devise_meteor 0.1.0

data/lib/devise_meteor/engine.rb

@@ -0,0 +1,10 @@
+module DeviseMeteor
+  class Engine < ::Rails::Engine
+    isolate_namespace DeviseMeteor
+
+    config.generators do |g|
+      g.test_framework :rspec
+      g.fixture_replacement :factory_girl, :dir => 'spec/factories'
+    end
+  end
+end

data/lib/devise_meteor/railtie.rb

@@ -0,0 +1,7 @@
+require 'rails'
+
+module DeviseMeteor
+  class Railtie < Rails::Railtie
+
+  end
+end

data/lib/devise_meteor/strategies/encrypter.rb

@@ -0,0 +1,15 @@
+module DeviseMeteor
+  module Encrypter
+
+    def self.digest(password)
+      sha256_hasher = DeviseMeteor::BCryptSHA256Hasher.new
+      sha256_hasher.encode(password, sha256_hasher.salt)
+    end
+
+
+    def self.compare(password, encrypted_password)
+      sha256_hasher = DeviseMeteor::BCryptSHA256Hasher.new
+      sha256_hasher.verify(password, encrypted_password)
+    end
+  end
+end

data/lib/devise_meteor/strategies/hasher.rb

@@ -0,0 +1,91 @@
+require "base64"
+require "bcrypt"
+require "openssl"
+
+module DeviseMeteor
+  class Hasher
+    attr_reader :algorithm
+
+    # Returns salt value to be used for hashing.
+    #
+    # @return [String] random salt value.
+    def salt
+      SecureRandom.hex(9)
+    end
+
+    # Returns if the given password match the encoded password.
+    #
+    # @param [String] password in plain text
+    # @param [String] encoded password to be matched
+    # @return [Boolean] if password match encoded password.
+    def verify(password, encoded)
+      raise NotImplementedError
+    end
+
+    # Returns given password encoded with the given salt.
+    #
+    # @param [String] password in plain text
+    # @param [String] salt to be used during hashing
+    # @return [String] given password hashed using the given salt
+    def encode(password, salt)
+      raise NotImplementedError
+    end
+
+    # Returns if given encoded password needs to be updated.
+    #
+    # @param [String] encoded password
+    # @return [Boolean] if encoded password needs to be updated
+    def must_update(encoded)
+      false
+    end
+
+    private
+
+    def constant_time_compare(a, b)
+      check = a.bytesize ^ b.bytesize
+      a.bytes.zip(b.bytes) { |x, y| check |= x ^ y }
+      check == 0
+    end
+  end
+
+# BCryptSHA256Hasher implements a BCrypt password hasher using SHA256.
+  class BCryptSHA256Hasher < Hasher
+    def initialize
+      @algorithm = :bcrypt_sha256
+      @cost = 10
+      @digest = OpenSSL::Digest::SHA256.new
+    end
+
+    def salt
+      BCrypt::Engine.generate_salt(@cost)
+    end
+
+    def get_password_string(password)
+      @digest.digest(password) unless @digest.nil?
+    end
+
+    def encode(password, salt)
+      password = get_password_string(password)
+      hash = BCrypt::Engine.hash_secret(password, salt)
+      return hash
+    end
+
+    def verify(password, encoded)
+      password_digest = get_password_string(password)
+      hash = BCrypt::Engine.hash_secret(password_digest, encoded)
+      Devise.secure_compare(encoded, hash)
+
+      constant_time_compare(encoded, hash)
+    end
+
+  end
+
+# BCryptHasher implements a BCrypt password hasher.
+  class BCryptHasher < BCryptSHA256Hasher
+    def initialize
+      @algorithm = :bcrypt
+      @cost = 10
+      @digest = nil
+    end
+  end
+end

