merb_auth_slice_multisite 0.8.6

data/README.textile

@@ -0,0 +1,147 @@
+h1. MerbAuthSliceMultisite
+
+This slice setups multisite capabilities in your merb application with subdomains (i.e. coolcars.yourapp.com) and an authentication check.
+
+Noteworthy: This multisite gem validates the usernames by the scope of the subdomain. This means someone can create another subdomain site using the same username and password, but technically it will be a new user in the users table - similar to how blinksale works. This is how I prefer things. It saves the hassle of a has_and_belongs_to_many relationship and the extra signup hoops you have to go through as a user if you want to create multiple accounts - lighthouse is an example of this.
+
+h2. Instructions for installation:
+
+1. Add github as a gem source & install
+<pre><code>gem sources -a http://gems.github.com
+sudo gem install scottmotte-merb_auth_slice_multisite
+</code></pre>
+
+2. Setup your application to use the gem.* Add the following to the end of dependencies.rb.
+<pre><code>dependency "scottmotte-merb_auth_slice_multisite", :require_as => 'merb_auth_slice_multisite'</code></pre>
+
+3. Remove default merb-auth-slice-password in dependencies.rb
+<pre></code><strike>dependency "merb-auth-slice-password"</strike></code></pre>
+(merb_auth_slice_multisite is now standalone. it does not depend on merb-auth-slice-password)
+
+4. Add in mixin. In your user model or in merb/merb-auth/setup.rb add the mixin 
+include Merb::Authentication::Mixins::UserBelongsToSite and then migrate your database.
+<pre><code>
+# in model
+class User
+	include Merb::Authentication::Mixins::UserBelongsToSite
+	include Merb::Authentication::Mixins::AuthenticatedUser #for remember me functionality
+end
+
+
+# or as I prefer in merb/merb-auth/setup.rb
+Merb::Authentication.user_class.class_eval{ 
+  include Merb::Authentication::Mixins::SaltedUser
+  include Merb::Authentication::Mixins::ActivatedUser
+  include Merb::Authentication::Mixins::UserBelongsToSite # <-- this one
+	include Merb::Authentication::Mixins::AuthenticatedUser # <-- and this one
+ }
+</code></pre>
+
+_Don't forget to migrate your database schema with rake db:autoupgrade or rake db:automigrate_
+
+5. Setup strategies.rb - make sure it looks like the following. merb_auth_slice_multisite uses its own custom strategy so including the others will mess things up.
+<pre><code>Merb::Slices::config[:"merb_auth_slice_multisite"][:no_default_strategies] = false</code></pre>
+
+As an aside, here's what an example router might look like using the slice to support subdomains. See how it checks for subdomain equaling www or nil and routes to the main site. And then everything else goes to the pages controller or users controller that has a subdomain. All of the controller actions then user @current_site.pages.all and @current_site.users.all instead of just User.all & Page.all. Starting to come together in your mind :)
+
+<pre><code>
+	Merb.logger.info("Compiling routes...")
+	Merb::Router.prepare do
+
+	  # Brochure site - equal to site_url from settings.yml and has no first_subdomain else do below
+	  match(:first_subdomain =>  /^(www)*$/) do
+	    resources :sites, :collection => { :changed_on_spreedly => :post }
+	    resources :static
+	    match('/signup').to(:controller => 'sites', :action => 'new')
+	    match('/').to(:controller => 'static', :action => 'index')
+	  end
+
+	  # Subdomain sites
+	  resources :pages
+	  resources :users, :identify => :login
+
+	  match('/').to(:controller => 'pages', :action => 'index')
+	  slice(:merb_auth_slice_multisite, :name_prefix => nil, :path_prefix => "") # /login, /logout
+	end
+</pre></code>
+
+6. Add the slice's routes to your router
+<pre><code>slice(:merb_auth_slice_multisite, :name_prefix => nil, :path_prefix => "")</code></pre>
+
+7. Setup @current_site value. I haven't worked out how to make it automatically accessible yet so for now paste the following into your app's application.rb file.
+<pre><code>
+before :get_site
+def get_site
+  # uses @current_site - for example, to create pages under current site do @current_site.pages.new
+  @current_site = Site.first(:subdomain => request.first_subdomain)
+  raise NotFound unless @current_site
+end
+</code></pre>
+
+8. Configure forgot_password functionality. Add the following into merb/merb-auth/setup.rb
+<pre><code># To change the parameter names for the password or login field you may set either of these two options
+#
+# Merb::Plugins.config[:"merb-auth"][:login_param]    = :email 
+# Merb::Plugins.config[:"merb-auth"][:password_param] = :my_password_field_name
+Merb::Slices::config[:merb_auth_slice_multisite][:send_password_from_email] = "no-reply@yourapp.com"
+Merb::Slices::config[:merb_auth_slice_multisite][:domain] = "example.com"</code></pre>
+
+
+h2. Additional details:
+
+Schema/Migrations. The mixin adds some fields to your user model. Where needed include these in your migrations if you are using migrations.
+<pre><code># Relationships/Associations
+belongs_to :site
+property :site_id, Integer
+validates_is_unique :login, :scope => :site_id
+validates_is_unique :email, :scope => :site_id
+</code></pre>
+
+Site model. You're probably wondering where the heck is the site model. It's in the slice. You can override it by running one of the rake tasks or you can create your own site.rb model and add additional fields which is what I do. For example, if you have pages under a site, you might do something like:
+<pre><code># site.rb
+class Site
+  has n, :pages, :order => [:position.asc]
+end
+</code></pre>
+
+@current_site. You can use @current_site in your controllers like so:
+<pre><code>
+class Pages < Application
+  # provides :xml, :yaml, :js
+
+  def index
+    @pages = @current_site.pages.all
+    display @pages
+  end
+
+  def show(id)
+    @page = @current_site.pages.get(id)
+    raise NotFound unless @page
+    display @page
+  end
+
+end # Pages	
+</pre></code>
+
+
+h2. Assumptions
+
+* works for subdomains (i.e. coolcars.yourapp.com) 
+* merb only
+* merb-auth-core dependency
+* merb-auth-more dependency
+* *only supports datamapper so far* (help me extend it! fork the project and request me to pull)
+* A site has n (has_many) users. A user belongs_to a site.
+* You can have multiple users with the same username and password as long as they each belong_to a different site. For example, there can be an admin user with the credentials { :login => 'admin', :email => 'admin@example.org', :site_id => 1} and an admin user with the credentials { :login => 'admin', :email => 'admin@example.org', :site_id => 66}. As long as the site_id is different then it is ok. This allows more freedom when your users want to setup multiple sites. 
+
+
+h2. How does it work?
+
+When logging in the "user" object found by merb-auth-core will be asked whether the user's login, password, and site_id match. It matches the site_id against the @current_site.id, and the login/password from the standard form fields.
+
+
+h2. Rake tasks   
+
+To see all available tasks for MerbAuthSliceMultisite run:
+
+rake -T slices:merb_auth_slice_multisite

