door_mat 0.0.5

data/config/routes.rb

@@ -0,0 +1,48 @@
+DoorMat::Engine.routes.draw do
+  if DoorMat.configuration.define_door_mat_routes
+
+    get '/sign_up' => 'sign_up#new', as: 'sign_up'
+    post '/sign_up' => 'sign_up#create'
+
+    get '/sign_in' => 'sign_in#new', as: 'sign_in'
+    post '/sign_in' => 'sign_in#create'
+    get '/sign_out' => 'sign_in#destroy', as: 'sign_out'
+
+    post '/terminate_session/:guid' => 'sessions#terminate', as: 'terminate_session'
+    get '/reconfirm_password' => 'reconfirm_password#new', as: 'reconfirm_password'
+    post '/reconfirm_password' => 'reconfirm_password#create'
+
+    get '/add_email' => 'manage_email#new', as: 'add_email'
+    post '/add_email' => 'manage_email#create'
+    post '/delete_email' => 'manage_email#destroy'
+    post '/set_primary_email' => 'manage_email#set_primary_email'
+
+    get '/email_confirmation_required' => 'static#email_confirmation_required', as: 'email_confirmation_required'
+    get '/confirm_email/:token/:email' => 'activities#confirm_email', as: 'confirm_email'
+    post '/resend_email_confirmation' => 'activities#resend_email_confirmation', as: 'resend_email_confirmation'
+    post '/download_recovery_key' => 'activities#download_recovery_key', as: 'download_recovery_key'
+
+    get '/change_password' => 'change_password#new', as: 'change_password'
+    post '/change_password' => 'change_password#create'
+
+    get '/sign_up_success' => 'static#sign_up_success', as: 'sign_up_success'
+    get '/sign_in_success' => 'static#sign_in_success', as: 'sign_in_success'
+    get '/add_email_success' => 'static#add_email_success', as: 'add_email_success'
+    get '/confirm_email_success' => 'static#confirm_email_success', as: 'confirm_email_success'
+    get '/change_password_success' => 'static#change_password_success', as: 'change_password_success'
+    get '/reconfirm_password_success' => 'static#reconfirm_password_success', as: 'reconfirm_password_success'
+
+
+    # skip_before_filter :require_valid_session for these routes
+    get '/access_token/:token_for(/:token)' => 'password_less_session#access_token', :as => 'access_token_token_for_token'
+    post '/access_token' => 'password_less_session#access_token_post'
+
+    get '/sign_out_success' => 'static#sign_out_success'
+    get '/forgot_password_verification_mail_sent' => 'static#forgot_password_verification_mail_sent'
+
+    get '/forgot_password' => 'forgot_passwords#new'
+    post '/forgot_password' => 'forgot_passwords#create'
+    get '/choose_new_password/:token/:email' => 'forgot_passwords#choose_new_password', as: 'choose_new_password'
+    post '/reset_password' => 'forgot_passwords#reset_password', as: 'reset_password'
+  end
+end

data/db/migrate/20140616234935_create_door_mat_actors.rb

@@ -0,0 +1,23 @@
+class CreateDoorMatActors < ActiveRecord::Migration
+  def change
+    create_table :door_mat_actors do |t|
+      # The salt of the user's password derived key; used for symmetric encryption of data
+      t.text :key_salt, :default => '', :null => false
+      # The salt of the password
+      t.text :password_salt, :default => '', :null => false
+      # The resulting hash used for authentication
+      t.text :password_hash, :default => '', :null => false
+      # A symmetric encryption key used by the system to encrypt data before handing it to the user
+      t.text :system_key, :default => '', :null => false
+      # The encrypted user key, used to recover data in a password recovery scenario
+      t.text :recovery_key, :default => '', :null => false
+
+      # The key to decrypt the pem pbkey; it is encrypted using the user's password derived key
+      t.text :encrypted_pem_key, :default => '', :null => false
+      t.text :pem_encrypted_pkey, :default => '', :null => false
+      t.text :pem_public_key, :default => '', :null => false
+
+      t.timestamps :null => false
+    end
+  end
+end

