lockbox_middleware 1.2.1 → 1.2.2

data/vendor/gems/authlogic-2.1.3/lib/authlogic/acts_as_authentic/password.rb

@@ -1,344 +0,0 @@
-module Authlogic
-  module ActsAsAuthentic
-    # This module has a lot of neat functionality. It is responsible for encrypting your password, salting it, and verifying it.
-    # It can also help you transition to a new encryption algorithm. See the Config sub module for configuration options.
-    module Password
-      def self.included(klass)
-        klass.class_eval do
-          extend Config
-          add_acts_as_authentic_module(Callbacks)
-          add_acts_as_authentic_module(Methods)
-        end
-      end
-      
-      # All configuration for the password aspect of acts_as_authentic.
-      module Config
-        # The name of the crypted_password field in the database.
-        #
-        # * <tt>Default:</tt> :crypted_password, :encrypted_password, :password_hash, or :pw_hash
-        # * <tt>Accepts:</tt> Symbol
-        def crypted_password_field(value = nil)
-          rw_config(:crypted_password_field, value, first_column_to_exist(nil, :crypted_password, :encrypted_password, :password_hash, :pw_hash))
-        end
-        alias_method :crypted_password_field=, :crypted_password_field
-        
-        # The name of the password_salt field in the database.
-        #
-        # * <tt>Default:</tt> :password_salt, :pw_salt, :salt, nil if none exist
-        # * <tt>Accepts:</tt> Symbol
-        def password_salt_field(value = nil)
-          rw_config(:password_salt_field, value, first_column_to_exist(nil, :password_salt, :pw_salt, :salt))
-        end
-        alias_method :password_salt_field=, :password_salt_field
-        
-        # Whether or not to require a password confirmation. If you don't want your users to confirm their password
-        # just set this to false.
-        #
-        # * <tt>Default:</tt> true
-        # * <tt>Accepts:</tt> Boolean
-        def require_password_confirmation(value = nil)
-          rw_config(:require_password_confirmation, value, true)
-        end
-        alias_method :require_password_confirmation=, :require_password_confirmation
-        
-        # By default passwords are required when a record is new or the crypted_password is blank, but if both of these things
-        # are met a password is not required. In this case, blank passwords are ignored.
-        #
-        # Think about a profile page, where the user can edit all of their information, including changing their password.
-        # If they do not want to change their password they just leave the fields blank. This will try to set the password to
-        # a blank value, in which case is incorrect behavior. As such, Authlogic ignores this. But let's say you have a completely
-        # separate page for resetting passwords, you might not want to ignore blank passwords. If this is the case for you, then
-        # just set this value to false.
-        #
-        # * <tt>Default:</tt> true
-        # * <tt>Accepts:</tt> Boolean
-        def ignore_blank_passwords(value = nil)
-          rw_config(:ignore_blank_passwords, value, true)
-        end
-        alias_method :ignore_blank_passwords=, :ignore_blank_passwords
-        
-        # When calling valid_password?("some pass") do you want to check that password against what's in that object or whats in
-        # the datbase. Take this example:
-        #
-        #   u = User.first
-        #   u.password = "new pass"
-        #   u.valid_password?("old pass")
-        #
-        # Should the last line above return true or false? The record hasn't been saved yet, so most would assume yes.
-        # Other would assume no. So I let you decide by giving you this option.
-        #
-        # * <tt>Default:</tt> true
-        # * <tt>Accepts:</tt> Boolean
-        def check_passwords_against_database(value = nil)
-          rw_config(:check_passwords_against_database, value, true)
-        end
-        alias_method :check_passwords_against_database=, :check_passwords_against_database
-        
-        # Whether or not to validate the password field.
-        #
-        # * <tt>Default:</tt> true
-        # * <tt>Accepts:</tt> Boolean
-        def validate_password_field(value = nil)
-          rw_config(:validate_password_field, value, true)
-        end
-        alias_method :validate_password_field=, :validate_password_field
-        
-        # A hash of options for the validates_length_of call for the password field. Allows you to change this however you want.
-        #
-        # <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
-        # merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
-        # options.</b>
-        #
-        # * <tt>Default:</tt> {:minimum => 4, :if => :require_password?}
-        # * <tt>Accepts:</tt> Hash of options accepted by validates_length_of
-        def validates_length_of_password_field_options(value = nil)
-          rw_config(:validates_length_of_password_field_options, value, {:minimum => 4, :if => :require_password?})
-        end
-        alias_method :validates_length_of_password_field_options=, :validates_length_of_password_field_options
-        
-        # A convenience function to merge options into the validates_length_of_login_field_options. So intead of:
-        #
-        #   self.validates_length_of_password_field_options = validates_length_of_password_field_options.merge(:my_option => my_value)
-        #
-        # You can do this:
-        #
-        #   merge_validates_length_of_password_field_options :my_option => my_value
-        def merge_validates_length_of_password_field_options(options = {})
-          self.validates_length_of_password_field_options = validates_length_of_password_field_options.merge(options)
-        end
-        
-        # A hash of options for the validates_confirmation_of call for the password field. Allows you to change this however you want.
