kent-authlogic_rpx 0.1.0

data/.document

@@ -0,0 +1,5 @@
+README.rdoc
+lib/**/*.rb
+bin/*
+features/**/*.feature
+LICENSE

data/.gitignore

@@ -0,0 +1,5 @@
+*.sw?
+.DS_Store
+coverage
+rdoc
+pkg

data/LICENSE

@@ -0,0 +1,20 @@
+Copyright (c) 2009 Kent Fenwick
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

data/README.rdoc

@@ -0,0 +1,535 @@
+= Authlogic RPX
+
+== Purpose
+
+Authlogic RPX is an Authlogic extension library that provides support for authentication using the RPX multi-authentication service offered by JanRain. To use RPX, you must first register your application at {RPX}[http://rpxnow.com/]. A free "Basic" account is available, in addition to paid enhanced versions. All work with Authlogic_RPX.  
+
+Key features and capabilities:
+* Auto-registration by default following RPX authentication (can be disabled if required)
+* Can allow users to enable RPX authentication for their existing password-enabled accounts
+* View helpers to assist with inserting login fragments in pages
+* Can co-exist with standard password authentication
+
+
+== Authlogic_RPX References
+
+*	<b>Authlogic_RPX gem repo:</b> [http://github.com/tardate/authlogic_rpx]
+*	<b>Authlogic_RPX issues and feedback:</b> [http://github.com/tardate/authlogic_rpx/issues]
+
+The demonstration Rails application is where you can see Authlogic_RPX in action:
+  
+* <b>Live Demonstration Site:</b> [http://rails-authlogic-rpx-sample.heroku.com]
+* <b>Demonstration site source repository:</b> [http://github.com/tardate/rails-authlogic-rpx-sample]
+
+== Authlogic and RPX References
+
+*	<b>Authlogic documentation:</b> [http://rdoc.info/projects/binarylogic/authlogic]
+*	<b>Authlogic repo:</b> [http://github.com/binarylogic/authlogic]
+*	<b>RPX documentation:</b> [https://rpxnow.com/docs]
+*	<b>RPX_now gem repo:</b> [http://github.com/grosser/rpx_now]
+
+
+== Installing Authlogic RPX gem
+
+Three gems are required: authlogic, grosser-rpx_now, and authlogic_rpx. Install these as appropriate to your environment and preferences.
+
+Currently tested versions:
+* authlogic 2.1.2,2.1.1
+* rpx_now 0.6.6
+* authlogic_rpx 1.0.4
+
+
+=== 1. Direct gem installation
+
+  sudo gem install authlogic
+  sudo gem install rpx_now --source http://gemcutter.org
+  sudo gem install authlogic_rpx --source http://gemcutter.org
+
+
+=== 2. Using Rails config.gems
+
+Include in config/environment.rb:
+  
+  config.gem 'authlogic', :version => '>= 2.1.1'
+  config.gem 'rpx_now', :version => '>= 0.6.6', :source => 'http://gemcutter.org'
+  config.gem 'authlogic_rpx', :version => '>= 1.0.4', :source => 'http://gemcutter.org'
+
+Then to install, run from the command line:
+
+  sudo rake gems:install
+
+
+=== 3. Using .gems file (e.g for heroku.com deployments)
+
+Include in RAILS_ROOT/.gems:
+  
+  authlogic --version '>= 2.1.1'
+  rpx_now --version '>= 0.6.6' --source gemcutter.org
+  authlogic_rpx --version '>= 1.0.4' --source gemcutter.org
+
+
+== Using Authlogic RPX
+
+<i>Note: in what follows, the user model is called User and the session controller takes the name UserSession (the authlogic convention). You are not restricted to these names - could be Member and MemberSession for example - but for simplicity, this documentation will stick to using the "User" convention.</i>
+
+Using Authlogic RPX is very similar to using standard authlogic, with the addition of just a few configuration options. So if you already have a project setup with authlogic, adding RPX support will be trivial.
+
+An important capability to be aware of is "auto registration". This means that when a user has logged in with RPX, if an account does not already exist in your application, it will be automatically created. That is, there is no separate/special "register" step for users to go through before just signing in. You can disable this if you need, but for most sites that use RPX as a primary authentication mechanism, this is probably what you want to happen.
+
+The main steps for enabling Authlogic RPX: 
+* 1. Enable RPX for your user model
+* 2. Add RPX configuration for the Authlogic session model
+* 3. Add custom user profile mapping (optional)
+* 4. Add application controller helpers: current_user, current_user_session
+* 5. Setup the Authlogic session controller
+* 6. Setup the Authlogic user controller
+* 7. Use view helpers to provide login links
+* 8. Allow users to "Add RPX" to existing accounts (optional)
+
+
+=== 1. Enable RPX for your user model
+
+The user model requires an additional field called "rpx_identifier". Creat a migration to add this. 
+You may need to remove database constraints on other fields if they will be unused in the RPX case (e.g. crypted_password and password_salt to make password authentication optional).
+
+If you are using auto-registration, you must also remove any database constraints for fields that will be automatically mapped (see notes in "3. Add custom user profile mapping during auto-registration")
+
+  class AddUsersRpxIdentifier < ActiveRecord::Migration
+    def self.up
+      add_column :users, :rpx_identifier, :string
+      add_index :users, :rpx_identifier
+
+      change_column :users, :crypted_password, :string, :default => nil, :null => true
+      change_column :users, :password_salt, :string, :default => nil, :null => true
+      
+    end
+
+    def self.down
+      remove_column :users, :rpx_identifier
+
+      [:crypted_password, :password_salt].each do |field|
+        User.all(:conditions => "#{field} is NULL").each { |user| user.update_attribute(field, "") if user.send(field).nil? }
+        change_column :users, field, :string, :default => "", :null => false
+      end
+    end
+  end
+
+The user model then needs to be tagged with "acts_as_authentic", and you must add rpx_identifier to the attr_accessible configuration (if you are using it)
+
+  class User < ActiveRecord::Base
+    acts_as_authentic do |c|
+      c.my_config_option = my_value # for available options see documentation in: Authlogic::ActsAsAuthentic
+    end # block optional
+    attr_accessible :username, :email, :password, :password_confirmation, :rpx_identifier
+  end
+
+{See the source for the sample user.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/models/user.rb].
+
+