data/db/migrate/20140617233357_create_door_mat_sessions.rb

@@ -0,0 +1,17 @@
+class CreateDoorMatSessions < ActiveRecord::Migration
+  def change
+    create_table :door_mat_sessions do |t|
+      t.belongs_to :actor, index: true
+      t.belongs_to :email
+      t.string :session_guid, :default => '', :null => false, index: true
+      t.text :type, :default => '', :null => false
+      t.text :agent, :default => '', :null => false
+      t.text :ip, :default => '', :null => false
+      t.text :encrypted_symmetric_actor_key, :default => '', :null => false
+      t.datetime :password_authenticated_at, :default => Date.new(2014,1,1), :null => false
+      t.integer :rating, :default => 0
+
+      t.timestamps :null => false
+    end
+  end
+end

data/db/migrate/20140630043202_create_door_mat_emails.rb

@@ -0,0 +1,12 @@
+class CreateDoorMatEmails < ActiveRecord::Migration
+  def change
+    create_table :door_mat_emails do |t|
+      t.belongs_to :actor, index: true
+      t.text :address_hash, :default => '', :null => false, index: true
+      t.text :address, :default => '', :null => false
+      t.integer :status, :default => 0
+
+      t.timestamps :null => false
+    end
+  end
+end

data/db/migrate/20140702045729_create_door_mat_activities.rb

@@ -0,0 +1,14 @@
+class CreateDoorMatActivities < ActiveRecord::Migration
+  def change
+    create_table :door_mat_activities do |t|
+      t.belongs_to :actor, index: true
+      t.string :type, :default => '', :null => false
+      t.integer :notifier_id, :null => false
+      t.string :notifier_type, :default => '', :null => false
+      t.text :link_hash, :default => '', :null => false
+      t.integer :status, :default => 0
+
+      t.timestamps :null => false
+    end
+  end
+end

data/db/migrate/20141115183045_create_door_mat_access_tokens.rb

@@ -0,0 +1,17 @@
+class CreateDoorMatAccessTokens < ActiveRecord::Migration
+  def change
+    create_table :door_mat_access_tokens do |t|
+
+      t.belongs_to :actor
+      t.text :hashed_token, :default => '', :null => false, index: true
+      t.text :name, :default => '', :null => false
+      t.integer :token_for, :default => 0
+      t.integer :status, :default => 0
+      t.text :identifier, :default => '', :null => false
+      t.text :data, :default => '', :null => false
+      t.integer :reference_id, :default => 0, :null => false
+
+      t.timestamps :null => false
+    end
+  end
+end

data/db/migrate/20141121191824_create_door_mat_memberships.rb

@@ -0,0 +1,14 @@
+class CreateDoorMatMemberships < ActiveRecord::Migration
+  def change
+    create_table :door_mat_memberships do |t|
+      t.belongs_to :member, index: true, class_name: "DoorMat::Actor"
+      t.belongs_to :member_of, index: true, class_name: "DoorMat::Actor"
+      t.integer :sponsor, :default => 0
+      t.integer :owner, :default => 0
+      t.integer :permission, :default => 0
+      t.text :key, :default => '', :null => false
+
+      t.timestamps :null => false
+    end
+  end
+end

data/db/migrate/20150910182126_rename_session_guid_column.rb

@@ -0,0 +1,5 @@
+class RenameSessionGuidColumn < ActiveRecord::Migration
+  def change
+    rename_column :door_mat_sessions, :session_guid, :hashed_token
+  end
+end

data/db/migrate/20150918210831_add_access_token_rating_column.rb

@@ -0,0 +1,5 @@
+class AddAccessTokenRatingColumn < ActiveRecord::Migration
+  def change
+    add_column :door_mat_access_tokens, :rating, :integer, :default => 0
+  end
+end