-        #
-        # <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
-        # merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
-        # options.</b>
-        #
-        # * <tt>Default:</tt> {:if => :require_password?}
-        # * <tt>Accepts:</tt> Hash of options accepted by validates_confirmation_of
-        def validates_confirmation_of_password_field_options(value = nil)
-          rw_config(:validates_confirmation_of_password_field_options, value, {:if => :require_password?})
-        end
-        alias_method :validates_confirmation_of_password_field_options=, :validates_confirmation_of_password_field_options
-        
-        # See merge_validates_length_of_password_field_options. The same thing, except for validates_confirmation_of_password_field_options
-        def merge_validates_confirmation_of_password_field_options(options = {})
-          self.validates_confirmation_of_password_field_options = validates_confirmation_of_password_field_options.merge(options)
-        end
-        
-        # A hash of options for the validates_length_of call for the password_confirmation field. Allows you to change this however you want.
-        #
-        # <b>Keep in mind this is ruby. I wanted to keep this as flexible as possible, so you can completely replace the hash or
-        # merge options into it. Checkout the convenience function merge_validates_length_of_password_field_options to merge
-        # options.</b>
-        #
-        # * <tt>Default:</tt> validates_length_of_password_field_options
-        # * <tt>Accepts:</tt> Hash of options accepted by validates_length_of
-        def validates_length_of_password_confirmation_field_options(value = nil)
-          rw_config(:validates_length_of_password_confirmation_field_options, value, validates_length_of_password_field_options)
-        end
-        alias_method :validates_length_of_password_confirmation_field_options=, :validates_length_of_password_confirmation_field_options
-        
-        # See merge_validates_length_of_password_field_options. The same thing, except for validates_length_of_password_confirmation_field_options
-        def merge_validates_length_of_password_confirmation_field_options(options = {})
-          self.validates_length_of_password_confirmation_field_options = validates_length_of_password_confirmation_field_options.merge(options)
-        end
-        
-        # The class you want to use to encrypt and verify your encrypted passwords. See the Authlogic::CryptoProviders module for more info
-        # on the available methods and how to create your own.
-        #
-        # * <tt>Default:</tt> CryptoProviders::Sha512
-        # * <tt>Accepts:</tt> Class
-        def crypto_provider(value = nil)
-          rw_config(:crypto_provider, value, CryptoProviders::Sha512)
-        end
-        alias_method :crypto_provider=, :crypto_provider
-        
-        # Let's say you originally encrypted your passwords with Sha1. Sha1 is starting to join the party with MD5 and you want to switch
-        # to something stronger. No problem, just specify your new and improved algorithm with the crypt_provider option and then let
-        # Authlogic know you are transitioning from Sha1 using this option. Authlogic will take care of everything, including transitioning
-        # your users to the new algorithm. The next time a user logs in, they will be granted access using the old algorithm and their
-        # password will be resaved with the new algorithm. All new users will obviously use the new algorithm as well.
-        #
-        # Lastly, if you want to transition again, you can pass an array of crypto providers. So you can transition from as many algorithms
-        # as you want.
-        #
-        # * <tt>Default:</tt> nil
-        # * <tt>Accepts:</tt> Class or Array
-        def transition_from_crypto_providers(value = nil)
-          rw_config(:transition_from_crypto_providers, (!value.nil? && [value].flatten.compact) || value, [])
-        end
-        alias_method :transition_from_crypto_providers=, :transition_from_crypto_providers
-      end
-      
-      # Callbacks / hooks to allow other modules to modify the behavior of this module.
-      module Callbacks
-        METHODS = [
-          "before_password_set", "after_password_set",
-          "before_password_verification", "after_password_verification"
-        ]
-        
-        def self.included(klass)
-          return if klass.crypted_password_field.nil?
-          klass.define_callbacks *METHODS
-        end
-        
-        private
-          METHODS.each do |method|
-            class_eval <<-"end_eval", __FILE__, __LINE__
-              def #{method}
-                run_callbacks(:#{method}) { |result, object| result == false }
-              end
-            end_eval
-          end
-      end
-      
-      # The methods related to the password field.