+=== 2. Add RPX configuration for the Authlogic session model
+
+Authlogic provides a helper to create the session model:
+  
+  script/generate session user_session
+
+The minimum configuration required is to add your RPX_API_KEY:  
+
+  class UserSession < Authlogic::Session::Base
+  	rpx_key RPX_API_KEY
+  end
+
+Get an API key by registering your application at {RPX}[http://rpxnow.com/]. A free "Basic" account is available, in addition to paid enhanced versions. All work with Authlogic_RPX.
+
+You probably don't want to put your API key in directly. A recommended approach is to set the key as an environment variable, and then set it as a constant in config/environment.rb:
+  
+  RPX_API_KEY = ENV['RPX_API_KEY']
+
+Two additional RPX-specific session configuration options are available.
+* auto_register: enable/disable user auto-registration (enabled by default)
+* rpx_extended_info: enable/disable extended profile information in the RPX authentication (disabled by default)
+
+For example, to disable auto-registration and enable extended info:
+  
+  class UserSession < Authlogic::Session::Base
+  	rpx_key RPX_API_KEY
+  	auto_register false
+  	rpx_extended_info
+  end
+
+{See the source for the sample user_session.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/models/user_session.rb].
+
+=== 3. Add custom user profile mapping (optional)
+
+Authlogic_rpx provides three hooks for mapping information from the RPX profile into your application's user model:
+  
+* map_rpx_data: user profile mapping during auto-registration
+* map_rpx_data_each_login: user profile mapping during login
+* map_added_rpx_data: user profile mapping when adding RPX to an existing account
+ 
+See https://rpxnow.com/docs#profile_data for the definition of available attributes in the RPX profile.
+
+=== 3a. map_rpx_data: user profile mapping during auto-registration
+
+When users auto-register, profile data from RPX is available to be inserted in the user's record on your site. By default, authlogic_rpx will map the username and email fields.
+
+If you have other fields you want to map, you can provide your own implementation of the map_rpx_data method in the UserSession model. In that method, you will be updating the "self.attempted_record" object, with information from the "@rpx_data" object. See the {RPX documentation}[https://rpxnow.com/docs#profile_data] to find out about the set of information that is available. 
+
+  class UserSession < Authlogic::Session::Base
+  	rpx_key RPX_API_KEY
+  	rpx_extended_info
+  	
+  private
+  
+    # map_rpx_data maps additional fields from the RPX response into the user object
+    # override this in your session controller to change the field mapping
+    # see https://rpxnow.com/docs#profile_data for the definition of available attributes
+    #
+    def map_rpx_data
+      # map core profile data using authlogic indirect column names
+      self.attempted_record.send("#{klass.login_field}=", @rpx_data['profile']['preferredUsername'] ) if attempted_record.send(klass.login_field).blank?
+      self.attempted_record.send("#{klass.email_field}=", @rpx_data['profile']['email'] ) if attempted_record.send(klass.email_field).blank?
+      
+      # map some other columns explicitly
+      self.attempted_record.fullname = @rpx_data['profile']['displayName'] if attempted_record.fullname.blank?
+    
+    	if rpx_extended_info?
+    		# map some extended attributes
+    	end
+    end
+  	
+  end
+
+{See the source for the sample user_session.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/models/user_session.rb].
+
+WARNING: if you are using auto-registration, any fields you map should NOT have constraints enforced at the database level.
+Authlogic_rpx will optimistically attempt to save the user record during registration, and violating a database constraint will cause the authentication/registration to fail.
+
+You can/should enforce any required validations at the model level e.g.
+
+  validates_uniqueness_of   :username, :case_sensitive => false
+  
+This will allow the auto-registration to proceed, and the user can be given a chance to rectify the validation errors on your user profile page.
+
+If it is not acceptable in your application to have user records created with potential validation errors in auto-populated fields, you will need to override map_rpx_data and implement whatever special handling makes sense in your case. For example:
+  
+* directly check for uniqueness and other validation requirements
+* automatically "uniquify" certain fields like username
+* save conflicting profile information to "pending user review" columns or a seperate table
+
+
+==== 3b. map_rpx_data_each_login: user profile mapping during login
+
+map_rpx_data_each_login provides a hook to allow you to map RPX profile information every time the user logs in.
+
+By default, nothing is mapped. If you have other fields you want to map, you can provide your own implementation of the map_rpx_data_each_login method in the UserSession model.
+
+This would mainly be used to update relatively volatile information that you are maintaining in the user model (such as profile image url)
+
+In the map_rpx_data_each_login procedure, you will be writing to fields of the "self.attempted_record" object, pulling data from the @rpx_data object. For example:
+			
+	def map_rpx_data_each_login
+		# we'll always update photo_url
+		self.attempted_record.photo_url = @rpx_data['profile']['photo']
+	end
+
+{See the source for the sample user_session.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/models/user_session.rb].
+
+
+==== 3c. map_added_rpx_data: user profile mapping when adding RPX to an existing account
+
+map_added_rpx_data maps additional fields from the RPX response into the user object during the "add RPX to existing account" process.
+
+By default, it only maps the rpx_identifier field. If you have other fields you want to map, you can provide your own implementation of the map_added_rpx_data method in the User model (NOT UserSession, unlike for map_rpx_data and map_rpx_data_each_login).
+
+NB: If you override this method, you will be responsible for also mapping the rpx_identifier.
+
+In the map_added_rpx_data procedure, you will be writing to fields of the "self" object, pulling data from the rpx_data parameter. For example:
+
+	def map_added_rpx_data( rpx_data )
+		self.rpx_identifier = rpx_data['profile']['identifier']
+
+		# map some additional fields, e.g. photo_url
+		self.photo_url = rpx_data['profile']['photo'] if photo_url.blank?
+	end
+
+{See the source for the sample user.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/models/user.rb].
+
+
+=== 4. Add application controller helpers: current_user, current_user_session
+
+We'll add current_user and current_user_session helpers. These can then be used in controllers and views to get a handle on the "current" logged in user.
+
+  class ApplicationController < ActionController::Base
+    helper :all # include all helpers, all the time
+    protect_from_forgery # See ActionController::RequestForgeryProtection for details
+  
+    # Scrub sensitive parameters from your log
+    filter_parameter_logging :password, :password_confirmation
+    
+    helper_method :current_user, :current_user_session
+    
+    private
+    
+  	def current_user_session
+  		return @current_user_session if defined?(@current_user_session)
+  		@current_user_session = UserSession.find
+  	end
+  
+  	def current_user
+  		return @current_user if defined?(@current_user)
+  		@current_user = current_user_session && current_user_session.record
+  	end
+  end
+
+{See the source for the sample user_session_controller.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/controllers/application_controller.rb].
+
+
+=== 5. Setup the Authlogic session controller
+
+If you don't already have a user session controller, create one. There are four actions of significance for authlogic_rpx:
+  
+  $ script/generate controller user_sessions index new create destroy
+
+{See the source for the sample user_session_controller.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/controllers/user_sessions_controller.rb].
+
+In config/routes.rb we can define the standard routes for this controller and two named routes for the main login/out (or singin/out if you prefer that terminology):
+
+  map.signin "signin", :controller => "user_sessions", :action => "new"
+  map.signout "signout", :controller => "user_sessions", :action => "destroy"
+  map.resources :user_sessions
+
+==== index
+This is where RPX will return to if the user cancelled the login process, so it needs to be handled. You probably just want to redirect the user to an appropriate alternative:
+  
+	def index
+		redirect_to current_user ? root_url : new_user_session_url
+	end
+
+==== new
+Typically used to render a login form
+
+	def new
+		@user_session = UserSession.new
+	end
+
+==== create
+This is where the magic happens for authentication. Authlogic hides all the underlying wiring, and you just need to "save" the session!
+
+Authlogic_rpx provides two additional methods that you might want to use to tailor you application behaviour:
+* new_registration? - if a new registration, e.g. force them to go via a registration follow-up page
+* registration_complete? - if registration details not complete, e.g. bounce the user over the profile editing page
+
+	def create
+		@user_session = UserSession.new(params[:user_session])
+		if @user_session.save
+			if @user_session.new_registration?
+				flash[:notice] = "Welcome! As a new user, please review your registration details before continuing.."
+				redirect_to edit_user_path( :current )
+			else
+				if @user_session.registration_complete?
+					flash[:notice] = "Successfully signed in."
+					redirect_back_or_default articles_path
+				else
+					flash[:notice] = "Welcome back! Please complete required registration details before continuing.."
+					redirect_to edit_user_path( :current )
+				end
+			end
+		else
+			flash[:error] = "Failed to login or register."
+			redirect_to new_user_session_path
+		end
+	end
+
+==== destroy
+The logout action..
+
+	def destroy
+		@user_session = current_user_session
+		@user_session.destroy if @user_session
+		flash[:notice] = "Successfully signed out."
+		redirect_to articles_path
+	end
+
+
+=== 6. Setup the Authlogic user controller
+
+The users controller handles the actual user creation and editing actions. In it's standard form, it looks like any other controller with an underlying ActiveRecord model.
+
+There are five basic actions to consider. If you don't already have a controller, create it:
+  
+  $ script/generate controller users new create edit show update
+
+{See the source for the sample users_controller.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/controllers/users_controller.rb].
+
+The users controller just needs standard routes defined in config/routes.rb:
+
+  map.resources :users
+  
+==== new
+Stock standard form for a user to register on the site. Only required if you will allow users to register without using RPX auto-registration (using standard password authentication).
+
+	def new
+		@user = User.new
+	end
+	
+==== create
+As for new, stock standard and only required if you will allow users to register without using RPX auto-registration.
+
+	def create
+		@user = User.new(params[:user])
+		if @user.save
+			flash[:notice] = "Successfully registered user."
+			redirect_to articles_path
+		else
+			render :action => 'new'
+		end
+	end
+	
+==== show
+Display's the user's profile. Uses the current_user helper that we'll include in the application controller.
+
+	def show
+		@user = current_user
+	end
+	
+==== edit
+Allows the user to edit their profile. Calling valid? will ensure any validation errors are highlighted. This can be relevant with RPX since auto-registration may not include all the profile data you want to make "mandatory" for normal users.
+
+	def edit
+		@user = current_user
+		@user.valid?
+	end
+
+==== update
+Handles the submission of the edit form. Again, uses the current_user helper that we'll include in the application controller.
+
+	def update
+		@user = current_user
+		@user.attributes = params[:user]
+		if @user.save
+			flash[:notice] = "Successfully updated user."
+			redirect_back_or_default articles_path
+		else
+			render :action => 'edit'
+		end
+	end
+
+
+=== 7. Use view helpers to provide login links
+
+So how to put a "login" link on your page? Two helper methods are provided:
+* <b>rpx_popup</b> helper to insert a link to pop-up RPX login
+* <b>rpx_embed</b> helper to insert an embedded iframe RPX login form
+
+Each takes an options hash:
+* <tt>link_text:</tt> text to use in the link (only used by rpx_popup)
+* <tt>app_name:</tt> name of the application you set when registering your service at rpxnow.com (will be prepended to RPX domain and used in RPX dialogues)
+* <tt>return_url:</tt> url for the RPX callback (e.g. user_sessions_url)
+* <tt>add_rpx:</tt> Optional. If true, requests RPX callback to add to current session. Else runs normal authentication process (default). See "8. Allow users to "Add RPX" to existing accounts"
+* <tt>unobtrusive:</tt> true/false; sets javascript style for link. unobtrusive=true links directly to rpxnow site, whereas unobtrusive=false does a javascript pop-over. Default: true (only used by rpx_popup)
+
+For example, to insert a login link in a navigation bar is as simple as this:
+
+		&lt;div id="user_nav"&gt;
+			&lt;%= link_to "Home", root_path %&gt; |
+			&lt;% if current_user %&gt;
+				&lt;%= link_to "Profile", user_path(:current) %&gt; |
+				&lt;%= link_to "Sign out", signout_path %&gt;
+			&lt;% else %&gt;
+				&lt;%= rpx_popup( :link_text => "Register/Sign in with RPX..", :app_name => "rails-authlogic-rpx-sample", :return_url => user_sessions_url, :unobtrusive => false ) %>&gt;
+			&lt;% end %&gt;
+		&lt;/div&gt;
+
+=== 8. Allow users to "Add RPX" to existing accounts (optional)
+
+If you got this far and have a working application, you are ready to go, especially if you only plan to support RPX authentication.
+
+However, if you support other authentication methods (e.g. by password), you probably want the ability to let user's add RPX to an existing account. This is not possible by default, however adding it is simply a matter of providing another method on your user controller.
+
+The route may be called anything you like. Let's use "addrpxauth" for example. 
+
+	# This action has the special purpose of receiving an update of the RPX identity information
+	# for current user - to add RPX authentication to an existing non-RPX account.
+	# RPX only supports :post, so this cannot simply go to update method (:put)
+	def addrpxauth
+		@user = current_user
+		if @user.save
+			flash[:notice] = "Successfully added RPX authentication for this account."
+			render :action => 'show'
+		else
+			render :action => 'edit'
+		end
+	end
+
+{This is demonstrated in the sample users_controller.rb}[http://github.com/tardate/rails-authlogic-rpx-sample/blob/master/app/controllers/users_controller.rb].
+
+You'll note this is almost identical to the "update". The main difference is that it needs to be enabled for :post by RPX. In config/routes.rb:
+
+  map.addrpxauth "addrpxauth", :controller => "users", :action => "addrpxauth", :method => :post
+
+To make an "Add RPX authentication for this account.." link, use rpx_popup as for normal RPX login, but set the return_url to the "addrpxauth" callback you have provided, and set the option :add_rpx to tru:
+      
+  &lt;%= rpx_popup( :link_text =&gt; "Add RPX authentication for this account..", :app_name =&gt; RPX_APP_NAME, :return_url =&gt; addrpxauth_url, :add_rpx =&gt; true, :unobtrusive =&gt; false ) %&gt; 
+
+
+=== 9. There is no 9
+
+That's all there is. To see Authlogic_RPX in action, check out the demonstration Rails application:
+* <b>Live Demonstration Site:</b> [http://rails-authlogic-rpx-sample.heroku.com]
+* <b>Demonstration site source repository:</b> [http://github.com/tardate/rails-authlogic-rpx-sample]
+
+
+== Improving Authlogic_RPX: next steps; how to help
+
+Authlogic_RPX is open source and hosted on {github}[http://github.com/tardate/authlogic_rpx]. Developer's are welcome to fork and play - if you have improvements or bug fixes, just send a request to pull from your fork.
+
+If you have issues or feedback, please log them in the {issues list on github}[http://github.com/tardate/authlogic_rpx/issues]
+
+Some of the improvements currently on the radar:
+* Still figuring out how to write some good automated tests
+* Implement/verify support for RPX "paid" service features of their "Plus" and "Pro" accounts (to date, only tested with free RPX "Basic" account)
+
+
+== Note on programmatically grabbing an authenticated session
+
+If you need to programmatically perform proxy authentication as a specific user (e.g. to run a batch process on behalf of the user), authlogic provides the necessary capability and this can be used with RPX-authenticated users too:
+
+  app.get "/" # force Authlogic::Session::Base.controller activation
+  user = User.find(:first)
+  session = UserSession.create(user, true) # skip authentication and log the user in directly, the true means "remember me"
+  session.valid?
+  => true
+ 
+
+== Internals
+
+Some design principles:
+* Attempted to stay as close to binarylogic's "unobtrusive authentication" sensibility in Authlogic design
+* All direct RPX processing is handled in the AuthlogicRpx::Session class (not in the ActiveRecord model)
+* It uses the plug-in architecture introduced in Authlogic v2.0.
+
+==== building the gem
+
+* increment the version in lib/authlogic_rpx/version.rb
+* update gem version refs in README.rdoc
+* update CHANGELOG.rdoc
+
+  # update manifest file
+  $ rake manifest
+  # update gemspec
+  $ rake build_gemspec
+  # build the gem
+  gem build authlogic_rpx.gemspec
+  # push the gem to gemcutter (e.g. for version 1.0.3)
+  gem push authlogic_rpx-1.0.3.gem
+
+
+== Kudos and Kopywrite
+
+Thanks to {binarylogic}[http://github.com/binarylogic] for cleaning up authentication in rails by creating Authlogic in the first place and offering it to the community.
+
+The idea of adding RPX support to authlogic is not new. Some early ideas were found in the following projects, although it was decided not to base this implementation on a fork of these, since the approaches varied considerably: 
+*	<b>http://github.com/hunter/authlogic_rpx</b> an initial start, based on authlogic_openid and using rpx_now
+*	<b>http://github.com/gampleman/authlogic_rpx/</b> similar, but including an implementation of the RPX api
+
+authlogic_rpx was created by Paul Gallagher (tardate.com) and released under the MIT license.