data/lib/devise_meteor/strategies/strategy.rb

@@ -0,0 +1,92 @@
+require 'devise/strategies/authenticatable'
+
+module Devise
+  module Strategies
+    class Meteor < Authenticatable
+
+      def valid?
+        valid_for_params_auth? || valid_for_http_auth?
+      end
+
+      def authenticate!
+        self.password = params_auth_hash[:password]
+
+        # search for user email
+        devise_resource = valid_for_params_auth? && mapping.to.find_for_database_authentication(authentication_hash)
+        meteor_resource = User.where(:emails.elem_match => {address: params_auth_hash[:email]}).first unless devise_resource
+        resource = devise_resource || meteor_resource
+
+        return fail!(:not_found_in_database) unless resource
+
+        # before continuing authentication process
+        # check existing passwords and synchronize them
+        if meteor_auth_missing?(resource)
+          # when already devise credentials stored
+          # assign them to devise_meteor fields
+          new_hashed_password = User.new(:password => password).encrypted_password
+          resource.services.set(password: {bcrypt: new_hashed_password})
+
+        elsif devise_auth_missing?(resource)
+          # when user registered through devise_meteor
+          # and credentials for devise not present
+          email = params_auth_hash[:email]
+          crypt = resource.services.password[:bcrypt]
+
+          unless resource.update_attributes(encrypted_password: crypt, email: email)
+            fail(resource.unauthenticated_message)
+          end
+          resource.reload
+
+        elsif both_auth_present?(resource)
+          #when both passwords already set
+        else
+          return pass
+        end
+
+        # now do validation
+        # this code is copied from Devise::Strategies::DatabaseAuthenticable
+        encrypted = false
+        if validate(resource) { encrypted = true; resource.valid_password?(password) }
+          remember_me(resource)
+          resource.after_database_authentication
+          success!(resource)
+        end
+
+        mapping.to.new.password = password if !encrypted && Devise.paranoid
+        fail(:not_found_in_database) unless resource
+      end
+
+      private
+
+      def both_auth_present?(resource)
+        has_a_meteor_password?(resource) && has_a_devise_password?(resource)
+      end
+
+      def devise_auth_missing?(resource)
+        has_a_meteor_password?(resource) && !has_a_devise_password?(resource)
+      end
+
+      def meteor_auth_missing?(resource)
+        has_a_devise_password?(resource) && !has_a_meteor_password?(resource)
+      end
+
+      def has_a_devise_password?(resource)
+        resource.encrypted_password.present?
+      end
+
+      def has_a_meteor_password?(resource)
+        resource.services.password.present?
+      end
+
+      # if you migrate from some other strategies than bcrypt
+      def legacy_authenticates?(resource, password)
+        # resource.encrypted_password == encrypt(resource, password)
+      end
+
+      def encrypt(resource, password)
+        # some old strategies code
+      end
+
+    end
+  end
+end

data/lib/devise_meteor/version.rb

@@ -0,0 +1,3 @@
+module DeviseMeteor
+  VERSION = "0.1.0"
+end

data/lib/devise_meteor.rb

@@ -0,0 +1,37 @@
+require 'devise_meteor/engine'
+
+
+require "devise_meteor/version"
+
+require 'rails'
+
+require 'devise_meteor/railtie' if defined?(Rails)
+require 'devise_meteor/railtie'
+
+require 'devise'
+require 'devise_meteor/strategies/encrypter'
+require 'devise_meteor/strategies/hasher'
+require 'devise/strategies/meteor'
+
+require 'devise_meteor/concerns/meteor_user_model'
+
+module DeviseMeteor
+
+  # enable configuration
+  class << self
+    attr_accessor :configuration
+  end
+
+  def self.configure
+    self.configuration ||= Configuration.new
+    yield(configuration)
+  end
+
+  class Configuration
+    attr_accessor :option
+
+    def initialize
+      @option = 'default_option'
+    end
+  end
+end

data/lib/generators/devise_meteor/install_generator.rb

@@ -0,0 +1,16 @@
+module DeviseMeteor
+  module Generators
+    class InstallGenerator < Rails::Generators::Base
+
+      source_root File.expand_path("../../templates", __FILE__)
+
+      desc "Creates initializer for devise_meteor specific config"
+
+      def copy_initializer
+        template "meteor_initializer.rb", "config/initializers/devise_meteor.rb"
+
+        puts "Added initializer to your app."
+      end
+    end
+  end
+end

