jcnetdev-restful-authentication 1.0.20080704
Sign up to get free protection for your applications and to get access to all the features.
- data/CHANGELOG +68 -0
- data/README +176 -0
- data/Rakefile +22 -0
- data/TODO +15 -0
- data/generators/authenticated/USAGE +1 -0
- data/generators/authenticated/authenticated_generator.rb +478 -0
- data/generators/authenticated/lib/insert_routes.rb +50 -0
- data/generators/authenticated/templates/_model_partial.html.erb +8 -0
- data/generators/authenticated/templates/activation.html.erb +3 -0
- data/generators/authenticated/templates/authenticated_system.rb +187 -0
- data/generators/authenticated/templates/authenticated_test_helper.rb +22 -0
- data/generators/authenticated/templates/controller.rb +43 -0
- data/generators/authenticated/templates/helper.rb +2 -0
- data/generators/authenticated/templates/login.html.erb +16 -0
- data/generators/authenticated/templates/mailer.rb +25 -0
- data/generators/authenticated/templates/migration.rb +26 -0
- data/generators/authenticated/templates/model.rb +69 -0
- data/generators/authenticated/templates/model_controller.rb +86 -0
- data/generators/authenticated/templates/model_helper.rb +93 -0
- data/generators/authenticated/templates/model_helper_spec.rb +158 -0
- data/generators/authenticated/templates/observer.rb +11 -0
- data/generators/authenticated/templates/signup.html.erb +19 -0
- data/generators/authenticated/templates/signup_notification.html.erb +8 -0
- data/generators/authenticated/templates/site_keys.rb +38 -0
- data/generators/authenticated/templates/spec/controllers/access_control_spec.rb +90 -0
- data/generators/authenticated/templates/spec/controllers/authenticated_system_spec.rb +101 -0
- data/generators/authenticated/templates/spec/controllers/sessions_controller_spec.rb +139 -0
- data/generators/authenticated/templates/spec/controllers/users_controller_spec.rb +198 -0
- data/generators/authenticated/templates/spec/fixtures/users.yml +60 -0
- data/generators/authenticated/templates/spec/helpers/users_helper_spec.rb +141 -0
- data/generators/authenticated/templates/spec/models/user_spec.rb +290 -0
- data/generators/authenticated/templates/stories/rest_auth_stories.rb +22 -0
- data/generators/authenticated/templates/stories/rest_auth_stories_helper.rb +81 -0
- data/generators/authenticated/templates/stories/steps/ra_navigation_steps.rb +49 -0
- data/generators/authenticated/templates/stories/steps/ra_resource_steps.rb +179 -0
- data/generators/authenticated/templates/stories/steps/ra_response_steps.rb +171 -0
- data/generators/authenticated/templates/stories/steps/user_steps.rb +153 -0
- data/generators/authenticated/templates/stories/users/accounts.story +186 -0
- data/generators/authenticated/templates/stories/users/sessions.story +134 -0
- data/generators/authenticated/templates/test/functional_test.rb +88 -0
- data/generators/authenticated/templates/test/mailer_test.rb +31 -0
- data/generators/authenticated/templates/test/model_functional_test.rb +99 -0
- data/generators/authenticated/templates/test/unit_test.rb +164 -0
- data/init.rb +1 -0
- data/lib/authentication.rb +43 -0
- data/lib/authentication/by_cookie_token.rb +85 -0
- data/lib/authentication/by_password.rb +65 -0
- data/lib/authorization.rb +15 -0
- data/lib/authorization/aasm_roles.rb +64 -0
- data/lib/authorization/stateful_roles.rb +63 -0
- data/lib/trustification.rb +15 -0
- data/lib/trustification/email_validation.rb +20 -0
- data/rails/init.rb +3 -0
- data/restful-authentication.gemspec +74 -0
- metadata +116 -0
@@ -0,0 +1,86 @@
|
|
1
|
+
class <%= model_controller_class_name %>Controller < ApplicationController
|
2
|
+
# Be sure to include AuthenticationSystem in Application Controller instead
|
3
|
+
include AuthenticatedSystem
|
4
|
+
<% if options[:stateful] %>
|
5
|
+
# Protect these actions behind an admin login
|
6
|
+
# before_filter :admin_required, :only => [:suspend, :unsuspend, :destroy, :purge]
|
7
|
+
before_filter :find_<%= file_name %>, :only => [:suspend, :unsuspend, :destroy, :purge]
|
8
|
+
<% end %>
|
9
|
+
|
10
|
+
# render new.rhtml
|
11
|
+
def new
|
12
|
+
@<%= file_name %> = <%= class_name %>.new
|
13
|
+
end
|
14
|
+
|
15
|
+
def create
|
16
|
+
logout_keeping_session!