data/Rakefile

@@ -0,0 +1,58 @@
+require 'rubygems'
+require 'rake'
+
+begin
+  require 'jeweler'
+  Jeweler::Tasks.new do |gem|
+    gem.name = "kent-authlogic_rpx"
+    gem.summary = %Q{Authlogic Plugin for RPX}
+    gem.description = %Q{Authlogic Plugin for RPX}
+    gem.email = "kent.fenwick@gmail.com"
+    gem.homepage = "http://github.com/kent/authlogic_rpx"
+    gem.authors = ["Kent Fenwick"]
+    gem.add_development_dependency "thoughtbot-shoulda"
+    gem.add_dependency("kent-rpx_now", ">= 0.6.11")
+    gem.add_dependency("authlogic", ">= 2.1.1")
+    # gem is a Gem::Specification... see http://www.rubygems.org/read/chapter/20 for additional settings
+  end
+rescue LoadError
+  puts "Jeweler (or a dependency) not available. Install it with: sudo gem install jeweler"
+end
+
+require 'rake/testtask'
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/*_test.rb'
+  test.verbose = true
+end
+
+begin
+  require 'rcov/rcovtask'
+  Rcov::RcovTask.new do |test|
+    test.libs << 'test'
+    test.pattern = 'test/**/*_test.rb'
+    test.verbose = true
+  end
+rescue LoadError
+  task :rcov do
+    abort "RCov is not available. In order to run rcov, you must: sudo gem install spicycode-rcov"
+  end
+end
+
+task :test => :check_dependencies
+
+task :default => :test
+
+require 'rake/rdoctask'
+Rake::RDocTask.new do |rdoc|
+  if File.exist?('VERSION')
+    version = File.read('VERSION')
+  else
+    version = ""
+  end
+
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "authlogic_rpx #{version}"
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end

data/VERSION

@@ -0,0 +1 @@
+0.1.0

data/init.rb

@@ -0,0 +1 @@
+require File.dirname(__FILE__) + "/lib/authlogic_rpx.rb"

data/kent-authlogic_rpx.gemspec

@@ -0,0 +1,64 @@
+# Generated by jeweler
+# DO NOT EDIT THIS FILE
+# Instead, edit Jeweler::Tasks in Rakefile, and run `rake gemspec`
+# -*- encoding: utf-8 -*-
+
+Gem::Specification.new do |s|
+  s.name = %q{kent-authlogic_rpx}
+  s.version = "0.1.0"
+
+  s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
+  s.authors = ["Kent Fenwick"]
+  s.date = %q{2009-12-22}
+  s.description = %q{Authlogic Plugin for RPX}
+  s.email = %q{kent.fenwick@gmail.com}
+  s.extra_rdoc_files = [
+    "LICENSE",
+     "README.rdoc"
+  ]
+  s.files = [
+    ".document",
+     ".gitignore",
+     "LICENSE",
+     "README.rdoc",
+     "Rakefile",
+     "VERSION",
+     "init.rb",
+     "kent-authlogic_rpx.gemspec",
+     "lib/authlogic_rpx.rb",
+     "lib/authlogic_rpx/acts_as_authentic.rb",
+     "lib/authlogic_rpx/helper.rb",
+     "lib/authlogic_rpx/session.rb",
+     "lib/authlogic_rpx/version.rb",
+     "test/authlogic_rpx_test.rb",
+     "test/test_helper.rb"
+  ]
+  s.homepage = %q{http://github.com/kent/authlogic_rpx}
+  s.rdoc_options = ["--charset=UTF-8"]
+  s.require_paths = ["lib"]
+  s.rubygems_version = %q{1.3.5}
+  s.summary = %q{Authlogic Plugin for RPX}
+  s.test_files = [
+    "test/authlogic_rpx_test.rb",
+     "test/test_helper.rb"
+  ]
+
+  if s.respond_to? :specification_version then
+    current_version = Gem::Specification::CURRENT_SPECIFICATION_VERSION
+    s.specification_version = 3
+
+    if Gem::Version.new(Gem::RubyGemsVersion) >= Gem::Version.new('1.2.0') then
+      s.add_development_dependency(%q<thoughtbot-shoulda>, [">= 0"])
+      s.add_runtime_dependency(%q<kent-rpx_now>, [">= 0.6.11"])
+      s.add_runtime_dependency(%q<authlogic>, [">= 2.1.1"])
+    else
+      s.add_dependency(%q<thoughtbot-shoulda>, [">= 0"])
+      s.add_dependency(%q<kent-rpx_now>, [">= 0.6.11"])
+      s.add_dependency(%q<authlogic>, [">= 2.1.1"])
+    end
+  else
+    s.add_dependency(%q<thoughtbot-shoulda>, [">= 0"])
+    s.add_dependency(%q<kent-rpx_now>, [">= 0.6.11"])
+    s.add_dependency(%q<authlogic>, [">= 2.1.1"])
+  end
+end

data/lib/authlogic_rpx.rb

@@ -0,0 +1,8 @@
+require "authlogic_rpx/version"
+require "authlogic_rpx/acts_as_authentic"
+require "authlogic_rpx/session"
+require "authlogic_rpx/helper"
+
+ActiveRecord::Base.send(:include, AuthlogicRpx::ActsAsAuthentic)
+Authlogic::Session::Base.send(:include, AuthlogicRpx::Session)
+ActionController::Base.helper AuthlogicRpx::Helper