data/lib/generators/templates/meteor_initializer.rb

@@ -0,0 +1,12 @@
+DeviseMeteor.configure do |config|
+
+
+end
+
+# you can uncomment this lines to match up "strings" ObjectIds from accounts-* packages
+
+#class BSON::ObjectId
+#  def self.mongoize(k)
+#    k.to_s
+#  end
+#end

data/spec/factories/users.rb

@@ -0,0 +1,19 @@
+FactoryGirl.define do
+
+  factory :user do
+    #after(:build) { |u| u.password_confirmation = u.password = mypassword }
+    email { Faker::Internet.email }
+    password "password"
+    password_confirmation "password"
+
+    factory :confirmed_user do
+      confirmed_at Date.today
+    end
+  end
+
+  factory :invalid_user, parent: :user do
+    email { Faker::Internet.email }
+    password "short"
+    password_confirmation "short"
+  end
+end

data/spec/models/meteor_authentication_spec.rb

@@ -0,0 +1,261 @@
+require 'rails_helper'
+
+describe DeviseMeteor::MeteorUserModel do
+
+  let(:meteor_user_attributes) {
+
+    {
+        '_id' => "633DYLkePqv2xMbDi",
+        "createdAt" => Time.now,
+        "emails" => [
+            {"address" => Faker::Internet.email,
+             "verified" => true}
+        ],
+        "profile" => {"firstName" => "DemoFirstName",
+                      "lastName" => "DemoLastName"
+        },
+        "services" => {
+            "password" => {
+                "bcrypt" => "$2a$10$4my6JyO3FxMDr4xm24k2Kev7Jqu0E.8KecXEv8fHhZQMSCHrQCUM."
+            },
+            "resume" => {
+                "loginTokens" => [
+                    {
+                        "when" => Time.now,
+                        "hashedToken" => "fPtV4ud7WzT9nKwgfRb56MwI8GORe3kGc4cO6FfM8xY="
+                    }
+                ]
+            }
+        },
+        "username" => "demouser"
+    }
+
+  }
+
+  describe "Meteor User attribute mapping" do
+
+    it "calls meteor_map_attributes before saving" do
+      user = User.new
+
+      expect(user).to receive(:meteor_map_attributes)
+      user.save
+
+    end
+
+    before :each do
+      @user = create :user
+    end
+
+    context 'emails' do
+
+      it 'should be an array' do
+        expect(@user.emails).to be_an Array
+      end
+
+      describe 'when changing the email' do
+
+        it 'does not verify on new unconfirmed' do
+          @user.confirm
+          @user.email = "test@test.com"
+          result2 = {address: @user.email, verified: false}
+
+          @user.save!
+          expect(@user.emails).to include result2
+        end
+
+        it 'does verify on confirm' do
+          @user.confirm
+          @user.email = "test@test.com"
+          @user.save!
+          result2 = {address: @user.email, verified: true}
+
+          @user.confirm
+
+          expect(@user.emails).to include result2
+        end
+
+        it 'does not overwrite old email' do
+          result1 = {address: @user.email, verified: true}
+
+          @user.confirm
+          @user.email = "test@test.com"
+          result2 = {address: @user.email, verified: false}
+
+          @user.save!
+          expect(@user.emails).to include result1
+          expect(@user.emails).to include result2
+        end
+
+        it 'does not have duplicated emails with different verified status' do
+          confirmed = {address: @user.email, verified: true}
+          @user.confirm
+
+          @user.email = "another@email.com"
+          unconfirmed = {address: @user.email, verified: false}
+          @user.save!
+          expect(@user.emails).to include confirmed
+          expect(@user.emails).to include unconfirmed
+          expect(@user.emails.size).to eql 2
+        end
+
+      end
+
+      describe 'verified' do
+
+        specify 'on new email should be false' do
+          result = {address: @user.email, verified: false}
+
+          expect(@user.emails).to include(result)
+        end
+
+        it 'on confirmed email should be true' do
+          result = {address: @user.email, verified: true}
+
+          @user.confirm
+
+          expect(@user.emails).to include(result)
+        end
+
+      end
+
+    end
+
+    describe 'createdAt' do
+      it 'should match created_at' do
+        expect(@user.created_at).to eql @user.createdAt
+      end
+    end
+
+    describe 'profile' do
+
