cbsorcery 0.8.6

Sign up to get free protection for your applications and to get access to all the features.
Files changed (135) hide show
  1. data/.document +5 -0
  2. data/.gitignore +56 -0
  3. data/.rspec +1 -0
  4. data/.travis.yml +40 -0
  5. data/CHANGELOG.md +263 -0
  6. data/Gemfile +6 -0
  7. data/LICENSE.txt +20 -0
  8. data/README.md +360 -0
  9. data/Rakefile +6 -0
  10. data/gemfiles/active_record-rails40.gemfile +7 -0
  11. data/gemfiles/active_record-rails41.gemfile +7 -0
  12. data/lib/generators/sorcery/USAGE +22 -0
  13. data/lib/generators/sorcery/helpers.rb +40 -0
  14. data/lib/generators/sorcery/install_generator.rb +95 -0
  15. data/lib/generators/sorcery/templates/initializer.rb +451 -0
  16. data/lib/generators/sorcery/templates/migration/activity_logging.rb +10 -0
  17. data/lib/generators/sorcery/templates/migration/brute_force_protection.rb +9 -0
  18. data/lib/generators/sorcery/templates/migration/core.rb +13 -0
  19. data/lib/generators/sorcery/templates/migration/external.rb +12 -0
  20. data/lib/generators/sorcery/templates/migration/remember_me.rb +8 -0
  21. data/lib/generators/sorcery/templates/migration/reset_password.rb +9 -0
  22. data/lib/generators/sorcery/templates/migration/user_activation.rb +9 -0
  23. data/lib/sorcery.rb +85 -0
  24. data/lib/sorcery/adapters/active_record_adapter.rb +120 -0
  25. data/lib/sorcery/adapters/base_adapter.rb +30 -0
  26. data/lib/sorcery/controller.rb +157 -0
  27. data/lib/sorcery/controller/config.rb +65 -0
  28. data/lib/sorcery/controller/submodules/activity_logging.rb +82 -0
  29. data/lib/sorcery/controller/submodules/brute_force_protection.rb +38 -0
  30. data/lib/sorcery/controller/submodules/external.rb +199 -0
  31. data/lib/sorcery/controller/submodules/http_basic_auth.rb +74 -0
  32. data/lib/sorcery/controller/submodules/remember_me.rb +81 -0
  33. data/lib/sorcery/controller/submodules/session_timeout.rb +56 -0
  34. data/lib/sorcery/crypto_providers/aes256.rb +51 -0
  35. data/lib/sorcery/crypto_providers/bcrypt.rb +97 -0
  36. data/lib/sorcery/crypto_providers/common.rb +35 -0
  37. data/lib/sorcery/crypto_providers/md5.rb +19 -0
  38. data/lib/sorcery/crypto_providers/sha1.rb +28 -0
  39. data/lib/sorcery/crypto_providers/sha256.rb +36 -0
  40. data/lib/sorcery/crypto_providers/sha512.rb +36 -0
  41. data/lib/sorcery/engine.rb +21 -0
  42. data/lib/sorcery/model.rb +183 -0
  43. data/lib/sorcery/model/config.rb +96 -0
  44. data/lib/sorcery/model/submodules/activity_logging.rb +70 -0
  45. data/lib/sorcery/model/submodules/brute_force_protection.rb +125 -0
  46. data/lib/sorcery/model/submodules/external.rb +100 -0
  47. data/lib/sorcery/model/submodules/remember_me.rb +62 -0
  48. data/lib/sorcery/model/submodules/reset_password.rb +131 -0
  49. data/lib/sorcery/model/submodules/user_activation.rb +149 -0
  50. data/lib/sorcery/model/temporary_token.rb +30 -0
  51. data/lib/sorcery/protocols/certs/ca-bundle.crt +5182 -0
  52. data/lib/sorcery/protocols/oauth.rb +42 -0
  53. data/lib/sorcery/protocols/oauth2.rb +47 -0
  54. data/lib/sorcery/providers/base.rb +27 -0
  55. data/lib/sorcery/providers/facebook.rb +63 -0
  56. data/lib/sorcery/providers/github.rb +51 -0
  57. data/lib/sorcery/providers/google.rb +51 -0
  58. data/lib/sorcery/providers/jira.rb +77 -0
  59. data/lib/sorcery/providers/linkedin.rb +66 -0
  60. data/lib/sorcery/providers/liveid.rb +53 -0
  61. data/lib/sorcery/providers/twitter.rb +59 -0
  62. data/lib/sorcery/providers/vk.rb +63 -0
  63. data/lib/sorcery/providers/xing.rb +64 -0
  64. data/lib/sorcery/railties/tasks.rake +6 -0
