lockbox_middleware 1.2.0 → 1.2.1

data/.gitignore

@@ -0,0 +1,15 @@
+.DS_*
+.idea/
+log/*
+tmp/*
+db/*sqlite3
+db/development_structure.*
+db/schema.*
+config/database.yml
+config/lockbox.yml
+test/tmp
+*.gemspec
+*.gem
+pkg/
+.rvmrc
+.bundle/

data/Capfile

@@ -0,0 +1,4 @@
+load 'deploy' if respond_to?(:namespace) # cap2 differentiator
+Dir['vendor/plugins/*/recipes/*.rb'].each { |plugin| load(plugin) }
+
+load 'config/deploy' # remove this line to skip loading any of the default tasks

data/Gemfile

@@ -0,0 +1,11 @@
+source "http://rubygems.org"
+
+gem "rack", "1.1.0"
+gem "auth-hmac"
+gem "httparty"
+
+group :test do
+  gem "rack-test"
+  gem "rspec"
+  gem "jferris-mocha"
+end

data/Rakefile

@@ -0,0 +1,12 @@
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require(File.join(File.dirname(__FILE__), 'config', 'boot'))
+
+require 'rake'
+require 'rake/testtask'
+require 'rake/rdoctask'
+
+require 'tasks/rails'
+
+task :default => :spec

data/VERSION

@@ -0,0 +1 @@
+1.2.1

data/app/controllers/admin/partners_controller.rb

@@ -0,0 +1,14 @@
+class Admin::PartnersController < AdminController
+
+  active_scaffold :partner do |config|
+    config.label = "API Partners"
+    update.columns.exclude [:password, :password_confirmation]
+    list.columns = [:id, :email, :name, :organization, :phone_number, :api_key, :max_requests]
+    create.columns = [:email, :name, :organization, :phone_number, :max_requests, :password, :password_confirmation]
+    list.sorting = {:id => 'DESC'}
+    update.columns.exclude :api_key
+    search.columns = [:email, :name, :organization, :api_key]
+    columns[:max_requests].label = "Requests per Hour"
+  end
+
+end

data/app/controllers/admin_controller.rb

@@ -0,0 +1,8 @@
+class AdminController < ApplicationController
+  include AdminAuthentication
+  layout "admin"
+  
+  skip_before_filter :require_user
+  before_filter :authenticate
+  
+end

data/app/controllers/application_controller.rb

@@ -0,0 +1,32 @@
+# Filters added to this controller apply to all controllers in the application.
+# Likewise, all the methods added will be available for all controllers.
+
+class ApplicationController < ActionController::Base
+  include Authentication
+  include ExceptionNotifiable
+  helper :all # include all helpers, all the time
+  protect_from_forgery # See ActionController::RequestForgeryProtection for details
+
+  ActiveScaffold.set_defaults do |config| 
+    config.ignore_columns.add [:created_at, :updated_at]
+  end
+
+  # Scrub sensitive parameters from your log
+  # filter_parameter_logging :password
+  def render_jsonp(json, options={})
+    callback, variable = params[:callback], params[:variable]
+    response = begin
+      if callback && variable
+        "var #{variable} = #{json};\n#{callback}(#{variable});"
+      elsif variable
+        "var #{variable} = #{json};"
+      elsif callback
+        "#{callback}(#{json});"
+      else
+        json
+      end
+    end
+    render({:text => response}.merge(options))
+  end
+  
+end

data/app/controllers/authentication_controller.rb

@@ -0,0 +1,58 @@
+class AuthenticationController < ApplicationController
+  skip_before_filter :require_user
+
+  # class HmacRequest
+  #     attr_accessor :env
+  #     def initialize
+  #       @env = {}
+  #     end
+  #     undef :method
+  #   end
+
+  def show
+    if params[:id] == 'hmac'
+      hmac_request = HmacRequest.new
+      hmac_request.env = request.headers
+      {'Content-Type' => 'Content-Type', 'Content-MD5' => 'Content-MD5', 'Date' => 'HTTP_DATE', 'Method' => 'REQUEST_METHOD', 'Authorization' => 'HTTP_AUTHORIZATION'}.each_pair do |h,e|
+        hmac_request.env[e] = hmac_request.env["X-Referer-#{h}"] unless hmac_request.env["X-Referer-#{h}"].blank?
+      end
+      key = hmac_auth(hmac_request)
+    else
+      key = params[:id]
+    end
+
+    @partner = Partner.authenticate(key)
+
+    if @partner.authorized
+      if @partner.max_requests.nil?
+        expires_in @partner.max_response_cache_time, :public => true, 'must-revalidate' => true
+      else
+        response.headers["Cache-Control"] = "public, no-cache"
+      end
+      # can't use head() here because it stupidly alters the camelCase of these header names
+      headers.merge!({'X-RateLimit-Limit' => @partner.max_requests.to_s,
+        'X-RateLimit-Remaining' => @partner.requests_remaining.to_s,
+        'X-RateLimit-Reset' => @partner.max_requests_reset_time.to_s}) unless @partner.max_requests.nil?
+      headers.merge!({'X-LockBox-API-Key' => key})
+      render :nothing => true, :status => :ok
+    elsif @partner.requests_remaining <= 0
+      render :four_two_oh, :status => 420
+    else
+      head 401
+    end
+  end
+
+  def hmac_auth(request)
+    credential_store = Partner.credential_store
+    authhmac = AuthHMAC.new(credential_store)
+    # debugger
+    if authhmac.authenticated?(request)
+      request.env['HTTP_AUTHORIZATION'] =~ /^AuthHMAC ([^:]+):/
+      access_key_id = $1
+      credential_store[access_key_id]
+    else
+      false
+    end
+  end
+
+end

