cbsorcery 0.8.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (135) hide show
  1. data/.document +5 -0
  2. data/.gitignore +56 -0
  3. data/.rspec +1 -0
  4. data/.travis.yml +40 -0
  5. data/CHANGELOG.md +263 -0
  6. data/Gemfile +6 -0
  7. data/LICENSE.txt +20 -0
  8. data/README.md +360 -0
  9. data/Rakefile +6 -0
  10. data/gemfiles/active_record-rails40.gemfile +7 -0
  11. data/gemfiles/active_record-rails41.gemfile +7 -0
  12. data/lib/generators/sorcery/USAGE +22 -0
  13. data/lib/generators/sorcery/helpers.rb +40 -0
  14. data/lib/generators/sorcery/install_generator.rb +95 -0
  15. data/lib/generators/sorcery/templates/initializer.rb +451 -0
  16. data/lib/generators/sorcery/templates/migration/activity_logging.rb +10 -0
  17. data/lib/generators/sorcery/templates/migration/brute_force_protection.rb +9 -0
  18. data/lib/generators/sorcery/templates/migration/core.rb +13 -0
  19. data/lib/generators/sorcery/templates/migration/external.rb +12 -0
  20. data/lib/generators/sorcery/templates/migration/remember_me.rb +8 -0
  21. data/lib/generators/sorcery/templates/migration/reset_password.rb +9 -0
  22. data/lib/generators/sorcery/templates/migration/user_activation.rb +9 -0
  23. data/lib/sorcery.rb +85 -0
  24. data/lib/sorcery/adapters/active_record_adapter.rb +120 -0
  25. data/lib/sorcery/adapters/base_adapter.rb +30 -0
  26. data/lib/sorcery/controller.rb +157 -0
  27. data/lib/sorcery/controller/config.rb +65 -0
  28. data/lib/sorcery/controller/submodules/activity_logging.rb +82 -0
  29. data/lib/sorcery/controller/submodules/brute_force_protection.rb +38 -0
  30. data/lib/sorcery/controller/submodules/external.rb +199 -0
  31. data/lib/sorcery/controller/submodules/http_basic_auth.rb +74 -0
  32. data/lib/sorcery/controller/submodules/remember_me.rb +81 -0
  33. data/lib/sorcery/controller/submodules/session_timeout.rb +56 -0
  34. data/lib/sorcery/crypto_providers/aes256.rb +51 -0
  35. data/lib/sorcery/crypto_providers/bcrypt.rb +97 -0
  36. data/lib/sorcery/crypto_providers/common.rb +35 -0
  37. data/lib/sorcery/crypto_providers/md5.rb +19 -0
  38. data/lib/sorcery/crypto_providers/sha1.rb +28 -0
  39. data/lib/sorcery/crypto_providers/sha256.rb +36 -0
  40. data/lib/sorcery/crypto_providers/sha512.rb +36 -0
  41. data/lib/sorcery/engine.rb +21 -0
  42. data/lib/sorcery/model.rb +183 -0
  43. data/lib/sorcery/model/config.rb +96 -0
  44. data/lib/sorcery/model/submodules/activity_logging.rb +70 -0
  45. data/lib/sorcery/model/submodules/brute_force_protection.rb +125 -0
  46. data/lib/sorcery/model/submodules/external.rb +100 -0
  47. data/lib/sorcery/model/submodules/remember_me.rb +62 -0
  48. data/lib/sorcery/model/submodules/reset_password.rb +131 -0
  49. data/lib/sorcery/model/submodules/user_activation.rb +149 -0
  50. data/lib/sorcery/model/temporary_token.rb +30 -0
  51. data/lib/sorcery/protocols/certs/ca-bundle.crt +5182 -0
  52. data/lib/sorcery/protocols/oauth.rb +42 -0
  53. data/lib/sorcery/protocols/oauth2.rb +47 -0
  54. data/lib/sorcery/providers/base.rb +27 -0
  55. data/lib/sorcery/providers/facebook.rb +63 -0
  56. data/lib/sorcery/providers/github.rb +51 -0
  57. data/lib/sorcery/providers/google.rb +51 -0
  58. data/lib/sorcery/providers/jira.rb +77 -0
  59. data/lib/sorcery/providers/linkedin.rb +66 -0
  60. data/lib/sorcery/providers/liveid.rb +53 -0
  61. data/lib/sorcery/providers/twitter.rb +59 -0
  62. data/lib/sorcery/providers/vk.rb +63 -0
  63. data/lib/sorcery/providers/xing.rb +64 -0
  64. data/lib/sorcery/railties/tasks.rake +6 -0
  65. data/lib/sorcery/test_helpers/internal.rb +78 -0
