cbsorcery 0.8.6
Sign up to get free protection for your applications and to get access to all the features.
- data/.document +5 -0
- data/.gitignore +56 -0
- data/.rspec +1 -0
- data/.travis.yml +40 -0
- data/CHANGELOG.md +263 -0
- data/Gemfile +6 -0
- data/LICENSE.txt +20 -0
- data/README.md +360 -0
- data/Rakefile +6 -0
- data/gemfiles/active_record-rails40.gemfile +7 -0
- data/gemfiles/active_record-rails41.gemfile +7 -0
- data/lib/generators/sorcery/USAGE +22 -0
- data/lib/generators/sorcery/helpers.rb +40 -0
- data/lib/generators/sorcery/install_generator.rb +95 -0
- data/lib/generators/sorcery/templates/initializer.rb +451 -0
- data/lib/generators/sorcery/templates/migration/activity_logging.rb +10 -0
- data/lib/generators/sorcery/templates/migration/brute_force_protection.rb +9 -0
- data/lib/generators/sorcery/templates/migration/core.rb +13 -0
- data/lib/generators/sorcery/templates/migration/external.rb +12 -0
- data/lib/generators/sorcery/templates/migration/remember_me.rb +8 -0
- data/lib/generators/sorcery/templates/migration/reset_password.rb +9 -0
- data/lib/generators/sorcery/templates/migration/user_activation.rb +9 -0
- data/lib/sorcery.rb +85 -0
- data/lib/sorcery/adapters/active_record_adapter.rb +120 -0
- data/lib/sorcery/adapters/base_adapter.rb +30 -0
- data/lib/sorcery/controller.rb +157 -0
- data/lib/sorcery/controller/config.rb +65 -0
- data/lib/sorcery/controller/submodules/activity_logging.rb +82 -0
- data/lib/sorcery/controller/submodules/brute_force_protection.rb +38 -0
- data/lib/sorcery/controller/submodules/external.rb +199 -0
- data/lib/sorcery/controller/submodules/http_basic_auth.rb +74 -0
- data/lib/sorcery/controller/submodules/remember_me.rb +81 -0
- data/lib/sorcery/controller/submodules/session_timeout.rb +56 -0
- data/lib/sorcery/crypto_providers/aes256.rb +51 -0
- data/lib/sorcery/crypto_providers/bcrypt.rb +97 -0
- data/lib/sorcery/crypto_providers/common.rb +35 -0
- data/lib/sorcery/crypto_providers/md5.rb +19 -0
- data/lib/sorcery/crypto_providers/sha1.rb +28 -0
- data/lib/sorcery/crypto_providers/sha256.rb +36 -0
- data/lib/sorcery/crypto_providers/sha512.rb +36 -0
- data/lib/sorcery/engine.rb +21 -0
- data/lib/sorcery/model.rb +183 -0
- data/lib/sorcery/model/config.rb +96 -0
- data/lib/sorcery/model/submodules/activity_logging.rb +70 -0
- data/lib/sorcery/model/submodules/brute_force_protection.rb +125 -0
- data/lib/sorcery/model/submodules/external.rb +100 -0
- data/lib/sorcery/model/submodules/remember_me.rb +62 -0
- data/lib/sorcery/model/submodules/reset_password.rb +131 -0
- data/lib/sorcery/model/submodules/user_activation.rb +149 -0
- data/lib/sorcery/model/temporary_token.rb +30 -0
- data/lib/sorcery/protocols/certs/ca-bundle.crt +5182 -0
- data/lib/sorcery/protocols/oauth.rb +42 -0
- data/lib/sorcery/protocols/oauth2.rb +47 -0
- data/lib/sorcery/providers/base.rb +27 -0
- data/lib/sorcery/providers/facebook.rb +63 -0
- data/lib/sorcery/providers/github.rb +51 -0
- data/lib/sorcery/providers/google.rb +51 -0
- data/lib/sorcery/providers/jira.rb +77 -0
- data/lib/sorcery/providers/linkedin.rb +66 -0
- data/lib/sorcery/providers/liveid.rb +53 -0
- data/lib/sorcery/providers/twitter.rb +59 -0
- data/lib/sorcery/providers/vk.rb +63 -0
- data/lib/sorcery/providers/xing.rb +64 -0
- data/lib/sorcery/railties/tasks.rake +6 -0
- data/lib/sorcery/test_helpers/internal.rb +78 -0
- data/lib/sorcery/test_helpers/internal/rails.rb +68 -0
- data/lib/sorcery/test_helpers/rails/controller.rb +21 -0
- data/lib/sorcery/test_helpers/rails/integration.rb +26 -0
- data/lib/sorcery/version.rb +3 -0
- data/sorcery.gemspec +34 -0
- data/spec/active_record/user_activation_spec.rb +18 -0
- data/spec/active_record/user_activity_logging_spec.rb +17 -0
- data/spec/active_record/user_brute_force_protection_spec.rb +16 -0
- data/spec/active_record/user_oauth_spec.rb +16 -0
- data/spec/active_record/user_remember_me_spec.rb +16 -0
- data/spec/active_record/user_reset_password_spec.rb +16 -0
- data/spec/active_record/user_spec.rb +37 -0
- data/spec/controllers/controller_activity_logging_spec.rb +124 -0
- data/spec/controllers/controller_brute_force_protection_spec.rb +43 -0
- data/spec/controllers/controller_http_basic_auth_spec.rb +68 -0