  65. data/lib/sorcery/test_helpers/internal.rb +78 -0
  66. data/lib/sorcery/test_helpers/internal/rails.rb +68 -0
  67. data/lib/sorcery/test_helpers/rails/controller.rb +21 -0
  68. data/lib/sorcery/test_helpers/rails/integration.rb +26 -0
  69. data/lib/sorcery/version.rb +3 -0
  70. data/sorcery.gemspec +34 -0
  71. data/spec/active_record/user_activation_spec.rb +18 -0
  72. data/spec/active_record/user_activity_logging_spec.rb +17 -0
  73. data/spec/active_record/user_brute_force_protection_spec.rb +16 -0
  74. data/spec/active_record/user_oauth_spec.rb +16 -0
  75. data/spec/active_record/user_remember_me_spec.rb +16 -0
  76. data/spec/active_record/user_reset_password_spec.rb +16 -0
  77. data/spec/active_record/user_spec.rb +37 -0
  78. data/spec/controllers/controller_activity_logging_spec.rb +124 -0
  79. data/spec/controllers/controller_brute_force_protection_spec.rb +43 -0
  80. data/spec/controllers/controller_http_basic_auth_spec.rb +68 -0
  81. data/spec/controllers/controller_oauth2_spec.rb +407 -0
  82. data/spec/controllers/controller_oauth_spec.rb +240 -0
  83. data/spec/controllers/controller_remember_me_spec.rb +117 -0
  84. data/spec/controllers/controller_session_timeout_spec.rb +80 -0
  85. data/spec/controllers/controller_spec.rb +215 -0
  86. data/spec/orm/active_record.rb +21 -0
  87. data/spec/rails_app/app/active_record/authentication.rb +3 -0
  88. data/spec/rails_app/app/active_record/user.rb +5 -0
  89. data/spec/rails_app/app/active_record/user_provider.rb +3 -0
  90. data/spec/rails_app/app/controllers/sorcery_controller.rb +265 -0
  91. data/spec/rails_app/app/helpers/application_helper.rb +2 -0
  92. data/spec/rails_app/app/mailers/sorcery_mailer.rb +32 -0
  93. data/spec/rails_app/app/views/application/index.html.erb +17 -0
  94. data/spec/rails_app/app/views/layouts/application.html.erb +14 -0
  95. data/spec/rails_app/app/views/sorcery_mailer/activation_email.html.erb +17 -0
  96. data/spec/rails_app/app/views/sorcery_mailer/activation_email.text.erb +9 -0
  97. data/spec/rails_app/app/views/sorcery_mailer/activation_needed_email.html.erb +17 -0
  98. data/spec/rails_app/app/views/sorcery_mailer/activation_success_email.html.erb +17 -0
  99. data/spec/rails_app/app/views/sorcery_mailer/activation_success_email.text.erb +9 -0
  100. data/spec/rails_app/app/views/sorcery_mailer/reset_password_email.html.erb +16 -0
  101. data/spec/rails_app/app/views/sorcery_mailer/reset_password_email.text.erb +8 -0
  102. data/spec/rails_app/app/views/sorcery_mailer/send_unlock_token_email.text.erb +1 -0
  103. data/spec/rails_app/config.ru +4 -0
  104. data/spec/rails_app/config/application.rb +56 -0
  105. data/spec/rails_app/config/boot.rb +4 -0
  106. data/spec/rails_app/config/database.yml +22 -0
  107. data/spec/rails_app/config/environment.rb +5 -0
  108. data/spec/rails_app/config/environments/test.rb +37 -0
  109. data/spec/rails_app/config/initializers/backtrace_silencers.rb +7 -0
  110. data/spec/rails_app/config/initializers/inflections.rb +10 -0
  111. data/spec/rails_app/config/initializers/mime_types.rb +5 -0
  112. data/spec/rails_app/config/initializers/secret_token.rb +7 -0
  113. data/spec/rails_app/config/initializers/session_store.rb +12 -0
  114. data/spec/rails_app/config/locales/en.yml +5 -0
  115. data/spec/rails_app/config/routes.rb +48 -0
  116. data/spec/rails_app/db/migrate/activation/20101224223622_add_activation_to_users.rb +17 -0
  117. data/spec/rails_app/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb +19 -0
  118. data/spec/rails_app/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb +13 -0
