jacobat-refinerycms 0.9.6.14

data/vendor/plugins/authentication/app/models/user_mailer.rb

@@ -0,0 +1,18 @@
+class UserMailer < ActionMailer::Base
+
+  def reset_notification(user, request)
+    setup_email(user)
+    @subject    += 'Link to reset your password'
+    @body[:url]  = "#{request.protocol}#{request.host_with_port}/reset/#{user.reset_code}"
+  end
+
+protected
+
+  def setup_email(user)
+    @recipients  = user.email
+    @subject     = ""
+    @sent_on     = Time.now
+    @body[:user] = user
+  end
+
+end

data/vendor/plugins/authentication/app/models/user_plugin.rb

@@ -0,0 +1,5 @@
+class UserPlugin < ActiveRecord::Base
+
+  belongs_to :user
+
+end

data/vendor/plugins/authentication/app/views/admin/users/_form.html.erb

@@ -0,0 +1,38 @@
+<%= error_messages_for :user %>
+<% form_for [:admin, @user] do |f| %>
+  <div class='field'>
+    <%= f.label :login %>
+    <%= f.text_field :login %>
+  </div>
+  <div class='field'>
+    <%= f.label :email %>
+    <%= f.text_field :email %>
+  </div>
+  <div class='field'>
+    <%= f.label :password %>
+    <%= f.password_field :password %><br />
+    <span class="preview">Leaving password blank keeps the current password</span>
+  </div>
+  <div class='field'>
+    <%= f.label :password_confirmation %>
+    <%= f.password_field :password_confirmation %>
+  </div>
+  <div class='field'>
+    <%= f.label :plugin_access %>
+    <ul id='plugins'>
+      <% @available_plugins.each do |plugin| -%>
+        <%# Since the dashboard is always included by the framework, this will maintain the user's order %>
+        <% if Refinery::Plugins.always_allowed.titles.include?(plugin) or (plugin == 'Users' and @user.id == current_user.id) %>
+          <%= hidden_field_tag 'user[plugins][]', plugin %>
+        <% else %>
+          <li>
+            <%= check_box_tag 'user[plugins][]', plugin, @selected_plugin_titles.include?(plugin), :id => "plugins_#{plugin.downcase.gsub(" ", "_")}" %>
+            <%= f.label 'user[plugins][]', plugin, :class => "stripped", :for => "plugins_#{plugin.downcase.gsub(" ", "_")}" %>
+          </li>
+        <% end %>
+      <% end %>
+    </ul>
+  </div>
+  <%= render :partial => "/shared/admin/form_actions", :locals => {:f => f, :continue_editing => false} %>
+
+<% end %>

data/vendor/plugins/authentication/app/views/admin/users/edit.html.erb

@@ -0,0 +1 @@
+<%= render :partial => 'form' %>

data/vendor/plugins/authentication/app/views/admin/users/index.html.erb

@@ -0,0 +1,40 @@
+<div id='actions'>
+  <ul>
+    <li>
+      <%= link_to "Create New User", new_admin_user_url, :class => "add_icon" %>
+    </li>
+  </ul>
+</div>
+<div id='records'>
+  <% if @users.any? %>
+    <%= will_paginate @users, :previous_label => '&laquo;', :next_label => '&raquo;' %>
+    <ul>
+      <% @users.each do |user| -%>
+        <li id="sortable_<%= user.id %>" class='clearfix record <%= cycle("on", "on-hover") %>'>
+          <span class='title'>
+            <span class='actions'>
+              <%= link_to refinery_icon_tag('delete.png'), admin_user_path(user),
+                                :class => "cancel confirm-delete",
+                :title => "Remove this user forever" if user.ui_deletable?(current_user) %>
+              <%= link_to refinery_icon_tag('application_edit.png'), edit_admin_user_path(user),
+                :title => 'Edit this user' %>
+              <%= mail_to user.email, refinery_icon_tag('email_go.png'), :title => 'Email this user' %>
+            </span>
+            <strong><%= user.login %></strong>
+            <span class="preview">
+              (<%= user.email %>) created <%= user.created_at.strftime("%b %d, %Y") %>
+            </span>
+          </span>
+        </li>
+      <% end -%>
+    </ul>
+    <%= will_paginate @users, :previous_label => '&laquo;', :next_label => '&raquo;' %>
+  <% else %>
+    <p>
+      <strong>
+        There are no users yet.
+        Click "Create New User" to add your first user.
+      </strong>
+    </p>
+  <% end %>
+</div>

