headstart 0.1.0

data/generators/headstart_tests/templates/test/integration/sign_in_test.rb

@@ -0,0 +1,66 @@
+require 'test_helper'
+
+class SignInTest < ActionController::IntegrationTest
+  
+  context 'Signing in as a User' do
+    
+    context 'who is not in the system' do
+      
+      should 'see a failure message' do
+        sign_in_as('someone@somewhere.com', 'password')
+        assert_match(/Bad email or password/, response.body)
+      end
+      
+      should 'not be signed in' do
+        sign_in_as "someone@somewhere.com", 'password'
+        assert !controller.signed_in?
+      end
+      
+    end
+    
+    context 'when confirmed' do
+      
+      setup do
+        @user = Factory(:user, :email => "bob@bob.bob", :password => "password")
+      end
+      
+      should 'be signed in' do
+        sign_in_as 'bob@bob.bob', 'password'
+        assert controller.signed_in?
+      end
+      
+      should 'see "Signed In"' do
+        sign_in_as 'bob@bob.bob', 'password'
+        assert_match %r{Signed in}, @response.body
+      end
+      
+      should 'be signed in on subsequent requests' do
+        sign_in_as 'bob@bob.bob', 'password'
+        reset_session
+        visit root_url
+        assert controller.signed_in?
+      end
+      
+    end
+        
+    context 'when confirmed but with bad credentials' do
+      
+      setup do
+        @user = Factory(:user, :email => 'bob@bob.bob', :password => 'password')
+      end
+      
+      should 'not be signed in' do
+        sign_in_as 'bob@bob.bob', 'badpassword'
+        assert !controller.signed_in?
+      end
+      
+      should 'see "Bad email or password"' do
+        sign_in_as 'bob@bob.bob', 'badpassword'
+        assert_match /Bad email or password/, response.body
+      end
+      
+    end
+    
+  end
+  
+end

data/generators/headstart_tests/templates/test/integration/sign_out_test.rb

@@ -0,0 +1,28 @@
+require 'test_helper'
+
+class SignOutTest < ActionController::IntegrationTest
+  
+  context 'Signing out as a user' do
+    
+    should 'see "Signed out"' do
+      sign_up(:email => 'bob@bob.bob')
+      sign_out
+      assert_match(/Signed out/, response.body)
+    end
+  
+    should 'be signed out' do
+      sign_up(:email => 'bob@bob.bob')
+      sign_out
+      assert !controller.signed_in?
+    end
+  
+    should 'be signed out when I return' do
+      sign_up(:email => 'bob@bob.bob')
+      sign_out
+      visit root_url
+      assert !controller.signed_in?
+    end
+    
+  end
+  
+end

data/generators/headstart_tests/templates/test/integration/sign_up_test.rb

@@ -0,0 +1,47 @@
+require 'test_helper'
+
+class SignUpTest < ActionController::IntegrationTest
+  
+  context 'Signing up as a new user' do
+    
+    setup do
+      ActionMailer::Base.deliveries.clear
+    end
+
+    teardown do
+      ActionMailer::Base.deliveries.clear
+    end
+    
+    context 'with invalid data' do
+      
+      should 'show error messages' do
+        sign_up(:email => 'invalidemail', :password_confirmation => '', :first_name => '', :last_name => '')
+        assert_match /Email is invalid/, response.body
+        assert_match /First name.*blank/, response.body
+        assert_match /Last name.*blank/, response.body
+        assert_match /Password doesn't match confirmation/, response.body
+      end
+      
+    end
+    
+    context 'with valid data' do
+      
+      should 'sign in the user' do
+        sign_up(:email => 'bob@bob.bob', :password => 'password', :password_confirmation => 'password')
+        assert controller.signed_in?
+      end
+    
+      should 'send a welcome email' do
+        sign_up(:email => 'bob@bob.bob', :password => 'password', :password_confirmation => 'password')
+        user = User.find_by_email('bob@bob.bob')
+        Delayed::Job.work_off
+        sent = ActionMailer::Base.deliveries.last
+        assert_equal user.email, sent.recipients
+        assert_match /welcome/i, sent.subject
+      end
+      
+    end
+    
+  end
+
+end