  66. data/lib/sorcery/test_helpers/internal/rails.rb +68 -0
  67. data/lib/sorcery/test_helpers/rails/controller.rb +21 -0
  68. data/lib/sorcery/test_helpers/rails/integration.rb +26 -0
  69. data/lib/sorcery/version.rb +3 -0
  70. data/sorcery.gemspec +34 -0
  71. data/spec/active_record/user_activation_spec.rb +18 -0
  72. data/spec/active_record/user_activity_logging_spec.rb +17 -0
  73. data/spec/active_record/user_brute_force_protection_spec.rb +16 -0
  74. data/spec/active_record/user_oauth_spec.rb +16 -0
  75. data/spec/active_record/user_remember_me_spec.rb +16 -0
  76. data/spec/active_record/user_reset_password_spec.rb +16 -0
  77. data/spec/active_record/user_spec.rb +37 -0
  78. data/spec/controllers/controller_activity_logging_spec.rb +124 -0
  79. data/spec/controllers/controller_brute_force_protection_spec.rb +43 -0
  80. data/spec/controllers/controller_http_basic_auth_spec.rb +68 -0
  81. data/spec/controllers/controller_oauth2_spec.rb +407 -0
  82. data/spec/controllers/controller_oauth_spec.rb +240 -0
  83. data/spec/controllers/controller_remember_me_spec.rb +117 -0
  84. data/spec/controllers/controller_session_timeout_spec.rb +80 -0
  85. data/spec/controllers/controller_spec.rb +215 -0
  86. data/spec/orm/active_record.rb +21 -0
  87. data/spec/rails_app/app/active_record/authentication.rb +3 -0
  88. data/spec/rails_app/app/active_record/user.rb +5 -0
  89. data/spec/rails_app/app/active_record/user_provider.rb +3 -0
  90. data/spec/rails_app/app/controllers/sorcery_controller.rb +265 -0
  91. data/spec/rails_app/app/helpers/application_helper.rb +2 -0
  92. data/spec/rails_app/app/mailers/sorcery_mailer.rb +32 -0
  93. data/spec/rails_app/app/views/application/index.html.erb +17 -0
  94. data/spec/rails_app/app/views/layouts/application.html.erb +14 -0
  95. data/spec/rails_app/app/views/sorcery_mailer/activation_email.html.erb +17 -0
  96. data/spec/rails_app/app/views/sorcery_mailer/activation_email.text.erb +9 -0
  97. data/spec/rails_app/app/views/sorcery_mailer/activation_needed_email.html.erb +17 -0
  98. data/spec/rails_app/app/views/sorcery_mailer/activation_success_email.html.erb +17 -0
  99. data/spec/rails_app/app/views/sorcery_mailer/activation_success_email.text.erb +9 -0
  100. data/spec/rails_app/app/views/sorcery_mailer/reset_password_email.html.erb +16 -0
  101. data/spec/rails_app/app/views/sorcery_mailer/reset_password_email.text.erb +8 -0
  102. data/spec/rails_app/app/views/sorcery_mailer/send_unlock_token_email.text.erb +1 -0
  103. data/spec/rails_app/config.ru +4 -0
  104. data/spec/rails_app/config/application.rb +56 -0
  105. data/spec/rails_app/config/boot.rb +4 -0
  106. data/spec/rails_app/config/database.yml +22 -0
  107. data/spec/rails_app/config/environment.rb +5 -0
  108. data/spec/rails_app/config/environments/test.rb +37 -0
  109. data/spec/rails_app/config/initializers/backtrace_silencers.rb +7 -0
  110. data/spec/rails_app/config/initializers/inflections.rb +10 -0
  111. data/spec/rails_app/config/initializers/mime_types.rb +5 -0
  112. data/spec/rails_app/config/initializers/secret_token.rb +7 -0
  113. data/spec/rails_app/config/initializers/session_store.rb +12 -0
  114. data/spec/rails_app/config/locales/en.yml +5 -0
  115. data/spec/rails_app/config/routes.rb +48 -0
  116. data/spec/rails_app/db/migrate/activation/20101224223622_add_activation_to_users.rb +17 -0
  117. data/spec/rails_app/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb +19 -0
  118. data/spec/rails_app/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb +13 -0
  119. data/spec/rails_app/db/migrate/core/20101224223620_create_users.rb +16 -0