data/lib/authlogic_rpx/acts_as_authentic.rb

@@ -0,0 +1,114 @@
+# This module is responsible for adding RPX functionality to Authlogic. Checkout the README for more info and please
+# see the sub modules for detailed documentation.
+module AuthlogicRpx
+	# This module is responsible for adding in the RPX functionality to your models. It hooks itself into the
+	# acts_as_authentic method provided by Authlogic.
+	module ActsAsAuthentic
+		# Adds in the neccesary modules for acts_as_authentic to include and also disabled password validation if
+		# RPX is being used.
+		def self.included(klass)
+		  klass.class_eval do
+			  extend Config
+			  add_acts_as_authentic_module(Methods, :prepend)
+		  end
+		end
+
+		module Config
+		
+			# map_id is used to enable RPX identity mapping
+			# experimental - a feature of RPX paid accounts and not properly developed/tested yet
+			#
+			# * <tt>Default:</tt> false
+			# * <tt>Accepts:</tt> boolean
+			def map_id(value = false)
+				rw_config(:map_id, value, false)
+			end
+			alias_method :map_id=, :map_id
+
+		end
+		
+		module Methods
+		
+			# Set up some simple validations
+			def self.included(klass)
+				klass.class_eval do
+					validates_uniqueness_of :rpx_identifier, :scope => validations_scope, :if => :using_rpx?
+					validates_length_of_password_field_options validates_length_of_password_field_options.merge(:if => :validate_password_with_rpx?)
+					validates_confirmation_of_password_field_options validates_confirmation_of_password_field_options.merge(:if => :validate_password_with_rpx?)
+					validates_length_of_password_confirmation_field_options validates_length_of_password_confirmation_field_options.merge(:if => :validate_password_with_rpx?)
+					before_validation :adding_rpx_identifier
+					after_create :map_rpx_identifier
+				end
+			end
+
+			# support a block given to the save
+			def save(perform_validation = true, &block)
+				result = super perform_validation
+				yield(result) if block_given?
+				result
+			end
+
+			# test if account it using RPX authentication
+			def using_rpx?
+			  self.column_names.include?("rpx_identifier") || !rpx_identifier.blank?
+			end
+
+			# test if account it using normal password authentication
+			def using_password?
+				!send(crypted_password_field).blank?
+			end
+
+		private
+			
+			def validate_password_with_rpx?
+				!using_rpx? && require_password?
+			end
+			
+			# hook for adding RPX identifier to an existing account. This is invoked prior to model validation.
+			# RPX information is plucked from the controller session object (where it was placed by the session model as a result
+			# of the RPX callback)
+			# The minimal action taken is to populate the rpx_identifier field in the user model.
+			#
+			# This procedure chains to the map_added_rpx_data, which may be over-ridden in your project to perform
+			# additional mapping of RPX information to the user model as may be desired.
+			#
+			def adding_rpx_identifier
+				return true unless session_class && session_class.controller
+				added_rpx_data = session_class.controller.session['added_rpx_data']	
+				unless added_rpx_data.blank?
+					session_class.controller.session['added_rpx_data'] = nil
+					map_added_rpx_data( added_rpx_data ) 
+				end
+				return true
+			end
+			
+			# map_added_rpx_data maps additional fields from the RPX response into the user object during the "add RPX to existing account" process.
+			# Override this in your user model to perform field mapping as may be desired
+			# See https://rpxnow.com/docs#profile_data for the definition of available attributes
+			#
+			# By default, it only maps the rpx_identifier field.
+			#
+			def map_added_rpx_data( rpx_data )
+			  self.rpx_identifier = rpx_data['profile']['identifier']
+			end
+			
+			
+			
+			# experimental - a feature of RPX paid accounts and not properly developed/tested yet
+			def map_id?
+				self.class.map_id
+			end
+				
+			# experimental - a feature of RPX paid accounts and not properly developed/tested yet
+			def map_rpx_identifier
+				RPXNow.map(rpx_identifier, id) if using_rpx? && map_id?
+			end
+			
+			# experimental - a feature of RPX paid accounts and not properly developed/tested yet
+			def unmap_rpx_identifer
+				RPXNow.unmap(rpx_identifier, id) if using_rpx? && map_id?
+			end
+			
+		end
+	end
+end

data/lib/authlogic_rpx/helper.rb

@@ -0,0 +1,42 @@
+module AuthlogicRpx
+	module Helper
+
+		# helper to insert an embedded iframe RPX login
+		# takes options hash:
+		#   * <tt>app_name:</tt> name of the application (will be prepended to RPX domain and used in RPX dialogues)
+		#   * <tt>return_url:</tt> url for the RPX callback (e.g. user_sessions_url)
+		#   * <tt>add_rpx:</tt> if true, requests RPX callback to add to current session. Else runs normal authentication process (default)
+		#
+		def rpx_embed(options = {})
+			params = (
+				{ :authenticity_token => form_authenticity_token, :add_rpx => options[:add_rpx] }.collect { |n| "#{n[0]}=#{ u(n[1]) }" if n[1] }
+			).compact.join('&')
+			RPXNow.embed_code(options[:app_name], u( options[:return_url] + '?' + params ) )
+		end
+
+		# helper to insert a link to pop-up RPX login
+		# takes options hash:
+		#   * <tt>link_text:</tt> text to use in the link
+		#   * <tt>app_name:</tt> name of the application (will be prepended to RPX domain and used in RPX dialogues)
+		#   * <tt>return_url:</tt> url for the RPX callback (e.g. user_sessions_url)
+		#   * <tt>add_rpx:</tt> if true, requests RPX callback to add to current session. Else runs normal authentication process (default)
+		#   * <tt>unobtrusive:</tt> true/false; sets javascript style for link. Default: true
+		#
+		# NB: i18n considerations? supports a :language parameter (not tested)
+		def rpx_popup(options = {})
+			params = (
+				{ :authenticity_token => form_authenticity_token, :add_rpx => options[:add_rpx] }.collect { |n| "#{n[0]}=#{ u(n[1]) }" if n[1] }
+			).compact.join('&')
+			unobtrusive = options[:unobtrusive].nil? ? true : options[:unobtrusive]
+			return_url = options[:return_url] + '?' + params 
+			return_url = u( return_url ) if unobtrusive # double-encoding required only if unobtrusive mode used
+			RPXNow.popup_code(
+  				options[:link_text], 
+  				options[:app_name],
+  				return_url,
+  				:unobtrusive=>unobtrusive
+  			) 
+		end
+
+	end
+end

