107
|
+
* Added auto_login(user) to the API
|
|
108
|
+
* Updated gem versions of oauth(1/2)
|
|
109
|
+
* Added logged_in? as a view helper
|
|
110
|
+
* Github provider added to external submodule
|
|
111
|
+
|
|
112
|
+
|
|
113
|
+
## 0.6.1
|
|
114
|
+
|
|
115
|
+
Gemfile versions updated due to public demand.
|
|
116
|
+
(bcrypt 3.0.0 and oauth2 0.4.1)
|
|
117
|
+
|
|
118
|
+
|
|
119
|
+
## 0.6.0
|
|
120
|
+
|
|
121
|
+
Fixes issues with external user_hash not including some fields, and an issue with User model not loaded when user_class is called. Now config.user_class should be a string or a symbol.
|
|
122
|
+
|
|
123
|
+
Improved specs.
|
|
124
|
+
|
|
125
|
+
## 0.5.3
|
|
126
|
+
|
|
127
|
+
Fixed #9
|
|
128
|
+
Fixed hardcoded method names in remember_me submodule.
|
|
129
|
+
Improved specs.
|
|
130
|
+
|
|
131
|
+
## 0.5.21
|
|
132
|
+
|
|
133
|
+
Fixed typo in initializer - MUST be "config.user_class = User"
|
|
134
|
+
|
|
135
|
+
## 0.5.2
|
|
136
|
+
|
|
137
|
+
Fixed #3 and #4 - Modular Sinatra apps work now, and User model isn't cached in development mode.
|
|
138
|
+
|
|
139
|
+
## 0.5.1
|
|
140
|
+
|
|
141
|
+
Fixed bug in reset_password - after reset can't login due to bad salt creation. Affected only Mongoid.
|
|
142
|
+
|
|
143
|
+
## 0.5.0
|
|
144
|
+
|
|
145
|
+
Added support for Mongoid! (still buggy and not recommended for serious use)
|
|
146
|
+
|
|
147
|
+
'reset_password!(:password => new_password)' changed into 'change_password!(new_password)'
|
|
148
|
+
|
|
149
|
+
## 0.4.2
|
|
150
|
+
|
|
151
|
+
Added test helpers for Rails 3 & Sinatra.
|
|
152
|
+
|
|
153
|
+
## 0.4.1
|
|
154
|
+
|
|
155
|
+
Fixing Rails app name in initializer.
|
|
156
|
+
|
|
157
|
+
## 0.4.0
|
|
158
|
+
|
|
159
|
+
Changed the way Sorcery is configured.
|
|
160
|
+
Now inside the model only add:
|
|
161
|
+
|
|
162
|
+
```
|
|
163
|
+
authenticates_with_sorcery!
|
|
164
|
+
```
|
|
165
|
+
|
|
166
|
+
In the controller no code is needed! All configuration is done in an initializer.
|
|
167
|
+
Added a rake task to create it.
|
|
168
|
+
|
|
169
|
+
```
|
|
170
|
+
rake sorcery:bootstrap
|
|
171
|
+
```
|
|
172
|
+
|
|
173
|
+
## 0.3.1
|
|
174
|
+
|
|
175
|
+
Renamed "oauth" module to "external" and made API prettier.
|
|
176
|
+
```
|
|
177
|
+
auth_at_provider(provider) => login_at(provider)
|
|
178
|
+
login_from_access_token(provider) => login_from(provider)
|
|
179
|
+
create_from_provider!(provider) => create_from(provider)
|
|
180
|
+
```
|
|
181
|
+
|
|
182
|
+
## 0.3.0
|
|
183
|
+
|
|
184
|
+
Added Sinatra support!
|
|
185
|
+
|
|
186
|
+
|
|
187
|
+
Added Rails 3 generator for migrations
|
|
188
|
+
|
|
189
|
+
|
|
190
|
+
## 0.2.1
|
|
191
|
+
|
|
192
|
+
Fixed bug with OAuth submodule - oauth gems were not required properly in gem.