  120. data/spec/rails_app/db/migrate/external/20101224223628_create_authentications_and_user_providers.rb +22 -0
  121. data/spec/rails_app/db/migrate/remember_me/20101224223623_add_remember_me_token_to_users.rb +15 -0
  122. data/spec/rails_app/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb +13 -0
  123. data/spec/rails_app/db/schema.rb +23 -0
  124. data/spec/rails_app/db/seeds.rb +7 -0
  125. data/spec/shared_examples/user_activation_shared_examples.rb +242 -0
  126. data/spec/shared_examples/user_activity_logging_shared_examples.rb +97 -0
  127. data/spec/shared_examples/user_brute_force_protection_shared_examples.rb +156 -0
  128. data/spec/shared_examples/user_oauth_shared_examples.rb +36 -0
  129. data/spec/shared_examples/user_remember_me_shared_examples.rb +57 -0
  130. data/spec/shared_examples/user_reset_password_shared_examples.rb +263 -0
  131. data/spec/shared_examples/user_shared_examples.rb +467 -0
  132. data/spec/sorcery_crypto_providers_spec.rb +198 -0
  133. data/spec/spec.opts +2 -0
  134. data/spec/spec_helper.rb +41 -0
  135. metadata +350 -0
data/.document ADDED
@@ -0,0 +1,5 @@
1
+ lib/**/*.rb
2
+ bin/*
3
+ -
4
+ features/**/*.feature
5
+ LICENSE.txt
data/.gitignore ADDED
@@ -0,0 +1,56 @@
1
+ # rcov generated
2
+ coverage
3
+
4
+ # rdoc generated
5
+ rdoc
6
+
7
+ # yard generated
8
+ doc
9
+ .yardoc
10
+
11
+ # bundler
12
+ .bundle
13
+
14
+ # jeweler generated
15
+ pkg
16
+
17
+ # for RVM
18
+ .rvmrc
19
+
20
+ # for RubyMine
21
+ .idea
22
+
23
+ # Have editor/IDE/OS specific files you need to ignore? Consider using a global gitignore:
24
+ #
25
+ # * Create a file at ~/.gitignore
26
+ # * Include files you want ignored
27
+ # * Run: git config --global core.excludesfile ~/.gitignore
28
+ #
29
+ # After doing this, these files will be ignored in all your git projects,
30
+ # saving you from having to 'pollute' every project you touch with them
31
+ #
32
+ # Not sure what to needs to be ignored for particular editors/OSes? Here's some ideas to get you started. (Remember, remove the leading # of the line)
33
+ #
34
+ # For MacOS:
35
+ #
36
+ #.DS_Store
37
+ #
38
+ # For TextMate
39
+ #*.tmproj
40
+ tmtags
41
+ #
42
+ # For emacs:
43
+ #*~
44
+ #\#*
45
+ #.\#*
46
+ #
47
+ # For vim:
48
+ #*.swp
49
+ #
50
+ spec/rails_app/log/*
51
+ *.log
52
+ *.sqlite3
53
+ Gemfile*.lock
54
+ gemfiles/*.lock
55
+ .ruby-version
56
+ tags
data/.rspec ADDED
@@ -0,0 +1 @@
1
+ --color
data/.travis.yml ADDED
@@ -0,0 +1,40 @@
1
+ language: ruby
2
+ rvm:
3
+ - 1.9.3
4
+ - 2.0.0
5
+ - 2.1
6
+
7
+ gemfile:
8
+ - Gemfile
9
+
10
+ before_script:
11
+ - mysql -e 'create database sorcery_test;'
12
+
13
+ matrix:
14
+ allow_failures:
15
+ - rvm: :jruby
16
+
17
+ include:
18
+ - rvm: 1.9.3
19
+ gemfile: gemfiles/active_record-rails41.gemfile
20
+
21
+ - rvm: 2.0.0
22
+ gemfile: gemfiles/active_record-rails41.gemfile
23
+
24
+ - rvm: 2.1
25
+ gemfile: gemfiles/active_record-rails41.gemfile
26
+
27
+ - rvm: jruby
28
+ gemfile: gemfiles/active_record-rails41.gemfile
29
+
30
+ - rvm: 1.9.3
31
+ gemfile: gemfiles/active_record-rails40.gemfile
32
+
33
+ - rvm: 2.0.0
34
+ gemfile: gemfiles/active_record-rails40.gemfile
35
+
36
+ - rvm: 2.1
37
+ gemfile: gemfiles/active_record-rails40.gemfile
38
+
39
+ - rvm: jruby
40
+ gemfile: gemfiles/active_record-rails40.gemfile
data/CHANGELOG.md ADDED
@@ -0,0 +1,263 @@
1
+ # Changelog
2
+
3
+ ## 1.0 (not released yet)
4
+
5
+ * Adapters (Mongoid, MongoMapper, DataMapper) are now separated from the core Sorcery repo and moved under `sorcery-rails` organization. Special thanks to @juike!