data/lib/headstart/authentication.rb

@@ -0,0 +1,138 @@
+module Headstart
+  module Authentication
+
+    def self.included(controller) # :nodoc:
+      controller.send(:include, InstanceMethods)
+      controller.extend(ClassMethods)
+    end
+
+    module ClassMethods
+      def self.extended(controller)
+        controller.helper_method :current_user, :signed_in?, 
+                                 :signed_out?,  :impersonating?
+        controller.hide_action   :current_user, :current_user=,
+                                 :signed_in?,   :signed_out?,
+                                 :sign_in,      :sign_out,
+                                 :authenticate, :deny_access,
+                                 :impersonating?
+      end
+    end
+
+    module InstanceMethods
+      # User in the current cookie
+      #
+      # @return [User, nil]
+      def current_user
+        @_current_user ||= user_from_cookie
+      end
+
+      # Set the current user
+      #
+      # @param [User]
+      def current_user=(user)
+        @_current_user = user
+      end
+
+      # Is the current user signed in?
+      #
+      # @return [true, false]
+      def signed_in?
+        ! current_user.nil?
+      end
+
+      # Is the current user signed out?
+      #
+      # @return [true, false]
+      def signed_out?
+        current_user.nil?
+      end
+
+      # Deny the user access if they are signed out.
+      #
+      # @example
+      #   before_filter :authenticate
+      def authenticate
+        deny_access unless signed_in?
+      end
+
+      # Sign user in to cookie.
+      #
+      # @param [User]
+      #
+      # @example
+      #   sign_in(@user)
+      def sign_in(user)
+        if user
+          cookies[:remember_token] = {
+            :value   => user.remember_token,
+            :expires => 1.year.from_now.utc
+          }
+          self.current_user = user
+        end
+      end
+
+      # Sign user out of cookie.
+      #
+      # @example
+      #   sign_out
+      def sign_out
+        current_user.reset_remember_token! if current_user
+        cookies.delete(:remember_token)
+        self.current_user = nil
+      end
+
+      # Store the current location and redirect to sign in.
+      # Display a failure flash message if included.
+      #
+      # @param [String] optional flash message to display to denied user
+      def deny_access(flash_message = nil)
+        store_location
+        flash[:failure] = flash_message if flash_message
+        redirect_to(sign_in_url)
+      end
+      
+      def impersonating?
+        !session[:admin_user_id].blank?
+      end
+      
+
+      protected
+
+      def user_from_cookie
+        if token = cookies[:remember_token]
+          ::User.find_by_remember_token(token)
+        end
+      end
+
+      def sign_user_in(user)
+        warn "[DEPRECATION] sign_user_in: unnecessary. use sign_in(user) instead."
+        sign_in(user)
+      end
+
+      def store_location
+        if request.get?
+          session[:return_to] = request.request_uri
+        end
+      end
+
+      def redirect_back_or(default)
+        redirect_to(return_to || default)
+        clear_return_to
+      end
+
+      def return_to
+        session[:return_to] || params[:return_to]
+      end
+
+      def clear_return_to
+        session[:return_to] = nil
+      end
+
+      def redirect_to_root
+        redirect_to('/')
+      end
+      
+    end
+    
+  end
+end