-      module Methods
-        def self.included(klass)
-          return if klass.crypted_password_field.nil?
-          
-          klass.class_eval do
-            include InstanceMethods
-            
-            if validate_password_field
-              validates_length_of :password, validates_length_of_password_field_options
-              
-              if require_password_confirmation
-                validates_confirmation_of :password, validates_confirmation_of_password_field_options
-                validates_length_of :password_confirmation, validates_length_of_password_confirmation_field_options
-              end
-            end
-            
-            after_save :reset_password_changed
-          end
-        end
-        
-        module InstanceMethods
-          # The password
-          def password
-            @password
-          end
-        
-          # This is a virtual method. Once a password is passed to it, it will create new password salt as well as encrypt
-          # the password.
-          def password=(pass)
-            return if ignore_blank_passwords? && pass.blank?
-            before_password_set
-            @password = pass
-            send("#{password_salt_field}=", Authlogic::Random.friendly_token) if password_salt_field
-            send("#{crypted_password_field}=", crypto_provider.encrypt(*encrypt_arguments(@password, false, act_like_restful_authentication? ? :restful_authentication : nil)))
-            @password_changed = true
-            after_password_set
-          end
-        
-          # Accepts a raw password to determine if it is the correct password or not. Notice the second argument. That defaults to the value of
-          # check_passwords_against_database. See that method for mor information, but basically it just tells Authlogic to check the password
-          # against the value in the database or the value in the object.
-          def valid_password?(attempted_password, check_against_database = check_passwords_against_database?)
-            crypted = check_against_database && send("#{crypted_password_field}_changed?") ? send("#{crypted_password_field}_was") : send(crypted_password_field)
-            return false if attempted_password.blank? || crypted.blank?
-            before_password_verification
-          
-            crypto_providers.each_with_index do |encryptor, index|
-              # The arguments_type of for the transitioning from restful_authentication
-              arguments_type = (act_like_restful_authentication? && index == 0) ||
-                (transition_from_restful_authentication? && index > 0 && encryptor == Authlogic::CryptoProviders::Sha1) ?
-                :restful_authentication : nil
-            
-              if encryptor.matches?(crypted, *encrypt_arguments(attempted_password, check_against_database, arguments_type))
-                transition_password(attempted_password) if transition_password?(index, encryptor, crypted, check_against_database)
-                after_password_verification
-                return true
-              end
-            end
-          
-            false
-          end
-        
-          # Resets the password to a random friendly token.
-          def reset_password
-            friendly_token = Authlogic::Random.friendly_token
-            self.password = friendly_token
-            self.password_confirmation = friendly_token
-          end
-          alias_method :randomize_password, :reset_password
-        
-          # Resets the password to a random friendly token and then saves the record.
-          def reset_password!
-            reset_password
-            save_without_session_maintenance(false)
-          end
-          alias_method :randomize_password!, :reset_password!
-        
-          private
-            def check_passwords_against_database?
-              self.class.check_passwords_against_database == true
-            end
-            
-            def crypto_providers
-              [crypto_provider] + transition_from_crypto_providers
-            end
-            
-            def encrypt_arguments(raw_password, check_against_database, arguments_type = nil)
-              salt = nil
-              salt = (check_against_database && send("#{password_salt_field}_changed?") ? send("#{password_salt_field}_was") : send(password_salt_field)) if password_salt_field
-              
-              case arguments_type
-              when :restful_authentication
-                [REST_AUTH_SITE_KEY, salt, raw_password, REST_AUTH_SITE_KEY].compact
-              else
-                [raw_password, salt].compact
-              end
-            end
-            
-            # Determines if we need to tranisiton the password.
-            # If the index > 0 then we are using an "transition from" crypto provider.
-            # If the encryptor has a cost and the cost it outdated.
-            # If we aren't using database values
-            # If we are using database values, only if the password hasnt change so we don't overwrite any changes
-            def transition_password?(index, encryptor, crypted, check_against_database)
-              (index > 0 || (encryptor.respond_to?(:cost_matches?) && !encryptor.cost_matches?(send(crypted_password_field)))) &&
-                (!check_against_database || !send("#{crypted_password_field}_changed?"))
-            end
-            
-            def transition_password(attempted_password)
-              self.password = attempted_password
-              save(false)
-            end
-          
-            def require_password?
-              new_record? || password_changed? || send(crypted_password_field).blank?
-            end
-          
-            def ignore_blank_passwords?
-              self.class.ignore_blank_passwords == true
-            end
-          
-            def password_changed?