data/door_mat.gemspec

@@ -0,0 +1,37 @@
+$:.push File.expand_path('../lib', __FILE__)
+
+require 'door_mat/version'
+
+Gem::Specification.new do |s|
+  s.name        = 'door_mat'
+  s.version     = DoorMat::VERSION
+  s.authors     = ['Luc Lussier']
+  s.email       = ['luc.lussier@gmail.com']
+  s.homepage    = 'https://github.com/datamolecule/door_mat'
+  s.summary     = 'User authentication and data encryption'
+  s.description = 'DoorMat is a Rails Engine that provides a solution for both user authentication and the encryption of user information. It aims to offer safe defaults so you can get going with what your website is really about.'
+  s.license     = 'MIT'
+
+  s.files = Dir['{app,bin,config,db,lib}/**/*', 'MIT-LICENSE', 'Rakefile', 'README.md', '.rspec', 'door_mat.gemspec', 'Gemfile']
+  s.test_files = Dir['spec/**/*']
+
+  s.add_dependency 'rails', '~> 4.2'
+  s.add_dependency 'bcrypt', '~> 3.1' #https://github.com/codahale/bcrypt-ruby
+  s.add_dependency 'request_store', '~> 1.1'
+
+  s.add_development_dependency 'sprockets', '2.12.4' # to prevent https://github.com/rails/rails/issues/19853
+  s.add_development_dependency 'sqlite3'
+  s.add_development_dependency 'database_cleaner'
+  s.add_development_dependency 'rspec-rails', '~> 3.4.2'
+  s.add_development_dependency 'factory_girl_rails', '~> 4.4.1'
+  s.add_development_dependency 'email_spec', '~> 2.0'
+  s.add_development_dependency 'capybara'
+  s.add_development_dependency 'show_me_the_cookies'
+  s.add_development_dependency 'poltergeist'
+  s.add_development_dependency 'selenium-webdriver'
+  s.add_development_dependency 'byebug'
+  s.add_development_dependency 'timecop'
+  s.add_development_dependency 'better_errors'
+  s.add_development_dependency 'binding_of_caller'
+  s.add_development_dependency 'simplecov'
+end

data/lib/door_mat.rb

@@ -0,0 +1,20 @@
+require 'request_store'
+
+require 'door_mat/configuration'
+require 'door_mat/engine'
+require 'door_mat/crypto'
+require 'door_mat/attr_symmetric_store'
+require 'door_mat/attr_asymmetric_store'
+require 'door_mat/controller'
+require 'door_mat/url_protocol'
+require 'door_mat/regex'
+
+require 'door_mat/process/actor_password_change'
+require 'door_mat/process/actor_sign_in'
+require 'door_mat/process/actor_sign_up'
+require 'door_mat/process/create_new_anonymous_actor'
+require 'door_mat/process/manage_email'
+require 'door_mat/process/reset_password'
+
+module DoorMat
+end

data/lib/door_mat/attr_asymmetric_store.rb

@@ -0,0 +1,82 @@
+module DoorMat
+  module AttrAsymmetricStore
+    class AttrAsymmetricStoreWrapper
+
+      def initialize(attribute, actor_column)
+        @attribute = attribute
+        @actor_column = actor_column
+      end
+
+      def after_find(record)
+        return if DoorMat::Crypto.current_skip_crypto_callback.skip?
+
+        # leave attribute as-is if blank or the actor is not set
+        encrypted_attribute = record.send("#{@attribute}")
+        actor = record.send("#{@actor_column}")
+        return if encrypted_attribute.blank? || actor.blank?
+
+        clear_attribute = nil
+
+        DoorMat::Session.current_session.autoload_sesion_for(actor)
+        DoorMat::Session.current_session.with_session_for_actor(actor) do |session|
+          clear_attribute = actor.decrypt_shared_key(encrypted_attribute, session)
+        end
+
+        if clear_attribute.nil?
+          clear_attribute = '[ENCRYPTED SHARED KEY]'
+        end
+
+        record.send("#{@attribute}=", clear_attribute)
+        DoorMat.configuration.logger.debug "DEBUG: Decrypt #{@attribute}: #{encrypted_attribute} -> #{clear_attribute}" if Rails.env.development?
+      end
+
+      def around_save(record)
+        return yield if DoorMat::Crypto.current_skip_crypto_callback.skip?
+
+        clear_attribute = record.send("#{@attribute}")
+        actor = record.send("#{@actor_column}")
+
+        # leave attribute as-is if blank or the actor is not set
+        if clear_attribute.blank? || actor.blank?
+          yield
+        else
+          encrypted_attribute = actor.encrypt_shared_key(clear_attribute)
+
+          DoorMat.configuration.logger.debug "DEBUG: Encrypt #{@attribute}: #{clear_attribute} -> #{encrypted_attribute}" if Rails.env.development?
+          record.send("#{@attribute}=", encrypted_attribute)
+          yield
+          record.send("#{@attribute}=", clear_attribute)
+          DoorMat.configuration.logger.debug "DEBUG: Decrypt #{@attribute}: #{encrypted_attribute} -> #{clear_attribute}" if Rails.env.development?
+        end
+      end
+
+    end
+
+    def self.included(base)
+      base.extend ClassMethods
+    end
+
+    module ClassMethods
+
+      def attr_asymmetric_store(*args, **options)
+        return unless self.table_exists?
+
+        actor_column = options.fetch(:actor_column, :actor).to_s
+        unless self.attribute_names.include? "#{actor_column}_id"
+          raise ActiveRecord::ActiveRecordError, "attr_asymmetric_store records must belong to a DoorMat::Actor but could not find the actor column. Pass the actor_column: :actor_column_name option to specify it."
+        end
+
+        args.each do |arg|
+          column_type = (self.columns_hash[arg.to_s].cast_type.respond_to?(:type) && self.columns_hash[arg.to_s].cast_type.type) || self.columns_hash[arg.to_s].cast_type.to_s
+          if [:text, :string].include? column_type
+            after_find DoorMat::AttrAsymmetricStore::AttrAsymmetricStoreWrapper.new(arg.to_s, actor_column)
+            around_save DoorMat::AttrAsymmetricStore::AttrAsymmetricStoreWrapper.new(arg.to_s, actor_column)
+          else
+            raise ActiveRecord::ActiveRecordError, "attr_asymmetric_store only support text and string column types."
+          end
+        end
+      end
+
+    end
+  end
+end