|
|
193
|
+
|
|
194
|
+
|
|
195
|
+
Fixed bug with OAuth submodule - Authentications class was not passed between model and controller in all cases resulting in Nil exception.
|
|
196
|
+
|
|
197
|
+
|
|
198
|
+
## 0.2.0
|
|
199
|
+
|
|
200
|
+
Added OAuth submodule.
|
|
201
|
+
|
|
202
|
+
### OAuth:
|
|
203
|
+
* OAuth1 and OAuth2 support (currently twitter & facebook)
|
|
204
|
+
* configurable db field names and authentications table.
|
|
205
|
+
|
|
206
|
+
Some bug fixes: 'return_to' feature, brute force permanent ban.
|
|
207
|
+
|
|
208
|
+
|
|
209
|
+
## 0.1.4
|
|
210
|
+
|
|
211
|
+
Added activity logging submodule.
|
|
212
|
+
|
|
213
|
+
|
|
214
|
+
### Activity Logging:
|
|
215
|
+
* automatic logging of last login, last logout and last activity time.
|
|
216
|
+
* an easy method of collecting the list of currently logged in users.
|
|
217
|
+
* configurable timeout by which to decide whether to include a user in the list of logged in users.
|
|
218
|
+
|
|
219
|
+
|
|
220
|
+
Fixed bug in basic_auth - it didn't set the session[:user_id] on successful login and tried to relogin from basic_auth on every action.
|
|
221
|
+
|
|
222
|
+
|
|
223
|
+
Added Reset Password hammering protection and updated the API.
|
|
224
|
+
|
|
225
|
+
|
|
226
|
+
Totally rewritten Brute Force Protection submodule.
|
|
227
|
+
|
|
228
|
+
|
|
229
|
+
## 0.1.3
|
|
230
|
+
|
|
231
|
+
Added support for Basic HTTP Auth.
|
|
232
|
+
|
|
233
|
+
## 0.1.2
|
|
234
|
+
|
|
235
|
+
Separated mailers between user_activation and password_reset and updated readme.
|
|
236
|
+
|
|
237
|
+
## 0.1.1
|
|
238
|
+
|
|
239
|
+
Fixed bug with BCrypt not being used properly by the lib and thus not working for authentication.
|
|
240
|
+
|
|
241
|
+
## 0.1.0
|
|
242
|
+
|
|
243
|
+
### Core Features:
|
|
244
|
+
* login/logout, optional redirect on login to where the user tried to reach before, configurable redirect for non-logged-in users.
|
|
245
|
+
* password encryption, algorithms: bcrypt(default), md5, sha1, sha256, sha512, aes256, custom(yours!), none. Configurable stretches and salt.
|
|
246
|
+
* configurable attribute names for username, password and email.
|
|
247
|
+
### User Activation:
|
|
248
|
+
* User activation by email with optional success email.
|
|
249
|
+
* configurable attribute names.
|
|
250
|
+
* configurable mailer.
|
|
251
|
+
* Optionally prevent active users to login.
|
|
252
|
+
### Password Reset:
|
|
253
|
+
* Reset password with email verification.
|
|
254
|
+
* configurable mailer, method name, and attribute name.
|
|
255
|
+
### Remember Me:
|
|
256
|
+
* Remember me with configurable expiration.
|
|
257
|
+
* configurable attribute names.
|
|
258
|
+
## Session Timeout:
|
|
259
|
+
* Configurable session timeout.
|
|
260
|
+
* Optionally session timeout will be calculated from last user action.
|
|
261
|
+
### Brute Force Protection:
|
|
262
|
+
* Brute force login hammering protection.
|
|
263
|
+
* configurable logins before ban, logins within time period before ban, ban time and ban action.