data/vendor/plugins/authentication/app/views/admin/users/new.html.erb

@@ -0,0 +1 @@
+<%= render :partial => "form" %>

data/vendor/plugins/authentication/app/views/sessions/new.html.erb

@@ -0,0 +1,24 @@
+<% form_for :session, :url => session_path do |f| -%>
+  <div class='clearfix'>
+    <div class='field session_username'>
+      <%= f.label :login %>
+      <%= f.text_field :login %>
+    </div>
+    <div class='field session_password'>
+      <%= f.label :password %>
+      <%= f.password_field :password %>
+    </div>
+  </div>
+  <div class='field forgot_password'>
+    <%= link_to "I forgot my password", forgot_url %>
+  </div>
+  <div class='field remember_me'>
+    <%= f.label :remember_me, nil %>
+    <%= f.check_box :remember_me %>
+  </div>
+  <div class='form-actions'>
+    <%= submit_tag 'Log in' %>
+    or
+    <%= link_to "Cancel", root_url %>
+  </div>
+<% end -%>

data/vendor/plugins/authentication/app/views/user_mailer/reset_notification.html.erb

@@ -0,0 +1,6 @@
+Request to reset password received for <%= @user.login %>
+
+Visit this url to choose a new password:
+  <%= @url %>
+
+(Your password will remain the same if no action is taken)

data/vendor/plugins/authentication/app/views/users/forgot.html.erb

@@ -0,0 +1,13 @@
+<%= error_messages_for :user %>
+<% form_for :user do |f| -%>
+  <p>Enter the email address for your account.</p>
+  <div class='field'>
+    <%= f.label :email %>
+    <%= f.text_field :email %>
+  </div>
+  <div class='form-actions'>
+    <%= submit_tag 'Reset password' %>
+    or
+    <%= link_to "Cancel", login_url %>
+  </div>
+<% end -%>

data/vendor/plugins/authentication/app/views/users/new.html.erb

@@ -0,0 +1,28 @@
+<%= error_messages_for :user %>
+<p>
+  Fill out the form below with your details so we can get you started.
+</p>
+<% form_for :user, :url => users_path do |f| -%>
+  <div class='field'>
+    <%= f.label :login %>
+    <%= f.text_field :login %>
+  </div>
+  <div class='field'>
+    <%= f.label :email %>
+    <%= f.text_field :email %>
+  </div>
+  <div class='field'>
+    <%= f.label :password %>
+    <%= f.password_field :password %>
+  </div>
+  <div class='field'>
+    <%= f.label :password_confirmation %>
+    <%= f.password_field :password_confirmation %>
+  </div>
+  <% if just_installed? %>
+    <% Refinery::Plugins.registered.titles.each do |plugin| %>
+      <%= hidden_field_tag 'user[plugins][]', plugin, :id => "plugins_#{plugin.downcase.gsub(" ", "_")}"  %>
+    <% end %>
+  <% end %>
+  <p><%= submit_tag 'Sign up' %></p>
+<% end -%>

data/vendor/plugins/authentication/app/views/users/reset.html.erb

@@ -0,0 +1,18 @@
+<%= error_messages_for :user %>
+<% form_for :user do |f| -%>
+  <p>Pick a new password for <%= @user.email %></p>
+  <div class='field'>
+    <%= f.label :password %>
+    <%= f.password_field :password %>
+  </div>
+  <div class='field'>
+    <%= f.label :password_confirmation %>
+    <%= f.password_field :password_confirmation %>
+  </div>
+
+  <div class='form-actions'>
+    <%= submit_tag 'Reset password' %>
+    or
+    <%= link_to "Cancel", login_url %>
+  </div>
+<% end -%>

data/vendor/plugins/authentication/authentication.md

@@ -0,0 +1,15 @@
+# Authentication
+
+## About
+
+At the heart of Refinery's user management is the authentication plugin located in ``vendor/plugins/authentication``
+
+What this really is is just a standard [RESTFul authentication](http://github.com/technoweenie/restful-authentication) install extended with a few extra features like "I forgot my password" and hooked directly into the heart of Refinery's plugin system.
+
+## Adding New Users
+
+New users can be easily added by going to the 'Users' area admin and clicking on "Add new user".
+
+## Limiting and Granting Access
+
+Each user has a set of plugins they're allowed to see. You can control which plugins each user can see by checking and unchecking the checkboxes next to the plugin name when editing or adding a new user.