  119. data/spec/rails_app/db/migrate/core/20101224223620_create_users.rb +16 -0
  120. data/spec/rails_app/db/migrate/external/20101224223628_create_authentications_and_user_providers.rb +22 -0
  121. data/spec/rails_app/db/migrate/remember_me/20101224223623_add_remember_me_token_to_users.rb +15 -0
  122. data/spec/rails_app/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb +13 -0
  123. data/spec/rails_app/db/schema.rb +23 -0
  124. data/spec/rails_app/db/seeds.rb +7 -0
  125. data/spec/shared_examples/user_activation_shared_examples.rb +242 -0
  126. data/spec/shared_examples/user_activity_logging_shared_examples.rb +97 -0
  127. data/spec/shared_examples/user_brute_force_protection_shared_examples.rb +156 -0
  128. data/spec/shared_examples/user_oauth_shared_examples.rb +36 -0
  129. data/spec/shared_examples/user_remember_me_shared_examples.rb +57 -0
  130. data/spec/shared_examples/user_reset_password_shared_examples.rb +263 -0
  131. data/spec/shared_examples/user_shared_examples.rb +467 -0
  132. data/spec/sorcery_crypto_providers_spec.rb +198 -0
  133. data/spec/spec.opts +2 -0
  134. data/spec/spec_helper.rb +41 -0
  135. metadata +350 -0
data/.document ADDED
@@ -0,0 +1,5 @@
1
+ lib/**/*.rb
2
+ bin/*
3
+ -
4
+ features/**/*.feature
5
+ LICENSE.txt
data/.gitignore ADDED
@@ -0,0 +1,56 @@
1
+ # rcov generated
2
+ coverage
3
+
4
+ # rdoc generated
5
+ rdoc
6
+
7
+ # yard generated
8
+ doc
9
+ .yardoc
10
+
11
+ # bundler
12
+ .bundle
13
+
14
+ # jeweler generated
15
+ pkg
16
+
17
+ # for RVM
18
+ .rvmrc
19
+
20
+ # for RubyMine
21
+ .idea
22
+
23
+ # Have editor/IDE/OS specific files you need to ignore? Consider using a global gitignore:
24
+ #
25
+ # * Create a file at ~/.gitignore
26
+ # * Include files you want ignored
27
+ # * Run: git config --global core.excludesfile ~/.gitignore
28
+ #
29
+ # After doing this, these files will be ignored in all your git projects,
30
+ # saving you from having to 'pollute' every project you touch with them
31
+ #
32
+ # Not sure what to needs to be ignored for particular editors/OSes? Here's some ideas to get you started. (Remember, remove the leading # of the line)
33
+ #
34
+ # For MacOS:
35
+ #
36
+ #.DS_Store
37
+ #
38
+ # For TextMate
39
+ #*.tmproj
40
+ tmtags
41
+ #
42
+ # For emacs:
43
+ #*~
44
+ #\#*
45
+ #.\#*
46
+ #
47
+ # For vim:
48
+ #*.swp
49
+ #
50
+ spec/rails_app/log/*
51
+ *.log
52
+ *.sqlite3
53
+ Gemfile*.lock
54
+ gemfiles/*.lock
55
+ .ruby-version
56
+ tags
data/.rspec ADDED
@@ -0,0 +1 @@
1
+ --color
data/.travis.yml ADDED
@@ -0,0 +1,40 @@
1
+ language: ruby
2
+ rvm:
3
+ - 1.9.3
4
+ - 2.0.0
5
+ - 2.1
6
+
7
+ gemfile:
8
+ - Gemfile
9
+
10
+ before_script:
11
+ - mysql -e 'create database sorcery_test;'
12
+
13
+ matrix:
14
+ allow_failures:
15
+ - rvm: :jruby
16
+
17
+ include:
18
+ - rvm: 1.9.3
19
+ gemfile: gemfiles/active_record-rails41.gemfile
20
+
21
+ - rvm: 2.0.0
22
+ gemfile: gemfiles/active_record-rails41.gemfile
23
+
24
+ - rvm: 2.1
25
+ gemfile: gemfiles/active_record-rails41.gemfile
26
+
27
+ - rvm: jruby
28
+ gemfile: gemfiles/active_record-rails41.gemfile
29
+
30
+ - rvm: 1.9.3
31
+ gemfile: gemfiles/active_record-rails40.gemfile
32
+
33
+ - rvm: 2.0.0
34
+ gemfile: gemfiles/active_record-rails40.gemfile
35
+
36
+ - rvm: 2.1
37
+ gemfile: gemfiles/active_record-rails40.gemfile
38
+
39
+ - rvm: jruby
40
+ gemfile: gemfiles/active_record-rails40.gemfile
data/CHANGELOG.md ADDED
@@ -0,0 +1,263 @@
1
+ # Changelog
2
+
3
+ ## 1.0 (not released yet)
4
+
5
+ * Adapters (Mongoid, MongoMapper, DataMapper) are now separated from the core Sorcery repo and moved under `sorcery-rails` organization. Special thanks to @juike!