|
data/Gemfile
ADDED
data/LICENSE.txt
ADDED
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
Copyright (c) 2010 Noam Ben-Ari <mailto:nbenari@gmail.com>
|
|
2
|
+
|
|
3
|
+
Permission is hereby granted, free of charge, to any person obtaining
|
|
4
|
+
a copy of this software and associated documentation files (the
|
|
5
|
+
"Software"), to deal in the Software without restriction, including
|
|
6
|
+
without limitation the rights to use, copy, modify, merge, publish,
|
|
7
|
+
distribute, sublicense, and/or sell copies of the Software, and to
|
|
8
|
+
permit persons to whom the Software is furnished to do so, subject to
|
|
9
|
+
the following conditions:
|
|
10
|
+
|
|
11
|
+
The above copyright notice and this permission notice shall be
|
|
12
|
+
included in all copies or substantial portions of the Software.
|
|
13
|
+
|
|
14
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
|
15
|
+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
16
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
|
17
|
+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
|
18
|
+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
|
19
|
+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
|
20
|
+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
data/README.md
ADDED
|
@@ -0,0 +1,360 @@
|
|
|
1
|
+
[](https://travis-ci.org/NoamB/sorcery)
|
|
2
|
+
[](https://codeclimate.com/github/NoamB/sorcery)
|
|
3
|
+
[](http://inch-ci.org/github/NoamB/sorcery)
|
|
4
|
+
|
|
5
|
+
# sorcery
|
|
6
|
+
Magical Authentication for Rails 3 and 4. Supports ActiveRecord,
|
|
7
|
+
DataMapper, Mongoid and MongoMapper.
|
|
8
|
+
|
|
9
|
+
Inspired by restful_authentication, Authlogic and Devise. Crypto code taken
|
|
10
|
+
almost unchanged from Authlogic. OAuth code inspired by OmniAuth and Ryan
|
|
11
|
+
Bates's railscasts about it.
|
|
12
|
+
|
|
13
|
+
**What's happening now?** We are rewriting Sorcery with decoupled DB adapters and using modern Rails 4 patterns. The next release (1.0) will be containing some API-breaking changes. Development is going right in the `master` branch.
|
|
14
|
+
We'll continue releasing `0.8.x` branch with security and bug fixes until November 2014.
|
|
15
|
+
|
|
16
|
+
**Rails 4 status:** [Sorcery 0.8.6](http://rubygems.org/gems/sorcery/versions/0.8.6) is fully tested and ready for Rails 4.0 and 4.1.
|
|
17
|
+
|
|
18
|
+
https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication
|
|
19
|
+
|
|
20
|
+
## Philosophy
|
|
21
|
+
|
|
22
|
+
Sorcery is a stripped-down, bare-bones authentication library, with which you
|
|
23
|
+
can write your own authentication flow. It was built with a few goals in mind:
|
|
24
|
+
|
|
25
|
+
* Less is more - less than 20 public methods to remember for the entire
|
|
26
|
+
feature-set make the lib easy to 'get'.
|
|
27
|
+
* No built-in or generated code - use the library's methods inside *your
|
|
28
|
+
own* MVC structures, and don't fight to fix someone else's.
|
|
29
|
+
* Magic yes, Voodoo no - the lib should be easy to hack for most developers.
|
|
30
|
+
* Configuration over Confusion - Centralized (1 file), Simple & short
|
|
31
|
+
configuration as possible, not drowning in syntactic sugar.
|
|
32
|
+
* Keep MVC cleanly separated - DB is for models, sessions are for
|
|
33
|
+
controllers. Models stay unaware of sessions.
|
|
34
|
+
|
|
35
|
+
|
|
36
|
+
Hopefully, I've achieved this. If not, let me know.
|
|
37
|
+
|
|
38
|
+
## Useful Links
|
|
39
|
+
|
|
40
|
+
[Documentation](http://rubydoc.info/gems/sorcery) |
|
|
41
|
+
[Railscast](http://railscasts.com/episodes/283-authentication-with-sorcery) | [Simple tutorial](https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication) | [Example Rails 3 app](https://github.com/NoamB/sorcery-example-app)
|
|
42
|
+
|
|
43
|
+
Check out the tutorials in the [Wiki](https://github.com/NoamB/sorcery/wiki) for more!