data/lib/door_mat/attr_symmetric_store.rb

@@ -0,0 +1,82 @@
+module DoorMat
+  module AttrSymmetricStore
+    class AttrSymmetricStoreWrapper
+
+      def initialize(attribute, actor_column)
+        @attribute = attribute
+        @actor_column = actor_column
+      end
+
+      def after_find(record)
+        return if DoorMat::Crypto.current_skip_crypto_callback.skip?
+
+        encrypted_attribute = record.send("#{@attribute}")
+        actor = record.send("#{@actor_column}")
+        clear_attribute = nil
+
+        DoorMat::Session.current_session.autoload_sesion_for(actor)
+        DoorMat::Session.current_session.with_session_for_actor(actor) do |session|
+          clear_attribute = session.decrypt(encrypted_attribute)
+        end
+
+        if clear_attribute.nil?
+          clear_attribute = '[ENCRYPTED]'
+          record.readonly!
+        end
+
+        record.send("#{@attribute}=", clear_attribute)
+        DoorMat.configuration.logger.debug "DEBUG: Decrypt #{@attribute}: #{encrypted_attribute} -> #{clear_attribute}" if Rails.env.development?
+      end
+
+      def around_save(record)
+        return yield if DoorMat::Crypto.current_skip_crypto_callback.skip?
+
+        raise ActiveRecord::Rollback, "Record is read-only" if record.readonly?
+
+        clear_attribute = record.send("#{@attribute}")
+        actor = record.send("#{@actor_column}")
+        encrypted_attribute = nil
+
+        DoorMat::Session.current_session.autoload_sesion_for(actor)
+        DoorMat::Session.current_session.with_session_for_actor(actor) do |session|
+          encrypted_attribute = session.encrypt(clear_attribute)
+        end
+        raise ActiveRecord::Rollback, "DoorMat::Session is not valid" if encrypted_attribute.nil?
+
+        DoorMat.configuration.logger.debug "DEBUG: Encrypt #{@attribute}: #{clear_attribute} -> #{encrypted_attribute}" if Rails.env.development?
+        record.send("#{@attribute}=", encrypted_attribute)
+        yield
+        record.send("#{@attribute}=", clear_attribute)
+        DoorMat.configuration.logger.debug "DEBUG: Decrypt #{@attribute}: #{encrypted_attribute} -> #{clear_attribute}" if Rails.env.development?
+      end
+
+    end
+
+    def self.included(base)
+      base.extend ClassMethods
+    end
+
+    module ClassMethods
+
+      def attr_symmetric_store(*args, **options)
+        return unless self.table_exists?
+
+        actor_column = options.fetch(:actor_column, :actor).to_s
+        unless self.attribute_names.include? "#{actor_column}_id"
+          raise ActiveRecord::ActiveRecordError, "attr_symmetric_store records must belong to a DoorMat::Actor but could not find the actor column. Pass the actor_column: :actor_column_name option to specify it."
+        end
+
+        args.each do |arg|
+          column_type = (self.columns_hash[arg.to_s].cast_type.respond_to?(:type) && self.columns_hash[arg.to_s].cast_type.type) || self.columns_hash[arg.to_s].cast_type.to_s
+          if [:text, :string].include? column_type
+            after_find DoorMat::AttrSymmetricStore::AttrSymmetricStoreWrapper.new(arg.to_s, actor_column)
+            around_save DoorMat::AttrSymmetricStore::AttrSymmetricStoreWrapper.new(arg.to_s, actor_column)
+          else
+            raise ActiveRecord::ActiveRecordError, "attr_symmetric_store only support text and string column types."
+          end
+        end
+      end
+
+    end
+  end
+end