|
17
|
+
@<%= file_name %> = <%= class_name %>.new(params[:<%= file_name %>])
|
18
|
+
<% if options[:stateful] -%>
|
19
|
+
@<%= file_name %>.register! if @<%= file_name %> && @<%= file_name %>.valid?
|
20
|
+
success = @<%= file_name %> && @<%= file_name %>.valid?
|
21
|
+
<% else -%>
|
22
|
+
success = @<%= file_name %> && @<%= file_name %>.save
|
23
|
+
<% end -%>
|
24
|
+
if success && @<%= file_name %>.errors.empty?
|
25
|
+
<% if !options[:include_activation] -%>
|
26
|
+
# Protects against session fixation attacks, causes request forgery
|
27
|
+
# protection if visitor resubmits an earlier form using back
|
28
|
+
# button. Uncomment if you understand the tradeoffs.
|
29
|
+
# reset session
|
30
|
+
self.current_<%= file_name %> = @<%= file_name %> # !! now logged in
|
31
|
+
<% end -%>
|
32
|
+
redirect_back_or_default('/')
|
33
|
+
flash[:notice] = "Thanks for signing up! We're sending you an email with your activation code."
|
34
|
+
else
|
35
|
+
flash[:error] = "We couldn't set up that account, sorry. Please try again, or contact an admin (link is above)."
|
36
|
+
render :action => 'new'
|
37
|
+
end
|
38
|
+
end
|
39
|
+
<% if options[:include_activation] %>
|
40
|
+
def activate
|
41
|
+
logout_keeping_session!
|
42
|
+
<%= file_name %> = <%= class_name %>.find_by_activation_code(params[:activation_code]) unless params[:activation_code].blank?
|
43
|
+
case
|
44
|
+
when (!params[:activation_code].blank?) && <%= file_name %> && !<%= file_name %>.active?
|
45
|
+
<%= file_name %>.activate!
|
46
|
+
flash[:notice] = "Signup complete! Please sign in to continue."
|
47
|
+
redirect_to '/login'
|
48
|
+
when params[:activation_code].blank?
|
49
|
+
flash[:error] = "The activation code was missing. Please follow the URL from your email."
|
50
|
+
redirect_back_or_default('/')
|
51
|
+
else
|
52
|
+
flash[:error] = "We couldn't find a <%= file_name %> with that activation code -- check your email? Or maybe you've already activated -- try signing in."
|
53
|
+
redirect_back_or_default('/')
|
54
|
+
end
|
55
|
+
end
|
56
|
+
<% end %><% if options[:stateful] %>
|
57
|
+
def suspend
|
58
|
+
@<%= file_name %>.suspend!
|
59
|
+
redirect_to <%= model_controller_routing_name %>_path
|
60
|
+
end
|
61
|
+
|
62
|
+
def unsuspend
|
63
|
+
@<%= file_name %>.unsuspend!
|
64
|
+
redirect_to <%= model_controller_routing_name %>_path
|
65
|
+
end
|
66
|
+
|
67
|
+
def destroy
|
68
|
+
@<%= file_name %>.delete!