|
|
44
|
+
|
|
45
|
+
## API Summary
|
|
46
|
+
|
|
47
|
+
Below is a summary of the library methods. Most method names are self
|
|
48
|
+
explaining and the rest are commented:
|
|
49
|
+
|
|
50
|
+
|
|
51
|
+
### core
|
|
52
|
+
```ruby
|
|
53
|
+
require_login # this is a before filter
|
|
54
|
+
login(email, password, remember_me = false)
|
|
55
|
+
auto_login(user)# login without credentials
|
|
56
|
+
logout
|
|
57
|
+
logged_in? # available to view
|
|
58
|
+
current_user # available to view
|
|
59
|
+
redirect_back_or_to # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
|
|
60
|
+
@user.external? # external users, such as facebook/twitter etc.
|
|
61
|
+
User.authenticates_with_sorcery!
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
### http basic auth
|
|
65
|
+
```ruby
|
|
66
|
+
require_login_from_http_basic # this is a before filter
|
|
67
|
+
```
|
|
68
|
+
|
|
69
|
+
### external
|
|
70
|
+
```ruby
|
|
71
|
+
login_at(provider) # sends the user to an external service (twitter etc.) to authenticate.
|
|
72
|
+
login_from(provider) # tries to login from the external provider's callback.
|
|
73
|
+
create_from(provider) # create the user in the local app db.
|
|
74
|
+
```
|
|
75
|
+
|
|
76
|
+
### remember me
|
|
77
|
+
```ruby
|
|
78
|
+
auto_login(user, should_remember=false) # login without credentials, optional remember_me
|
|
79
|
+
remember_me!
|
|
80
|
+
forget_me!
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
### reset password
|
|
84
|
+
```ruby
|
|
85
|
+
User.load_from_reset_password_token(token)
|
|
86
|
+
@user.generate_reset_password_token! # if you want to send the email by youself
|
|
87
|
+
@user.deliver_reset_password_instructions! # generates the token and sends the email
|
|
88
|
+
@user.change_password!(new_password)
|
|
89
|
+
```
|
|
90
|
+
|
|
91
|
+
### user activation
|
|
92
|
+
```ruby
|
|
93
|
+
User.load_from_activation_token(token)
|
|
94
|
+
@user.setup_activation
|
|
95
|
+
@user.activate!
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
Please see the tutorials in the github wiki for detailed usage information.
|
|
99
|
+
|
|
100
|
+
## Installation
|
|
101
|
+
|
|
102
|
+
If using bundler, first add 'sorcery' to your Gemfile:
|
|
103
|
+
|
|
104
|
+
```ruby
|
|
105
|
+
gem "sorcery"
|
|
106
|
+
```
|
|
107
|
+
|
|
108
|
+
And run
|
|
109
|
+
|
|
110
|
+
```ruby
|
|
111
|
+
bundle install
|
|
112
|
+
```
|
|
113
|
+
|
|
114
|
+
Otherwise simply
|
|
115
|
+
|
|
116
|
+
```ruby
|
|
117
|
+
gem install sorcery
|
|
118
|
+
```
|
|
119
|
+
|
|
120
|
+
## Rails configuration
|
|
121
|
+
|
|
122
|
+
```bash
|
|
123
|
+
rails generate sorcery:install
|
|
124
|
+
```
|
|
125
|
+
|
|
126
|
+
This will generate the core migration file, the initializer file and the
|
|
127
|
+
'User' model class.
|
|
128
|
+
|
|
129
|
+
```bash
|
|
130
|
+
rails generate sorcery:install remember_me reset_password
|
|
131
|
+
```
|
|
132
|
+
|
|
133
|
+
This will generate the migrations files for remember_me and reset_password
|
|
134
|
+
submodules and will create the initializer file (and add submodules to it),
|
|
135
|
+
and create the 'User' model class.