6
+
7
+ ## 0.8.7 (not released yet)
8
+
9
+ * `find_by_provider_and_uid` method was replaced with `find_by_oauth_credentials`
10
+ * Sorcery::VERSION constant was added to allow easy version check
11
+ * `@user.setup_activation` method was made to be public
12
+ * `current_users` method is deprecated
13
+ * Fetching email from VK auth, thanks to @makaroni4
14
+ * Add logged_in? method to test_helpers
15
+ * #locked? method is now public API
16
+ * Introduces a new User instance method `generate_reset_password_token` to generate a new reset password token without sending an email
17
+
18
+ ## 0.8.6
19
+
20
+ * `current_user` returns `nil` instead of `false` if there's no user loggd in (#493)
21
+ * MongoMapper adapter does not override `save!` method anymore. However due to ORM's lack of support for `validate: false` in `save!`, the combination of `validate: false` and `raise_on_failure: true` is not possible in MongoMapper. The errors will not be raised in this situation. (#151)
22
+ * Fixed rename warnings for bcrypt-ruby
23
+ * The way Sorcery adapters are included has been changed due to problem with multiple `included` blocks error in `ActiveSupport::Concern` class (#527)
24
+ * Session timeout works with new cookie serializer introduced in Rails 4.1
25
+ * Rails 4.1 compatibility bugs were fixed, this version is fully supported (#538)
26
+ * VK providers now supports `scope` option
27
+ * Support for DataMapper added
28
+ * Helpers for integration tests were added
29
+ * Fixed problems with special characters in user login attributes (MongoMapper & Mongoid)
30
+ * Fixed remaining `password_confirmation` value - it is now cleared just like `password`
31
+
32
+ ## 0.8.5
33
+ * Fixed add_provider_to_user with CamelCased authentications_class model (#382)
34
+ * Fixed unlock_token_mailer_disabled to only disable automatic mailing (#467)
35
+ * Make send_email_* methods easier to overwrite (#473)
36
+ * Don't add `:username` field for User. Config option `username_attribute_names` is now `:email` by default instead of `:username`.
37
+
38
+ If you're using `username` as main field for users to login, you'll need to tune your Sorcery config:
39
+
40
+ ```ruby
41
+ config.user_config do |user|
42
+ # ...
43
+ user.username_attribute_names = [:username]
44
+ end
45
+ ```
46
+ * `rails generate sorcery:install` now works inside Rails engine
47
+
48
+ ## 0.8.4
49
+
50
+ * Few security fixes in `external` module
51
+
52
+ ## 0.8.3 (yanked because of bad Jeweler release)
53
+
54
+ ## 0.8.2
55
+
56
+ * Activity logging feature has a new column called `last_login_from_ip_address` (string type). If you use ActiveRecord, you will have to add this column to DB ([#465](https://github.com/NoamB/sorcery/issues/465))
57
+
58
+ ## 0.8.1
59
+ <!-- TO BE WRITTEN -->
60
+
61
+ ## 0.8.0
62
+ <!-- TO BE WRITTEN -->
63
+
64
+ ## 0.7.13
65
+ <!-- TO BE WRITTEN -->
66
+
67
+ ## 0.7.12
68
+ <!-- TO BE WRITTEN -->
69
+
70
+ ## 0.7.11
71
+ <!-- TO BE WRITTEN -->
72
+
73
+ ## 0.7.10
74
+ <!-- TO BE WRITTEN -->
75
+
76
+ ## 0.7.9
77
+ <!-- TO BE WRITTEN -->
78
+
79
+ ## 0.7.8
80
+ <!-- TO BE WRITTEN -->
81
+
82
+ ## 0.7.7
83
+ <!-- TO BE WRITTEN -->
84
+
85
+ ## 0.7.6
86
+ <!-- TO BE WRITTEN -->
87
+
88
+ ## 0.7.5
89
+ <!-- TO BE WRITTEN -->
90
+
91
+ ## 0.7.1-0.7.4
92
+
93
+ * Fixed a bug in the new generator
94
+ * Many bugfixes
95
+ * MongoMapper added to supported ORMs list, thanks @kbighorse
96
+ * Sinatra support discontinued!
97
+ * New generator contributed by @ahazem
98
+ * Cookie domain setting contributed by @Highcode
99
+
100
+
101
+ ## 0.7.0
102
+
103
+ * Many bugfixes
104
+ * Added default SSL certificate for oauth2
105
+ * Added multi-username ability
106
+ * Security fixes (CSRF, cookie digesting)
107
+ * Added auto_login(user) to the API
108
+ * Updated gem versions of oauth(1/2)
109
+ * Added logged_in? as a view helper
110
+ * Github provider added to external submodule
111
+
112
+
113
+ ## 0.6.1
114
+
115
+ Gemfile versions updated due to public demand.
116
+ (bcrypt 3.0.0 and oauth2 0.4.1)
117
+
118
+
119
+ ## 0.6.0
120
+
121
+ Fixes issues with external user_hash not including some fields, and an issue with User model not loaded when user_class is called. Now config.user_class should be a string or a symbol.
122
+
123
+ Improved specs.
124
+
125
+ ## 0.5.3
126
+
127
+ Fixed #9
128
+ Fixed hardcoded method names in remember_me submodule.
129
+ Improved specs.
130
+
131
+ ## 0.5.21
132
+
133
+ Fixed typo in initializer - MUST be "config.user_class = User"
134
+
135
+ ## 0.5.2
136
+
137
+ Fixed #3 and #4 - Modular Sinatra apps work now, and User model isn't cached in development mode.
138
+
139
+ ## 0.5.1
140
+
141
+ Fixed bug in reset_password - after reset can't login due to bad salt creation. Affected only Mongoid.