- data/spec/controllers/controller_oauth2_spec.rb +407 -0
- data/spec/controllers/controller_oauth_spec.rb +240 -0
- data/spec/controllers/controller_remember_me_spec.rb +117 -0
- data/spec/controllers/controller_session_timeout_spec.rb +80 -0
- data/spec/controllers/controller_spec.rb +215 -0
- data/spec/orm/active_record.rb +21 -0
- data/spec/rails_app/app/active_record/authentication.rb +3 -0
- data/spec/rails_app/app/active_record/user.rb +5 -0
- data/spec/rails_app/app/active_record/user_provider.rb +3 -0
- data/spec/rails_app/app/controllers/sorcery_controller.rb +265 -0
- data/spec/rails_app/app/helpers/application_helper.rb +2 -0
- data/spec/rails_app/app/mailers/sorcery_mailer.rb +32 -0
- data/spec/rails_app/app/views/application/index.html.erb +17 -0
- data/spec/rails_app/app/views/layouts/application.html.erb +14 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_email.html.erb +17 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_email.text.erb +9 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_needed_email.html.erb +17 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_success_email.html.erb +17 -0
- data/spec/rails_app/app/views/sorcery_mailer/activation_success_email.text.erb +9 -0
- data/spec/rails_app/app/views/sorcery_mailer/reset_password_email.html.erb +16 -0
- data/spec/rails_app/app/views/sorcery_mailer/reset_password_email.text.erb +8 -0
- data/spec/rails_app/app/views/sorcery_mailer/send_unlock_token_email.text.erb +1 -0
- data/spec/rails_app/config.ru +4 -0
- data/spec/rails_app/config/application.rb +56 -0
- data/spec/rails_app/config/boot.rb +4 -0
- data/spec/rails_app/config/database.yml +22 -0
- data/spec/rails_app/config/environment.rb +5 -0
- data/spec/rails_app/config/environments/test.rb +37 -0
- data/spec/rails_app/config/initializers/backtrace_silencers.rb +7 -0
- data/spec/rails_app/config/initializers/inflections.rb +10 -0
- data/spec/rails_app/config/initializers/mime_types.rb +5 -0
- data/spec/rails_app/config/initializers/secret_token.rb +7 -0
- data/spec/rails_app/config/initializers/session_store.rb +12 -0
- data/spec/rails_app/config/locales/en.yml +5 -0
- data/spec/rails_app/config/routes.rb +48 -0
- data/spec/rails_app/db/migrate/activation/20101224223622_add_activation_to_users.rb +17 -0
- data/spec/rails_app/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb +19 -0
- data/spec/rails_app/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb +13 -0
- data/spec/rails_app/db/migrate/core/20101224223620_create_users.rb +16 -0
- data/spec/rails_app/db/migrate/external/20101224223628_create_authentications_and_user_providers.rb +22 -0
- data/spec/rails_app/db/migrate/remember_me/20101224223623_add_remember_me_token_to_users.rb +15 -0
- data/spec/rails_app/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb +13 -0
- data/spec/rails_app/db/schema.rb +23 -0
- data/spec/rails_app/db/seeds.rb +7 -0
- data/spec/shared_examples/user_activation_shared_examples.rb +242 -0
- data/spec/shared_examples/user_activity_logging_shared_examples.rb +97 -0
- data/spec/shared_examples/user_brute_force_protection_shared_examples.rb +156 -0
- data/spec/shared_examples/user_oauth_shared_examples.rb +36 -0
- data/spec/shared_examples/user_remember_me_shared_examples.rb +57 -0
- data/spec/shared_examples/user_reset_password_shared_examples.rb +263 -0
- data/spec/shared_examples/user_shared_examples.rb +467 -0
- data/spec/sorcery_crypto_providers_spec.rb +198 -0
- data/spec/spec.opts +2 -0
- data/spec/spec_helper.rb +41 -0
- metadata +350 -0
data/.document
ADDED
data/.gitignore
ADDED
@@ -0,0 +1,56 @@
|
|
1
|
+
# rcov generated
|
2
|
+
coverage
|
3
|
+
|
4
|
+
# rdoc generated
|
5
|
+
rdoc
|
6
|
+
|
7
|
+
# yard generated
|
8
|
+
doc
|
9
|
+
.yardoc
|
10
|
+
|
11
|
+
# bundler
|
12
|
+
.bundle
|
13
|
+
|
14
|
+
# jeweler generated
|
15
|
+
pkg
|
16
|
+
|
17
|
+
# for RVM
|
18
|
+
.rvmrc
|
19
|
+
|
20
|
+
# for RubyMine
|
21
|
+
.idea
|
22
|
+
|
23
|
+
# Have editor/IDE/OS specific files you need to ignore? Consider using a global gitignore:
|
24
|
+
#
|
25
|
+
# * Create a file at ~/.gitignore
|
26
|
+
# * Include files you want ignored
|
27
|
+
# * Run: git config --global core.excludesfile ~/.gitignore
|
28
|
+
#
|
29
|
+
# After doing this, these files will be ignored in all your git projects,
|
