coca 0.1.0

data/MIT-LICENSE

@@ -0,0 +1,20 @@
+Copyright 2013 YOURNAME
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.md

@@ -0,0 +1,208 @@
+# Coca
+
+Coca stands for **Chain of Command Authentication**. It's a lightweight authentication-delegation scheme that makes SSO very easy to add to a devise-based rails app. Delegation is through an ordinary JSON API so you can pass any user data you like down the chain after authentication succeeds.
+
+We thought about calling it 'delegated devise' because in the present implementation it's just a devise strategy that can delegate to another application and an API for receiving delegated auth calls. In future we'd like to extend the principle more widely so we gave it a more general name.
+
+Coca is highly configurable but the defaults are simple and secure. It is designed to be part of a service-based architecture, where it will bind together a set of applications around a shared authentication service.
+
+Coca is naturally extensible because you can send any information you like down the chain and do whatever you like when it arrives. RBAC or other authorization information is easily distributed this way.
+
+Since we already have a nice tidy deference tree, Coca also supports attribute propagation. Your auth master is likely also to be a directory server and coca can help you to dry out contact (or any) attributes by passing notifications up and down the chain when they change.
+
+
+## tl;dr
+
+    class User < ActiveRecord::Base
+      # must have a :uid column
+      devise :cocable
+    end
+    
+    # and in an initialiser:
+    
+    Coca.secret = "Shared secret key"
+    
+    Coca.delegate_to do |master|
+      master.host = auth.example.com
+    end
+
+
+## Use coca if
+
+* You want to implement single sign-on within a cluster of trusted applications that all inhabit a single domain;
+
+* You want an easy way to pass around permissions or other extended user information;
+
+* You want your authentication service to be part of your usual rails cluster and benefit from its existing availability and backup measures;
+
+* You're not planning to offer a remote login-with-me service to applications as yet unknown.
+
+There's nothing to stop you running coca in parallel with other auth services including OAuth, SAML or even LDAP.
+
+
+## Usage
+
+Each link in the chain of command is defined as a server to which we defer  and/or a set of servers from which we accept requests. Within that link you  also have to declare that one or models should take part in the authentication scheme.
+
+
+### Configuring the chain
+
+Each application can be master, servant or both. Configuration is usually in config/initialisers/coca.rb:
+
+    # On every application in this chain
+    
+    Coca.secret = "Shared secret key"
+
+    # To act as a servant:
+
+    Coca.delegate_to do |master|
+      master.host = fq.domain.com or ip address or localhost
+      master.port = optional
+      master.path = "/coca/user"
+    end
+    
+    # To act as a master:
+    
+    Coca.delegate_from do |servant|
+      servant.host = fq.domain.com or ip address or localhost
+      servant.ttl = 3600
+    end
+    
+You can have any number of links up and down. More than one `delegate_to` is unlikely but possible.
+    
+    # TTL can be set globally
+    Coca.token_ttl = 86400
+    
+    # disable to not broadcast user changes or ignore incoming updates
+    Coca.propagate_updates = true
+    
+    # disable to allow insecure requests in and out
+    Coca.require_https = true
+    
+    # disable to omit reverse IP check on incoming requests and updates
+    Coca.check_source = true
+
+    # you may want to set this per environment
+    Coca.cookie_name = 'must_be_the_same_across_sso_group'
+    Coca.cookie_domain = :all
+
+
+### Delegating in a model
+
+To start with coca is implemented as a devise strategy. Minimally:
+
+    class User < ActiveRecord::Base
+      devise :cocable
+
+You can try other strategies first: they will work in the usual way and check against local resource properties. The `:cocable` strategy would normally be last. 
+
+    class User < ActiveRecord::Base
+      devise :database_authenticatable,
+             :token_authenticatable,
+             :cocable
+
+If masters are defined, the cocable strategy will pass credentials up the chain before finally admitting failure.
+
+
+### Authenticating in the master
+
+The delegated auth call is just an ordinary API request. The supplied auth parameters are passed on. If they are accepted by the master server then the API request will work and a JSON packet will be returned. If not, we return 401. All of this is done just by trying to authenticate the resource in the usual way, and usually requires no change to your resource class.
+
+To continue the chain upward, just add the cocable strategy to the User class in your master application (and define a master). 
+
+
+### Routing in the master
+
+For most purposese you only need to mount coca:
+
+    mount Coca::Engine => "/coca", :as => :coca
+
+The main api controller response to /coca/authenticate. It's a very ordinary controller that inherits from your ApplicationController and tries to authenticate against your local resources.
+
+
+### Data
+
+Coca requires all your authenticable resources to have a `uid` column, and it expects your authentication master to set that value and pass it down on auth.
+
+In the servant coca requires no devise columns. If you're not trying any other strategies locally, your user model can be very minimal.
+
+In the master coca has no other requirements but you will want a fuller set of devise strategies, probably include `:database_authenticatable` and `:token_authenticatable` and all the data columns they require.
+
+
+## Extending Coca
+