-              @password_changed == true
-            end
-            
-            def reset_password_changed
-              @password_changed = nil
-            end
-          
-            def crypted_password_field
-              self.class.crypted_password_field
-            end
-          
-            def password_salt_field
-              self.class.password_salt_field
-            end
-          
-            def crypto_provider
-              self.class.crypto_provider
-            end
-          
-            def transition_from_crypto_providers
-              self.class.transition_from_crypto_providers
-            end
-        end
-      end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/acts_as_authentic/perishable_token.rb

@@ -1,105 +0,0 @@
-module Authlogic
-  module ActsAsAuthentic
-    # This provides a handy token that is "perishable". Meaning the token is only good for a certain amount of time. This is perfect for
-    # resetting password, confirming accounts, etc. Typically during these actions you send them this token in via their email. Once they
-    # use the token and do what they need to do, that token should expire. Don't worry about maintaining this, changing it, or expiring it
-    # yourself. Authlogic does all of this for you. See the sub modules for all of the tools Authlogic provides to you.
-    module PerishableToken
-      def self.included(klass)
-        klass.class_eval do
-          extend Config
-          add_acts_as_authentic_module(Methods)
-        end
-      end
-      
-      # Change how the perishable token works.
-      module Config
-        # When using the find_using_perishable_token method the token can expire. If the token is expired, no
-        # record will be returned. Use this option to specify how long the token is valid for.
-        #
-        # * <tt>Default:</tt> 10.minutes
-        # * <tt>Accepts:</tt> Fixnum
-        def perishable_token_valid_for(value = nil)
-          rw_config(:perishable_token_valid_for, (!value.nil? && value.to_i) || value, 10.minutes.to_i)
-        end
-        alias_method :perishable_token_valid_for=, :perishable_token_valid_for
-        
-        # Authlogic tries to expire and change the perishable token as much as possible, without comprising
-        # it's purpose. This is for security reasons. If you want to manage it yourself, you can stop
-        # Authlogic from getting your in way by setting this to true.
-        #
-        # * <tt>Default:</tt> false
-        # * <tt>Accepts:</tt> Boolean
-        def disable_perishable_token_maintenance(value = nil)
-          rw_config(:disable_perishable_token_maintenance, value, false)
-        end
-        alias_method :disable_perishable_token_maintenance=, :disable_perishable_token_maintenance
-      end
-      
-      # All methods relating to the perishable token.
-      module Methods
-        def self.included(klass)
-          return if !klass.column_names.include?("perishable_token")
-          
-          klass.class_eval do
-            extend ClassMethods
-            include InstanceMethods
-            
-            validates_uniqueness_of :perishable_token, :if => :perishable_token_changed?
-            before_save :reset_perishable_token, :unless => :disable_perishable_token_maintenance?
-          end
-        end
-        
-        # Class level methods for the perishable token
-        module ClassMethods
-          # Use this methdo to find a record with a perishable token. This method does 2 things for you:
-          #
-          # 1. It ignores blank tokens
-          # 2. It enforces the perishable_token_valid_for configuration option.
-          #
-          # If you want to use a different timeout value, just pass it as the second parameter:
-          #
-          #   User.find_using_perishable_token(token, 1.hour)
-          def find_using_perishable_token(token, age = self.perishable_token_valid_for)
-            return if token.blank?
-            age = age.to_i
-            
-            conditions_sql = "perishable_token = ?"
-            conditions_subs = [token]
-            
-            if column_names.include?("updated_at") && age > 0
-              conditions_sql += " and updated_at > ?"
-              conditions_subs << age.seconds.ago
-            end
-            
-            find(:first, :conditions => [conditions_sql, *conditions_subs])
-          end
-          
-          # This method will raise ActiveRecord::NotFound if no record is found.
-          def find_using_perishable_token!(token, age = perishable_token_valid_for)
-            find_using_perishable_token(token, age) || raise(ActiveRecord::RecordNotFound)
-          end
-        end
-        
-        # Instance level methods for the perishable token.
-        module InstanceMethods
-          # Resets the perishable token to a random friendly token.
-          def reset_perishable_token
-            self.perishable_token = Random.friendly_token
-          end
-          
-          # Same as reset_perishable_token, but then saves the record afterwards.
-          def reset_perishable_token!
-            reset_perishable_token
-            save_without_session_maintenance(false)
-          end
-          
-          # A convenience method based on the disable_perishable_token_maintenance configuration option.
-          def disable_perishable_token_maintenance?