|
|
136
|
+
|
|
137
|
+
```bash
|
|
138
|
+
rails generate sorcery:install --model Person
|
|
139
|
+
```
|
|
140
|
+
|
|
141
|
+
This will generate the core migration file, the initializer and change the
|
|
142
|
+
model class (in the initializer and migration files) to the class 'Person'
|
|
143
|
+
(and its pluralized version, 'people')
|
|
144
|
+
|
|
145
|
+
```bash
|
|
146
|
+
rails generate sorcery:install http_basic_auth external remember_me --only-submodules
|
|
147
|
+
```
|
|
148
|
+
|
|
149
|
+
This will generate only the migration files for the specified submodules and
|
|
150
|
+
will add them to the initializer file.
|
|
151
|
+
|
|
152
|
+
Inside the initializer, the comments will tell you what each setting does.
|
|
153
|
+
|
|
154
|
+
## DelayedJob Integration
|
|
155
|
+
|
|
156
|
+
By default emails are sent synchronously. You can send them asynchronously by
|
|
157
|
+
using the [delayed_job gem](https://github.com/collectiveidea/delayed_job).
|
|
158
|
+
|
|
159
|
+
After implementing the `delayed_job` into your project add the code below at
|
|
160
|
+
the end of the `config/initializers/sorcery.rb` file. After that all emails
|
|
161
|
+
will be sent asynchronously.
|
|
162
|
+
|
|
163
|
+
```ruby
|
|
164
|
+
module Sorcery
|
|
165
|
+
module Model
|
|
166
|
+
module InstanceMethods
|
|
167
|
+
def generic_send_email(method, mailer)
|
|
168
|
+
config = sorcery_config
|
|
169
|
+
mail = config.send(mailer).delay.send(config.send(method), self)
|
|
170
|
+
end
|
|
171
|
+
end
|
|
172
|
+
end
|
|
173
|
+
end
|
|
174
|
+
```
|
|
175
|
+
|
|
176
|
+
Sidekiq and Resque integrations are coming soon.
|
|
177
|
+
|
|
178
|
+
## Single Table Inheritance (STI) Support
|
|
179
|
+
STI is supported via a single setting in config/initializers/sorcery.rb.
|
|
180
|
+
|
|
181
|
+
## Full Features List by module
|
|
182
|
+
|
|
183
|
+
**Core** (see [lib/sorcery/model.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model.rb) and
|
|
184
|
+
[lib/sorcery/controller.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller.rb)):
|
|
185
|
+
|
|
186
|
+
* login/logout, optional return user to requested url on login, configurable
|
|
187
|
+
redirect for non-logged-in users.
|
|
188
|
+
* password encryption, algorithms: bcrypt(default), md5, sha1, sha256,
|
|
189
|
+
sha512, aes256, custom(yours!), none. Configurable stretches and salt.
|
|
190
|
+
* configurable attribute names for username, password and email.
|
|
191
|
+
* allow multiple fields to serve as username.
|
|
192
|
+
|
|
193
|
+
|
|
194
|
+
**User Activation** (see [lib/sorcery/model/submodules/user_activation.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/user_activation.rb)):
|
|
195
|
+
|
|
196
|
+
* User activation by email with optional success email.
|
|
197
|
+
* configurable attribute names.
|
|
198
|
+
* configurable mailer, method name, and attribute name.
|
|
199
|
+
* configurable temporary token expiration.
|
|
200
|
+
* Optionally prevent non-active users to login.
|
|
201
|
+
|
|
202
|
+
|
|
203
|
+
**Reset Password** (see [lib/sorcery/model/submodules/reset_password.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/reset_password.rb)):
|
|
204
|
+
|
|
205
|
+
* Reset password with email verification.
|
|
206
|
+
* configurable mailer, method name, and attribute name.
|
|
207
|
+
* configurable temporary token expiration.
|
|
208
|
+
* configurable time between emails (hammering protection).
|
|
209
|
+
|
|
210
|
+
|
|
211
|
+
**Remember Me** (see [lib/sorcery/model/submodules/remember_me.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/remember_me.rb)):
|
|
212
|
+
|
|
213
|
+
* Remember me with configurable expiration.
|
|
214
|
+
* configurable attribute names.