|
69
|
+
redirect_to <%= model_controller_routing_name %>_path
|
70
|
+
end
|
71
|
+
|
72
|
+
def purge
|
73
|
+
@<%= file_name %>.destroy
|
74
|
+
redirect_to <%= model_controller_routing_name %>_path
|
75
|
+
end
|
76
|
+
|
77
|
+
# There's no page here to update or destroy a <%= file_name %>. If you add those, be
|
78
|
+
# smart -- make sure you check that the visitor is authorized to do so, that they
|
79
|
+
# supply their old password along with a new one to update it, etc.
|
80
|
+
|
81
|
+
protected
|
82
|
+
def find_<%= file_name %>
|
83
|
+
@<%= file_name %> = <%= class_name %>.find(params[:id])
|
84
|
+
end
|
85
|
+
<% end -%>
|
86
|
+
end
|
@@ -0,0 +1,93 @@
|
|
1
|
+
module <%= model_controller_class_name %>Helper
|
2
|
+
|
3
|
+
#
|
4
|
+
# Use this to wrap view elements that the user can't access.
|
5
|
+
# !! Note: this is an *interface*, not *security* feature !!
|
6
|
+
# You need to do all access control at the controller level.
|
7
|
+
#
|
8
|
+
# Example:
|
9
|
+
# <%%= if_authorized?(:index, User) do link_to('List all users', users_path) end %> |
|
10
|
+
# <%%= if_authorized?(:edit, @user) do link_to('Edit this user', edit_user_path) end %> |
|
11
|
+
# <%%= if_authorized?(:destroy, @user) do link_to 'Destroy', @user, :confirm => 'Are you sure?', :method => :delete end %>
|
12
|
+
#
|
13
|
+
#
|
14
|
+
def if_authorized?(action, resource, &block)
|
15
|
+
if authorized?(action, resource)
|
16
|
+
yield action, resource
|
17
|
+
end
|
18
|
+
end
|
19
|
+
|
20
|
+
#
|
21
|
+
# Link to user's page ('<%= table_name %>/1')
|
22
|
+
#
|
23
|
+
# By default, their login is used as link text and link title (tooltip)
|
24
|
+
#
|
25
|
+
# Takes options
|
26
|
+
# * :content_text => 'Content text in place of <%= file_name %>.login', escaped with
|
27
|
+
# the standard h() function.
|
28
|
+
# * :content_method => :<%= file_name %>_instance_method_to_call_for_content_text
|
29
|
+
# * :title_method => :<%= file_name %>_instance_method_to_call_for_title_attribute
|
30
|
+
# * as well as link_to()'s standard options
|
31
|
+
#
|
32
|
+
# Examples:
|
33
|
+
# link_to_<%= file_name %> @<%= file_name %>
|
34
|
+
# # => <a href="/<%= table_name %>/3" title="barmy">barmy</a>
|
35
|
+
#
|
36
|
+
# # if you've added a .name attribute:
|
37
|
+
# content_tag :span, :class => :vcard do
|
38
|
+
# (link_to_<%= file_name %> <%= file_name %>, :class => 'fn n', :title_method => :login, :content_method => :name) +
|
39
|
+
# ': ' + (content_tag :span, <%= file_name %>.email, :class => 'email')
|
40
|
+
# end
|
41
|
+
# # => <span class="vcard"><a href="/<%= table_name %>/3" title="barmy" class="fn n">Cyril Fotheringay-Phipps</a>: <span class="email">barmy@blandings.com</span></span>
|
42
|
+
#
|
43
|
+
# link_to_<%= file_name %> @<%= file_name %>, :content_text => 'Your user page'
|
44
|
+
# # => <a href="/<%= table_name %>/3" title="barmy" class="nickname">Your user page</a>
|
45
|
+
#
|
46
|
+
def link_to_<%= file_name %>(<%= file_name %>, options={})
|
47
|
+
raise "Invalid <%= file_name %>" unless <%= file_name %>
