lockbox_middleware 1.2.1 → 1.2.2

data/vendor/gems/authlogic-2.1.3/lib/authlogic/acts_as_authentic/session_maintenance.rb

@@ -1,139 +0,0 @@
-module Authlogic
-  module ActsAsAuthentic
-    # This is one of my favorite features that I think is pretty cool. It's things like this that make a library great
-    # and let you know you are on the right track.
-    #
-    # Just to clear up any confusion, Authlogic stores both the record id and the persistence token in the session.
-    # Why? So stale sessions can not be persisted. It stores the id so it can quickly find the record, and the
-    # persistence token to ensure no sessions are stale. So if the persistence token changes, the user must log
-    # back in.
-    #
-    # Well, the persistence token changes with the password. What happens if the user changes his own password?
-    # He shouldn't have to log back in, he's the one that made the change.
-    #
-    # That being said, wouldn't it be nice if their session and cookie information was automatically updated?
-    # Instead of cluttering up your controller with redundant session code. The same thing goes for new
-    # registrations.
-    #
-    # That's what this module is all about. This will automatically maintain the cookie and session values as
-    # records are saved.
-    module SessionMaintenance
-      def self.included(klass)
-        klass.class_eval do
-          extend Config
-          add_acts_as_authentic_module(Methods)
-        end
-      end
-      
-      module Config
-        # This is more of a convenience method. In order to turn off automatic maintenance of sessions just
-        # set this to false, or you can also set the session_ids method to a blank array. Both accomplish
-        # the same thing. This method is a little clearer in it's intentions though.
-        #
-        # * <tt>Default:</tt> true
-        # * <tt>Accepts:</tt> Boolean
-        def maintain_sessions(value = nil)
-          rw_config(:maintain_sessions, value, true)
-        end
-        alias_method :maintain_sessions=, :maintain_sessions
-        
-        # As you may know, authlogic sessions can be separate by id (See Authlogic::Session::Base#id). You can
-        # specify here what session ids you want auto maintained. By default it is the main session, which has
-        # an id of nil.
-        #
-        # * <tt>Default:</tt> [nil]
-        # * <tt>Accepts:</tt> Array
-        def session_ids(value = nil)
-          rw_config(:session_ids, value, [nil])
-        end
-        alias_method :session_ids=, :session_ids
-        
-        # The name of the associated session class. This is inferred by the name of the model.
-        #
-        # * <tt>Default:</tt> "#{klass.name}Session".constantize
-        # * <tt>Accepts:</tt> Class
-        def session_class(value = nil)
-          const = "#{base_class.name}Session".constantize rescue nil
-          rw_config(:session_class, value, const)
-        end
-        alias_method :session_class=, :session_class
-      end
-      
-      module Methods
-        def self.included(klass)
-          klass.class_eval do
-            before_save :get_session_information, :if => :update_sessions?
-            before_save :maintain_sessions, :if => :update_sessions?
-          end
-        end
-        
-        # Save the record and skip session maintenance all together.
-        def save_without_session_maintenance(*args)
-          self.skip_session_maintenance = true
-          result = save(*args)
-          self.skip_session_maintenance = false
-          result
-        end
-        
-        private
-          def skip_session_maintenance=(value)
-            @skip_session_maintenance = value
-          end
-          
-          def skip_session_maintenance
-            @skip_session_maintenance ||= false
-          end
-          
-          def update_sessions?
-            !skip_session_maintenance && session_class && session_class.activated? && self.class.maintain_sessions == true && !session_ids.blank? && persistence_token_changed?
-          end
-          
-          def get_session_information
-            # Need to determine if we are completely logged out, or logged in as another user
-            @_sessions = []
-            
-            session_ids.each do |session_id|
-              session = session_class.find(session_id, self)
-              @_sessions << session if session && session.record
-            end
-          end
-          
-          def maintain_sessions
-            if @_sessions.empty?
-              create_session
-            else
-              update_sessions
-            end
-          end
-          
-          def create_session
-            # We only want to automatically login into the first session, since this is the main session. The other sessions are sessions
-            # that need to be created after logging into the main session.
-            session_id = session_ids.first
-            session_class.create(*[self, self, session_id].compact)
-
-            return true
-          end
-          
-          def update_sessions
-            # We found sessions above, let's update them with the new info
-            @_sessions.each do |stale_session|
-              next if stale_session.record != self
-              stale_session.unauthorized_record = self
-              stale_session.save
-            end
-
-            return true
-          end
-          
-          def session_ids
-            self.class.session_ids
-          end
-          
-          def session_class
-            self.class.session_class
-          end
-      end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/acts_as_authentic/single_access_token.rb