-            self.class.disable_perishable_token_maintenance == true
-          end
-        end
-      end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/acts_as_authentic/persistence_token.rb

@@ -1,68 +0,0 @@
-module Authlogic
-  module ActsAsAuthentic
-    # Maintains the persistence token, the token responsible for persisting sessions. This token
-    # gets stores in the session and the cookie.
-    module PersistenceToken
-      def self.included(klass)
-        klass.class_eval do
-          add_acts_as_authentic_module(Methods)
-        end
-      end
-      
-      # Methods for the persistence token.
-      module Methods
-        def self.included(klass)
-          klass.class_eval do
-            extend ClassMethods
-            include InstanceMethods
-            
-            if respond_to?(:after_password_set) && respond_to?(:after_password_verification)
-              after_password_set :reset_persistence_token
-              after_password_verification :reset_persistence_token!, :if => :reset_persistence_token?
-            end
-            
-            validates_presence_of :persistence_token
-            validates_uniqueness_of :persistence_token, :if => :persistence_token_changed?
-            
-            before_validation :reset_persistence_token, :if => :reset_persistence_token?
-          end
-        end
-        
-        # Class level methods for the persistence token.
-        module ClassMethods
-          # Resets ALL persistence tokens in the database, which will require all users to reauthenticate.
-          def forget_all
-            # Paginate these to save on memory
-            records = nil
-            i = 0
-            begin
-              records = find(:all, :limit => 50, :offset => i)
-              records.each { |record| record.forget! }
-              i += 50
-            end while !records.blank?
-          end
-        end
-        
-        # Instance level methods for the persistence token.
-        module InstanceMethods
-          # Resets the persistence_token field to a random hex value.
-          def reset_persistence_token
-            self.persistence_token = Authlogic::Random.hex_token
-          end
-          
-          # Same as reset_persistence_token, but then saves the record.
-          def reset_persistence_token!
-            reset_persistence_token
-            save_without_session_maintenance(false)
-          end
-          alias_method :forget!, :reset_persistence_token!
-          
-          private
-            def reset_persistence_token?
-              persistence_token.blank?
-            end
-        end
-      end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/acts_as_authentic/restful_authentication.rb

@@ -1,61 +0,0 @@
-module Authlogic
-  module ActsAsAuthentic
-    # This module is responsible for transitioning existing applications from the restful_authentication plugin.
-    module RestfulAuthentication
-      def self.included(klass)
-        klass.class_eval do
-          extend Config
-          include InstanceMethods
-        end
-      end
-      
-      module Config
-        # Switching an existing app to Authlogic from restful_authentication? No problem, just set this true and your users won't know
-        # anything changed. From your database perspective nothing will change at all. Authlogic will continue to encrypt passwords
-        # just like restful_authentication, so your app won't skip a beat. Although, might consider transitioning your users to a newer
-        # and stronger algorithm. Checkout the transition_from_restful_authentication option.
-        #
-        # * <tt>Default:</tt> false
-        # * <tt>Accepts:</tt> Boolean
-        def act_like_restful_authentication(value = nil)
-          r = rw_config(:act_like_restful_authentication, value, false)
-          set_restful_authentication_config if value
-          r
-        end
-        alias_method :act_like_restful_authentication=, :act_like_restful_authentication
-        
-        # This works just like act_like_restful_authentication except that it will start transitioning your users to the algorithm you
-        # specify with the crypto provider option. The next time they log in it will resave their password with the new algorithm
-        # and any new record will use the new algorithm as well. Make sure to update your users table if you are using the default
-        # migration since it will set crypted_password and salt columns to a maximum width of 40 characters which is not enough. 
-        def transition_from_restful_authentication(value = nil)
-          r = rw_config(:transition_from_restful_authentication, value, false)
-          set_restful_authentication_config if value
-          r
-        end
-        alias_method :transition_from_restful_authentication=, :transition_from_restful_authentication
-        
-        private
-          def set_restful_authentication_config
-            crypto_provider_key = act_like_restful_authentication ? :crypto_provider : :transition_from_crypto_providers
-            self.send("#{crypto_provider_key}=", CryptoProviders::Sha1)
-            if !defined?(::REST_AUTH_SITE_KEY) || ::REST_AUTH_SITE_KEY.nil?
-              class_eval("::REST_AUTH_SITE_KEY = ''") if !defined?(::REST_AUTH_SITE_KEY)
-              CryptoProviders::Sha1.stretches = 1
-            end
-          end
-      end
-      
-      module InstanceMethods
-        private
-          def act_like_restful_authentication?
-            self.class.act_like_restful_authentication == true
-          end
-          
-          def transition_from_restful_authentication?
-            self.class.transition_from_restful_authentication == true
-          end
-      end
-    end
-  end
-end