data/lib/headstart/configuration.rb

@@ -0,0 +1,34 @@
+module Headstart
+  class Configuration
+    attr_accessor :mailer_sender
+    attr_accessor :impersonation_hash
+    attr_accessor :use_facebook_connect
+    attr_accessor :facebook_api_key
+    attr_accessor :facebook_secret_key
+    attr_accessor :use_delayed_job
+
+    def initialize
+      @mailer_sender          = 'donotreply@example.com'
+      @impersonation_hash     = 'e76e05e1ddf74560ffb64c02a1c1b26c'
+      @user_facebook_connect  = false
+      @use_delayed_job  = true
+    end
+  end
+
+  class << self
+    attr_accessor :configuration
+  end
+
+  # Configure Headstart someplace sensible,
+  # like config/initializers/headstart.rb
+  #
+  # @example
+  #   Headstart.configure do |config|
+  #     config.mailer_sender = 'donotreply@example.com'
+  #     config.impersonation_hash = 'abc123def456...'
+  #   end
+  def self.configure
+    self.configuration ||= Configuration.new
+    yield(configuration)
+  end
+end

data/lib/headstart/extensions/errors.rb

@@ -0,0 +1,6 @@
+if defined?(ActionController)
+  module ActionController
+    class Forbidden < StandardError
+    end
+  end
+end

data/lib/headstart/extensions/rescue.rb

@@ -0,0 +1,5 @@
+if defined?(ActionDispatch::ShowExceptions) # Rails 3
+  ActionDispatch::ShowExceptions.rescue_responses.update('ActionController::Forbidden' => :forbidden)
+elsif defined?(ActionController::Base)
+  ActionController::Base.rescue_responses.update('ActionController::Forbidden' => :forbidden)
+end

data/lib/headstart/routes.rb

@@ -0,0 +1,67 @@
+module Headstart
+  class Routes
+
+    # In your application's config/routes.rb, draw Headstart's routes:
+    #
+    # @example
+    #   map.resources :posts
+    #   Headstart::Routes.draw(map)
+    #
+    # If you need to override a Headstart route, invoke your app route
+    # earlier in the file so Rails' router short-circuits when it finds
+    # your route:
+    #
+    # @example
+    #   map.resources :users, :only => [:new, :create]
+    #   Headstart::Routes.draw(map)
+    def self.draw(map)
+      map.resources :passwords,
+        :controller => 'headstart/passwords',
+        :only       => [:new, :create]
+
+      map.resource  :session,
+        :controller => 'headstart/sessions',
+        :only       => [:new, :create, :destroy]
+
+      map.resources :users, :controller => 'headstart/users' do |users|
+        users.resource :password,
+          :controller => 'headstart/passwords',
+          :only       => [:create, :edit, :update]
+          
+        users.resource :confirmation,
+          :controller => 'headstart/confirmations',
+          :only       => [:new, :create]
+      end
+      
+      map.resource :impersonation,
+        :controller => 'headstart/impersonations',
+        :only       => [:create, :destroy]
+      map.resources :impersonations,
+        :controller => 'headstart/impersonations',
+        :only       => :index
+        
+      map.sign_up    'sign_up',
+        :controller   => 'headstart/users',
+        :action       => 'new'
+      map.sign_in    'sign_in',
+        :controller   => 'headstart/sessions',
+        :action       => 'new'
+      map.fb_connect 'fb_connect',
+        :controller   => 'headstart/sessions',
+        :action       => 'create'
+      map.fb_disconnect 'fb_disconnect',
+        :controller   => 'headstart/users',
+        :action       => 'facebook_remove'
+      map.sign_out   'sign_out',
+        :controller   => 'headstart/sessions',
+        :action       => 'destroy',
+        :method       => :delete
+      map.admin      'admin', 
+        :controller   => '/admin/admin',
+        :action       => :index
+
+      map.root :controller => "sessions", :action => 'index'
+    end
+
+  end
+end