30
|
+
# saving you from having to 'pollute' every project you touch with them
|
31
|
+
#
|
32
|
+
# Not sure what to needs to be ignored for particular editors/OSes? Here's some ideas to get you started. (Remember, remove the leading # of the line)
|
33
|
+
#
|
34
|
+
# For MacOS:
|
35
|
+
#
|
36
|
+
#.DS_Store
|
37
|
+
#
|
38
|
+
# For TextMate
|
39
|
+
#*.tmproj
|
40
|
+
tmtags
|
41
|
+
#
|
42
|
+
# For emacs:
|
43
|
+
#*~
|
44
|
+
#\#*
|
45
|
+
#.\#*
|
46
|
+
#
|
47
|
+
# For vim:
|
48
|
+
#*.swp
|
49
|
+
#
|
50
|
+
spec/rails_app/log/*
|
51
|
+
*.log
|
52
|
+
*.sqlite3
|
53
|
+
Gemfile*.lock
|
54
|
+
gemfiles/*.lock
|
55
|
+
.ruby-version
|
56
|
+
tags
|
data/.rspec
ADDED
@@ -0,0 +1 @@
|
|
1
|
+
--color
|
data/.travis.yml
ADDED
@@ -0,0 +1,40 @@
|
|
1
|
+
language: ruby
|
2
|
+
rvm:
|
3
|
+
- 1.9.3
|
4
|
+
- 2.0.0
|
5
|
+
- 2.1
|
6
|
+
|
7
|
+
gemfile:
|
8
|
+
- Gemfile
|
9
|
+
|
10
|
+
before_script:
|
11
|
+
- mysql -e 'create database sorcery_test;'
|
12
|
+
|
13
|
+
matrix:
|
14
|
+
allow_failures:
|
15
|
+
- rvm: :jruby
|
16
|
+
|
17
|
+
include:
|
18
|
+
- rvm: 1.9.3
|
19
|
+
gemfile: gemfiles/active_record-rails41.gemfile
|
20
|
+
|
21
|
+
- rvm: 2.0.0
|
22
|
+
gemfile: gemfiles/active_record-rails41.gemfile
|
23
|
+
|
24
|
+
- rvm: 2.1
|
25
|
+
gemfile: gemfiles/active_record-rails41.gemfile
|
26
|
+
|
27
|
+
- rvm: jruby
|
28
|
+
gemfile: gemfiles/active_record-rails41.gemfile
|
29
|
+
|
30
|
+
- rvm: 1.9.3
|
31
|
+
gemfile: gemfiles/active_record-rails40.gemfile
|
32
|
+
|
33
|
+
- rvm: 2.0.0
|
34
|
+
gemfile: gemfiles/active_record-rails40.gemfile
|
35
|
+
|
36
|
+
- rvm: 2.1
|
37
|
+
gemfile: gemfiles/active_record-rails40.gemfile
|
38
|
+
|
39
|
+
- rvm: jruby
|
40
|
+
gemfile: gemfiles/active_record-rails40.gemfile
|
data/CHANGELOG.md
ADDED
@@ -0,0 +1,263 @@
|
|
1
|
+
# Changelog
|
2
|
+
|
3
|
+
## 1.0 (not released yet)
|
4
|
+
|
5
|
+
* Adapters (Mongoid, MongoMapper, DataMapper) are now separated from the core Sorcery repo and moved under `sorcery-rails` organization. Special thanks to @juike!
|
6
|
+
|
7
|
+
## 0.8.7 (not released yet)
|
8
|
+
|
9
|
+
* `find_by_provider_and_uid` method was replaced with `find_by_oauth_credentials`
|
10
|
+
* Sorcery::VERSION constant was added to allow easy version check
|
11
|
+
* `@user.setup_activation` method was made to be public
|
12
|
+
* `current_users` method is deprecated
|
13
|
+
* Fetching email from VK auth, thanks to @makaroni4
|
14
|
+
* Add logged_in? method to test_helpers
|
15
|
+
* #locked? method is now public API
|
16
|
+
* Introduces a new User instance method `generate_reset_password_token` to generate a new reset password token without sending an email
|
17
|
+
|
18
|
+
## 0.8.6
|
19
|
+
|
20
|
+
* `current_user` returns `nil` instead of `false` if there's no user loggd in (#493)
|
21
|
+
* MongoMapper adapter does not override `save!` method anymore. However due to ORM's lack of support for `validate: false` in `save!`, the combination of `validate: false` and `raise_on_failure: true` is not possible in MongoMapper. The errors will not be raised in this situation. (#151)
|
22
|
+
* Fixed rename warnings for bcrypt-ruby
|
23
|
+
* The way Sorcery adapters are included has been changed due to problem with multiple `included` blocks error in `ActiveSupport::Concern` class (#527)
|
24
|
+
* Session timeout works with new cookie serializer introduced in Rails 4.1
|
25
|
+
* Rails 4.1 compatibility bugs were fixed, this version is fully supported (#538)
|
26
|
+
* VK providers now supports `scope` option
|
27
|
+
* Support for DataMapper added
|
28
|
+
* Helpers for integration tests were added
|
29
|
+
* Fixed problems with special characters in user login attributes (MongoMapper & Mongoid)
|
30
|
+
* Fixed remaining `password_confirmation` value - it is now cleared just like `password`
|
31
|
+
|
32
|
+
## 0.8.5
|
33
|
+
* Fixed add_provider_to_user with CamelCased authentications_class model (#382)
|
34
|
+
* Fixed unlock_token_mailer_disabled to only disable automatic mailing (#467)
|
35
|
+
* Make send_email_* methods easier to overwrite (#473)
|
36
|
+
* Don't add `:username` field for User. Config option `username_attribute_names` is now `:email` by default instead of `:username`.