data/vendor/plugins/authentication/config/routes.rb

@@ -0,0 +1,15 @@
+ActionController::Routing::Routes.draw do |map|
+
+  map.resources :users
+  map.resource :session
+
+  map.namespace(:admin) do |admin|
+    admin.resources :users
+  end
+
+  map.login  '/login', :controller => 'sessions', :action => 'new'
+  map.logout '/logout', :controller => 'sessions', :action => 'destroy'
+  map.forgot '/forgot', :controller => 'users', :action => 'forgot'
+  map.reset 'reset/:reset_code', :controller => 'users', :action => 'reset'
+
+end

data/vendor/plugins/authentication/lib/authenticated_system.rb

@@ -0,0 +1,115 @@
+module AuthenticatedSystem
+  protected
+    # Returns true or false if the user is logged in.
+    # Preloads @current_user with the user model if they're logged in.
+    def logged_in?
+      !!current_user
+    end
+
+    # Accesses the current user from the session.
+    # Future calls avoid the database because nil is not equal to false.
+    def current_user
+      @current_user ||= (login_from_session || login_from_basic_auth || login_from_cookie) unless @current_user == false
+    end
+
+    # Store the given user id in the session.
+    def current_user=(new_user)
+      session[:user_id] = new_user ? new_user.id : nil
+      @current_user = new_user || false
+    end
+
+    # Check if the user is authorized
+    #
+    # Override this method in your controllers if you want to restrict access
+    # to only a few actions or if you want to check if the user
+    # has the correct rights.
+    #
+    # Example:
+    #
+    #  # only allow nonbobs
+    #  def authorized?
+    #    current_user.login != "bob"
+    #  end
+    def authorized?
+      logged_in?
+    end
+
+    # Filter method to enforce a login requirement.
+    #
+    # To require logins for all actions, use this in your controllers:
+    #
+    #   before_filter :login_required
+    #
+    # To require logins for specific actions, use this in your controllers:
+    #
+    #   before_filter :login_required, :only => [ :edit, :update ]
+    #
+    # To skip this in a subclassed controller:
+    #
+    #   skip_before_filter :login_required
+    #
+    def login_required
+      authorized? || access_denied
+    end
+
+    # Redirect as appropriate when an access request fails.
+    #
+    # The default action is to redirect to the login screen.
+    #
+    # Override this method in your controllers if you want to have special
+    # behavior in case the user is not authorized
+    # to access the requested action.  For example, a popup window might
+    # simply close itself.
+    def access_denied
+      respond_to do |format|
+        format.html do
+          store_location
+          redirect_to new_session_path
+        end
+        format.any do
+          request_http_basic_authentication 'Web Password'
+        end
+      end
+    end
+
+    # Store the URI of the current request in the session.
+    #
+    # We can return to this location by calling #redirect_back_or_default.
+    def store_location
+      session[:return_to] = request.request_uri
+    end
+
+    # Redirect to the URI stored by the most recent store_location call or
+    # to the passed default.
+    def redirect_back_or_default(default)
+      redirect_to(session[:return_to] || default)
+      session[:return_to] = nil
+    end
+
+    # Inclusion hook to make #current_user and #logged_in?
+    # available as ActionView helper methods.
+    def self.included(base)
+      base.send :helper_method, :current_user, :logged_in?
+    end
+
+    # Called from #current_user.  First attempt to login by the user id stored in the session.
+    def login_from_session
+      self.current_user = User.find_by_id(session[:user_id]) if session[:user_id]
+    end
+
+    # Called from #current_user.  Now, attempt to login by basic authentication information.
+    def login_from_basic_auth
+      authenticate_with_http_basic do |username, password|
+        self.current_user = User.authenticate(username, password)
+      end
+    end
+
+    # Called from #current_user.  Finaly, attempt to login by an expiring token in the cookie.
+    def login_from_cookie
+      user = cookies[:auth_token] && User.find_by_remember_token(cookies[:auth_token])
+      if user && user.remember_token?
+        cookies[:auth_token] = { :value => user.remember_token, :expires => user.remember_token_expires_at }
+        self.current_user = user
+      end
+    end
+end

data/vendor/plugins/authentication/lib/authenticated_test_helper.rb

@@ -0,0 +1,10 @@
+module AuthenticatedTestHelper
+  # Sets the current user in the session from the user fixtures.
+  def login_as(user)
+    @request.session[:user_id] = user ? users(user).id : nil
+  end
+
+  def authorize_as(user)
+    @request.env["HTTP_AUTHORIZATION"] = user ? ActionController::HttpAuthentication::Basic.encode_credentials(users(user).login, 'test') : nil
+  end
+end

data/vendor/plugins/authentication/rails/init.rb

@@ -0,0 +1,13 @@
+Refinery::Plugin.register do |plugin|
+  plugin.title = "Users"
+  plugin.description = "Manage users"
+  plugin.version = 1.0
+  plugin.menu_match = /admin\/users$/
+  plugin.activity = {
+    :class => User,
+    :url_prefix => "edit_",
+    :title => "login",
+    :created_image => "user_add.png",
+    :updated_image => "user_edit.png"
+  }
+end