@@ -1,65 +0,0 @@
-module Authlogic
-  module ActsAsAuthentic
-    # This module is responsible for maintaining the single_access token. For more information the single access token and how to use it,
-    # see the Authlogic::Session::Params module.
-    module SingleAccessToken
-      def self.included(klass)
-        klass.class_eval do
-          extend Config
-          add_acts_as_authentic_module(Methods)
-        end
-      end
-      
-      # All configuration for the single_access token aspect of acts_as_authentic.
-      module Config
-        # The single access token is used for authentication via URLs, such as a private feed. That being said,
-        # if the user changes their password, that token probably shouldn't change. If it did, the user would have
-        # to update all of their URLs. So be default this is option is disabled, if you need it, feel free to turn
-        # it on.
-        #
-        # * <tt>Default:</tt> false
-        # * <tt>Accepts:</tt> Boolean
-        def change_single_access_token_with_password(value = nil)
-          rw_config(:change_single_access_token_with_password, value, false)
-        end
-        alias_method :change_single_access_token_with_password=, :change_single_access_token_with_password
-      end
-      
-      # All method, for the single_access token aspect of acts_as_authentic.
-      module Methods
-        def self.included(klass)
-          return if !klass.column_names.include?("single_access_token")
-          
-          klass.class_eval do
-            include InstanceMethods
-            validates_uniqueness_of :single_access_token, :if => :single_access_token_changed?
-            before_validation :reset_single_access_token, :if => :reset_single_access_token?
-            after_password_set(:reset_single_access_token, :if => :change_single_access_token_with_password?) if respond_to?(:after_password_set)
-          end
-        end
-        
-        module InstanceMethods
-          # Resets the single_access_token to a random friendly token.
-          def reset_single_access_token
-            self.single_access_token = Authlogic::Random.friendly_token
-          end
-        
-          # same as reset_single_access_token, but then saves the record.
-          def reset_single_access_token!
-            reset_single_access_token
-            save_without_session_maintenance
-          end
-      
-          protected
-            def reset_single_access_token?
-              single_access_token.blank?
-            end
-          
-            def change_single_access_token_with_password?
-              self.class.change_single_access_token_with_password == true
-            end
-        end
-      end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/acts_as_authentic/validations_scope.rb

@@ -1,32 +0,0 @@
-module Authlogic
-  module ActsAsAuthentic
-    # Allows you to scope everything to specific fields.
-    # See the Config submodule for more info.
-    # For information on how to scope off of a parent object see Authlogic::AuthenticatesMany
-    module ValidationsScope
-      def self.included(klass)
-        klass.class_eval do
-          extend Config
-        end
-      end
-      
-      # All configuration for the scope feature.
-      module Config
-        # Allows you to scope everything to specific field(s). Works just like validates_uniqueness_of.
-        # For example, let's say a user belongs to a company, and you want to scope everything to the
-        # company:
-        #
-        #   acts_as_authentic do |c|
-        #     c.validations_scope = :company_id
-        #   end
-        #
-        # * <tt>Default:</tt> nil
-        # * <tt>Accepts:</tt> Symbol or Array of symbols
-        def validations_scope(value = nil)
-          rw_config(:validations_scope, value)
-        end
-        alias_method :validations_scope=, :validations_scope
-      end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/authenticates_many/association.rb