data/lib/door_mat/configuration.rb

@@ -0,0 +1,193 @@
+module DoorMat
+  class Configuration
+
+    attr_accessor \
+    :mailer_from_address,
+    :password_reconfirm_delay,
+    :public_computer_access_session_timeout,
+    :private_computer_access_session_timeout,
+    :forgot_password_link_request_delay_minutes,
+    :forgot_password_link_expiration_delay_minutes,
+    :allow_remember_me_feature,
+    :remember_me_require_private_computer_confirmation,
+    :remember_me_max_day_count,
+    :leak_email_address_at_reconfirm,
+    :plausible_deniability_count,
+    :max_email_count_per_actor,
+    :define_door_mat_routes,
+    :allow_redirect_to_requested_url,
+    :lockdown_default_redirect_url,
+    :sign_up_success_url,
+    :sign_in_success_url,
+    :add_email_success_url,
+    :destroy_email_redirect_url,
+    :set_primary_email_redirect_url,
+    :resend_email_confirmation_redirect_url,
+    :confirm_email_success_url,
+    :reconfirm_password_success_url,
+    :change_password_success_url,
+    :sign_out_success_url,
+    :forgot_password_verification_mail_sent_url,
+    :allow_sign_up,
+    :allow_sign_in_from_sign_up_form,
+    :transmit_cookies_only_over_https,
+    :crypto_pbkdf2_salt_length,
+    :crypto_pbkdf2_password_length,
+    :crypto_pbkdf2_iterations,
+    :crypto_bcrypt_cost,
+    :crypto_secure_compare_default_length,
+    :event_hook_before_sign_up,
+    :event_hook_after_sign_up,
+    :event_hook_after_failed_sign_up,
+    :event_hook_before_sign_in,
+    :event_hook_after_sign_in,
+    :event_hook_after_failed_sign_in,
+    :event_hook_before_confirm_email,
+    :event_hook_after_confirm_email,
+    :event_hook_after_failed_confirm_email,
+    :event_hook_before_download_recovery_key,
+    :event_hook_after_download_recovery_key,
+    :event_hook_after_failed_download_recovery_key,
+    :event_hook_before_sign_out,
+    :event_hook_after_sign_out,
+    :logger,
+    :password_less_sessions
+
+    def initialize
+      @mailer_from_address = "noreply@example.com"
+
+      # Controllers that require_password_reconfirm will only
+      # allow the user in without requesting an additional sign-in if the user password
+      # was last entered less than password_reconfirm_delay
+      # minutes ago.
+      # All sections of the site allowing access to or modification
+      # of sensitive information or settings should be protected this way.
+      # This includes operations resulting in
+      # a financial transaction using stored or pre-authorized payment methods.
+      @password_reconfirm_delay = 5
+
+      # A session from a public computer will only last
+      # until the browser is closed and will timeout
+      # after public_computer_access_session_timeout
+      # minutes of inactivity.
+      @public_computer_access_session_timeout = 30
+
+      # A session from a private computer will survive
+      # a browser restart but will expire in the
+      # browser and timeout on the system
+      # after private_computer_access_session_timeout
+      # minutes of inactivity.
+      @private_computer_access_session_timeout = 60
+
+
+      # To prevent email flooding, a new request for a recovery password
+      # links will only be sent after the specified delay
+      @forgot_password_link_request_delay_minutes = 30
+
+      # Password recovery links older than this delay become invalid
+      @forgot_password_link_expiration_delay_minutes = 30
+
+      # Does the system allow the remember me feature?
+      # High value target systems such as financial sites
+      # should not allow the remember me feature.
+      # Even when this feature is enabled, sensitive area of the site
+      # should require users to re-authenticate using a
+      # before_action -> {require_password_reconfirm()}
+      # filter
+      @allow_remember_me_feature = false
+
+      # As a safety reminder, the user must confirm that they