|
37
|
+
|
38
|
+
If you're using `username` as main field for users to login, you'll need to tune your Sorcery config:
|
39
|
+
|
40
|
+
```ruby
|
41
|
+
config.user_config do |user|
|
42
|
+
# ...
|
43
|
+
user.username_attribute_names = [:username]
|
44
|
+
end
|
45
|
+
```
|
46
|
+
* `rails generate sorcery:install` now works inside Rails engine
|
47
|
+
|
48
|
+
## 0.8.4
|
49
|
+
|
50
|
+
* Few security fixes in `external` module
|
51
|
+
|
52
|
+
## 0.8.3 (yanked because of bad Jeweler release)
|
53
|
+
|
54
|
+
## 0.8.2
|
55
|
+
|
56
|
+
* Activity logging feature has a new column called `last_login_from_ip_address` (string type). If you use ActiveRecord, you will have to add this column to DB ([#465](https://github.com/NoamB/sorcery/issues/465))
|
57
|
+
|
58
|
+
## 0.8.1
|
59
|
+
<!-- TO BE WRITTEN -->
|
60
|
+
|
61
|
+
## 0.8.0
|
62
|
+
<!-- TO BE WRITTEN -->
|
63
|
+
|
64
|
+
## 0.7.13
|
65
|
+
<!-- TO BE WRITTEN -->
|
66
|
+
|
67
|
+
## 0.7.12
|
68
|
+
<!-- TO BE WRITTEN -->
|
69
|
+
|
70
|
+
## 0.7.11
|
71
|
+
<!-- TO BE WRITTEN -->
|
72
|
+
|
73
|
+
## 0.7.10
|
74
|
+
<!-- TO BE WRITTEN -->
|
75
|
+
|
76
|
+
## 0.7.9
|
77
|
+
<!-- TO BE WRITTEN -->
|
78
|
+
|
79
|
+
## 0.7.8
|
80
|
+
<!-- TO BE WRITTEN -->
|
81
|
+
|
82
|
+
## 0.7.7
|
83
|
+
<!-- TO BE WRITTEN -->
|
84
|
+
|
85
|
+
## 0.7.6
|
86
|
+
<!-- TO BE WRITTEN -->
|
87
|
+
|
88
|
+
## 0.7.5
|
89
|
+
<!-- TO BE WRITTEN -->
|
90
|
+
|
91
|
+
## 0.7.1-0.7.4
|
92
|
+
|
93
|
+
* Fixed a bug in the new generator
|
94
|
+
* Many bugfixes
|
95
|
+
* MongoMapper added to supported ORMs list, thanks @kbighorse
|
96
|
+
* Sinatra support discontinued!
|
97
|
+
* New generator contributed by @ahazem
|
98
|
+
* Cookie domain setting contributed by @Highcode
|
99
|
+
|
100
|
+
|
101
|
+
## 0.7.0
|
102
|
+
|
103
|
+
* Many bugfixes
|
104
|
+
* Added default SSL certificate for oauth2
|
105
|
+
* Added multi-username ability
|
106
|
+
* Security fixes (CSRF, cookie digesting)
|
107
|
+
* Added auto_login(user) to the API
|
108
|
+
* Updated gem versions of oauth(1/2)
|
109
|
+
* Added logged_in? as a view helper
|
110
|
+
* Github provider added to external submodule
|
111
|
+
|
112
|
+
|
113
|
+
## 0.6.1
|
114
|
+
|
115
|
+
Gemfile versions updated due to public demand.
|
116
|
+
(bcrypt 3.0.0 and oauth2 0.4.1)
|
117
|
+
|
118
|
+
|
119
|
+
## 0.6.0
|
120
|
+
|
121
|
+
Fixes issues with external user_hash not including some fields, and an issue with User model not loaded when user_class is called. Now config.user_class should be a string or a symbol.
|
122
|
+
|
123
|
+
Improved specs.
|
124
|
+
|
125
|
+
## 0.5.3
|
126
|
+
|
127
|
+
Fixed #9
|
128
|
+
Fixed hardcoded method names in remember_me submodule.
|
129
|
+
Improved specs.
|
130
|
+
|
131
|
+
## 0.5.21
|
132
|
+
|
133
|
+
Fixed typo in initializer - MUST be "config.user_class = User"
|
134
|
+
|
135
|
+
## 0.5.2
|
136
|
+
|
137
|
+
Fixed #3 and #4 - Modular Sinatra apps work now, and User model isn't cached in development mode.
|
138
|
+
|
139
|
+
## 0.5.1
|
140
|
+
|
141
|
+
Fixed bug in reset_password - after reset can't login due to bad salt creation. Affected only Mongoid.
|
142
|
+
|
143
|
+
## 0.5.0
|
144
|
+
|
145
|
+
Added support for Mongoid! (still buggy and not recommended for serious use)
|
146
|
+
|
147
|
+
'reset_password!(:password => new_password)' changed into 'change_password!(new_password)'
|
148
|
+
|
149
|
+
## 0.4.2
|
150
|
+
|
151
|
+
Added test helpers for Rails 3 & Sinatra.
|
152
|
+
|
153
|
+
## 0.4.1
|
154
|
+
|
155
|
+
Fixing Rails app name in initializer.
|
156
|
+
|
157
|
+
## 0.4.0
|
158
|
+
|
159
|
+
Changed the way Sorcery is configured.
|
160
|
+
Now inside the model only add:
|
161
|
+
|
162
|
+
```
|
163
|
+
authenticates_with_sorcery!
|
164
|
+
```
|
165
|
+
|
166
|
+
In the controller no code is needed! All configuration is done in an initializer.
|
167
|
+
Added a rake task to create it.
|
168
|
+
|
169
|
+
```
|
170
|
+
rake sorcery:bootstrap
|
171
|
+
```
|
172
|
+
|
173
|
+
## 0.3.1
|
174
|
+
|
175
|
+
Renamed "oauth" module to "external" and made API prettier.
|
176
|
+
```
|
177
|
+
auth_at_provider(provider) => login_at(provider)
|
178
|
+
login_from_access_token(provider) => login_from(provider)
|
179
|
+
create_from_provider!(provider) => create_from(provider)
|
180
|
+
```
|
181
|
+
|
182
|
+
## 0.3.0
|
183
|
+
|
184
|
+
Added Sinatra support!