142
+
143
+ ## 0.5.0
144
+
145
+ Added support for Mongoid! (still buggy and not recommended for serious use)
146
+
147
+ 'reset_password!(:password => new_password)' changed into 'change_password!(new_password)'
148
+
149
+ ## 0.4.2
150
+
151
+ Added test helpers for Rails 3 & Sinatra.
152
+
153
+ ## 0.4.1
154
+
155
+ Fixing Rails app name in initializer.
156
+
157
+ ## 0.4.0
158
+
159
+ Changed the way Sorcery is configured.
160
+ Now inside the model only add:
161
+
162
+ ```
163
+ authenticates_with_sorcery!
164
+ ```
165
+
166
+ In the controller no code is needed! All configuration is done in an initializer.
167
+ Added a rake task to create it.
168
+
169
+ ```
170
+ rake sorcery:bootstrap
171
+ ```
172
+
173
+ ## 0.3.1
174
+
175
+ Renamed "oauth" module to "external" and made API prettier.
176
+ ```
177
+ auth_at_provider(provider) => login_at(provider)
178
+ login_from_access_token(provider) => login_from(provider)
179
+ create_from_provider!(provider) => create_from(provider)
180
+ ```
181
+
182
+ ## 0.3.0
183
+
184
+ Added Sinatra support!
185
+
186
+
187
+ Added Rails 3 generator for migrations
188
+
189
+
190
+ ## 0.2.1
191
+
192
+ Fixed bug with OAuth submodule - oauth gems were not required properly in gem.
193
+
194
+
195
+ Fixed bug with OAuth submodule - Authentications class was not passed between model and controller in all cases resulting in Nil exception.
196
+
197
+
198
+ ## 0.2.0
199
+
200
+ Added OAuth submodule.
201
+
202
+ ### OAuth:
203
+ * OAuth1 and OAuth2 support (currently twitter & facebook)
204
+ * configurable db field names and authentications table.
205
+
206
+ Some bug fixes: 'return_to' feature, brute force permanent ban.
207
+
208
+
209
+ ## 0.1.4
210
+
211
+ Added activity logging submodule.
212
+
213
+
214
+ ### Activity Logging:
215
+ * automatic logging of last login, last logout and last activity time.
216
+ * an easy method of collecting the list of currently logged in users.
217
+ * configurable timeout by which to decide whether to include a user in the list of logged in users.
218
+
219
+
220
+ Fixed bug in basic_auth - it didn't set the session[:user_id] on successful login and tried to relogin from basic_auth on every action.
221
+
222
+
223
+ Added Reset Password hammering protection and updated the API.
224
+
225
+
226
+ Totally rewritten Brute Force Protection submodule.
227
+
228
+
229
+ ## 0.1.3
230
+
231
+ Added support for Basic HTTP Auth.
232
+
233
+ ## 0.1.2
234
+
235
+ Separated mailers between user_activation and password_reset and updated readme.
236
+
237
+ ## 0.1.1
238
+
239
+ Fixed bug with BCrypt not being used properly by the lib and thus not working for authentication.
240
+
241
+ ## 0.1.0
242
+
243
+ ### Core Features:
244
+ * login/logout, optional redirect on login to where the user tried to reach before, configurable redirect for non-logged-in users.
245
+ * password encryption, algorithms: bcrypt(default), md5, sha1, sha256, sha512, aes256, custom(yours!), none. Configurable stretches and salt.
246
+ * configurable attribute names for username, password and email.
247
+ ### User Activation:
248
+ * User activation by email with optional success email.
249
+ * configurable attribute names.
250
+ * configurable mailer.
251
+ * Optionally prevent active users to login.
252
+ ### Password Reset:
253
+ * Reset password with email verification.
254
+ * configurable mailer, method name, and attribute name.
255
+ ### Remember Me:
256
+ * Remember me with configurable expiration.
257
+ * configurable attribute names.
258
+ ## Session Timeout:
259
+ * Configurable session timeout.
260
+ * Optionally session timeout will be calculated from last user action.
261
+ ### Brute Force Protection:
262
+ * Brute force login hammering protection.
263
+ * configurable logins before ban, logins within time period before ban, ban time and ban action.
data/Gemfile ADDED
@@ -0,0 +1,6 @@
1
+ source 'https://rubygems.org'
2
+
3
+ gem 'rails', '~> 3.2'
4
+ gem 'sqlite3'
5
+
6
+ gemspec
data/LICENSE.txt ADDED
@@ -0,0 +1,20 @@
1
+ Copyright (c) 2010 Noam Ben-Ari <mailto:nbenari@gmail.com>
2
+
3
+ Permission is hereby granted, free of charge, to any person obtaining
4
+ a copy of this software and associated documentation files (the
5
+ "Software"), to deal in the Software without restriction, including
6
+ without limitation the rights to use, copy, modify, merge, publish,
7
+ distribute, sublicense, and/or sell copies of the Software, and to
8
+ permit persons to whom the Software is furnished to do so, subject to
9
+ the following conditions:
10
+
11
+ The above copyright notice and this permission notice shall be
12
+ included in all copies or substantial portions of the Software.