6
+
7
+ ## 0.8.7 (not released yet)
8
+
9
+ * `find_by_provider_and_uid` method was replaced with `find_by_oauth_credentials`
10
+ * Sorcery::VERSION constant was added to allow easy version check
11
+ * `@user.setup_activation` method was made to be public
12
+ * `current_users` method is deprecated
13
+ * Fetching email from VK auth, thanks to @makaroni4
14
+ * Add logged_in? method to test_helpers
15
+ * #locked? method is now public API
16
+ * Introduces a new User instance method `generate_reset_password_token` to generate a new reset password token without sending an email
17
+
18
+ ## 0.8.6
19
+
20
+ * `current_user` returns `nil` instead of `false` if there's no user loggd in (#493)
21
+ * MongoMapper adapter does not override `save!` method anymore. However due to ORM's lack of support for `validate: false` in `save!`, the combination of `validate: false` and `raise_on_failure: true` is not possible in MongoMapper. The errors will not be raised in this situation. (#151)
22
+ * Fixed rename warnings for bcrypt-ruby
23
+ * The way Sorcery adapters are included has been changed due to problem with multiple `included` blocks error in `ActiveSupport::Concern` class (#527)
24
+ * Session timeout works with new cookie serializer introduced in Rails 4.1
25
+ * Rails 4.1 compatibility bugs were fixed, this version is fully supported (#538)
26
+ * VK providers now supports `scope` option
27
+ * Support for DataMapper added
28
+ * Helpers for integration tests were added
29
+ * Fixed problems with special characters in user login attributes (MongoMapper & Mongoid)
30
+ * Fixed remaining `password_confirmation` value - it is now cleared just like `password`
31
+
32
+ ## 0.8.5
33
+ * Fixed add_provider_to_user with CamelCased authentications_class model (#382)
34
+ * Fixed unlock_token_mailer_disabled to only disable automatic mailing (#467)
35
+ * Make send_email_* methods easier to overwrite (#473)
36
+ * Don't add `:username` field for User. Config option `username_attribute_names` is now `:email` by default instead of `:username`.
37
+
38
+ If you're using `username` as main field for users to login, you'll need to tune your Sorcery config:
39
+
40
+ ```ruby
41
+ config.user_config do |user|
42
+ # ...
43
+ user.username_attribute_names = [:username]
44
+ end
45
+ ```
46
+ * `rails generate sorcery:install` now works inside Rails engine
47
+
48
+ ## 0.8.4
49
+
50
+ * Few security fixes in `external` module
51
+
52
+ ## 0.8.3 (yanked because of bad Jeweler release)
53
+
54
+ ## 0.8.2
55
+
56
+ * Activity logging feature has a new column called `last_login_from_ip_address` (string type). If you use ActiveRecord, you will have to add this column to DB ([#465](https://github.com/NoamB/sorcery/issues/465))
57
+
58
+ ## 0.8.1
59
+ <!-- TO BE WRITTEN -->
60
+
61
+ ## 0.8.0
62
+ <!-- TO BE WRITTEN -->
63
+
64
+ ## 0.7.13
65
+ <!-- TO BE WRITTEN -->
66
+
67
+ ## 0.7.12
68
+ <!-- TO BE WRITTEN -->
69
+
70
+ ## 0.7.11
71
+ <!-- TO BE WRITTEN -->
72
+
73
+ ## 0.7.10
74
+ <!-- TO BE WRITTEN -->
75
+
76
+ ## 0.7.9
77
+ <!-- TO BE WRITTEN -->
78
+
79
+ ## 0.7.8
80
+ <!-- TO BE WRITTEN -->
81
+
82
+ ## 0.7.7
83
+ <!-- TO BE WRITTEN -->
84
+
85
+ ## 0.7.6
86
+ <!-- TO BE WRITTEN -->
87
+
88
+ ## 0.7.5
89
+ <!-- TO BE WRITTEN -->
90
+
91
+ ## 0.7.1-0.7.4
92
+
93
+ * Fixed a bug in the new generator
94
+ * Many bugfixes
95
+ * MongoMapper added to supported ORMs list, thanks @kbighorse
96
+ * Sinatra support discontinued!
97
+ * New generator contributed by @ahazem
98
+ * Cookie domain setting contributed by @Highcode
99
+
100
+
101
+ ## 0.7.0
102
+
103
+ * Many bugfixes
104
+ * Added default SSL certificate for oauth2
105
+ * Added multi-username ability
106
+ * Security fixes (CSRF, cookie digesting)
107
+ * Added auto_login(user) to the API
108
+ * Updated gem versions of oauth(1/2)
109
+ * Added logged_in? as a view helper
110
+ * Github provider added to external submodule
111
+
112
+
113
+ ## 0.6.1
114
+
115
+ Gemfile versions updated due to public demand.
116
+ (bcrypt 3.0.0 and oauth2 0.4.1)
117
+
118
+
119
+ ## 0.6.0
120
+
121
+ Fixes issues with external user_hash not including some fields, and an issue with User model not loaded when user_class is called. Now config.user_class should be a string or a symbol.
122
+
123
+ Improved specs.
124
+
125
+ ## 0.5.3
126
+
127
+ Fixed #9
128
+ Fixed hardcoded method names in remember_me submodule.
129
+ Improved specs.
130
+
131
+ ## 0.5.21
132
+
133
+ Fixed typo in initializer - MUST be "config.user_class = User"
134
+
135
+ ## 0.5.2
136
+
137
+ Fixed #3 and #4 - Modular Sinatra apps work now, and User model isn't cached in development mode.
138
+
139
+ ## 0.5.1
140
+
141
+ Fixed bug in reset_password - after reset can't login due to bad salt creation. Affected only Mongoid.