data/lib/authlogic_rpx/session.rb

@@ -0,0 +1,212 @@
+module AuthlogicRpx
+	# This module is responsible for adding all of the RPX goodness to the Authlogic::Session::Base class.
+	module Session
+		# Add a simple rpx_identifier attribute and some validations for the field.
+		def self.included(klass)
+			klass.class_eval do
+				extend Config
+				include Methods
+			end
+		end
+		
+		module Config
+		  
+			def find_by_rpx_identifier_method(value = nil)
+				rw_config(:find_by_rpx_identifier_method, value, :find_by_rpx_identifier)
+			end
+			alias_method :find_by_rpx_identifier_method=, :find_by_rpx_identifier_method
+
+			# Auto Register is enabled by default. 
+			# Add this in your Session object if you need to disable auto-registration via rpx
+			#
+			def auto_register(value=true)
+				auto_register_value(value)
+			end
+			def auto_register_value(value=nil)
+				rw_config(:auto_register,value,true)
+			end      
+			alias_method :auto_register=,:auto_register
+
+			# Add this in your Session object to set the RPX API key 
+			# RPX won't work without the API key. Set it here if not already set in your app configuration.
+			#
+			def rpx_key(value=nil)
+				rpx_key_value(value)
+			end
+			def rpx_key_value(value=nil)
+				if ! inheritable_attributes.include?(:rpx_key) 
+					RPXNow.api_key = value 
+				end
+				rw_config(:rpx_key,value,false)
+			end
+			alias_method :rpx_key=,:rpx_key
+
+			# Add this in your Session object to set whether RPX returns extended user info 
+			# By default, it will not, which is enough to get username, name, email and the rpx identified
+			# if you want to map additional information into your user details, you can request extended
+			# attributes (though not all providers give them - see the RPX docs)
+			#
+			def rpx_extended_info(value=true)
+				rpx_extended_info_value(value)
+			end
+			def rpx_extended_info_value(value=nil)
+				rw_config(:rpx_extended_info,value,false)
+			end
+			alias_method :rpx_extended_info=,:rpx_extended_info
+
+		end
+		
+		module Methods
+		  
+			def self.included(klass)
+				klass.class_eval do
+					attr_accessor :new_registration
+					attr_accessor :rpx_identifier
+					after_persisting :add_rpx_identifier, :if => :adding_rpx_identifier?
+					validate :validate_by_rpx, :if => :authenticating_with_rpx?
+				end
+			end
+      		  
+			# Determines if the authenticated user is also a new registration.
+			# For use in the session controller to help direct the most appropriate action to follow.
+			# 
+			def new_registration?
+				new_registration
+			end
+			
+			# Determines if the authenticated user has a complete registration (no validation errors)
+			# For use in the session controller to help direct the most appropriate action to follow.
+			# 
+			def registration_complete?
+				attempted_record && attempted_record.valid?
+			end
+
+		private
+		  # Tests if current request is for RPX authentication
+		  #
+			def authenticating_with_rpx?
+				controller.params[:token] && !controller.params[:add_rpx]
+			end
+
+      # hook instance finder method to class
+      #
+			def find_by_rpx_identifier_method
+				self.class.find_by_rpx_identifier_method
+			end
+
+			# Tests if auto_registration is enabled (on by default)
+			#
+			def auto_register?
+				self.class.auto_register_value
+			end
+
+			# Tests if rpx_extended_info is enabled (off by default)
+			#
+			def rpx_extended_info?
+				self.class.rpx_extended_info_value
+			end
+
+      # Tests if current request is the special case of adding RPX to an existing account
+      #
+			def adding_rpx_identifier?
+				controller.params[:token] && controller.params[:add_rpx]
+			end
+			
+			# Handles the special case of RPX being added to an existing account. 
+			# At this point, a session has been established as a result of a "save" on the user model (which indirectly triggers user session validation).
+			# We do not directly add the RPX details to the user record here in order to avoid getting
+			# into a recursive dance between the session and user models.
+			# Rather, it uses the trick of adding the necessary RPX information to the session object, 
+			# and the user model will pluck these values out before completing its validation step.
+			#
+			def add_rpx_identifier
+				data = RPXNow.user_data(controller.params[:token], :extended=> rpx_extended_info? ) {|raw| raw }
+				controller.session['added_rpx_data'] = data if data
+			end
+			
+			# the main RPX magic. At this point, a session is being validated and we know RPX identifier
+			# has been provided. We'll callback to RPX to verify the token, and authenticate the matching 
+			# user. 
+			# If no user is found, and we have auto_register enabled (default) this method will also 
+			# create the user registration stub.
+			#
+			# On return to the controller, you can test for new_registration? and registration_complete?
+			# to determine the most appropriate action
+			#
+			def validate_by_rpx
+				@rpx_data = RPXNow.user_data(controller.params[:token], :extended=> rpx_extended_info? ) {|raw| raw }
+				# If we don't have a valid sign-in, give-up at this point
+				if @rpx_data.nil?
+					errors.add_to_base("Authentication failed. Please try again.")
+					return false
+				end
+				rpx_id = @rpx_data['profile']['identifier']
+				if rpx_id.blank?
+					errors.add_to_base("Authentication failed. Please try again.")
+					return false
+				end		
+				
+				self.attempted_record = klass.send(find_by_rpx_identifier_method, rpx_id)
+				
+				# so what do we do if we can't find an existing user matching the RPX authentication..
+				if !attempted_record
+					if auto_register?   
+						self.attempted_record = klass.new( :rpx_identifier=> rpx_id )     
+						map_rpx_data
+						# save the new user record - without session maintenance else we get caught in a self-referential hell,
+						# since both session and user objects invoke each other upon save
+						self.new_registration=true
+						self.attempted_record.save_without_session_maintenance
+					else
+						errors.add_to_base("We did not find any accounts with that login. Enter your details and create an account.")
+						return false
+					end
+				else
+				  map_rpx_data_each_login
+				end
+			
+			end
+
+			# map_rpx_data maps additional fields from the RPX response into the user object during auto-registration.
+			# Override this in your session model to change the field mapping
+			# See https://rpxnow.com/docs#profile_data for the definition of available attributes
+			#
+			# In this procedure, you will be writing to fields of the "self.attempted_record" object, pulling data from the @rpx_data object.
+			#
+			# WARNING: if you are using auto-registration, any fields you map should NOT have constraints enforced at the database level.
+			# authlogic_rpx will optimistically attempt to save the user record during registration, and 
+			# violating a database constraint will cause the authentication/registration to fail.
+			#
+			# You can/should enforce any required validations at the model level e.g.
+			#   validates_uniqueness_of   :username, :case_sensitive => false
+			# This will allow the auto-registration to proceed, and the user can be given a chance to rectify the validation errors
+			# on your user profile page.
+			#
+			# If it is not acceptable in your application to have user records created with potential validation errors in auto-populated fields, you
+			# will need to override map_rpx_data and implement whatever special handling makes sense in your case. For example:
+			#   - directly check for uniqueness and other validation requirements
+			#   - automatically "uniquify" fields like username
+			#   - save conflicting profile information to "pending user review" columns or a seperate table
+			#
+			def map_rpx_data
+				self.attempted_record.send("#{klass.login_field}=", @rpx_data['profile']['preferredUsername'] ) if attempted_record.send(klass.login_field).blank?
+				self.attempted_record.send("#{klass.email_field}=", @rpx_data['profile']['email'] ) if attempted_record.send(klass.email_field).blank?
+			end
+
+			# map_rpx_data_each_login provides a hook to allow you to map RPX profile information every time the user
+			# logs in.
+			# By default, nothing is mapped. 
+			#
+			# This would mainly be used to update relatively volatile information that you are maintaining in the user model (such as profile image url)
+			#
+			# In this procedure, you will be writing to fields of the "self.attempted_record" object, pulling data from the @rpx_data object.
+			#
+			#
+			def map_rpx_data_each_login
+
+			end
+	
+		end
+		
+	end
+end