+At heart coca is a simple remote authentication service: credentials are checked remotely and if they are found valid, user information is returned.
+
+The data package that we return on successful auth is built by calling `serializable_hash` on the user model in the coca master. As a minimum it should return an auth token, but you can add any other data you like. If you have local resources that are owned by remote users, some kind of uid will be needed. Also permissions, friends lists, recent messages, password replacement instructions: anything it makes sense to hold centrally can be worked out in the master and passed down to all servant applications.
+
+Your coca response package will be treated as model attributes. It's up to you to make sure that your local user object does the right thing with whatever is passed down.
+
+
+## Reminders and confirmations
+
+We're going to need some routing here. Only the auth master is in a position to handle password-reminders and to send confirmation and other messages to new users.
+
+
+## Propagating resource changes
+
+It's a short step from an auth server to a directory server. Once authentication is centralised, you start to avoid duplicating other user attributes. But what if you want to display the user's email address in one of the servant apps, or offer the user a change of address form while they're working in the calendar? You don't always want to send them somewhere else, or call another server just to get a single attribute.
+
+
+## How coca works
+
+All the actual authentication done by devise as usual. Coca just adds a way to try out credentials on another server. 
+
+1. A coca servant app has its own devise strategies. You can set that up any way you like, and you may choose to accept credentials locally for some users.
+
+2. If the app is presented with an auth token or login pair that it doesn't recognise, those credentials are passed up to the configured master application in a JSON request that includes a predefined API key. 
+
+3. The master will check that the requesting host and the secret key match before it gives any response.
+
+4. If the supplied credentials succeed in authenticating the user at the master application, it will return 200 and a package of user information. If the app doesn't recognise the credentials, it may pass them on to its own coca master. If there isn't one, or that request fails too, it will return 401 and no data.
+
+5. As the confirmation package travels down the chain each servant app stores the auth token and does what it likes with any other data that is returned.
+
+6. Subsequent requests that present a valid auth token will be successful at the bottom of the chain.
+
+7. The master will include in the confirmation package a configurable TTL for the auth token. You can use this to set a balance between revokability and responsiveness. Set it to zero for maximum control or to a sensible session length like 30 minutes to minimise the coca overhead.
+
+8. The original servant app receives the confirmation package, saves the authentication token and does whatever it does with the other data. It also puts the auth token in a domain cookie (not the usual session cookie) that will be picked up by any other application in the same domain.
+
+9. When the same browser visits another application in the same domain, it presents the master's auth token cookie. The second servant app passes that token up the chain to the same master. Having issued the token, the master accepts it and returns the same confirmation package as before. The second servant stores the auth token locally so that it too can accept subsequent requests without delegation, token expiry permitting.
+
+
+## Compared to OAuth
+
+* **This is not an authorization service.** There is no mechanism for issuing API tokens or granting access to individual resources. The chain of command is defined on initialisation and all requests and responses have to come from sources that are already trusted. OAuth makes it possible to have ad-hoc relationships between strangers. Coca is a conversation among friends.
+
+* **OAuth is a user-pull scheme** that bounces off the browser a few times and requires it to pass callbacks between servers. The user sees confirmation dialogs from different providers or is forced to visit services in a certain order. Coca works by server-pull, invisible to the user and no more difficult than just logging in. It doesn't matter where you arrive: once you've logged in, you're in.
+
+* **Oauth works across domains.** Coca mostly doesn't: you can authenticate against a master at any address, but SSO is limited to domains that can share a cookie. In practice that means coca only provides SSO across related subdomains.
+
+* **OAuth is horrible to work with,** absurdly complicated and a daft way to implement SSO unless you are also piggybacking on a remote service. Coca is quite nice.
+
+
+## Compared to XAuth
+
+* XAuth is just OAuth made stupider. It is superficially similar to coca in that credentials are passed to a remote server, but after that you're bouncing around callbacks again. 
+
+
+## Compared to LDAP
+
+There's nothing wrong with LDAP. If you're working in a situation where an LDAP server is available, and you don't need to layer RBAC or anything else on top, we advise you to use it.
+
+If you don't already have an LDAP server with its own availability regime and a dedicated team of lab-coats, you get to choose between several lardy Java services. None of them will sit nicely on your load-balanced cloud node, and none of them are easy to couple with RBAC or other services. In that case you're probably better off using coca and providing a CardDAV service from the top of the chain.
+
+
+## Author
+
+William Ross for spanner. Will at spanner dot org.
+
+## Copyright
+
+Copyright Spanner 2013. All rights reserved.
+
+## License
+
+Released under the MIT license.
+