|
185
|
+
|
186
|
+
|
187
|
+
Added Rails 3 generator for migrations
|
188
|
+
|
189
|
+
|
190
|
+
## 0.2.1
|
191
|
+
|
192
|
+
Fixed bug with OAuth submodule - oauth gems were not required properly in gem.
|
193
|
+
|
194
|
+
|
195
|
+
Fixed bug with OAuth submodule - Authentications class was not passed between model and controller in all cases resulting in Nil exception.
|
196
|
+
|
197
|
+
|
198
|
+
## 0.2.0
|
199
|
+
|
200
|
+
Added OAuth submodule.
|
201
|
+
|
202
|
+
### OAuth:
|
203
|
+
* OAuth1 and OAuth2 support (currently twitter & facebook)
|
204
|
+
* configurable db field names and authentications table.
|
205
|
+
|
206
|
+
Some bug fixes: 'return_to' feature, brute force permanent ban.
|
207
|
+
|
208
|
+
|
209
|
+
## 0.1.4
|
210
|
+
|
211
|
+
Added activity logging submodule.
|
212
|
+
|
213
|
+
|
214
|
+
### Activity Logging:
|
215
|
+
* automatic logging of last login, last logout and last activity time.
|
216
|
+
* an easy method of collecting the list of currently logged in users.
|
217
|
+
* configurable timeout by which to decide whether to include a user in the list of logged in users.
|
218
|
+
|
219
|
+
|
220
|
+
Fixed bug in basic_auth - it didn't set the session[:user_id] on successful login and tried to relogin from basic_auth on every action.
|
221
|
+
|
222
|
+
|
223
|
+
Added Reset Password hammering protection and updated the API.
|
224
|
+
|
225
|
+
|
226
|
+
Totally rewritten Brute Force Protection submodule.
|
227
|
+
|
228
|
+
|
229
|
+
## 0.1.3
|
230
|
+
|
231
|
+
Added support for Basic HTTP Auth.
|
232
|
+
|
233
|
+
## 0.1.2
|
234
|
+
|
235
|
+
Separated mailers between user_activation and password_reset and updated readme.
|
236
|
+
|
237
|
+
## 0.1.1
|
238
|
+
|
239
|
+
Fixed bug with BCrypt not being used properly by the lib and thus not working for authentication.
|
240
|
+
|
241
|
+
## 0.1.0
|
242
|
+
|
243
|
+
### Core Features:
|
244
|
+
* login/logout, optional redirect on login to where the user tried to reach before, configurable redirect for non-logged-in users.
|
245
|
+
* password encryption, algorithms: bcrypt(default), md5, sha1, sha256, sha512, aes256, custom(yours!), none. Configurable stretches and salt.
|
246
|
+
* configurable attribute names for username, password and email.
|
247
|
+
### User Activation:
|
248
|
+
* User activation by email with optional success email.
|
249
|
+
* configurable attribute names.
|
250
|
+
* configurable mailer.
|
251
|
+
* Optionally prevent active users to login.
|
252
|
+
### Password Reset:
|
253
|
+
* Reset password with email verification.
|
254
|
+
* configurable mailer, method name, and attribute name.
|
255
|
+
### Remember Me:
|
256
|
+
* Remember me with configurable expiration.
|
257
|
+
* configurable attribute names.
|
258
|
+
## Session Timeout:
|
259
|
+
* Configurable session timeout.
|
260
|
+
* Optionally session timeout will be calculated from last user action.
|
261
|
+
### Brute Force Protection:
|
262
|
+
* Brute force login hammering protection.
|
263
|
+
* configurable logins before ban, logins within time period before ban, ban time and ban action.
|
data/Gemfile
ADDED
data/LICENSE.txt
ADDED
@@ -0,0 +1,20 @@
|
|
1
|
+
Copyright (c) 2010 Noam Ben-Ari <mailto:nbenari@gmail.com>
|
2
|
+
|
3
|
+
Permission is hereby granted, free of charge, to any person obtaining
|
4
|
+
a copy of this software and associated documentation files (the
|
5
|
+
"Software"), to deal in the Software without restriction, including
|
6
|
+
without limitation the rights to use, copy, modify, merge, publish,
|
7
|
+
distribute, sublicense, and/or sell copies of the Software, and to
|
8
|
+
permit persons to whom the Software is furnished to do so, subject to
|
9
|
+
the following conditions:
|
10
|
+
|
11
|
+
The above copyright notice and this permission notice shall be
|
12
|
+
included in all copies or substantial portions of the Software.
|
13
|
+
|
14
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
15
|
+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
16
|
+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
17
|
+
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
18
|
+
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
19
|
+
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
20
|
+
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
data/README.md
ADDED
@@ -0,0 +1,360 @@
|
|
1
|
+
[![Build Status](https://travis-ci.org/NoamB/sorcery.svg?branch=master)](https://travis-ci.org/NoamB/sorcery)
|
2
|
+
[![Code Climate](https://codeclimate.com/github/NoamB/sorcery.png)](https://codeclimate.com/github/NoamB/sorcery)
|
3
|
+
[![Inline docs](http://inch-ci.org/github/NoamB/sorcery.png?branch=master)](http://inch-ci.org/github/NoamB/sorcery)
|
4
|
+
|
5
|
+
# sorcery
|
6
|
+
Magical Authentication for Rails 3 and 4. Supports ActiveRecord,
|
7
|
+
DataMapper, Mongoid and MongoMapper.
|
8
|
+
|
9
|
+
Inspired by restful_authentication, Authlogic and Devise. Crypto code taken
|
10
|
+
almost unchanged from Authlogic. OAuth code inspired by OmniAuth and Ryan
|
11
|
+
Bates's railscasts about it.