13
+
14
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
15
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
16
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
17
+ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
18
+ LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
19
+ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
20
+ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
data/README.md ADDED
@@ -0,0 +1,360 @@
1
+ [![Build Status](https://travis-ci.org/NoamB/sorcery.svg?branch=master)](https://travis-ci.org/NoamB/sorcery)
2
+ [![Code Climate](https://codeclimate.com/github/NoamB/sorcery.png)](https://codeclimate.com/github/NoamB/sorcery)
3
+ [![Inline docs](http://inch-ci.org/github/NoamB/sorcery.png?branch=master)](http://inch-ci.org/github/NoamB/sorcery)
4
+
5
+ # sorcery
6
+ Magical Authentication for Rails 3 and 4. Supports ActiveRecord,
7
+ DataMapper, Mongoid and MongoMapper.
8
+
9
+ Inspired by restful_authentication, Authlogic and Devise. Crypto code taken
10
+ almost unchanged from Authlogic. OAuth code inspired by OmniAuth and Ryan
11
+ Bates's railscasts about it.
12
+
13
+ **What's happening now?** We are rewriting Sorcery with decoupled DB adapters and using modern Rails 4 patterns. The next release (1.0) will be containing some API-breaking changes. Development is going right in the `master` branch.
14
+ We'll continue releasing `0.8.x` branch with security and bug fixes until November 2014.
15
+
16
+ **Rails 4 status:** [Sorcery 0.8.6](http://rubygems.org/gems/sorcery/versions/0.8.6) is fully tested and ready for Rails 4.0 and 4.1.
17
+
18
+ https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication
19
+
20
+ ## Philosophy
21
+
22
+ Sorcery is a stripped-down, bare-bones authentication library, with which you
23
+ can write your own authentication flow. It was built with a few goals in mind:
24
+
25
+ * Less is more - less than 20 public methods to remember for the entire
26
+ feature-set make the lib easy to 'get'.
27
+ * No built-in or generated code - use the library's methods inside *your
28
+ own* MVC structures, and don't fight to fix someone else's.
29
+ * Magic yes, Voodoo no - the lib should be easy to hack for most developers.
30
+ * Configuration over Confusion - Centralized (1 file), Simple & short
31
+ configuration as possible, not drowning in syntactic sugar.
32
+ * Keep MVC cleanly separated - DB is for models, sessions are for
33
+ controllers. Models stay unaware of sessions.
34
+
35
+
36
+ Hopefully, I've achieved this. If not, let me know.
37
+
38
+ ## Useful Links
39
+
40
+ [Documentation](http://rubydoc.info/gems/sorcery) |
41
+ [Railscast](http://railscasts.com/episodes/283-authentication-with-sorcery) | [Simple tutorial](https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication) | [Example Rails 3 app](https://github.com/NoamB/sorcery-example-app)
42
+
43
+ Check out the tutorials in the [Wiki](https://github.com/NoamB/sorcery/wiki) for more!
44
+
45
+ ## API Summary
46
+
47
+ Below is a summary of the library methods. Most method names are self
48
+ explaining and the rest are commented:
49
+
50
+
51
+ ### core
52
+ ```ruby
53
+ require_login # this is a before filter
54
+ login(email, password, remember_me = false)
55
+ auto_login(user)# login without credentials
56
+ logout
57
+ logged_in? # available to view
58
+ current_user # available to view
59
+ redirect_back_or_to # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
60
+ @user.external? # external users, such as facebook/twitter etc.
61
+ User.authenticates_with_sorcery!
62
+ ```
63
+
64
+ ### http basic auth
65
+ ```ruby
66
+ require_login_from_http_basic # this is a before filter
67
+ ```
68
+
69
+ ### external
70
+ ```ruby
71
+ login_at(provider) # sends the user to an external service (twitter etc.) to authenticate.
72
+ login_from(provider) # tries to login from the external provider's callback.
73
+ create_from(provider) # create the user in the local app db.
74
+ ```
75
+
76
+ ### remember me
77
+ ```ruby
78
+ auto_login(user, should_remember=false) # login without credentials, optional remember_me
79
+ remember_me!
80
+ forget_me!
81
+ ```
82
+
83
+ ### reset password
84
+ ```ruby
85
+ User.load_from_reset_password_token(token)
86
+ @user.generate_reset_password_token! # if you want to send the email by youself
87
+ @user.deliver_reset_password_instructions! # generates the token and sends the email
88
+ @user.change_password!(new_password)
89
+ ```
90
+
91
+ ### user activation
92
+ ```ruby
93
+ User.load_from_activation_token(token)
94
+ @user.setup_activation
95
+ @user.activate!
96
+ ```
97
+
98
+ Please see the tutorials in the github wiki for detailed usage information.