@@ -1,42 +0,0 @@
-module Authlogic
-  module AuthenticatesMany
-    # An object of this class is used as a proxy for the authenticates_many relationship. It basically allows you to "save" scope details
-    # and call them on an object, which allows you to do the following:
-    #
-    #   @account.user_sessions.new
-    #   @account.user_sessions.find
-    #   # ... etc
-    #
-    # You can call all of the class level methods off of an object with a saved scope, so that calling the above methods scopes the user
-    # sessions down to that specific account. To implement this via ActiveRecord do something like:
-    #
-    #   class User < ActiveRecord::Base
-    #     authenticates_many :user_sessions
-    #   end
-    class Association
-      attr_accessor :klass, :find_options, :id
-      
-      def initialize(klass, find_options, id)
-        self.klass = klass
-        self.find_options = find_options
-        self.id = id
-      end
-      
-      [:create, :create!, :find, :new].each do |method|
-        class_eval <<-"end_eval", __FILE__, __LINE__
-          def #{method}(*args)
-            klass.with_scope(scope_options) do
-              klass.#{method}(*args)
-            end
-          end
-        end_eval
-      end
-      alias_method :build, :new
-    
-      private
-        def scope_options
-          {:find_options => find_options, :id => id}
-        end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/authenticates_many/base.rb

@@ -1,55 +0,0 @@
-module Authlogic
-  # This allows you to scope your authentication. For example, let's say all users belong to an account, you want to make sure only users
-  # that belong to that account can actually login into that account. Simple, just do:
-  #
-  #   class Account < ActiveRecord::Base
-  #     authenticates_many :user_sessions
-  #   end
-  #
-  # Now you can scope sessions just like everything else in ActiveRecord:
-  #
-  #   @account.user_sessions.new(*args)
-  #   @account.user_sessions.create(*args)
-  #   @account.user_sessions.find(*args)
-  #   # ... etc
-  #
-  # Checkout the authenticates_many method for a list of options.
-  # You may also want to checkout Authlogic::ActsAsAuthentic::Scope to scope your model.
-  module AuthenticatesMany
-    module Base
-      # Allows you set essentially set up a relationship with your sessions. See module definition above for more details.
-      #
-      # === Options
-      #
-      # * <tt>session_class:</tt> default: "#{name}Session",
-      #   This is the related session class.
-      #   
-      # * <tt>relationship_name:</tt> default: options[:session_class].klass_name.underscore.pluralize,
-      #   This is the name of the relationship you want to use to scope everything. For example an Account has many Users. There should be a relationship
-      #   called :users that you defined with a has_many. The reason we use the relationship is so you don't have to repeat yourself. The relatonship
-      #   could have all kinds of custom options. So instead of repeating yourself we essentially use the scope that the relationship creates.
-      #
-      # * <tt>find_options:</tt> default: nil,
-      #   By default the find options are created from the relationship you specify with :relationship_name. But if you want to override this and
-      #   manually specify find_options you can do it here. Specify options just as you would in ActiveRecord::Base.find.
-      #
-      # * <tt>scope_cookies:</tt> default: false
-      #   By the nature of cookies they scope theirself if you are using subdomains to access accounts. If you aren't using subdomains you need to have
-      #   separate cookies for each account, assuming a user is logging into mroe than one account. Authlogic can take care of this for you by
-      #   prefixing the name of the cookie and sessin with the model id. You just need to tell Authlogic to do this by passing this option.
-      def authenticates_many(name, options = {})
-        options[:session_class] ||= name.to_s.classify.constantize
-        options[:relationship_name] ||= options[:session_class].klass_name.underscore.pluralize
-        class_eval <<-"end_eval", __FILE__, __LINE__
-          def #{name}
-            find_options = #{options[:find_options].inspect} || #{options[:relationship_name]}.scope(:find)
-            find_options.delete_if { |key, value| ![:conditions, :include, :joins].include?(key.to_sym) || value.nil? }
-            @#{name} ||= Authlogic::AuthenticatesMany::Association.new(#{options[:session_class]}, find_options, #{options[:scope_cookies] ? "self.class.model_name.underscore + '_' + self.send(self.class.primary_key).to_s" : "nil"})
-          end
-        end_eval
-      end
-    end
-    
-    ::ActiveRecord::Base.extend(Base) if defined?(::ActiveRecord)
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/controller_adapters/abstract_adapter.rb