data/lib/headstart/user.rb

@@ -0,0 +1,279 @@
+require 'digest/sha1'
+
+module Headstart
+  module User
+    
+    Admin = 'admin'
+    
+    # Hook for all Headstart::User modules.
+    #
+    # If you need to override parts of Headstart::User,
+    # extend and include à la carte.
+    #
+    # @example
+    #   extend ClassMethods
+    #   include InstanceMethods
+    #   include AttrAccessor
+    #   include Callbacks
+    #
+    # @see ClassMethods
+    # @see InstanceMethods
+    # @see AttrAccessible
+    # @see AttrAccessor
+    # @see Validations
+    # @see Callbacks
+    def self.included(model)
+      model.extend(ClassMethods)
+
+      model.send(:include, InstanceMethods)
+      model.send(:include, AttrAccessor)
+      model.send(:include, Validations)
+      model.send(:include, Callbacks)
+    end
+
+    module AttrAccessor
+      # Hook for attr_accessor virtual attributes.
+      #
+      # :password, :password_confirmation
+      def self.included(model)
+        model.class_eval do
+          attr_accessor :password, :password_confirmation
+        end
+      end
+    end
+
+    module Validations
+      # Hook for validations.
+      #
+      # :email must be present, unique, formatted
+      #
+      # If password is required,
+      # :password must be present, confirmed
+      def self.included(model)
+        model.class_eval do
+          validates_presence_of     :email, :unless => :email_optional?
+          validates_uniqueness_of   :email, :case_sensitive => false, :allow_blank => true
+          validates_format_of       :email, :with => %r{.+@.+\..+}, :allow_blank => true
+
+          validates_presence_of     :password, :unless => :password_optional?
+          validates_confirmation_of :password, :unless => :password_optional?
+          
+          validates_presence_of     :first_name, :last_name
+        end
+      end
+    end
+
+    module Callbacks
+      # Hook for callbacks.
+      #
+      # salt, token, password encryption are handled before_save.
+      def self.included(model)
+        model.class_eval do
+          before_save   :initialize_salt,
+                        :encrypt_password
+          before_create :generate_confirmation_token,
+                        :generate_remember_token
+          after_create  :send_welcome_email, :unless => :suppress_receive_welcome_email?
+        end
+      end
+    end
+
+    module InstanceMethods
+      # Am I authenticated with given password?
+      #
+      # @param [String] plain-text password
+      # @return [true, false]
+      # @example
+      #   user.authenticated?('password')
+      def authenticated?(password)
+        encrypted_password == encrypt(password)
+      end
+
+      # Don't send welcome email if email already confirmed, or
+      # use is a facebook connect user
+      def suppress_receive_welcome_email?
+        return true if email_confirmed?
+        if self.facebook_uid.present?
+          self.email_confirmed    = true
+          self.confirmation_token = nil
+          self.save
+          return true
+        end
+        return false
+      end
+      
+      # Set the remember token.
+      #
+      # @deprecated Use {#reset_remember_token!} instead
+      def remember_me!
+        warn "[DEPRECATION] remember_me!: use reset_remember_token! instead"
+        reset_remember_token!
+      end
+
+      # Reset the remember token.
+      #
+      # @example
+      #   user.reset_remember_token!
+      def reset_remember_token!
+        generate_remember_token
+        save(false)
+      end
+
+      # Confirm my email.
+      #
+      # @example
+      #   user.confirm_email!
+      def confirm_email!
+        self.email_confirmed    = true
+        self.confirmation_token = nil
+        save(false)
+      end
+      
+      # Mark my account as forgotten password.
+      #
+      # @example
+      #   user.forgot_password!
+      def forgot_password!
+        generate_password_reset_token
+        save(false)
+      end
+
+      # Update my password.
+      #
+      # @param [String, String] password and password confirmation
+      # @return [true, false] password was updated or not
+      # @example
+      #   user.update_password('new-password', 'new-password')
+      def update_password(new_password, new_password_confirmation)
+        self.password              = new_password
+        self.password_confirmation = new_password_confirmation