142
+
143
+ ## 0.5.0
144
+
145
+ Added support for Mongoid! (still buggy and not recommended for serious use)
146
+
147
+ 'reset_password!(:password => new_password)' changed into 'change_password!(new_password)'
148
+
149
+ ## 0.4.2
150
+
151
+ Added test helpers for Rails 3 & Sinatra.
152
+
153
+ ## 0.4.1
154
+
155
+ Fixing Rails app name in initializer.
156
+
157
+ ## 0.4.0
158
+
159
+ Changed the way Sorcery is configured.
160
+ Now inside the model only add:
161
+
162
+ ```
163
+ authenticates_with_sorcery!
164
+ ```
165
+
166
+ In the controller no code is needed! All configuration is done in an initializer.
167
+ Added a rake task to create it.
168
+
169
+ ```
170
+ rake sorcery:bootstrap
171
+ ```
172
+
173
+ ## 0.3.1
174
+
175
+ Renamed "oauth" module to "external" and made API prettier.
176
+ ```
177
+ auth_at_provider(provider) => login_at(provider)
178
+ login_from_access_token(provider) => login_from(provider)
179
+ create_from_provider!(provider) => create_from(provider)
180
+ ```
181
+
182
+ ## 0.3.0
183
+
184
+ Added Sinatra support!
185
+
186
+
187
+ Added Rails 3 generator for migrations
188
+
189
+
190
+ ## 0.2.1
191
+
192
+ Fixed bug with OAuth submodule - oauth gems were not required properly in gem.
193
+
194
+
195
+ Fixed bug with OAuth submodule - Authentications class was not passed between model and controller in all cases resulting in Nil exception.
196
+
197
+
198
+ ## 0.2.0
199
+
200
+ Added OAuth submodule.
201
+
202
+ ### OAuth:
203
+ * OAuth1 and OAuth2 support (currently twitter & facebook)
204
+ * configurable db field names and authentications table.
205
+
206
+ Some bug fixes: 'return_to' feature, brute force permanent ban.
207
+
208
+
209
+ ## 0.1.4
210
+
211
+ Added activity logging submodule.
212
+
213
+
214
+ ### Activity Logging:
215
+ * automatic logging of last login, last logout and last activity time.
216
+ * an easy method of collecting the list of currently logged in users.
217
+ * configurable timeout by which to decide whether to include a user in the list of logged in users.
218
+
219
+
220
+ Fixed bug in basic_auth - it didn't set the session[:user_id] on successful login and tried to relogin from basic_auth on every action.
221
+
222
+
223
+ Added Reset Password hammering protection and updated the API.
224
+
225
+
226
+ Totally rewritten Brute Force Protection submodule.
227
+
228
+
229
+ ## 0.1.3
230
+
231
+ Added support for Basic HTTP Auth.
232
+
233
+ ## 0.1.2
234
+
235
+ Separated mailers between user_activation and password_reset and updated readme.
236
+
237
+ ## 0.1.1
238
+
239
+ Fixed bug with BCrypt not being used properly by the lib and thus not working for authentication.
240
+
241
+ ## 0.1.0
242
+
243
+ ### Core Features:
244
+ * login/logout, optional redirect on login to where the user tried to reach before, configurable redirect for non-logged-in users.
245
+ * password encryption, algorithms: bcrypt(default), md5, sha1, sha256, sha512, aes256, custom(yours!), none. Configurable stretches and salt.
246
+ * configurable attribute names for username, password and email.
247
+ ### User Activation:
248
+ * User activation by email with optional success email.
249
+ * configurable attribute names.
250
+ * configurable mailer.
251
+ * Optionally prevent active users to login.
252
+ ### Password Reset:
253
+ * Reset password with email verification.
254
+ * configurable mailer, method name, and attribute name.
255
+ ### Remember Me:
256
+ * Remember me with configurable expiration.
257
+ * configurable attribute names.
258
+ ## Session Timeout:
259
+ * Configurable session timeout.
260
+ * Optionally session timeout will be calculated from last user action.
261
+ ### Brute Force Protection:
262
+ * Brute force login hammering protection.
263
+ * configurable logins before ban, logins within time period before ban, ban time and ban action.
data/Gemfile ADDED
@@ -0,0 +1,6 @@
1
+ source 'https://rubygems.org'
2
+
3
+ gem 'rails', '~> 3.2'
4
+ gem 'sqlite3'
5
+
6
+ gemspec
data/LICENSE.txt ADDED
@@ -0,0 +1,20 @@
1
+ Copyright (c) 2010 Noam Ben-Ari <mailto:nbenari@gmail.com>
2
+
3
+ Permission is hereby granted, free of charge, to any person obtaining
4
+ a copy of this software and associated documentation files (the
5
+ "Software"), to deal in the Software without restriction, including
6
+ without limitation the rights to use, copy, modify, merge, publish,
7
+ distribute, sublicense, and/or sell copies of the Software, and to
8
+ permit persons to whom the Software is furnished to do so, subject to
9
+ the following conditions:
10
+
11
+ The above copyright notice and this permission notice shall be
12
+ included in all copies or substantial portions of the Software.