|
12
|
+
|
13
|
+
**What's happening now?** We are rewriting Sorcery with decoupled DB adapters and using modern Rails 4 patterns. The next release (1.0) will be containing some API-breaking changes. Development is going right in the `master` branch.
|
14
|
+
We'll continue releasing `0.8.x` branch with security and bug fixes until November 2014.
|
15
|
+
|
16
|
+
**Rails 4 status:** [Sorcery 0.8.6](http://rubygems.org/gems/sorcery/versions/0.8.6) is fully tested and ready for Rails 4.0 and 4.1.
|
17
|
+
|
18
|
+
https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication
|
19
|
+
|
20
|
+
## Philosophy
|
21
|
+
|
22
|
+
Sorcery is a stripped-down, bare-bones authentication library, with which you
|
23
|
+
can write your own authentication flow. It was built with a few goals in mind:
|
24
|
+
|
25
|
+
* Less is more - less than 20 public methods to remember for the entire
|
26
|
+
feature-set make the lib easy to 'get'.
|
27
|
+
* No built-in or generated code - use the library's methods inside *your
|
28
|
+
own* MVC structures, and don't fight to fix someone else's.
|
29
|
+
* Magic yes, Voodoo no - the lib should be easy to hack for most developers.
|
30
|
+
* Configuration over Confusion - Centralized (1 file), Simple & short
|
31
|
+
configuration as possible, not drowning in syntactic sugar.
|
32
|
+
* Keep MVC cleanly separated - DB is for models, sessions are for
|
33
|
+
controllers. Models stay unaware of sessions.
|
34
|
+
|
35
|
+
|
36
|
+
Hopefully, I've achieved this. If not, let me know.
|
37
|
+
|
38
|
+
## Useful Links
|
39
|
+
|
40
|
+
[Documentation](http://rubydoc.info/gems/sorcery) |
|
41
|
+
[Railscast](http://railscasts.com/episodes/283-authentication-with-sorcery) | [Simple tutorial](https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication) | [Example Rails 3 app](https://github.com/NoamB/sorcery-example-app)
|
42
|
+
|
43
|
+
Check out the tutorials in the [Wiki](https://github.com/NoamB/sorcery/wiki) for more!
|
44
|
+
|
45
|
+
## API Summary
|
46
|
+
|
47
|
+
Below is a summary of the library methods. Most method names are self
|
48
|
+
explaining and the rest are commented:
|
49
|
+
|
50
|
+
|
51
|
+
### core
|
52
|
+
```ruby
|
53
|
+
require_login # this is a before filter
|
54
|
+
login(email, password, remember_me = false)
|
55
|
+
auto_login(user)# login without credentials
|
56
|
+
logout
|
57
|
+
logged_in? # available to view
|
58
|
+
current_user # available to view
|
59
|
+
redirect_back_or_to # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
|
60
|
+
@user.external? # external users, such as facebook/twitter etc.
|
61
|
+
User.authenticates_with_sorcery!
|
62
|
+
```
|
63
|
+
|
64
|
+
### http basic auth
|
65
|
+
```ruby
|
66
|
+
require_login_from_http_basic # this is a before filter
|
67
|
+
```
|
68
|
+
|
69
|
+
### external
|
70
|
+
```ruby
|
71
|
+
login_at(provider) # sends the user to an external service (twitter etc.) to authenticate.
|
72
|
+
login_from(provider) # tries to login from the external provider's callback.
|
73
|
+
create_from(provider) # create the user in the local app db.
|
74
|
+
```
|
75
|
+
|
76
|
+
### remember me
|
77
|
+
```ruby
|
78
|
+
auto_login(user, should_remember=false) # login without credentials, optional remember_me
|
79
|
+
remember_me!
|
80
|
+
forget_me!
|
81
|
+
```
|
82
|
+
|
83
|
+
### reset password
|
84
|
+
```ruby
|
85
|
+
User.load_from_reset_password_token(token)
|
86
|
+
@user.generate_reset_password_token! # if you want to send the email by youself
|
87
|
+
@user.deliver_reset_password_instructions! # generates the token and sends the email
|
88
|
+
@user.change_password!(new_password)
|
89
|
+
```
|
90
|
+
|
91
|
+
### user activation
|
92
|
+
```ruby
|
93
|
+
User.load_from_activation_token(token)
|
94
|
+
@user.setup_activation
|
95
|
+
@user.activate!
|
96
|
+
```
|
97
|
+
|
98
|
+
Please see the tutorials in the github wiki for detailed usage information.
|
99
|
+
|
100
|
+
## Installation
|
101
|
+
|
102
|
+
If using bundler, first add 'sorcery' to your Gemfile:
|
103
|
+
|
104
|
+
```ruby
|
105
|
+
gem "sorcery"
|
106
|
+
```
|
107
|
+
|
108
|
+
And run
|
109
|
+
|
110
|
+
```ruby
|
111
|
+
bundle install
|
112
|
+
```
|
113
|
+
|
114
|
+
Otherwise simply
|
115
|
+
|
116
|
+
```ruby
|
117
|
+
gem install sorcery
|
118
|
+
```
|
119
|
+
|
120
|
+
## Rails configuration
|
121
|
+
|
122
|
+
```bash
|
123
|
+
rails generate sorcery:install
|
124
|
+
```
|
125
|
+
|
126
|
+
This will generate the core migration file, the initializer file and the
|
127
|
+
'User' model class.
|
128
|
+
|
129
|
+
```bash
|
130
|
+
rails generate sorcery:install remember_me reset_password
|
131
|
+
```
|
132
|
+
|
133
|
+
This will generate the migrations files for remember_me and reset_password
|
134
|
+
submodules and will create the initializer file (and add submodules to it),
|
135
|
+
and create the 'User' model class.