99
+
100
+ ## Installation
101
+
102
+ If using bundler, first add 'sorcery' to your Gemfile:
103
+
104
+ ```ruby
105
+ gem "sorcery"
106
+ ```
107
+
108
+ And run
109
+
110
+ ```ruby
111
+ bundle install
112
+ ```
113
+
114
+ Otherwise simply
115
+
116
+ ```ruby
117
+ gem install sorcery
118
+ ```
119
+
120
+ ## Rails configuration
121
+
122
+ ```bash
123
+ rails generate sorcery:install
124
+ ```
125
+
126
+ This will generate the core migration file, the initializer file and the
127
+ 'User' model class.
128
+
129
+ ```bash
130
+ rails generate sorcery:install remember_me reset_password
131
+ ```
132
+
133
+ This will generate the migrations files for remember_me and reset_password
134
+ submodules and will create the initializer file (and add submodules to it),
135
+ and create the 'User' model class.
136
+
137
+ ```bash
138
+ rails generate sorcery:install --model Person
139
+ ```
140
+
141
+ This will generate the core migration file, the initializer and change the
142
+ model class (in the initializer and migration files) to the class 'Person'
143
+ (and its pluralized version, 'people')
144
+
145
+ ```bash
146
+ rails generate sorcery:install http_basic_auth external remember_me --only-submodules
147
+ ```
148
+
149
+ This will generate only the migration files for the specified submodules and
150
+ will add them to the initializer file.
151
+
152
+ Inside the initializer, the comments will tell you what each setting does.
153
+
154
+ ## DelayedJob Integration
155
+
156
+ By default emails are sent synchronously. You can send them asynchronously by
157
+ using the [delayed_job gem](https://github.com/collectiveidea/delayed_job).
158
+
159
+ After implementing the `delayed_job` into your project add the code below at
160
+ the end of the `config/initializers/sorcery.rb` file. After that all emails
161
+ will be sent asynchronously.
162
+
163
+ ```ruby
164
+ module Sorcery
165
+ module Model
166
+ module InstanceMethods
167
+ def generic_send_email(method, mailer)
168
+ config = sorcery_config
169
+ mail = config.send(mailer).delay.send(config.send(method), self)
170
+ end
171
+ end
172
+ end
173
+ end
174
+ ```
175
+
176
+ Sidekiq and Resque integrations are coming soon.
177
+
178
+ ## Single Table Inheritance (STI) Support
179
+ STI is supported via a single setting in config/initializers/sorcery.rb.
180
+
181
+ ## Full Features List by module
182
+
183
+ **Core** (see [lib/sorcery/model.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model.rb) and
184
+ [lib/sorcery/controller.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller.rb)):
185
+
186
+ * login/logout, optional return user to requested url on login, configurable
187
+ redirect for non-logged-in users.
188
+ * password encryption, algorithms: bcrypt(default), md5, sha1, sha256,
189
+ sha512, aes256, custom(yours!), none. Configurable stretches and salt.
190
+ * configurable attribute names for username, password and email.
191
+ * allow multiple fields to serve as username.
192
+
193
+
194
+ **User Activation** (see [lib/sorcery/model/submodules/user_activation.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/user_activation.rb)):
195
+
196
+ * User activation by email with optional success email.
197
+ * configurable attribute names.
198
+ * configurable mailer, method name, and attribute name.
199
+ * configurable temporary token expiration.
200
+ * Optionally prevent non-active users to login.
201
+
202
+
203
+ **Reset Password** (see [lib/sorcery/model/submodules/reset_password.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/reset_password.rb)):
204
+
205
+ * Reset password with email verification.
206
+ * configurable mailer, method name, and attribute name.
207
+ * configurable temporary token expiration.
208
+ * configurable time between emails (hammering protection).
209
+
210
+
211
+ **Remember Me** (see [lib/sorcery/model/submodules/remember_me.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/remember_me.rb)):
212
+
213
+ * Remember me with configurable expiration.
214
+ * configurable attribute names.
215
+
216
+
217
+ **Session Timeout** (see [lib/sorcery/controller/submodules/session_timeout.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/session_timeout.rb)):
218
+
219
+ * Configurable session timeout.
220
+ * Optionally session timeout will be calculated from last user action.
221
+
222
+
223
+ **Brute Force Protection** (see [lib/sorcery/model/submodules/brute_force_protection.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/brute_force_protection.rb)):
224
+
225
+ * Brute force login hammering protection.
226
+ * configurable logins before lock and lock duration.
227
+
228
+
229
+ **Basic HTTP Authentication** (see [lib/sorcery/controller/submodules/http_basic_auth.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/http_basic_auth.rb)):
230
+
231
+ * A before filter for requesting authentication with HTTP Basic.
232
+ * automatic login from HTTP Basic.
233
+ * automatic login is disabled if session key changed.
234
+
235
+
236
+ **Activity Logging** (see [lib/sorcery/model/submodules/activity_logging.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/activity_logging.rb)):
237
+
238
+ * automatic logging of last login, last logout, last activity time and IP
239
+ address for last login.