13
+
14
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
15
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
16
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
17
+ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
18
+ LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
19
+ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
20
+ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
data/README.md ADDED
@@ -0,0 +1,360 @@
1
+ [![Build Status](https://travis-ci.org/NoamB/sorcery.svg?branch=master)](https://travis-ci.org/NoamB/sorcery)
2
+ [![Code Climate](https://codeclimate.com/github/NoamB/sorcery.png)](https://codeclimate.com/github/NoamB/sorcery)
3
+ [![Inline docs](http://inch-ci.org/github/NoamB/sorcery.png?branch=master)](http://inch-ci.org/github/NoamB/sorcery)
4
+
5
+ # sorcery
6
+ Magical Authentication for Rails 3 and 4. Supports ActiveRecord,
7
+ DataMapper, Mongoid and MongoMapper.
8
+
9
+ Inspired by restful_authentication, Authlogic and Devise. Crypto code taken
10
+ almost unchanged from Authlogic. OAuth code inspired by OmniAuth and Ryan
11
+ Bates's railscasts about it.
12
+
13
+ **What's happening now?** We are rewriting Sorcery with decoupled DB adapters and using modern Rails 4 patterns. The next release (1.0) will be containing some API-breaking changes. Development is going right in the `master` branch.
14
+ We'll continue releasing `0.8.x` branch with security and bug fixes until November 2014.
15
+
16
+ **Rails 4 status:** [Sorcery 0.8.6](http://rubygems.org/gems/sorcery/versions/0.8.6) is fully tested and ready for Rails 4.0 and 4.1.
17
+
18
+ https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication
19
+
20
+ ## Philosophy
21
+
22
+ Sorcery is a stripped-down, bare-bones authentication library, with which you
23
+ can write your own authentication flow. It was built with a few goals in mind:
24
+
25
+ * Less is more - less than 20 public methods to remember for the entire
26
+ feature-set make the lib easy to 'get'.
27
+ * No built-in or generated code - use the library's methods inside *your
28
+ own* MVC structures, and don't fight to fix someone else's.
29
+ * Magic yes, Voodoo no - the lib should be easy to hack for most developers.
30
+ * Configuration over Confusion - Centralized (1 file), Simple & short
31
+ configuration as possible, not drowning in syntactic sugar.
32
+ * Keep MVC cleanly separated - DB is for models, sessions are for
33
+ controllers. Models stay unaware of sessions.
34
+
35
+
36
+ Hopefully, I've achieved this. If not, let me know.
37
+
38
+ ## Useful Links
39
+
40
+ [Documentation](http://rubydoc.info/gems/sorcery) |
41
+ [Railscast](http://railscasts.com/episodes/283-authentication-with-sorcery) | [Simple tutorial](https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication) | [Example Rails 3 app](https://github.com/NoamB/sorcery-example-app)
42
+
43
+ Check out the tutorials in the [Wiki](https://github.com/NoamB/sorcery/wiki) for more!
44
+
45
+ ## API Summary
46
+
47
+ Below is a summary of the library methods. Most method names are self
48
+ explaining and the rest are commented:
49
+
50
+
51
+ ### core
52
+ ```ruby
53
+ require_login # this is a before filter
54
+ login(email, password, remember_me = false)
55
+ auto_login(user)# login without credentials
56
+ logout
57
+ logged_in? # available to view
58
+ current_user # available to view
59
+ redirect_back_or_to # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
60
+ @user.external? # external users, such as facebook/twitter etc.
61
+ User.authenticates_with_sorcery!
62
+ ```
63
+
64
+ ### http basic auth
65
+ ```ruby
66
+ require_login_from_http_basic # this is a before filter
67
+ ```
68
+
69
+ ### external
70
+ ```ruby
71
+ login_at(provider) # sends the user to an external service (twitter etc.) to authenticate.
72
+ login_from(provider) # tries to login from the external provider's callback.
73
+ create_from(provider) # create the user in the local app db.
74
+ ```
75
+
76
+ ### remember me
77
+ ```ruby
78
+ auto_login(user, should_remember=false) # login without credentials, optional remember_me
79
+ remember_me!
80
+ forget_me!
81
+ ```
82
+
83
+ ### reset password
84
+ ```ruby
85
+ User.load_from_reset_password_token(token)
86
+ @user.generate_reset_password_token! # if you want to send the email by youself
87
+ @user.deliver_reset_password_instructions! # generates the token and sends the email
88
+ @user.change_password!(new_password)
89
+ ```
90
+
91
+ ### user activation
92
+ ```ruby
93
+ User.load_from_activation_token(token)
94
+ @user.setup_activation
95
+ @user.activate!
96
+ ```
97
+
98
+ Please see the tutorials in the github wiki for detailed usage information.