|
|
215
|
+
|
|
216
|
+
|
|
217
|
+
**Session Timeout** (see [lib/sorcery/controller/submodules/session_timeout.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/session_timeout.rb)):
|
|
218
|
+
|
|
219
|
+
* Configurable session timeout.
|
|
220
|
+
* Optionally session timeout will be calculated from last user action.
|
|
221
|
+
|
|
222
|
+
|
|
223
|
+
**Brute Force Protection** (see [lib/sorcery/model/submodules/brute_force_protection.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/brute_force_protection.rb)):
|
|
224
|
+
|
|
225
|
+
* Brute force login hammering protection.
|
|
226
|
+
* configurable logins before lock and lock duration.
|
|
227
|
+
|
|
228
|
+
|
|
229
|
+
**Basic HTTP Authentication** (see [lib/sorcery/controller/submodules/http_basic_auth.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/http_basic_auth.rb)):
|
|
230
|
+
|
|
231
|
+
* A before filter for requesting authentication with HTTP Basic.
|
|
232
|
+
* automatic login from HTTP Basic.
|
|
233
|
+
* automatic login is disabled if session key changed.
|
|
234
|
+
|
|
235
|
+
|
|
236
|
+
**Activity Logging** (see [lib/sorcery/model/submodules/activity_logging.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/activity_logging.rb)):
|
|
237
|
+
|
|
238
|
+
* automatic logging of last login, last logout, last activity time and IP
|
|
239
|
+
address for last login.
|
|
240
|
+
* an easy method of collecting the list of currently logged in users.
|
|
241
|
+
* configurable timeout by which to decide whether to include a user in the
|
|
242
|
+
list of logged in users.
|
|
243
|
+
|
|
244
|
+
|
|
245
|
+
**External** (see [lib/sorcery/controller/submodules/external.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/external.rb)):
|
|
246
|
+
|
|
247
|
+
* OAuth1 and OAuth2 support (currently: Twitter, Facebook, Github, Google,
|
|
248
|
+
LinkedIn, VK, LiveID and Xing)
|
|
249
|
+
* configurable db field names and authentications table.
|
|
250
|
+
|
|
251
|
+
|
|
252
|
+
## Next Planned Features
|
|
253
|
+
|
|
254
|
+
I've got some thoughts which include (unordered):
|
|
255
|
+
|
|
256
|
+
* Passing a block to encrypt, allowing the developer to define his own mix
|
|
257
|
+
of salting and encrypting
|
|
258
|
+
* Forgot username, maybe as part of the reset_password module
|
|
259
|
+
* Scoping logins (to a subdomain or another arbitrary field)
|
|
260
|
+
* Allowing storing the salt and crypted password in the same DB field for
|
|
261
|
+
extra security
|
|
262
|
+
* Other reset password strategies (security questions?)
|
|
263
|
+
* Other brute force protection strategies (captcha)
|
|
264
|
+
|
|
265
|
+
|
|
266
|
+
Have an idea? Let me know, and it might get into the gem!
|
|
267
|
+
|
|
268
|
+
## Backward compatibility
|
|
269
|
+
|
|
270
|
+
While the lib is young and evolving fast I'm breaking backward compatibility
|
|
271
|
+
quite often. I'm constantly finding better ways to do things and throwing away
|
|
272
|
+
old ways. To let you know when things are changing in a non-compatible way,
|
|
273
|
+
I'm bumping the minor version of the gem. The patch version changes are
|
|
274
|
+
backward compatible.
|
|
275
|
+
|
|
276
|
+
In short, an app that works with x.3.1 should be able to upgrade to x.3.2 with
|
|
277
|
+
no code changes. The same cannot be said about upgrading to x.4.0 and above,
|
|
278
|
+
however.
|
|
279
|
+
|
|
280
|
+
## DataMapper Support
|
|
281
|
+
|
|
282
|
+
Important notes:
|
|
283
|
+
|
|
284
|
+
* Expected to work with DM adapters: dm-mysql-adapter,
|
|
285
|
+
dm-redis-adapter.