@@ -1,67 +0,0 @@
-module Authlogic
-  module ControllerAdapters # :nodoc:
-    # Allows you to use Authlogic in any framework you want, not just rails. See the RailsAdapter or MerbAdapter
-    # for an example of how to adapt Authlogic to work with your framework.
-    class AbstractAdapter
-      attr_accessor :controller
-
-      def initialize(controller)
-        self.controller = controller
-      end
-      
-      def authenticate_with_http_basic(&block)
-        @auth = Rack::Auth::Basic::Request.new(controller.request.env)
-        if @auth.provided? and @auth.basic?
-          block.call(*@auth.credentials)
-        else
-          false
-        end
-      end
-      
-      def cookies
-        controller.cookies
-      end
-      
-      def cookie_domain
-        raise NotImplementedError.new("The cookie_domain method has not been implemented by the controller adapter")
-      end
-
-      def params
-        controller.params
-      end
-
-      def request
-        controller.request
-      end
-
-      def request_content_type
-        request.content_type
-      end
-
-      def session
-        controller.session
-      end
-      
-      def responds_to_single_access_allowed?
-        controller.respond_to?(:single_access_allowed?, true)
-      end
-      
-      def single_access_allowed?
-        controller.send(:single_access_allowed?)
-      end
-      
-      def responds_to_last_request_update_allowed?
-        controller.respond_to?(:last_request_update_allowed?, true)
-      end
-      
-      def last_request_update_allowed?
-        controller.send(:last_request_update_allowed?)
-      end
-      
-      private
-        def method_missing(id, *args, &block)
-          controller.send(id, *args, &block)
-        end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/controller_adapters/merb_adapter.rb

@@ -1,30 +0,0 @@
-module Authlogic
-  module ControllerAdapters
-    # Adapts authlogic to work with merb. The point is to close the gap between what authlogic expects and what the merb controller object
-    # provides. Similar to how ActiveRecord has an adapter for MySQL, PostgreSQL, SQLite, etc.
-    class MerbAdapter < AbstractAdapter
-      # Lets Authlogic know about the controller object via a before filter, AKA "activates" authlogic.
-      module MerbImplementation
-        def self.included(klass) # :nodoc:
-          klass.before :activate_authlogic
-        end
-        
-        def cookie_domain
-          Merb::Config[:session_cookie_domain]
-        end
-
-        private
-          def activate_authlogic
-            Authlogic::Session::Base.controller = MerbAdapter.new(self)
-          end
-      end
-    end
-  end
-end
- 
-# make sure we're running inside Merb
-if defined?(Merb::Plugins)
-  Merb::BootLoader.before_app_loads do
-    Merb::Controller.send(:include, Authlogic::ControllerAdapters::MerbAdapter::MerbImplementation)
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/controller_adapters/rails_adapter.rb