+        if valid?
+          self.password_reset_token = nil
+        end
+        save
+      end
+      
+      def facebook_user?
+        !self.facebook_uid.blank?
+      end
+      
+      ##
+      # Returns +true+ if the user is an admin.
+      # 
+      def admin?
+        self.role == Admin
+      end
+      
+      ##
+      # Returns the user's full name.
+      #
+      def name
+        "#{self.first_name} #{self.last_name}"
+      end
+      
+      protected
+
+      def generate_hash(string)
+        Digest::SHA1.hexdigest(string)
+      end
+
+      def initialize_salt
+        if new_record?
+          self.salt = generate_hash("--#{Time.now.utc}--#{password}--#{rand}--")
+        end
+      end
+
+      def encrypt_password
+        return if password.blank?
+        self.encrypted_password = encrypt(password)
+      end
+
+      def encrypt(string)
+        generate_hash("--#{salt}--#{string}--")
+      end
+      
+      def generate_confirmation_token
+        self.confirmation_token = encrypt("--#{Time.now.utc}--#{password}--#{rand}--")
+      end
+      
+      def generate_password_reset_token
+        self.password_reset_token = encrypt("--#{Time.now.utc}--#{password}--#{rand}--")
+      end
+      
+      def generate_remember_token
+        self.remember_token = encrypt("--#{Time.now.utc}--#{encrypted_password}--#{id}--#{rand}--")
+      end
+
+      # Always false. Override to allow other forms of authentication
+      # (username, facebook, etc).
+      # @return [Boolean] true if the email field be left blank for this user
+      def email_optional?
+        false
+      end
+
+      # True if the password has been set and the password is not being
+      # updated. Override to allow other forms of # authentication (username,
+      # facebook, etc).
+      # @return [Boolean] true if the password field can be left blank for this user
+      def password_optional?
+        facebook_user? || (encrypted_password.present? && password.blank?)
+      end
+
+      def password_required?
+        # warn "[DEPRECATION] password_required?: use !password_optional? instead"
+        !password_optional?
+      end
+      
+      def send_welcome_email
+        if Headstart.configuration.use_delayed_job
+          Delayed::Job.enqueue DeliverWelcomeJob.new(self.id)
+        else
+          if user = ::User.find_by_id(self.id)
+            HeadstartMailer.deliver_welcome(user)
+          end
+        end
+      end
+      
+      def send_confirmation_email
+        HeadstartMailer.deliver_confirmation self
+      end
+      
+    end
+
+    module ClassMethods
+      # Authenticate with email and password.
+      #
+      # @param [String, String] email and password
+      # @return [User, nil] authenticated user or nil
+      # @example
+      #   User.authenticate("email@example.com", "password")
+      def authenticate(email, password)
+        return nil  unless user = find_by_email(email)
+        return user if     user.authenticated?(password)
+      end
+      
+      def find_facebook_user(facebook_session, facebook_uid)
+        return nil unless Headstart.configuration.use_facebook_connect && facebook_session && facebook_uid
+        
+        begin
+          facebook_user = MiniFB::Session.new(Headstart.configuration.facebook_api_key,
+                                              Headstart.configuration.facebook_secret_key,
+                                              facebook_session, facebook_uid).user
+        rescue MiniFB::FaceBookError
+          facebook_user = nil
+        end
+        return nil unless facebook_user
+        
+        user = ::User.find_by_facebook_uid(facebook_uid) || ::User.find_by_email(facebook_user['email']) || ::User.new
+        user.tap do |user|
+          user.facebook_uid     = facebook_uid
+          user.email            = facebook_user['email']
+          user.first_name       = facebook_user['first_name']
+          user.last_name        = facebook_user['last_name']
+          user.save
+        end
+      end
+    end
+
+  end
+end

data/lib/headstart.rb

@@ -0,0 +1,7 @@
+require 'headstart/extensions/errors'
+require 'headstart/extensions/rescue'
+
+require 'headstart/configuration'
+require 'headstart/routes'
+require 'headstart/authentication'
+require 'headstart/user'

data/rails/init.rb

@@ -0,0 +1,4 @@
+require 'delayed_job'
+require 'mini_fb'
+require 'mad_mimi_mailer'
+require 'headstart'