240
+ * an easy method of collecting the list of currently logged in users.
241
+ * configurable timeout by which to decide whether to include a user in the
242
+ list of logged in users.
243
+
244
+
245
+ **External** (see [lib/sorcery/controller/submodules/external.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/external.rb)):
246
+
247
+ * OAuth1 and OAuth2 support (currently: Twitter, Facebook, Github, Google,
248
+ LinkedIn, VK, LiveID and Xing)
249
+ * configurable db field names and authentications table.
250
+
251
+
252
+ ## Next Planned Features
253
+
254
+ I've got some thoughts which include (unordered):
255
+
256
+ * Passing a block to encrypt, allowing the developer to define his own mix
257
+ of salting and encrypting
258
+ * Forgot username, maybe as part of the reset_password module
259
+ * Scoping logins (to a subdomain or another arbitrary field)
260
+ * Allowing storing the salt and crypted password in the same DB field for
261
+ extra security
262
+ * Other reset password strategies (security questions?)
263
+ * Other brute force protection strategies (captcha)
264
+
265
+
266
+ Have an idea? Let me know, and it might get into the gem!
267
+
268
+ ## Backward compatibility
269
+
270
+ While the lib is young and evolving fast I'm breaking backward compatibility
271
+ quite often. I'm constantly finding better ways to do things and throwing away
272
+ old ways. To let you know when things are changing in a non-compatible way,
273
+ I'm bumping the minor version of the gem. The patch version changes are
274
+ backward compatible.
275
+
276
+ In short, an app that works with x.3.1 should be able to upgrade to x.3.2 with
277
+ no code changes. The same cannot be said about upgrading to x.4.0 and above,
278
+ however.
279
+
280
+ ## DataMapper Support
281
+
282
+ Important notes:
283
+
284
+ * Expected to work with DM adapters: dm-mysql-adapter,
285
+ dm-redis-adapter.
286
+ * Submodules DM adapter dependent: activity_logging (dm-mysql-adapter)
287
+ * Usage: include DataMapper::Resource in user model, follow sorcery
288
+ instructions (remember to add property id, validators and accessor
289
+ attributes such as password and password_confirmation)
290
+ * Option downcase__username_before_authenticating and dm-mysql,
291
+ http://datamapper.lighthouseapp.com/projects/20609/tickets/1105-add-support-for-definingchanging-default-collation
292
+
293
+ ## Upgrading
294
+
295
+ Important notes while upgrading:
296
+
297
+ * If you are upgrading from <= **0.8.5** and you're using Sorcery test helpers,
298
+ you need to change the way you include them to following code:
299
+
300
+ ```ruby
301
+ RSpec.configure do |config|
302
+ config.include Sorcery::TestHelpers::Rails::Controller, type: :controller
303
+ config.include Sorcery::TestHelpers::Rails::Integration, type: :feature
304
+ end
305
+ ```
306
+
307
+ * If are upgrading to **0.8.2** and use activity_logging feature with
308
+ ActiveRecord, you will have to add a new column
309
+ `last_login_from_ip_address`
310
+ [#465](https://github.com/NoamB/sorcery/issues/465)
311
+ * Sinatra support existed until **v0.7.0** (including), but was dropped
312
+ later due to being a maintenance nightmare.
313
+ * If upgrading from <= **0.6.1 to >= **0.7.0** you need to change
314
+ 'username
315
+ _attribute_name' to 'username_attribute_names' in initializer.
316
+ * If upgrading from <= **v0.5.1** to >= **v0.5.2** you need to explicitly
317
+ set your user_class model in the initializer file.
318
+
319
+ ```ruby
320
+ # This line must come after the 'user config' block.
321
+ config.user_class = User
322
+ ```
323
+
324
+
325
+ ## Contributing to sorcery
326
+
327
+ Your feedback is very welcome and will make this gem much much better for you,
328
+ me and everyone else. Besides feedback on code, features, suggestions and bug
329
+ reports, you may want to actually make an impact on the code. For this:
330
+
331
+ * Fork it.
332
+ * Fix it.
333
+ * Test it.
334
+ * Commit it.
335
+ * Send me a pull request so I'll... Pull it.
336
+
337
+
338
+ If you feel sorcery has made your life easier, and you would like to express
339
+ your thanks via a donation, my paypal email is in the contact details.
340
+
341
+ ## Contact
342
+
343
+ Feel free to ask questions using these contact details:
344
+
345
+ #### Noam Ben-Ari
346
+
347
+ email: nbenari@gmail.com ( also for paypal )
348
+
349
+ twitter: @nbenari
350
+
351
+ #### Kir Shatrov
352
+
353
+ email: shatrov@me.com
354
+
355
+ twitter: @Kiiiir
356
+
357
+ ## Copyright
358
+
359
+ Copyright (c) 2010-2014 Noam Ben Ari (nbenari@gmail.com). See LICENSE.txt for
360
+ further details.