|
48
|
+
options.reverse_merge! :content_method => :login, :title_method => :login, :class => :nickname
|
49
|
+
content_text = options.delete(:content_text)
|
50
|
+
content_text ||= <%= file_name %>.send(options.delete(:content_method))
|
51
|
+
options[:title] ||= <%= file_name %>.send(options.delete(:title_method))
|
52
|
+
link_to h(content_text), <%= model_controller_routing_name.singularize %>_path(<%= file_name %>), options
|
53
|
+
end
|
54
|
+
|
55
|
+
#
|
56
|
+
# Link to login page using remote ip address as link content
|
57
|
+
#
|
58
|
+
# The :title (and thus, tooltip) is set to the IP address
|
59
|
+
#
|
60
|
+
# Examples:
|
61
|
+
# link_to_login_with_IP
|
62
|
+
# # => <a href="/login" title="169.69.69.69">169.69.69.69</a>
|
63
|
+
#
|
64
|
+
# link_to_login_with_IP :content_text => 'not signed in'
|
65
|
+
# # => <a href="/login" title="169.69.69.69">not signed in</a>
|
66
|
+
#
|
67
|
+
def link_to_login_with_IP content_text=nil, options={}
|
68
|
+
ip_addr = request.remote_ip
|
69
|
+
content_text ||= ip_addr
|
70
|
+
options.reverse_merge! :title => ip_addr
|
71
|
+
if tag = options.delete(:tag)
|
72
|
+
content_tag tag, h(content_text), options
|
73
|
+
else
|
74
|
+
link_to h(content_text), login_path, options
|
75
|
+
end
|
76
|
+
end
|
77
|
+
|
78
|
+
#
|
79
|
+
# Link to the current user's page (using link_to_<%= file_name %>) or to the login page
|
80
|
+
# (using link_to_login_with_IP).
|
81
|
+
#
|
82
|
+
def link_to_current_<%= file_name %>(options={})
|
83
|
+
if current_<%= file_name %>
|
84
|
+
link_to_<%= file_name %> current_<%= file_name %>, options
|
85
|
+
else
|
86
|
+
content_text = options.delete(:content_text) || 'not signed in'
|
87
|
+
# kill ignored options from link_to_<%= file_name %>
|
88
|
+
[:content_method, :title_method].each{|opt| options.delete(opt)}
|
89
|
+
link_to_login_with_IP content_text, options
|
90
|
+
end
|
91
|
+
end
|
92
|
+
|
93
|
+
end
|
@@ -0,0 +1,158 @@
|
|
1
|
+
require File.dirname(__FILE__) + '/../spec_helper'
|
2
|
+
include ApplicationHelper
|
3
|
+
include <%= model_controller_class_name %>Helper
|
4
|
+
|
5
|
+
describe "<%= model_controller_class_name %>Helper.link_to_<%= file_name %>" do
|
6
|
+
before do
|
7
|
+
@<%= file_name %> = <%= class_name %>.new({
|
8
|
+
:name => '<%= class_name %> Name',
|
9
|
+
:login => '<%= file_name %>_name',
|
10
|
+
})
|
11
|
+
@<%= file_name %>.id = 1 # set non-attr_accessible specifically
|
12
|
+
end
|
13
|
+
|
14
|
+
it "should give an error on a nil <%= file_name %>" do
|
15
|
+
lambda { link_to_<%= file_name %>(nil) }.should raise_error('Invalid <%= file_name %>')
|
16
|
+
end
|
17
|
+
|
18
|
+
it "should link to the given <%= file_name %>" do
|
19
|
+
link_to_<%= file_name %>(@<%= file_name %>).should have_tag("a[href='/<%= table_name %>/1']")
|
20
|
+
end
|
21
|
+
|
22
|
+
it "should use given link text if :content_text is specified" do
|
23
|
+
link_to_<%= file_name %>(@<%= file_name %>, :content_text => 'Hello there!').should have_tag("a", 'Hello there!')