99
+
100
+ ## Installation
101
+
102
+ If using bundler, first add 'sorcery' to your Gemfile:
103
+
104
+ ```ruby
105
+ gem "sorcery"
106
+ ```
107
+
108
+ And run
109
+
110
+ ```ruby
111
+ bundle install
112
+ ```
113
+
114
+ Otherwise simply
115
+
116
+ ```ruby
117
+ gem install sorcery
118
+ ```
119
+
120
+ ## Rails configuration
121
+
122
+ ```bash
123
+ rails generate sorcery:install
124
+ ```
125
+
126
+ This will generate the core migration file, the initializer file and the
127
+ 'User' model class.
128
+
129
+ ```bash
130
+ rails generate sorcery:install remember_me reset_password
131
+ ```
132
+
133
+ This will generate the migrations files for remember_me and reset_password
134
+ submodules and will create the initializer file (and add submodules to it),
135
+ and create the 'User' model class.
136
+
137
+ ```bash
138
+ rails generate sorcery:install --model Person
139
+ ```
140
+
141
+ This will generate the core migration file, the initializer and change the
142
+ model class (in the initializer and migration files) to the class 'Person'
143
+ (and its pluralized version, 'people')
144
+
145
+ ```bash
146
+ rails generate sorcery:install http_basic_auth external remember_me --only-submodules
147
+ ```
148
+
149
+ This will generate only the migration files for the specified submodules and
150
+ will add them to the initializer file.
151
+
152
+ Inside the initializer, the comments will tell you what each setting does.
153
+
154
+ ## DelayedJob Integration
155
+
156
+ By default emails are sent synchronously. You can send them asynchronously by
157
+ using the [delayed_job gem](https://github.com/collectiveidea/delayed_job).
158
+
159
+ After implementing the `delayed_job` into your project add the code below at
160
+ the end of the `config/initializers/sorcery.rb` file. After that all emails
161
+ will be sent asynchronously.
162
+
163
+ ```ruby
164
+ module Sorcery
165
+ module Model
166
+ module InstanceMethods
167
+ def generic_send_email(method, mailer)
168
+ config = sorcery_config
169
+ mail = config.send(mailer).delay.send(config.send(method), self)
170
+ end
171
+ end
172
+ end
173
+ end
174
+ ```
175
+
176
+ Sidekiq and Resque integrations are coming soon.
177
+
178
+ ## Single Table Inheritance (STI) Support
179
+ STI is supported via a single setting in config/initializers/sorcery.rb.
180
+
181
+ ## Full Features List by module
182
+
183
+ **Core** (see [lib/sorcery/model.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model.rb) and
184
+ [lib/sorcery/controller.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller.rb)):
185
+
186
+ * login/logout, optional return user to requested url on login, configurable
187
+ redirect for non-logged-in users.
188
+ * password encryption, algorithms: bcrypt(default), md5, sha1, sha256,
189
+ sha512, aes256, custom(yours!), none. Configurable stretches and salt.
190
+ * configurable attribute names for username, password and email.
191
+ * allow multiple fields to serve as username.
192
+
193
+
194
+ **User Activation** (see [lib/sorcery/model/submodules/user_activation.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/user_activation.rb)):
195
+
196
+ * User activation by email with optional success email.
197
+ * configurable attribute names.
198
+ * configurable mailer, method name, and attribute name.
199
+ * configurable temporary token expiration.
200
+ * Optionally prevent non-active users to login.
201
+
202
+
203
+ **Reset Password** (see [lib/sorcery/model/submodules/reset_password.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/reset_password.rb)):
204
+
205
+ * Reset password with email verification.
206
+ * configurable mailer, method name, and attribute name.
207
+ * configurable temporary token expiration.
208
+ * configurable time between emails (hammering protection).
209
+
210
+
211
+ **Remember Me** (see [lib/sorcery/model/submodules/remember_me.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/remember_me.rb)):
212
+
213
+ * Remember me with configurable expiration.
214
+ * configurable attribute names.
215
+
216
+
217
+ **Session Timeout** (see [lib/sorcery/controller/submodules/session_timeout.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/session_timeout.rb)):
218
+
219
+ * Configurable session timeout.
220
+ * Optionally session timeout will be calculated from last user action.
221
+
222
+
223
+ **Brute Force Protection** (see [lib/sorcery/model/submodules/brute_force_protection.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/brute_force_protection.rb)):
224
+
225
+ * Brute force login hammering protection.
226
+ * configurable logins before lock and lock duration.
227
+
228
+
229
+ **Basic HTTP Authentication** (see [lib/sorcery/controller/submodules/http_basic_auth.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/http_basic_auth.rb)):
230
+
231
+ * A before filter for requesting authentication with HTTP Basic.
232
+ * automatic login from HTTP Basic.
233
+ * automatic login is disabled if session key changed.
234
+
235
+
236
+ **Activity Logging** (see [lib/sorcery/model/submodules/activity_logging.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/activity_logging.rb)):
237
+
238
+ * automatic logging of last login, last logout, last activity time and IP
239
+ address for last login.