data/vendor/plugins/authentication/test/fixtures/users.yml

@@ -0,0 +1,19 @@
+quentin:
+  id: 1
+  login: quentin
+  email: quentin@example.com
+  salt: 7e3041ebc2fc05a40c60028e2c4901a81035d3cd
+  crypted_password: 00742970dc9e6319f8019fd54864d3ea740f04b1 # test
+  created_at: <%= 5.days.ago.to_s :db %>
+  activation_code: 8f24789ae988411ccf33ab0c30fe9106fab32e9b 
+  activated_at: <%= 5.days.ago.to_s :db %> 
+  state: active
+aaron:
+  id: 2
+  login: aaron
+  email: aaron@example.com
+  salt: 7e3041ebc2fc05a40c60028e2c4901a81035d3cd
+  crypted_password: 00742970dc9e6319f8019fd54864d3ea740f04b1 # test
+  created_at: <%= 1.days.ago.to_s :db %>
+  activation_code: 8f24789ae988411ccf33ab0c30fe9106fab32e9a 
+  state: pending

data/vendor/plugins/authentication/test/functional/admin/base_controller_test.rb

@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class Admin::BaseControllerTest < ActionController::TestCase
+  # Replace this with your real tests.
+  def test_truth
+    assert true
+  end
+end

data/vendor/plugins/authentication/test/functional/admin/dashboard_controller_test.rb

@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class Admin::DashboardControllerTest < ActionController::TestCase
+  # Replace this with your real tests.
+  def test_truth
+    assert true
+  end
+end

data/vendor/plugins/authentication/test/functional/admin/pages_controller_test.rb

@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class Admin::PagesControllerTest < ActionController::TestCase
+  # Replace this with your real tests.
+  def test_truth
+    assert true
+  end
+end

data/vendor/plugins/authentication/test/functional/sessions_controller_test.rb

@@ -0,0 +1,85 @@
+require File.dirname(__FILE__) + '/../test_helper'
+require 'sessions_controller'
+
+# Re-raise errors caught by the controller.
+class SessionsController; def rescue_action(e) raise e end; end
+
+class SessionsControllerTest < Test::Unit::TestCase
+  # Be sure to include AuthenticatedTestHelper in test/test_helper.rb instead
+  # Then, you can remove it from this and the units test.
+  include AuthenticatedTestHelper
+
+  fixtures :users
+
+  def setup
+    @controller = SessionsController.new
+    @request    = ActionController::TestRequest.new
+    @response   = ActionController::TestResponse.new
+  end
+
+  def test_should_login_and_redirect
+    post :create, :login => 'quentin', :password => 'test'
+    assert session[:user_id]
+    assert_response :redirect
+  end
+
+  def test_should_fail_login_and_not_redirect
+    post :create, :login => 'quentin', :password => 'bad password'
+    assert_nil session[:user_id]
+    assert_response :success
+  end
+
+  def test_should_logout
+    login_as :quentin
+    get :destroy
+    assert_nil session[:user_id]
+    assert_response :redirect
+  end
+
+  def test_should_remember_me
+    post :create, :login => 'quentin', :password => 'test', :remember_me => "1"
+    assert_not_nil @response.cookies["auth_token"]
+  end
+
+  def test_should_not_remember_me
+    post :create, :login => 'quentin', :password => 'test', :remember_me => "0"
+    assert_nil @response.cookies["auth_token"]
+  end
+
+  def test_should_delete_token_on_logout
+    login_as :quentin
+    get :destroy
+    assert_equal @response.cookies["auth_token"], []
+  end
+
+  def test_should_login_with_cookie
+    users(:quentin).remember_me
+    @request.cookies["auth_token"] = cookie_for(:quentin)
+    get :new
+    assert @controller.send(:logged_in?)
+  end
+
+  def test_should_fail_expired_cookie_login
+    users(:quentin).remember_me
+    users(:quentin).update_attribute :remember_token_expires_at, 5.minutes.ago
+    @request.cookies["auth_token"] = cookie_for(:quentin)
+    get :new
+    assert !@controller.send(:logged_in?)
+  end
+
+  def test_should_fail_cookie_login
+    users(:quentin).remember_me
+    @request.cookies["auth_token"] = auth_token('invalid_auth_token')
+    get :new
+    assert !@controller.send(:logged_in?)
+  end
+
+  protected
+    def auth_token(token)
+      CGI::Cookie.new('name' => 'auth_token', 'value' => token)
+    end
+
+    def cookie_for(user)
+      auth_token users(user).remember_token
+    end
+end