|
24
|
+
end
|
25
|
+
|
26
|
+
it "should use the login as link text with no :content_method specified" do
|
27
|
+
link_to_<%= file_name %>(@<%= file_name %>).should have_tag("a", '<%= file_name %>_name')
|
28
|
+
end
|
29
|
+
|
30
|
+
it "should use the name as link text with :content_method => :name" do
|
31
|
+
link_to_<%= file_name %>(@<%= file_name %>, :content_method => :name).should have_tag("a", '<%= class_name %> Name')
|
32
|
+
end
|
33
|
+
|
34
|
+
it "should use the login as title with no :title_method specified" do
|
35
|
+
link_to_<%= file_name %>(@<%= file_name %>).should have_tag("a[title='<%= file_name %>_name']")
|
36
|
+
end
|
37
|
+
|
38
|
+
it "should use the name as link title with :content_method => :name" do
|
39
|
+
link_to_<%= file_name %>(@<%= file_name %>, :title_method => :name).should have_tag("a[title='<%= class_name %> Name']")
|
40
|
+
end
|
41
|
+
|
42
|
+
it "should have nickname as a class by default" do
|
43
|
+
link_to_<%= file_name %>(@<%= file_name %>).should have_tag("a.nickname")
|
44
|
+
end
|
45
|
+
|
46
|
+
it "should take other classes and no longer have the nickname class" do
|
47
|
+
result = link_to_<%= file_name %>(@<%= file_name %>, :class => 'foo bar')
|
48
|
+
result.should have_tag("a.foo")
|
49
|
+
result.should have_tag("a.bar")
|
50
|
+
end
|
51
|
+
end
|
52
|
+
|
53
|
+
describe "<%= model_controller_class_name %>Helper.link_to_signin_with_IP" do
|
54
|
+
before do
|
55
|
+
end
|
56
|
+
|
57
|
+
it "should link to the signin_path" do
|
58
|
+
link_to_signin_with_IP().should have_tag("a[href='/signin']")
|
59
|
+
end
|
60
|
+
|
61
|
+
it "should use given link text if :content_text is specified" do
|
62
|
+
link_to_signin_with_IP(:content_text => 'Hello there!').should have_tag("a", 'Hello there!')
|
63
|
+
end
|
64
|
+
|
65
|
+
it "should use the login as link text with no :content_method specified" do
|
66
|
+
link_to_signin_with_IP().should have_tag("a", '0.0.0.0')
|
67
|
+
end
|
68
|
+
|
69
|
+
it "should use the ip address as title" do
|
70
|
+
link_to_signin_with_IP().should have_tag("a[title='0.0.0.0']")
|
71
|
+
end
|
72
|
+
|
73
|
+
it "should by default be like school in summer and have no class" do
|
74
|
+
link_to_signin_with_IP().should_not have_tag("a.nickname")
|
75
|
+
end
|
76
|
+
|
77
|
+
it "should have some class if you tell it to" do
|
78
|
+
result = link_to_signin_with_IP(:class => 'foo bar')
|
79
|
+
result.should have_tag("a.foo")
|
80
|
+
result.should have_tag("a.bar")
|
81
|
+
end
|
82
|
+
end
|
83
|
+
|
84
|
+
describe "<%= model_controller_class_name %>Helper.link_to_current_<%= file_name %>, When logged in" do
|
85
|
+
fixtures :<%= table_name %>
|
86
|
+
include AuthenticatedTestHelper
|
87
|
+
before do
|
88
|
+
login_as(:quentin)
|
89
|
+
end
|
90
|
+
|
91
|
+
it "should link to the given <%= file_name %>" do
|
92
|
+
link_to_current_<%= file_name %>().should have_tag("a[href='/<%= table_name %>/1']")
|
93
|
+
end
|
94
|
+
|
95
|
+
it "should use given link text if :content_text is specified" do
|
96
|
+
link_to_current_user(:content_text => 'Hello there!').should have_tag("a", 'Hello there!')