240
+ * an easy method of collecting the list of currently logged in users.
241
+ * configurable timeout by which to decide whether to include a user in the
242
+ list of logged in users.
243
+
244
+
245
+ **External** (see [lib/sorcery/controller/submodules/external.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/external.rb)):
246
+
247
+ * OAuth1 and OAuth2 support (currently: Twitter, Facebook, Github, Google,
248
+ LinkedIn, VK, LiveID and Xing)
249
+ * configurable db field names and authentications table.
250
+
251
+
252
+ ## Next Planned Features
253
+
254
+ I've got some thoughts which include (unordered):
255
+
256
+ * Passing a block to encrypt, allowing the developer to define his own mix
257
+ of salting and encrypting
258
+ * Forgot username, maybe as part of the reset_password module
259
+ * Scoping logins (to a subdomain or another arbitrary field)
260
+ * Allowing storing the salt and crypted password in the same DB field for
261
+ extra security
262
+ * Other reset password strategies (security questions?)
263
+ * Other brute force protection strategies (captcha)
264
+
265
+
266
+ Have an idea? Let me know, and it might get into the gem!
267
+
268
+ ## Backward compatibility
269
+
270
+ While the lib is young and evolving fast I'm breaking backward compatibility
271
+ quite often. I'm constantly finding better ways to do things and throwing away
272
+ old ways. To let you know when things are changing in a non-compatible way,
273
+ I'm bumping the minor version of the gem. The patch version changes are
274
+ backward compatible.
275
+
276
+ In short, an app that works with x.3.1 should be able to upgrade to x.3.2 with
277
+ no code changes. The same cannot be said about upgrading to x.4.0 and above,
278
+ however.
279
+
280
+ ## DataMapper Support
281
+
282
+ Important notes:
283
+
284
+ * Expected to work with DM adapters: dm-mysql-adapter,
285
+ dm-redis-adapter.
286
+ * Submodules DM adapter dependent: activity_logging (dm-mysql-adapter)
287
+ * Usage: include DataMapper::Resource in user model, follow sorcery
288
+ instructions (remember to add property id, validators and accessor
289
+ attributes such as password and password_confirmation)
290
+ * Option downcase__username_before_authenticating and dm-mysql,
291
+ http://datamapper.lighthouseapp.com/projects/20609/tickets/1105-add-support-for-definingchanging-default-collation
292
+
293
+ ## Upgrading
294
+
295
+ Important notes while upgrading:
296
+
297
+ * If you are upgrading from <= **0.8.5** and you're using Sorcery test helpers,
298
+ you need to change the way you include them to following code:
299
+
300
+ ```ruby
301
+ RSpec.configure do |config|
302
+ config.include Sorcery::TestHelpers::Rails::Controller, type: :controller
303
+ config.include Sorcery::TestHelpers::Rails::Integration, type: :feature
304
+ end
305
+ ```
306
+
307
+ * If are upgrading to **0.8.2** and use activity_logging feature with
308
+ ActiveRecord, you will have to add a new column
309
+ `last_login_from_ip_address`
310
+ [#465](https://github.com/NoamB/sorcery/issues/465)
311
+ * Sinatra support existed until **v0.7.0** (including), but was dropped
312
+ later due to being a maintenance nightmare.
313
+ * If upgrading from <= **0.6.1 to >= **0.7.0** you need to change
314
+ 'username
315
+ _attribute_name' to 'username_attribute_names' in initializer.
316
+ * If upgrading from <= **v0.5.1** to >= **v0.5.2** you need to explicitly
317
+ set your user_class model in the initializer file.
318
+
319
+ ```ruby
320
+ # This line must come after the 'user config' block.
321
+ config.user_class = User
322
+ ```
323
+
324
+
325
+ ## Contributing to sorcery
326
+
327
+ Your feedback is very welcome and will make this gem much much better for you,
328
+ me and everyone else. Besides feedback on code, features, suggestions and bug
329
+ reports, you may want to actually make an impact on the code. For this:
330
+
331
+ * Fork it.
332
+ * Fix it.
333
+ * Test it.
334
+ * Commit it.
335
+ * Send me a pull request so I'll... Pull it.
336
+
337
+
338
+ If you feel sorcery has made your life easier, and you would like to express
339
+ your thanks via a donation, my paypal email is in the contact details.
340
+
341
+ ## Contact
342
+
343
+ Feel free to ask questions using these contact details:
344
+
345
+ #### Noam Ben-Ari
346
+
347
+ email: nbenari@gmail.com ( also for paypal )
348
+
349
+ twitter: @nbenari
350
+
351
+ #### Kir Shatrov
352
+
353
+ email: shatrov@me.com
354
+
355
+ twitter: @Kiiiir
356
+
357
+ ## Copyright
358
+
359
+ Copyright (c) 2010-2014 Noam Ben Ari (nbenari@gmail.com). See LICENSE.txt for
360
+ further details.