data/app/controllers/confirmation_controller.rb

@@ -0,0 +1,14 @@
+class ConfirmationController < ApplicationController
+
+  skip_before_filter :require_user
+
+  def update
+    @partner           = Partner.find_by_perishable_token!(params[:perishable_token])
+    @partner.confirmed = true
+    @partner.save
+    PartnerSession.create(@partner)
+    flash[:success]    = "You account has been confirmed."
+    redirect_to root_path
+  end
+
+end

data/app/controllers/fetch_password_controller.rb

@@ -0,0 +1,44 @@
+class FetchPasswordController < ApplicationController
+  
+  skip_before_filter :require_user, :except => :update
+  
+  def index
+    @partner = Partner.new
+  end
+  
+  def show
+    @partner        = Partner.find_by_perishable_token!(params[:id])
+    partner_session = PartnerSession.new(@partner)
+    
+    unless partner_session.save
+      flash[:error] = "Could not authenticate"
+      redirect_to fetch_password_index_path
+    end
+  end
+  
+  def create
+    @partner = Partner.find_by_email(params[:partner][:email])
+    
+    if @partner
+      PartnerMailer.deliver_fetch_password(@partner)
+      flash[:notice] = "Fetch password email sent to #{@partner.email}"
+      redirect_to root_path
+    else
+      @partner      = Partner.new
+      flash[:error] = "Email doesn't exist"
+      render :action => :index
+    end
+  end
+  
+  def update
+    current_user.attributes = params[:partner]
+    
+    if current_user.save
+      flash[:success] = "Password updated"
+      redirect_to root_path
+    else
+      render :action => :show
+    end
+  end
+  
+end

data/app/controllers/home_controller.rb

@@ -0,0 +1,11 @@
+class HomeController < ApplicationController
+  skip_before_filter :require_user
+  
+  def show
+#    if current_user
+#      redirect_to partners_path(current_user.api_key)
+#    else
+#      redirect_to :login
+#    end
+  end
+end

data/app/controllers/partner_sessions_controller.rb

@@ -0,0 +1,30 @@
+class PartnerSessionsController < ApplicationController
+
+  skip_before_filter :require_user, :only => [:create, :new]
+  before_filter      :require_no_user, :only => [:create, :new]
+  
+  def new
+    @partner_session = PartnerSession.new
+  end
+  
+  def create
+    @partner_session = PartnerSession.new(params[:partner_session])
+
+    if @partner_session.save
+      flash[:success] = "You have been signed in"
+      redirect_back_or_default partners_path
+    else
+      @partner_session.errors.clear
+      flash.now[:error]  = "Email doesn't exist or bad Pasword"
+      flash.now[:notice] = "<a href='#{fetch_password_index_path}'>Did you forget your password?</a>"
+      render :action => :new
+    end
+  end
+  
+  def destroy
+    current_user_session.destroy
+    flash[:success] = "You have been logged out"
+    redirect_back_or_default root_path
+  end
+
+end

data/app/controllers/partners_controller.rb

@@ -0,0 +1,58 @@
+class PartnersController < ApplicationController
+  skip_before_filter :require_user, :only => [:new, :create]
+  before_filter :load_partner, :only => [:show, :edit, :update]
+
+  def index
+    redirect_to partner_path(current_user.api_key)
+  end
+  
+  def show
+    respond_to do |format|
+      format.html {}
+      format.json { render :json => @partner.to_json(:only => [:name, :api_key, :organization, :phone_number, :email]) }
+      format.jsonp {  render_jsonp(@partner.to_json)  }
+    end
+
+  end
+
+  def new
+    @partner = Partner.new
+  end
+
+  def create
+    @partner = Partner.new(params[:partner])
+    
+    if @partner.save
+      PartnerMailer.deliver_confirmation(@partner)
+      flash[:notice] = "A confirmation email has been sent to you"
+      redirect_to partner_path(@partner.api_key)
+    else
+      render :action => 'new'
+    end
+  end
+  
+  def edit
+  end
+  
+  def update
+    @partner.attributes = params[:partner]
+    
+    if @partner.save
+      redirect_to partner_path(@partner.api_key)
+    else
+      render :action => :edit
+    end
+  end
+
+  def load_partner
+    partner = Partner.find_by_api_key(params[:id])
+    if partner == current_user
+      @partner = partner
+    else
+      
+      render :file => "#{Rails.public_path}/401.html", :status => :unauthorized
+      return
+    end
+  end
+  
+end