data/VERSION.yml

@@ -0,0 +1,4 @@
+--- 
+:major: 0
+:minor: 8
+:patch: 6

data/app/controllers/application.rb

@@ -0,0 +1,5 @@
+class MerbAuthSliceMultisite::Application < Merb::Controller
+  
+  controller_for_slice
+  
+end

data/app/controllers/exceptions.rb

@@ -0,0 +1,33 @@
+# the mixin to provide the exceptions controller action for Unauthenticated
+module MerbAuthSliceMultisite::ExceptionsMixin
+  def unauthenticated
+    provides :xml, :js, :json, :yaml
+
+    case content_type
+    when :html
+      render
+    else
+      basic_authentication.request!
+      ""
+    end
+  end # unauthenticated
+end
+
+Merb::Authentication.customize_default do
+  
+  Exceptions.class_eval do
+    include Merb::Slices::Support # Required to provide slice_url
+  
+    # # This stuff allows us to provide a default view
+    the_view_path = File.expand_path(File.dirname(__FILE__) / ".." / "views")
+    self._template_roots ||= []
+    self._template_roots << [the_view_path, :_template_location]
+    self._template_roots << [Merb.dir_for(:view), :_template_location]
+    
+    include MerbAuthSliceMultisite::ExceptionsMixin
+    
+    show_action :unauthenticated
+
+  end# Exceptions.class_eval
+  
+end # Customize default