data/lib/authlogic_rpx/version.rb

@@ -0,0 +1,51 @@
+module AuthlogicRpx
+  # A class for describing the current version of a library. The version
+  # consists of three parts: the +major+ number, the +minor+ number, and the
+  # +tiny+ (or +patch+) number.
+  class Version
+    include Comparable
+  
+    # A convenience method for instantiating a new Version instance with the
+    # given +major+, +minor+, and +tiny+ components.
+    def self.[](major, minor, tiny)
+      new(major, minor, tiny)
+    end
+
+    attr_reader :major, :minor, :tiny
+
+    # Create a new Version object with the given components.
+    def initialize(major, minor, tiny)
+      @major, @minor, @tiny = major, minor, tiny
+    end
+
+    # Compare this version to the given +version+ object.
+    def <=>(version)
+      to_i <=> version.to_i
+    end
+
+    # Converts this version object to a string, where each of the three
+    # version components are joined by the '.' character. E.g., 2.0.0.
+    def to_s
+      @to_s ||= [@major, @minor, @tiny].join(".")
+    end
+
+    # Converts this version to a canonical integer that may be compared
+    # against other version objects.
+    def to_i
+      @to_i ||= @major * 1_000_000 + @minor * 1_000 + @tiny
+    end
+    
+    def to_a
+      [@major, @minor, @tiny]
+    end
+
+    MAJOR = 1
+    MINOR = 0
+    TINY  = 4
+
+    # The current version as a Version instance
+    CURRENT = new(MAJOR, MINOR, TINY)
+    # The current version as a String
+    STRING = CURRENT.to_s
+  end
+end

data/test/authlogic_rpx_test.rb

@@ -0,0 +1,7 @@
+require 'test_helper'
+
+class AuthlogicRpxTest < Test::Unit::TestCase
+  should "probably rename this file and start testing for real" do
+    flunk "hey buddy, you should probably rename this file and start testing for real"
+  end
+end

data/test/test_helper.rb

@@ -0,0 +1,10 @@
+require 'rubygems'
+require 'test/unit'
+require 'shoulda'
+
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+require 'authlogic_rpx'
+
+class Test::Unit::TestCase
+end

metadata

@@ -0,0 +1,100 @@
+--- !ruby/object:Gem::Specification 
+name: kent-authlogic_rpx
+version: !ruby/object:Gem::Version 
+  version: 0.1.0
+platform: ruby
+authors: 
+- Kent Fenwick
+autorequire: 
+bindir: bin
+cert_chain: []
+
+date: 2009-12-22 00:00:00 -05:00
+default_executable: 
+dependencies: 
+- !ruby/object:Gem::Dependency 
+  name: thoughtbot-shoulda
+  type: :development
+  version_requirement: 
+  version_requirements: !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: "0"
+    version: 
+- !ruby/object:Gem::Dependency 
+  name: kent-rpx_now
+  type: :runtime
+  version_requirement: 
+  version_requirements: !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: 0.6.11
+    version: 
+- !ruby/object:Gem::Dependency 
+  name: authlogic
+  type: :runtime
+  version_requirement: 
+  version_requirements: !ruby/object:Gem::Requirement 
+    requirements: 
+    - - ">="
+      - !ruby/object:Gem::Version 
+        version: 2.1.1
+    version: 
+description: Authlogic Plugin for RPX
+email: kent.fenwick@gmail.com
+executables: []
+
+extensions: []
+
+extra_rdoc_files: 
+- LICENSE
+- README.rdoc
+files: 
+- .document
+- .gitignore
+- LICENSE
+- README.rdoc
+- Rakefile
+- VERSION
+- init.rb
+- kent-authlogic_rpx.gemspec
+- lib/authlogic_rpx.rb
+- lib/authlogic_rpx/acts_as_authentic.rb
+- lib/authlogic_rpx/helper.rb
+- lib/authlogic_rpx/session.rb
+- lib/authlogic_rpx/version.rb
+- test/authlogic_rpx_test.rb
+- test/test_helper.rb
+has_rdoc: true
+homepage: http://github.com/kent/authlogic_rpx
+licenses: []
+
+post_install_message: 
+rdoc_options: 
+- --charset=UTF-8
+require_paths: 
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+required_rubygems_version: !ruby/object:Gem::Requirement 
+  requirements: 
+  - - ">="
+    - !ruby/object:Gem::Version 
+      version: "0"
+  version: 
+requirements: []
+
+rubyforge_project: 
+rubygems_version: 1.3.5
+signing_key: 
+specification_version: 3
+summary: Authlogic Plugin for RPX
+test_files: 
+- test/authlogic_rpx_test.rb
+- test/test_helper.rb