data/app/helpers/admin/partners_helper.rb

@@ -0,0 +1,3 @@
+module Admin::PartnersHelper
+
+end

data/app/helpers/admin_helper.rb

@@ -0,0 +1,2 @@
+module AdminHelper
+end

data/app/helpers/application_helper.rb

@@ -0,0 +1,20 @@
+# Methods added to this helper will be available to all templates in the application.
+module ApplicationHelper
+
+  def flash_helper
+    returning("") do |helpers|
+      flash.each do |key, message|
+        helpers << content_tag(:div, message, :class => "flash-#{key}")
+      end
+    end
+  end
+  
+  def session_header
+    if current_user
+      render :partial => "shared/logged_in_menu"
+    else
+      render :partial => "shared/logged_out_menu"
+    end
+  end
+
+end

data/app/helpers/authentication_helper.rb

@@ -0,0 +1,2 @@
+module AuthenticationHelper
+end

data/app/helpers/fetch_password_helper.rb

@@ -0,0 +1,2 @@
+module FetchPasswordHelper
+end

data/app/helpers/home_helper.rb

@@ -0,0 +1,2 @@
+module HomeHelper
+end

data/app/helpers/labeled_builder.rb

@@ -0,0 +1,76 @@
+class LabeledBuilder < ActionView::Helpers::FormBuilder
+  alias :real_label :label unless method_defined?(:real_label)
+
+  ((field_helpers - %w(check_box radio_button hidden_field label)) + %w(date_select datetime_select) ) .each do |method_name|
+    src = <<-end_src
+      alias :real_#{method_name} :#{method_name}
+      def #{method_name}(field_name, options = {})
+        options ||= {}
+        label_options = (options[:label_options] || {})
+        label_options[:required] = options[:required] if options[:required]
+        lbl = options[:label] == '' ? '' : label(field_name, options.delete(:label), label_options)
+        help = (options[:help]) ?  @template.content_tag('div', options[:help], :class => 'field-help') : ''
+        @template.content_tag('div', lbl + help + super, :class => 'field')
+      end
+    end_src
+    class_eval src, __FILE__, __LINE__
+  end
+
+  alias :real_check_box :check_box
+  def check_box(field_name, options = {})
+    options ||= {}
+    label_options = (options[:label_options] || {})
+    label_options[:required] = options[:required] if options[:required]
+    lbl = options[:label] == '' ? '' : label(field_name, options.delete(:label), label_options)
+    help = (options[:help]) ?  @template.content_tag('div', options[:help], :class => 'field-help') : ''
+    @template.content_tag('div', lbl + help + super, :class => 'field')
+  end
+
+  alias :real_select :select
+  src = <<-end_src
+    def select(field_name, choices, options = {}, html_options = {})
+      options ||= {}
+      label_options = (options[:label_options] || {})
+      label_options[:required] = options[:required] if options[:required]
+      lbl = options[:label] == '' ? '' : label(field_name, options.delete(:label), label_options)
+      help = (options[:help]) ?  @template.content_tag('div', options[:help], :class => 'field-help') : ''
+      @template.content_tag('div', lbl + help + super, :class => 'field')
+    end
+  end_src
+  class_eval src, __FILE__, __LINE__
+
+  def collection_select(field_name, collection, value_method, text_method, options = {}, html_options = {})
+    options ||= {}
+    label_options = (options[:label_options] || {})
+    label_options[:required] = options[:required]
+    lbl = options[:label] == '' ? '' : label(field_name, options.delete(:label), label_options)
+    help = (options[:help]) ?  @template.content_tag('div', options[:help], :class => 'field-help') : ''
+    @template.content_tag('div', lbl + help + super, :class => 'field')
+  end
+
+  def label(field_name, text=nil, options={})
+    # reqd = "#{required_icon}" if options[:required] || ((@object && @object.attribute_required?(field_name)) && !options.include?(:required))
+    reqd = is_field_required?(field_name, options) ? '' : optional_tag
+    text = (text.nil? ? nil : text) || field_name.to_s.humanize.titleize
+    real_label(field_name, "#{text}#{reqd}", options)
+  end
+
+  def is_field_required?(field_name, options)
+    options[:required] || ((@object && @object.respond_to?(:attribute_required?) && @object.attribute_required?(field_name)) && !options.include?(:required))
+  end
+
+  def labeled_fields_for(name, *args, &block)
+    name = "#{object_name}[#{name}]"
+    @template.labeled_fields_for(name, *args, &block)
+  end
+
+  def required_icon
+    # "&nbsp;" + @template.tag(:span, :class=>'ss_sprite ss_star')
+    @template.content_tag(:span, '*', :class=>'required')
+  end
+
+  def optional_tag
+    #@template.content_tag(:span, "(optional)", :class=>'optional')
+  end
+
+end