+      it 'has a relation to Profile' do
+        expect(@user.profile).to be_a DeviseMeteor::MeteorProfile
+      end
+
+      describe 'name' do
+
+        it 'writes into name field' do
+          name = "John Doe"
+          @user.update_attribute(:name, name)
+          expect(User.last.profile.name).to eql name
+        end
+
+        it 'reads from name field' do
+          name = "John Doe"
+          @user.update_attribute(:name, name)
+          expect(@user.name).to eql @user.profile.name
+        end
+      end
+
+      describe 'username' do
+
+        it 'writes into name field' do
+          username = "John Doe"
+          @user.update_attribute(:username, username)
+          expect(User.last.profile.username).to eql username
+        end
+
+        it 'reads from name field' do
+          username = "John Doe"
+          @user.update_attribute(:username, username)
+          expect(@user.username).to eql @user.profile.username
+        end
+      end
+
+    end
+
+    describe 'services' do
+
+      # this example is copy pasted from the devise_meteor documentation
+      # http://docs.meteor.com/#/full/meteor_users
+      # bcrypt: password decrypted is "asdfasdf"
+      let(:valid_services_hash) {
+        {"password" => {
+            "bcrypt" => "$2a$10$4my6JyO3FxMDr4xm24k2Kev7Jqu0E.8KecXEv8fHhZQMSCHrQCUM."
+        },
+         "facebook" => {
+             "id" => "709050",
+             "accessToken" => "S0M3_R34LLY-CMPLX-T0K3N"
+         },
+         "resume" => {
+             "loginTokens" => [
+                 {"token" => "4no7eR-c0mpl3x-c0d3-with-numb3r5",
+                  "when" => 1234567890}
+             ]
+         }}
+      }
+
+      let(:decrypted_password) {
+        'asdfasdf'
+      }
+
+      it 'must have a service relation' do
+        expect(@user.services).to be_a DeviseMeteor::MeteorService
+      end
+
+      context 'password' do
+        before :each do
+          @user.confirm
+        end
+
+        let(:valid_password_hash) {
+          valid_services_hash[:password]
+        }
+
+        context 'changed by devise' do
+          it 'writes password on creation' do
+            expect(User.last.services.password[:bcrypt]).to eql @user.services.password[:bcrypt]
+          end
+
+          it 'writes new password also to session.password' do
+            new_password = 'N3W_P455W0RD'
+
+            @user.password = new_password
+            @user.password_confirmation = new_password
+            @user.save
+
+            expect(User.last.services.password[:bcrypt]).to eql @user.services.password[:bcrypt]
+          end
+
+          it 'tries to use the meteors password' do
+            password = @user.services.password[:bcrypt]
+            true
+          end
+
+        end
+
+      end
+
+      context 'facebook' do
+
+        it 'allows multiple provider assignment' do
+          @user.services.update_attributes(facebook: valid_services_hash['facebook'])
+
+          expect(User.last.services.facebook[:id]).to eq valid_services_hash['facebook']['id']
+          expect(User.last.services.facebook[:id]).to eq valid_services_hash['facebook']['id']
+        end
+
+        it 'allows single provider assignment' do
+          @user.services.update_attribute(:facebook, valid_services_hash['facebook'])
+
+          expect(User.last.services.facebook[:id]).to eq valid_services_hash['facebook']['id']
+          expect(User.last.services.facebook[:accessToken]).to eq valid_services_hash['facebook']['accessToken']
+        end
+
+        it 'allows to change provider data' do
+          new_facebook_hash = {id: '12345678', accessToken: 'New_Access_token'}
+
+          @user.services.update_attribute(:facebook, valid_services_hash['facebook'])
+          expect(User.last.services.facebook[:id]).to eq valid_services_hash['facebook']['id']
+          expect(User.last.services.facebook[:accessToken]).to eq valid_services_hash['facebook']['accessToken']
+
+          @user.services.update_attribute(:facebook, new_facebook_hash)
+
+          expect(User.last.services.facebook[:id]).to eq new_facebook_hash[:id]
+          expect(User.last.services.facebook[:accessToken]).to eq new_facebook_hash[:accessToken]
+        end
+
+      end
+    end
+  end
+end