data/Rakefile

@@ -0,0 +1,29 @@
+#!/usr/bin/env rake
+begin
+  require 'bundler/setup'
+rescue LoadError
+  puts 'You must `gem install bundler` and `bundle install` to run rake tasks'
+end
+begin
+  require 'rdoc/task'
+rescue LoadError
+  require 'rdoc/rdoc'
+  require 'rake/rdoctask'
+  RDoc::Task = Rake::RDocTask
+end
+
+RDoc::Task.new(:rdoc) do |rdoc|
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title    = 'Coca'
+  rdoc.options << '--line-numbers'
+  rdoc.rdoc_files.include('README.rdoc')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end
+
+APP_RAKEFILE = File.expand_path("../spec/dummy/Rakefile", __FILE__)
+load 'rails/tasks/engine.rake'
+
+
+
+Bundler::GemHelper.install_tasks
+

data/app/assets/javascripts/coca/application.js

@@ -0,0 +1,15 @@
+// This is a manifest file that'll be compiled into application.js, which will include all the files
+// listed below.
+//
+// Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts,
+// or vendor/assets/javascripts of plugins, if any, can be referenced here using a relative path.
+//
+// It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
+// the compiled file.
+//
+// WARNING: THE FIRST BLANK LINE MARKS THE END OF WHAT'S TO BE PROCESSED, ANY BLANK LINE SHOULD
+// GO AFTER THE REQUIRES BELOW.
+//
+//= require jquery
+//= require jquery_ujs
+//= require_tree .

data/app/assets/stylesheets/coca/application.css

@@ -0,0 +1,13 @@
+/*
+ * This is a manifest file that'll be compiled into application.css, which will include all the files
+ * listed below.
+ *
+ * Any CSS and SCSS file within this directory, lib/assets/stylesheets, vendor/assets/stylesheets,
+ * or vendor/assets/stylesheets of plugins, if any, can be referenced here using a relative path.
+ *
+ * You're free to add application-wide styles to this file and they'll appear at the top of the
+ * compiled file, but it's generally better to create a new file per style scope.
+ *
+ *= require_self
+ *= require_tree .
+ */

data/app/controllers/coca/authentications_controller.rb

@@ -0,0 +1,24 @@
+module Coca
+  class AuthenticationsController < RocketPants::Base
+    include Devise::Controllers::Helpers
+
+    before_filter :require_valid_servant!
+    before_filter :allow_params_authentication!
+
+    def show
+      scope = params[:scope].to_sym      
+      if user = warden.authenticate(:scope => scope)
+        expose user
+      else
+        head :unauthorized
+      end
+    end
+
+  protected
+
+    def require_valid_servant!
+      Coca.valid_servant?(request.remote_ip, params[:key])
+    end
+
+  end
+end

data/app/helpers/coca/application_helper.rb

@@ -0,0 +1,4 @@
+module Coca
+  module ApplicationHelper
+  end
+end

data/app/views/layouts/coca/application.html.erb

@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Coca</title>
+  <%= stylesheet_link_tag    "coca/application", :media => "all" %>
+  <%= javascript_include_tag "coca/application" %>
+  <%= csrf_meta_tags %>
+</head>
+<body>
+
+<%= yield %>
+
+</body>
+</html>

data/config/routes.rb

@@ -0,0 +1,7 @@
+Rails.application.routes.draw do
+  namespace "coca" do
+    api :version => 1 do
+      get "/check" => "authentications#show", :as => :check
+    end
+  end
+end