|
|
286
|
+
* Submodules DM adapter dependent: activity_logging (dm-mysql-adapter)
|
|
287
|
+
* Usage: include DataMapper::Resource in user model, follow sorcery
|
|
288
|
+
instructions (remember to add property id, validators and accessor
|
|
289
|
+
attributes such as password and password_confirmation)
|
|
290
|
+
* Option downcase__username_before_authenticating and dm-mysql,
|
|
291
|
+
http://datamapper.lighthouseapp.com/projects/20609/tickets/1105-add-support-for-definingchanging-default-collation
|
|
292
|
+
|
|
293
|
+
## Upgrading
|
|
294
|
+
|
|
295
|
+
Important notes while upgrading:
|
|
296
|
+
|
|
297
|
+
* If you are upgrading from <= **0.8.5** and you're using Sorcery test helpers,
|
|
298
|
+
you need to change the way you include them to following code:
|
|
299
|
+
|
|
300
|
+
```ruby
|
|
301
|
+
RSpec.configure do |config|
|
|
302
|
+
config.include Sorcery::TestHelpers::Rails::Controller, type: :controller
|
|
303
|
+
config.include Sorcery::TestHelpers::Rails::Integration, type: :feature
|
|
304
|
+
end
|
|
305
|
+
```
|
|
306
|
+
|
|
307
|
+
* If are upgrading to **0.8.2** and use activity_logging feature with
|
|
308
|
+
ActiveRecord, you will have to add a new column
|
|
309
|
+
`last_login_from_ip_address`
|
|
310
|
+
[#465](https://github.com/NoamB/sorcery/issues/465)
|
|
311
|
+
* Sinatra support existed until **v0.7.0** (including), but was dropped
|
|
312
|
+
later due to being a maintenance nightmare.
|
|
313
|
+
* If upgrading from <= **0.6.1 to >= **0.7.0** you need to change
|
|
314
|
+
'username
|
|
315
|
+
_attribute_name' to 'username_attribute_names' in initializer.
|
|
316
|
+
* If upgrading from <= **v0.5.1** to >= **v0.5.2** you need to explicitly
|
|
317
|
+
set your user_class model in the initializer file.
|
|
318
|
+
|
|
319
|
+
```ruby
|
|
320
|
+
# This line must come after the 'user config' block.
|
|
321
|
+
config.user_class = User
|
|
322
|
+
```
|
|
323
|
+
|
|
324
|
+
|
|
325
|
+
## Contributing to sorcery
|
|
326
|
+
|
|
327
|
+
Your feedback is very welcome and will make this gem much much better for you,
|
|
328
|
+
me and everyone else. Besides feedback on code, features, suggestions and bug
|
|
329
|
+
reports, you may want to actually make an impact on the code. For this:
|
|
330
|
+
|
|
331
|
+
* Fork it.
|
|
332
|
+
* Fix it.
|
|
333
|
+
* Test it.
|
|
334
|
+
* Commit it.
|
|
335
|
+
* Send me a pull request so I'll... Pull it.
|
|
336
|
+
|
|
337
|
+
|
|
338
|
+
If you feel sorcery has made your life easier, and you would like to express
|
|
339
|
+
your thanks via a donation, my paypal email is in the contact details.
|
|
340
|
+
|
|
341
|
+
## Contact
|
|
342
|
+
|
|
343
|
+
Feel free to ask questions using these contact details:
|
|
344
|
+
|
|
345
|
+
#### Noam Ben-Ari
|
|
346
|
+
|
|
347
|
+
email: nbenari@gmail.com ( also for paypal )
|
|
348
|
+
|
|
349
|
+
twitter: @nbenari
|
|
350
|
+
|
|
351
|
+
#### Kir Shatrov
|
|
352
|
+
|
|
353
|
+
email: shatrov@me.com
|
|
354
|
+
|
|
355
|
+
twitter: @Kiiiir
|
|
356
|
+
|
|
357
|
+
## Copyright
|
|
358
|
+
|
|
359
|
+
Copyright (c) 2010-2014 Noam Ben Ari (nbenari@gmail.com). See LICENSE.txt for
|
|
360
|
+
further details.
|