|
97
|
+
end
|
98
|
+
|
99
|
+
it "should use the login as link text with no :content_method specified" do
|
100
|
+
link_to_current_user().should have_tag("a", 'quentin')
|
101
|
+
end
|
102
|
+
|
103
|
+
it "should use the name as link text with :content_method => :name" do
|
104
|
+
link_to_current_user(:content_method => :name).should have_tag("a", 'Quentin')
|
105
|
+
end
|
106
|
+
|
107
|
+
it "should use the login as title with no :title_method specified" do
|
108
|
+
link_to_current_user().should have_tag("a[title='quentin']")
|
109
|
+
end
|
110
|
+
|
111
|
+
it "should use the name as link title with :content_method => :name" do
|
112
|
+
link_to_current_user(:title_method => :name).should have_tag("a[title='Quentin']")
|
113
|
+
end
|
114
|
+
|
115
|
+
it "should have nickname as a class" do
|
116
|
+
link_to_current_user().should have_tag("a.nickname")
|
117
|
+
end
|
118
|
+
|
119
|
+
it "should take other classes and no longer have the nickname class" do
|
120
|
+
result = link_to_current_user(:class => 'foo bar')
|
121
|
+
result.should have_tag("a.foo")
|
122
|
+
result.should have_tag("a.bar")
|
123
|
+
end
|
124
|
+
end
|
125
|
+
|
126
|
+
|
127
|
+
|
128
|
+
describe "<%= model_controller_class_name %>Helper.link_to_current_user, When logged out" do
|
129
|
+
include AuthenticatedTestHelper
|
130
|
+
before do
|
131
|
+
end
|
132
|
+
|
133
|
+
it "should link to the signin_path" do
|
134
|
+
link_to_current_user().should have_tag("a[href='/signin']")
|
135
|
+
end
|
136
|
+
|
137
|
+
it "should use given link text if :content_text is specified" do
|
138
|
+
link_to_current_user(:content_text => 'Hello there!').should have_tag("a", 'Hello there!')
|
139
|
+
end
|
140
|
+
|
141
|
+
it "should use the IP address as link text with no :content_method specified" do
|
142
|
+
link_to_current_user().should have_tag("a", '0.0.0.0')
|
143
|
+
end
|
144
|
+
|
145
|
+
it "should use the ip address as title" do
|
146
|
+
link_to_current_user().should have_tag("a[title='0.0.0.0']")
|
147
|
+
end
|
148
|
+
|
149
|
+
it "should by default be like school in summer and have no class" do
|
150
|
+
link_to_current_user().should_not have_tag("a.nickname")
|
151
|
+
end
|
152
|
+
|
153
|
+
it "should have some class if you tell it to" do
|
154
|
+
result = link_to_current_user(:class => 'foo bar')
|
155
|
+
result.should have_tag("a.foo")
|
156
|
+
result.should have_tag("a.bar")
|
157
|
+
end
|
158
|
+
end
|
@@ -0,0 +1,11 @@
|
|
1
|
+
class <%= class_name %>Observer < ActiveRecord::Observer
|
2
|
+
def after_create(<%= file_name %>)
|
3
|
+
<%= class_name %>Mailer.deliver_signup_notification(<%= file_name %>)
|
4
|
+
end
|
5
|
+
|
6
|
+
def after_save(<%= file_name %>)
|
7
|
+
<% if options[:include_activation] %>
|
8
|
+
<%= class_name %>Mailer.deliver_activation(<%= file_name %>) if <%= file_name %>.recently_activated?