data/lib/coca.rb

@@ -0,0 +1,62 @@
+require "coca/engine"
+require 'coca/delegate'
+require 'coca/auth_cookie'
+require 'devise/models/cocable'
+require 'devise/strategies/cocable'
+
+Warden::Manager.after_set_user do |user, warden, options|
+  Coca::AuthCookie.new(warden.cookies, options[:scope]).set(user)
+end
+
+Warden::Manager.before_logout do |user, warden, options|
+  Coca::AuthCookie.new(warden.cookies, options[:scope]).unset
+end
+
+module Coca
+  mattr_accessor :masters, 
+                 :servants, 
+                 :cookie_domain,
+                 :check_source,
+                 :require_https,
+                 :propagate_updates,
+                 :token_ttl,
+                 :secret,
+                 :debug
+  
+  @@masters = []
+  @@servants = []
+  @@cookie_domain = :all
+  @@check_source = true
+  @@require_https = true
+  @@propagate_updates = false
+  @@token_ttl = 1800
+  @@secret = "Unset"
+  @@debug = true
+  
+  class << self
+    def add_master(name, &block)
+      @@masters.push Coca::Delegate.new(name, &block)
+    end
+
+    def add_servant(name, &block)
+      @@servants.push Coca::Delegate.new(name, &block)
+    end
+  
+    def valid_servant?(referer, key)
+      servants.find { |servant| servant.valid_referer?(referer) && valid_secret?(key) }
+    end
+
+    def valid_master?(referer, key)
+      masters.find { |master| master.valid_referer?(referer) && valid_secret?(key) }
+    end
+  
+    def valid_secret?(key)
+      !!key && !key.blank? && key == Coca.secret
+    end
+  end
+end
+
+Devise.add_module :cocable,
+                  :route => :session,
+                  :strategy => true,
+                  :controller => :sessions

data/lib/coca/auth_cookie.rb

@@ -0,0 +1,77 @@
+require 'signed_json'
+
+# Based on the same class in devise-login-cookie by pda
+# https://github.com/pda/devise-login-cookie
+
+module Coca
+
+  class AuthCookie
+
+    def initialize(cookies, scope)
+      @cookies = cookies
+      @scope = scope
+    end
+
+    # Sets the cookie, referencing the given resource.id (e.g. User)
+    def set(resource)
+      @cookies[cookie_name] = cookie_options.merge(:value => encoded_value(resource))
+    end
+
+    # Unsets the cookie via the HTTP response.
+    def unset
+      @cookies.delete cookie_name, cookie_options
+    end
+    
+    def token
+      value[0]
+    end
+
+    # The Time at which the cookie was created.
+    def created_at
+      valid? ? Time.at(value[1]) : nil
+    end
+
+    # Whether the cookie appears valid.
+    def valid?
+      present? && value.all?
+    end
+
+    def present?
+      @cookies[cookie_name].present?
+    end
+
+    # Whether the cookie was set since the given Time
+    def set_since?(time)
+      created_at && created_at >= time
+    end
+
+  private
+
+    def value
+      begin
+        @value = signer.decode @cookies[cookie_name]
+      rescue SignedJson::Error
+        [nil, nil]
+      end
+    end
+
+    def cookie_name
+      :"coca_#{@scope}_token"
+    end
+
+    def encoded_value(resource)
+      signer.encode [ resource.authentication_token, Time.now.to_i ]
+    end
+
+    def cookie_options
+      @session_options ||= Rails.configuration.session_options
+      @session_options.slice(:path, :secure, :httponly).merge(:domain => Coca.cookie_domain)
+    end
+
+    def signer
+      @signer ||= SignedJson::Signer.new(Coca.secret)
+    end
+
+  end
+
+end

data/lib/coca/delegate.rb

@@ -0,0 +1,62 @@
+require 'resolv'
+require 'httparty'
+
+module Coca
+  class Delegate
+    include HTTParty
+    attr_writer :name, :host, :port, :ttl, :protocol
+    
+    def initialize(name='')
+      @name = name
+      yield self if block_given?
+    end
+
+    def ttl
+      @ttl ||= Coca.token_ttl
+    end
+    
+    def host
+      @host ||= "localhost"
+    end
+    
+    def port
+      @port
+    end
+    
+    def protocol
+      @protocol ||= 'https'
+    end
+    
+    def base_uri
+      [host, port].compact.join(':')
+    end
+
+    def path
+      @path ||= "/coca/1/check"
+    end
+    
+    def ip_address
+      @ip ||= Resolv.new.getaddress(host)
+    end
+    
+    def valid_referer?(referer)
+      !!referer && !referer.blank? && referer == ip_address
+    end
+    
+    def host_url_with_port
+      hup = "#{protocol}://#{host}"
+      hup << ":#{port}" if port
+      hup
+    end
+    
+    def url
+      @url ||= URI.join(host_url_with_port, path).to_s
+    end
+        
+    def authenticate(scope, credentials)
+      response = HTTParty.get url, :scope => scope, :"#{scope}" => credentials
+      response.body if response.code != 401
+    end
+    
+  end
+end