+      # are not loging in from a public computer before enabling
+      # the remember me feature
+      @remember_me_require_private_computer_confirmation = true
+
+      # A session from a private computer for which the
+      # cookie will remain for a number of days specified
+      # by remember_me_max_day_count and automatically
+      # renew the session for that period of time
+      @remember_me_max_day_count = 30
+
+      # Do not pre-populate the email address field
+      # in the sign_in form while doing a password reconfirmation
+      # as it could be considered to leak the information about which
+      # email address was used to login to the system before the reconfirmation request
+      @leak_email_address_at_reconfirm = false
+
+      # How many different accounts a single email address can be associated with on the system
+      @plausible_deniability_count = 1
+
+      # How many different emails can be linked to an actor
+      @max_email_count_per_actor = 2
+
+      # Production systems should eventually redefine their own routes explicitly
+      # instead of relying on those provided by the engine
+      @define_door_mat_routes = true
+
+      #
+      @allow_redirect_to_requested_url = true
+
+      # When specifying redirects in
+      # config/initializers/door_mat.rb you can use:
+      # [ :main_app, :__path__ ] or [:__engine_name_, :__path__] respectively to redirect to an
+      # existing path defined in your main application or loaded engine.
+      # [:main_app, :root_url] to redirect to the root of your main application.
+      # [ :request, :referer ] for an alternative to redirect_to :back.
+      @lockdown_default_redirect_url = [ :request, :referer ]
+      @sign_up_success_url = [ :sign_up_success_url ]
+      @sign_in_success_url = [ :sign_in_success_url ]
+      @add_email_success_url = [ :add_email_success_url ]
+      @destroy_email_redirect_url = [ :request, :referer ]
+      @set_primary_email_redirect_url = [ :request, :referer ]
+      @resend_email_confirmation_redirect_url = [ :request, :referer ]
+      @confirm_email_success_url = [ :confirm_email_success_url ]
+      @reconfirm_password_success_url = [ :reconfirm_password_success_url ]
+      @change_password_success_url = [ :change_password_success_url ]
+      @sign_out_success_url = [ :sign_out_success_url ]
+      @forgot_password_verification_mail_sent_url = [ :forgot_password_verification_mail_sent_url ]
+
+      @allow_sign_up = true
+      @allow_sign_in_from_sign_up_form = false
+
+      @transmit_cookies_only_over_https = true
+
+      @crypto_pbkdf2_salt_length = 32
+      @crypto_pbkdf2_password_length = 32
+      @crypto_pbkdf2_iterations = 10_000
+
+      @crypto_bcrypt_cost = 12
+
+      @crypto_secure_compare_default_length = 1024
+
+
+      @event_hook_before_sign_up = []
+      @event_hook_after_sign_up = []
+      @event_hook_after_failed_sign_up = []
+      @event_hook_before_sign_in = []
+      @event_hook_after_sign_in = []
+      @event_hook_after_failed_sign_in = []
+      @event_hook_before_confirm_email = []
+      @event_hook_after_confirm_email = [] # The confirmed DoorMat::Email is passed as function argument
+      @event_hook_after_failed_confirm_email = []
+      @event_hook_before_download_recovery_key = []
+      @event_hook_after_download_recovery_key = []
+      @event_hook_after_failed_download_recovery_key = []
+      @event_hook_before_sign_out = []
+      @event_hook_after_sign_out = []
+
+      @logger = Rails.logger
+
+      # By default, there are no password less sessions defined
+      # see test_app/config/initializers/door_mat.rb for sample usage
+      @password_less_sessions = {}
+
+    end
+  end
+
+  def self.configuration
+    @configuration ||= DoorMat::Configuration.new
+  end
+
+  def self.configure
+    yield configuration
+  end
+end