|
9
|
+
<% end %>
|
10
|
+
end
|
11
|
+
end
|
@@ -0,0 +1,19 @@
|
|
1
|
+
<h1>Sign up as a new user</h1>
|
2
|
+
<%% @<%= file_name %>.password = @<%= file_name %>.password_confirmation = nil %>
|
3
|
+
|
4
|
+
<%%= error_messages_for :<%= file_name %> %>
|
5
|
+
<%% form_for :<%= file_name %>, :url => <%= model_controller_routing_name %>_path do |f| -%>
|
6
|
+
<p><label for="login">Login</label><br/>
|
7
|
+
<%%= f.text_field :login %></p>
|
8
|
+
|
9
|
+
<p><label for="email">Email</label><br/>
|
10
|
+
<%%= f.text_field :email %></p>
|
11
|
+
|
12
|
+
<p><label for="password">Password</label><br/>
|
13
|
+
<%%= f.password_field :password %></p>
|
14
|
+
|
15
|
+
<p><label for="password_confirmation">Confirm Password</label><br/>
|
16
|
+
<%%= f.password_field :password_confirmation %></p>
|
17
|
+
|
18
|
+
<p><%%= submit_tag 'Sign up' %></p>
|
19
|
+
<%% end -%>
|
@@ -0,0 +1,38 @@
|
|
1
|
+
|
2
|
+
# A Site key gives additional protection against a dictionary attack if your
|
3
|
+
# DB is ever compromised. With no site key, we store
|
4
|
+
# DB_password = hash(user_password, DB_user_salt)
|
5
|
+
# If your database were to be compromised you'd be vulnerable to a dictionary
|
6
|
+
# attack on all your stupid users' passwords. With a site key, we store
|
7
|
+
# DB_password = hash(user_password, DB_user_salt, Code_site_key)
|
8
|
+
# That means an attacker needs access to both your site's code *and* its
|
9
|
+
# database to mount an "offline dictionary attack.":http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/web-authentication.html
|
10
|
+
#
|
11
|
+
# It's probably of minor importance, but recommended by best practices: 'defense
|
12
|
+
# in depth'. Needless to say, if you upload this to github or the youtubes or
|
13
|
+
# otherwise place it in public view you'll kinda defeat the point. Your users'
|
14
|
+
# passwords are still secure, and the world won't end, but defense_in_depth -= 1.
|
15
|
+
#
|
16
|
+
# Please note: if you change this, all the passwords will be invalidated, so DO
|
17
|
+
# keep it someplace secure. Use the random value given or type in the lyrics to
|
18
|
+
# your favorite Jay-Z song or something; any moderately long, unpredictable text.
|
19
|
+
REST_AUTH_SITE_KEY = '<%= $rest_auth_site_key_from_generator %>'
|
20
|
+
|
21
|
+
# Repeated applications of the hash make brute force (even with a compromised
|
22
|
+
# database and site key) harder, and scale with Moore's law.
|
23
|
+
#
|
24
|
+
# bq. "To squeeze the most security out of a limited-entropy password or
|
25
|
+
# passphrase, we can use two techniques [salting and stretching]... that are
|
26
|
+
# so simple and obvious that they should be used in every password system.
|
27
|
+
# There is really no excuse not to use them." http://tinyurl.com/37lb73
|
28
|
+
# Practical Security (Ferguson & Scheier) p350
|
29
|
+
#
|
30
|
+
# A modest 10 foldings (the default here) adds 3ms. This makes brute forcing 10
|
31
|
+
# times harder, while reducing an app that otherwise serves 100 reqs/s to 78 signin
|
32
|
+
# reqs/s, an app that does 10reqs/s to 9.7 reqs/s
|
33
|
+
#
|
34
|
+
# More:
|
35
|
+
# * http://www.owasp.org/index.php/Hashing_Java
|
36
|
+
# * "An Illustrated Guide to Cryptographic Hashes":http://www.unixwiz.net/techtips/iguide-crypto-hashes.html
|
37
|
+
|
38
|
+
REST_AUTH_DIGEST_STRETCHES = <%= $rest_auth_digest_stretches_from_generator %>
|
@@ -0,0 +1,90 @@
|
|
1
|
+
require File.dirname(__FILE__) + '<%= ('/..'*controller_class_nesting_depth) + '/../spec_helper' %>'