@@ -1,48 +0,0 @@
-module Authlogic
-  module ControllerAdapters
-    # Adapts authlogic to work with rails. The point is to close the gap between what authlogic expects and what the rails controller object
-    # provides. Similar to how ActiveRecord has an adapter for MySQL, PostgreSQL, SQLite, etc.
-    class RailsAdapter < AbstractAdapter
-      class AuthlogicLoadedTooLateError < StandardError; end
-      
-      def authenticate_with_http_basic(&block)
-        controller.authenticate_with_http_basic(&block)
-      end
-      
-      def cookies
-        controller.send(:cookies)
-      end
-      
-      def cookie_domain
-        @cookie_domain_key ||= Rails::VERSION::STRING >= '2.3' ? :domain : :session_domain
-        ActionController::Base.session_options[@cookie_domain_key]
-      end
-      
-      def request_content_type
-        request.format.to_s
-      end
-      
-      # Lets Authlogic know about the controller object via a before filter, AKA "activates" authlogic.
-      module RailsImplementation
-        def self.included(klass) # :nodoc:
-          if defined?(::ApplicationController)
-            raise AuthlogicLoadedTooLateError.new("Authlogic is trying to prepend a before_filter in ActionController::Base to active itself" +
-              ", the problem is that ApplicationController has already been loaded meaning the before_filter won't get copied into your" +
-              " application. Generally this is due to another gem or plugin requiring your ApplicationController prematurely, such as" +
-              " the resource_controller plugin. The solution is to require Authlogic before these other gems / plugins. Please require" +
-              " authlogic first to get rid of this error.")
-          end
-          
-          klass.prepend_before_filter :activate_authlogic
-        end
-        
-        private
-          def activate_authlogic
-            Authlogic::Session::Base.controller = RailsAdapter.new(self)
-          end
-      end
-    end
-  end
-end
-
-ActionController::Base.send(:include, Authlogic::ControllerAdapters::RailsAdapter::RailsImplementation)

data/vendor/gems/authlogic-2.1.3/lib/authlogic/controller_adapters/sinatra_adapter.rb

@@ -1,61 +0,0 @@
-# Authlogic bridge for Sinatra
-module Authlogic
-  module ControllerAdapters
-    module SinatraAdapter
-      class Cookies
-        attr_reader :request, :response
-
-        def initialize(request, response)
-          @request = request
-          @response = response
-        end
-
-        def delete(key, options = {})
-          @request.cookies.delete(key)
-        end
-
-        def []=(key, options)
-          @response.set_cookie(key, options)
-        end
-
-        def method_missing(meth, *args, &block)
-          @request.cookies.send(meth, *args, &block)
-        end
-      end
-
-      class Controller
-        attr_reader :request, :response, :cookies
-
-        def initialize(request, response)
-          @request = request
-          @cookies = Cookies.new(request, response)
-        end
-
-        def session
-          env['rack.session']
-        end
-
-        def method_missing(meth, *args, &block)
-          @request.send meth, *args, &block
-        end
-      end
-
-      class Adapter < AbstractAdapter
-        def cookie_domain
-          env['SERVER_NAME']
-        end
-
-        module Implementation
-          def self.included(klass)
-            klass.send :before do
-              controller = Controller.new(request, response)
-              Authlogic::Session::Base.controller = Adapter.new(controller)
-            end
-          end
-        end
-      end
-    end
-  end
-end
-
-Sinatra::Request.send(:include, Authlogic::ControllerAdapters::SinatraAdapter::Adapter::Implementation)

data/vendor/gems/authlogic-2.1.3/lib/authlogic/crypto_providers/aes256.rb

@@ -1,43 +0,0 @@
-require "openssl"
-
-module Authlogic
-  module CryptoProviders
-    # This encryption method is reversible if you have the supplied key. So in order to use this encryption method you must supply it with a key first.
-    # In an initializer, or before your application initializes, you should do the following:
-    #
-    #   Authlogic::CryptoProviders::AES256.key = "my really long and unique key, preferrably a bunch of random characters"
-    #
-    # My final comment is that this is a strong encryption method, but its main weakness is that its reversible. If you do not need to reverse the hash
-    # then you should consider Sha512 or BCrypt instead.
-    #
-    # Keep your key in a safe place, some even say the key should be stored on a separate server.
-    # This won't hurt performance because the only time it will try and access the key on the separate server is during initialization, which only
-    # happens once. The reasoning behind this is if someone does compromise your server they won't have the key also. Basically, you don't want to
-    # store the key with the lock.
-    class AES256
-      class << self
-        attr_writer :key
-    
-        def encrypt(*tokens)
-          aes.encrypt
-          aes.key = @key
-          [aes.update(tokens.join) + aes.final].pack("m").chomp
-        end
-    
-        def matches?(crypted, *tokens)
-          aes.decrypt
-          aes.key = @key
-          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
-        rescue OpenSSL::CipherError
-          false
-        end
-    
-        private
-          def aes
-            raise ArgumentError.new("You must provide a key like #{name}.key = my_key before using the #{name}") if @key.blank?
-            @aes ||= OpenSSL::Cipher::Cipher.new("AES-256-ECB")
-          end
-      end
-    end
-  end
-end