|
136
|
+
|
137
|
+
```bash
|
138
|
+
rails generate sorcery:install --model Person
|
139
|
+
```
|
140
|
+
|
141
|
+
This will generate the core migration file, the initializer and change the
|
142
|
+
model class (in the initializer and migration files) to the class 'Person'
|
143
|
+
(and its pluralized version, 'people')
|
144
|
+
|
145
|
+
```bash
|
146
|
+
rails generate sorcery:install http_basic_auth external remember_me --only-submodules
|
147
|
+
```
|
148
|
+
|
149
|
+
This will generate only the migration files for the specified submodules and
|
150
|
+
will add them to the initializer file.
|
151
|
+
|
152
|
+
Inside the initializer, the comments will tell you what each setting does.
|
153
|
+
|
154
|
+
## DelayedJob Integration
|
155
|
+
|
156
|
+
By default emails are sent synchronously. You can send them asynchronously by
|
157
|
+
using the [delayed_job gem](https://github.com/collectiveidea/delayed_job).
|
158
|
+
|
159
|
+
After implementing the `delayed_job` into your project add the code below at
|
160
|
+
the end of the `config/initializers/sorcery.rb` file. After that all emails
|
161
|
+
will be sent asynchronously.
|
162
|
+
|
163
|
+
```ruby
|
164
|
+
module Sorcery
|
165
|
+
module Model
|
166
|
+
module InstanceMethods
|
167
|
+
def generic_send_email(method, mailer)
|
168
|
+
config = sorcery_config
|
169
|
+
mail = config.send(mailer).delay.send(config.send(method), self)
|
170
|
+
end
|
171
|
+
end
|
172
|
+
end
|
173
|
+
end
|
174
|
+
```
|
175
|
+
|
176
|
+
Sidekiq and Resque integrations are coming soon.
|
177
|
+
|
178
|
+
## Single Table Inheritance (STI) Support
|
179
|
+
STI is supported via a single setting in config/initializers/sorcery.rb.
|
180
|
+
|
181
|
+
## Full Features List by module
|
182
|
+
|
183
|
+
**Core** (see [lib/sorcery/model.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model.rb) and
|
184
|
+
[lib/sorcery/controller.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller.rb)):
|
185
|
+
|
186
|
+
* login/logout, optional return user to requested url on login, configurable
|
187
|
+
redirect for non-logged-in users.
|
188
|
+
* password encryption, algorithms: bcrypt(default), md5, sha1, sha256,
|
189
|
+
sha512, aes256, custom(yours!), none. Configurable stretches and salt.
|
190
|
+
* configurable attribute names for username, password and email.
|
191
|
+
* allow multiple fields to serve as username.
|
192
|
+
|
193
|
+
|
194
|
+
**User Activation** (see [lib/sorcery/model/submodules/user_activation.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/user_activation.rb)):
|
195
|
+
|
196
|
+
* User activation by email with optional success email.
|
197
|
+
* configurable attribute names.
|
198
|
+
* configurable mailer, method name, and attribute name.
|
199
|
+
* configurable temporary token expiration.
|
200
|
+
* Optionally prevent non-active users to login.
|
201
|
+
|
202
|
+
|
203
|
+
**Reset Password** (see [lib/sorcery/model/submodules/reset_password.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/reset_password.rb)):
|
204
|
+
|
205
|
+
* Reset password with email verification.
|
206
|
+
* configurable mailer, method name, and attribute name.
|
207
|
+
* configurable temporary token expiration.
|
208
|
+
* configurable time between emails (hammering protection).
|
209
|
+
|
210
|
+
|
211
|
+
**Remember Me** (see [lib/sorcery/model/submodules/remember_me.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/remember_me.rb)):
|
212
|
+
|
213
|
+
* Remember me with configurable expiration.
|
214
|
+
* configurable attribute names.
|
215
|
+
|
216
|
+
|
217
|
+
**Session Timeout** (see [lib/sorcery/controller/submodules/session_timeout.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/session_timeout.rb)):
|
218
|
+
|
219
|
+
* Configurable session timeout.
|
220
|
+
* Optionally session timeout will be calculated from last user action.
|
221
|
+
|
222
|
+
|
223
|
+
**Brute Force Protection** (see [lib/sorcery/model/submodules/brute_force_protection.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/brute_force_protection.rb)):
|
224
|
+
|
225
|
+
* Brute force login hammering protection.
|
226
|
+
* configurable logins before lock and lock duration.
|
227
|
+
|
228
|
+
|
229
|
+
**Basic HTTP Authentication** (see [lib/sorcery/controller/submodules/http_basic_auth.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/http_basic_auth.rb)):
|
230
|
+
|
231
|
+
* A before filter for requesting authentication with HTTP Basic.
|
232
|
+
* automatic login from HTTP Basic.
|
233
|
+
* automatic login is disabled if session key changed.
|
234
|
+
|
235
|
+
|
236
|
+
**Activity Logging** (see [lib/sorcery/model/submodules/activity_logging.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/activity_logging.rb)):
|
237
|
+
|
238
|
+
* automatic logging of last login, last logout, last activity time and IP
|
239
|
+
address for last login.
|
240
|
+
* an easy method of collecting the list of currently logged in users.
|
241
|
+
* configurable timeout by which to decide whether to include a user in the
|
242
|
+
list of logged in users.
|
243
|
+
|
244
|
+
|
245
|
+
**External** (see [lib/sorcery/controller/submodules/external.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/external.rb)):
|
246
|
+
|
247
|
+
* OAuth1 and OAuth2 support (currently: Twitter, Facebook, Github, Google,
|
248
|
+
LinkedIn, VK, LiveID and Xing)
|
249
|
+
* configurable db field names and authentications table.