data/lib/coca/engine.rb

@@ -0,0 +1,16 @@
+require 'devise'
+require 'rocket_pants'
+
+module Coca
+  class Engine < ::Rails::Engine
+    isolate_namespace Coca
+    
+    config.generators do |g|
+      g.test_framework      :rspec,        :fixture => false
+      g.fixture_replacement :factory_girl, :dir => 'spec/factories'
+      g.assets false
+      g.helper false
+    end
+    
+  end
+end

data/lib/coca/version.rb

@@ -0,0 +1,3 @@
+module Coca
+  VERSION = "0.1.0"
+end

data/lib/devise/models/cocable.rb

@@ -0,0 +1,11 @@
+require 'devise/strategies/cocable'
+
+module Devise
+  module Models
+    module Cocable
+      extend ActiveSupport::Concern
+
+
+    end
+  end
+end

data/lib/devise/strategies/cocable.rb

@@ -0,0 +1,56 @@
+require 'devise/strategies/authenticatable'
+
+module Devise
+  module Strategies
+    
+    # The cocable strategy will look for a user in two places: 
+    # in a domain cookie set by one of our peers and verified by an upstream app
+    # or in credentials supplied to us and verified by an upstream app
+    #
+    # (If the credentials matched locally, we wouldn't usually get to this strategy)
+
+    class Cocable < Authenticatable
+      def valid?
+        valid_for_params_auth? || cookie.valid?
+      end
+
+      def authenticate!
+        resource = nil
+        response = nil
+        
+        if authentication_hash
+          response = delegate(authentication_hash)
+        else
+          response = delegate({:auth_token => cookie.token})
+        end
+        
+        if response
+          resource = mapping.to.where(:uid => response[:uid]).first_or_create
+          resource.update_attributes(response.except(:uid))
+        end
+        
+        success!(resource) if resource# && validate(resource)
+      end
+      
+      def delegate(credentials)
+        response = nil
+        Coca.masters.each do |master|
+          response = master.authenticate(scope, credentials)
+          break if response
+        end
+        response
+      end
+
+    private
+      # AuthCookie takes care of the naming and signing of cookies for each warden scope.
+      # All we need is the token contained in the cookie for this scope, if there is one.
+      #
+      def cookie
+        @cookie ||= Coca::AuthCookie.new(cookies, scope)
+      end
+
+    end
+  end
+end
+
+Warden::Strategies.add(:cocable, Devise::Strategies::Cocable)

data/lib/tasks/coca_tasks.rake

@@ -0,0 +1,4 @@
+# desc "Explaining what the task does"
+# task :coca do
+#   # Task goes here
+# end

metadata

@@ -0,0 +1,256 @@
+--- !ruby/object:Gem::Specification
+name: coca
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+  prerelease: 
+platform: ruby
+authors:
+- William Ross
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2013-07-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rails
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 3.2.13
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ~>
+      - !ruby/object:Gem::Version
+        version: 3.2.13
+- !ruby/object:Gem::Dependency
+  name: jquery-rails
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: devise
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rocket_pants
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: signed_json
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: mysql2
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rspec-rails
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: factory_girl_rails
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: simplecov
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: database_cleaner
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: factory_girl_rails
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: shoulda-matchers
+  requirement: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    none: false
+    requirements:
+    - - ! '>='
+      - !ruby/object:Gem::Version
+        version: '0'
+description: Coca is a chainable, devise-based scheme for delegation of authentication.
+  It works through a standard JSON API so the packet that you pass down on auth is
+  completely configurable. See coca-rbac for a similarly transparent RBAC implementation.
+email:
+- will@spanner.org
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- app/assets/javascripts/coca/application.js
+- app/assets/stylesheets/coca/application.css
+- app/controllers/coca/authentications_controller.rb
+- app/helpers/coca/application_helper.rb
+- app/views/layouts/coca/application.html.erb
+- config/routes.rb
+- lib/coca/auth_cookie.rb
+- lib/coca/delegate.rb
+- lib/coca/engine.rb
+- lib/coca/version.rb
+- lib/coca.rb
+- lib/devise/models/cocable.rb
+- lib/devise/strategies/cocable.rb
+- lib/tasks/coca_tasks.rake
+- MIT-LICENSE
+- Rakefile
+- README.md
+homepage: https://github.com/spanner/coca
+licenses: []
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  none: false
+  requirements:
+  - - ! '>='
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 1.8.23
+signing_key: 
+specification_version: 3
+summary: Lightweight, simple SSO for rails.
+test_files: []