|
2
|
+
# Be sure to include AuthenticatedTestHelper in spec/spec_helper.rb instead
|
3
|
+
# Then, you can remove it from this and the units test.
|
4
|
+
include AuthenticatedTestHelper
|
5
|
+
|
6
|
+
#
|
7
|
+
# A test controller with and without access controls
|
8
|
+
#
|
9
|
+
class AccessControlTestController < ApplicationController
|
10
|
+
before_filter :login_required, :only => :login_is_required
|
11
|
+
def login_is_required
|
12
|
+
respond_to do |format|
|
13
|
+
@foo = { 'success' => params[:format]||'no fmt given'}
|
14
|
+
format.html do render :text => "success" end
|
15
|
+
format.xml do render :xml => @foo, :status => :ok end
|
16
|
+
format.json do render :json => @foo, :status => :ok end
|
17
|
+
end
|
18
|
+
end
|
19
|
+
def login_not_required
|
20
|
+
respond_to do |format|
|
21
|
+
@foo = { 'success' => params[:format]||'no fmt given'}
|
22
|
+
format.html do render :text => "success" end
|
23
|
+
format.xml do render :xml => @foo, :status => :ok end
|
24
|
+
format.json do render :json => @foo, :status => :ok end
|
25
|
+
end
|
26
|
+
end
|
27
|
+
end
|
28
|
+
|
29
|
+
#
|
30
|
+
# Access Control
|
31
|
+
#
|
32
|
+
|
33
|
+
ACCESS_CONTROL_FORMATS = [
|
34
|
+
['', "success"],
|
35
|
+
['xml', "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<hash>\n <success>xml</success>\n</hash>\n"],
|
36
|
+
['json', "{\"success\": \"json\"}"],]
|
37
|
+
ACCESS_CONTROL_AM_I_LOGGED_IN = [
|
38
|
+
[:i_am_logged_in, :quentin],
|
39
|
+
[:i_am_not_logged_in, nil],]
|
40
|
+
ACCESS_CONTROL_IS_LOGIN_REQD = [
|
41
|
+
:login_not_required,
|
42
|
+
:login_is_required,]
|
43
|
+
|
44
|
+
describe AccessControlTestController do
|
45
|
+
fixtures :<%= table_name %>
|
46
|
+
before do
|
47
|
+
# is there a better way to do this?
|
48
|
+
ActionController::Routing::Routes.add_route '/login_is_required', :controller => 'access_control_test', :action => 'login_is_required'
|
49
|
+
ActionController::Routing::Routes.add_route '/login_not_required', :controller => 'access_control_test', :action => 'login_not_required'
|
50
|
+
end
|
51
|
+
|
52
|
+
ACCESS_CONTROL_FORMATS.each do |format, success_text|
|
53
|
+
ACCESS_CONTROL_AM_I_LOGGED_IN.each do |logged_in_status, <%= file_name %>_login|
|
54
|
+
ACCESS_CONTROL_IS_LOGIN_REQD.each do |login_reqd_status|
|
55
|
+
describe "requesting #{format.blank? ? 'html' : format}; #{logged_in_status.to_s.humanize} and #{login_reqd_status.to_s.humanize}" do
|
56
|
+
before do
|
57
|
+
logout_keeping_session!
|
58
|
+
@<%= file_name %> = format.blank? ? login_as(<%= file_name %>_login) : authorize_as(<%= file_name %>_login)
|
59
|
+
get login_reqd_status.to_s, :format => format
|
60
|
+
end
|
61
|
+
|
62
|
+
if ((login_reqd_status == :login_not_required) ||
|
63
|
+
(login_reqd_status == :login_is_required && logged_in_status == :i_am_logged_in))
|
64
|
+
it "succeeds" do
|
65
|
+
response.should have_text(success_text)
|
66
|
+
response.code.to_s.should == '200'
|
67
|
+
end
|
68
|
+
|
69
|
+
elsif (login_reqd_status == :login_is_required && logged_in_status == :i_am_not_logged_in)
|
70
|
+
if ['html', ''].include? format
|
71
|
+
it "redirects me to the log in page" do
|
72
|
+
response.should redirect_to('/<%= controller_routing_path %>/new')
|
73
|
+
end
|
74
|
+
else
|
75
|
+
it "returns 'Access denied' and a 406 (Access Denied) status code" do
|
76
|
+
response.should have_text("HTTP Basic: Access denied.\n")
|
77
|
+
response.code.to_s.should == '401'
|
78
|
+
end
|
79
|
+
end
|
80
|
+
|
81
|
+
else
|
82
|
+
warn "Oops no case for #{format} and #{logged_in_status.to_s.humanize} and #{login_reqd_status.to_s.humanize}"
|
83
|
+
end
|
84
|
+
end # describe
|
85
|
+
|
86
|
+
end
|
87
|
+
end
|
88
|
+
end # cases
|
89
|
+
|
90
|
+
end
|