|
250
|
+
|
251
|
+
|
252
|
+
## Next Planned Features
|
253
|
+
|
254
|
+
I've got some thoughts which include (unordered):
|
255
|
+
|
256
|
+
* Passing a block to encrypt, allowing the developer to define his own mix
|
257
|
+
of salting and encrypting
|
258
|
+
* Forgot username, maybe as part of the reset_password module
|
259
|
+
* Scoping logins (to a subdomain or another arbitrary field)
|
260
|
+
* Allowing storing the salt and crypted password in the same DB field for
|
261
|
+
extra security
|
262
|
+
* Other reset password strategies (security questions?)
|
263
|
+
* Other brute force protection strategies (captcha)
|
264
|
+
|
265
|
+
|
266
|
+
Have an idea? Let me know, and it might get into the gem!
|
267
|
+
|
268
|
+
## Backward compatibility
|
269
|
+
|
270
|
+
While the lib is young and evolving fast I'm breaking backward compatibility
|
271
|
+
quite often. I'm constantly finding better ways to do things and throwing away
|
272
|
+
old ways. To let you know when things are changing in a non-compatible way,
|
273
|
+
I'm bumping the minor version of the gem. The patch version changes are
|
274
|
+
backward compatible.
|
275
|
+
|
276
|
+
In short, an app that works with x.3.1 should be able to upgrade to x.3.2 with
|
277
|
+
no code changes. The same cannot be said about upgrading to x.4.0 and above,
|
278
|
+
however.
|
279
|
+
|
280
|
+
## DataMapper Support
|
281
|
+
|
282
|
+
Important notes:
|
283
|
+
|
284
|
+
* Expected to work with DM adapters: dm-mysql-adapter,
|
285
|
+
dm-redis-adapter.
|
286
|
+
* Submodules DM adapter dependent: activity_logging (dm-mysql-adapter)
|
287
|
+
* Usage: include DataMapper::Resource in user model, follow sorcery
|
288
|
+
instructions (remember to add property id, validators and accessor
|
289
|
+
attributes such as password and password_confirmation)
|
290
|
+
* Option downcase__username_before_authenticating and dm-mysql,
|
291
|
+
http://datamapper.lighthouseapp.com/projects/20609/tickets/1105-add-support-for-definingchanging-default-collation
|
292
|
+
|
293
|
+
## Upgrading
|
294
|
+
|
295
|
+
Important notes while upgrading:
|
296
|
+
|
297
|
+
* If you are upgrading from <= **0.8.5** and you're using Sorcery test helpers,
|
298
|
+
you need to change the way you include them to following code:
|
299
|
+
|
300
|
+
```ruby
|
301
|
+
RSpec.configure do |config|
|
302
|
+
config.include Sorcery::TestHelpers::Rails::Controller, type: :controller
|
303
|
+
config.include Sorcery::TestHelpers::Rails::Integration, type: :feature
|
304
|
+
end
|
305
|
+
```
|
306
|
+
|
307
|
+
* If are upgrading to **0.8.2** and use activity_logging feature with
|
308
|
+
ActiveRecord, you will have to add a new column
|
309
|
+
`last_login_from_ip_address`
|
310
|
+
[#465](https://github.com/NoamB/sorcery/issues/465)
|
311
|
+
* Sinatra support existed until **v0.7.0** (including), but was dropped
|
312
|
+
later due to being a maintenance nightmare.
|
313
|
+
* If upgrading from <= **0.6.1 to >= **0.7.0** you need to change
|
314
|
+
'username
|
315
|
+
_attribute_name' to 'username_attribute_names' in initializer.
|
316
|
+
* If upgrading from <= **v0.5.1** to >= **v0.5.2** you need to explicitly
|
317
|
+
set your user_class model in the initializer file.
|
318
|
+
|
319
|
+
```ruby
|
320
|
+
# This line must come after the 'user config' block.
|
321
|
+
config.user_class = User
|
322
|
+
```
|
323
|
+
|
324
|
+
|
325
|
+
## Contributing to sorcery
|
326
|
+
|
327
|
+
Your feedback is very welcome and will make this gem much much better for you,
|
328
|
+
me and everyone else. Besides feedback on code, features, suggestions and bug
|
329
|
+
reports, you may want to actually make an impact on the code. For this:
|
330
|
+
|
331
|
+
* Fork it.
|
332
|
+
* Fix it.
|
333
|
+
* Test it.
|
334
|
+
* Commit it.
|
335
|
+
* Send me a pull request so I'll... Pull it.
|
336
|
+
|
337
|
+
|
338
|
+
If you feel sorcery has made your life easier, and you would like to express
|
339
|
+
your thanks via a donation, my paypal email is in the contact details.
|
340
|
+
|
341
|
+
## Contact
|
342
|
+
|
343
|
+
Feel free to ask questions using these contact details:
|
344
|
+
|
345
|
+
#### Noam Ben-Ari
|
346
|
+
|
347
|
+
email: nbenari@gmail.com ( also for paypal )
|
348
|
+
|
349
|
+
twitter: @nbenari
|
350
|
+
|
351
|
+
#### Kir Shatrov
|
352
|
+
|
353
|
+
email: shatrov@me.com
|
354
|
+
|
355
|
+
twitter: @Kiiiir
|
356
|
+
|
357
|
+
## Copyright
|
358
|
+
|
359
|
+
Copyright (c) 2010-2014 Noam Ben Ari (nbenari@gmail.com). See LICENSE.txt for
|
360
|
+
further details.
|