data/vendor/gems/authlogic-2.1.3/lib/authlogic/crypto_providers/bcrypt.rb

@@ -1,90 +0,0 @@
-begin
-  require "bcrypt"
-rescue LoadError
-  "sudo gem install bcrypt-ruby"
-end
-
-module Authlogic
-  module CryptoProviders
-    # For most apps Sha512 is plenty secure, but if you are building an app that stores nuclear launch codes you might want to consier BCrypt. This is an extremely
-    # secure hashing algorithm, mainly because it is slow. A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a
-    # password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this, generating a password takes exponentially longer than any
-    # of the Sha algorithms. I did some benchmarking to save you some time with your decision:
-    #
-    #   require "bcrypt"
-    #   require "digest"
-    #   require "benchmark"
-    #
-    #   Benchmark.bm(18) do |x|
-    #     x.report("BCrypt (cost = 10:") { 100.times { BCrypt::Password.create("mypass", :cost => 10) } }
-    #     x.report("BCrypt (cost = 2:") { 100.times { BCrypt::Password.create("mypass", :cost => 2) } }
-    #     x.report("Sha512:") { 100.times { Digest::SHA512.hexdigest("mypass") } }
-    #     x.report("Sha1:") { 100.times { Digest::SHA1.hexdigest("mypass") } }
-    #   end
-    #
-    #                           user     system      total        real
-    #   BCrypt (cost = 10): 10.780000   0.060000  10.840000 ( 11.100289)
-    #   BCrypt (cost = 2):  0.180000   0.000000   0.180000 (  0.181914)
-    #   Sha512:             0.000000   0.000000   0.000000 (  0.000829)
-    #   Sha1:               0.000000   0.000000   0.000000 (  0.000395)
-    #
-    # You can play around with the cost to get that perfect balance between performance and security.
-    #
-    # Decided BCrypt is for you? Just insall the bcrypt gem:
-    #
-    #   gem install bcrypt-ruby
-    #
-    # Tell acts_as_authentic to use it:
-    #
-    #   acts_as_authentic do |c|
-    #     c.crypto_provider = Authlogic::CryptoProviders::BCrypt
-    #   end
-    #
-    # You are good to go!
-    class BCrypt
-      class << self
-        # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
-        # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
-        def cost
-          @cost ||= 10
-        end
-        attr_writer :cost
-        
-        # Creates a BCrypt hash for the password passed.
-        def encrypt(*tokens)
-          ::BCrypt::Password.create(join_tokens(tokens), :cost => cost)
-        end
-        
-        # Does the hash match the tokens? Uses the same tokens that were used to encrypt.
-        def matches?(hash, *tokens)
-          hash = new_from_hash(hash)
-          return false if hash.blank?
-          hash == join_tokens(tokens)
-        end
-        
-        # This method is used as a flag to tell Authlogic to "resave" the password upon a successful login, using the new cost
-        def cost_matches?(hash)
-          hash = new_from_hash(hash)
-          if hash.blank?
-            false
-          else
-            hash.cost == cost
-          end
-        end
-        
-        private
-          def join_tokens(tokens)
-            tokens.flatten.join
-          end
-          
-          def new_from_hash(hash)
-            begin
-              ::BCrypt::Password.new(hash)
-            rescue ::BCrypt::Errors::InvalidHash
-              return nil
-            end
-          end
-      end
-    end
-  end
-end