data/app/controllers/passwords.rb

@@ -0,0 +1,29 @@
+class MerbAuthSliceMultisite::Passwords <  MerbAuthSliceMultisite::Application
+  
+  def send_password
+    @login_param = Merb::Authentication::Strategies::Multisite::Base.login_param
+    @site_id_param = Merb::Authentication::Strategies::Multisite::Base.site_id_param
+    @user = Merb::Authentication.user_class.first(@login_param => params[@login_param], @site_id_param => params[@site_id_param])
+      
+    if @user
+      from = MerbAuthSliceMultisite[:send_password_from_email]
+      raise "No :send_password_from_email option set for Merb::Slices::config[:merb_auth_slice_multisite][:send_password_from_email]" unless from 
+      @user.password = @user.password_confirmation = new_generated_password     
+      send_mail(MerbAuthSliceMultisite::SendPasswordMailer, :send_password, { :subject => (MerbAuthSliceMultisite[:send_password_subject] || "Forgetful? :)"), :from => from, :to => @user.email }, { :user => @user })
+      @user.save
+      redirect "/", :message => {:notice => "Password sent. Check your email."}
+    else
+      redirect "/", :message => {:error => "User with #{@login_param} \"%s\" not found".t(params[@login_param].freeze)}
+    end
+  end
+  
+  private
+  
+    def new_generated_password
+      chars = ("a".."z").to_a
+      start_password = ""
+      1.upto(6) { |i| start_password << chars[rand(chars.size-1)] }
+      @password = start_password
+    end
+ 
+end # MerbAuthSliceMultisite::Passwords

data/app/controllers/sessions.rb

@@ -0,0 +1,56 @@
+class MerbAuthSliceMultisite::Sessions < MerbAuthSliceMultisite::Application
+  
+  before :_maintain_auth_session_before, :exclude => [:destroy]  # Need to hang onto the redirection during the session.abandon!
+  before :_abandon_session,     :only => [:update, :destroy]
+  before  :_maintain_auth_session_after,  :exclude => [:destroy]  # Need to hang onto the redirection during the session.abandon!
+  before :ensure_authenticated, :only => [:update]
+
+  # redirect from an after filter for max flexibility
+  # We can then put it into a slice and ppl can easily 
+  # customize the action
+  after :redirect_after_login,  :only => :update, :if => lambda{ !(300..399).include?(status) }
+  after :redirect_after_logout, :only => :destroy
+  
+  def update
+    "Add an after filter to do stuff after login"
+  end
+
+  def destroy
+    "Add an after filter to do stuff after logout"
+    cookies.delete :auth_token
+  end
+  
+  
+  private   
+  # @overwritable
+  def redirect_after_login
+    message[:notice] = "Authenticated Successfully"
+    redirect_back_or "/", :message => message, :ignore => [slice_url(:login), slice_url(:logout)]
+  end
+  
+  # @overwritable
+  def redirect_after_logout
+    message[:notice] = "Logged Out"
+    redirect "/", :message => message
+  end  
+
+  # @private
+  def _maintain_auth_session_before
+    @_maintain_auth_session = {}
+    Merb::Authentication.maintain_session_keys.each do |k|
+      @_maintain_auth_session[k] = session[k]
+    end
+  end
+  
+  # @private
+  def _maintain_auth_session_after
+    @_maintain_auth_session.each do |k,v|
+      session[k] = v
+    end
+  end
+  
+  # @private
+  def _abandon_session
+    session.abandon!
+  end
+end

data/app/helpers/application_helper.rb

@@ -0,0 +1,64 @@
+module Merb
+  module MerbAuthSliceMultisite
+    module ApplicationHelper
+      
+      # @param *segments<Array[#to_s]> Path segments to append.
+      #
+      # @return <String> 
+      #  A path relative to the public directory, with added segments.
+      def image_path(*segments)
+        public_path_for(:image, *segments)
+      end
+      
+      # @param *segments<Array[#to_s]> Path segments to append.
+      #
+      # @return <String> 
+      #  A path relative to the public directory, with added segments.
+      def javascript_path(*segments)
+        public_path_for(:javascript, *segments)
+      end
+      
+      # @param *segments<Array[#to_s]> Path segments to append.
+      #
+      # @return <String> 
+      #  A path relative to the public directory, with added segments.
+      def stylesheet_path(*segments)
+        public_path_for(:stylesheet, *segments)
+      end
+      
+      # Construct a path relative to the public directory
+      # 
+      # @param <Symbol> The type of component.
+      # @param *segments<Array[#to_s]> Path segments to append.
+      #
+      # @return <String> 
+      #  A path relative to the public directory, with added segments.
+      def public_path_for(type, *segments)
+        ::MerbAuthSliceMultisite.public_path_for(type, *segments)
+      end
+      
+      # Construct an app-level path.
+      # 
+      # @param <Symbol> The type of component.
+      # @param *segments<Array[#to_s]> Path segments to append.
+      #
+      # @return <String> 
+      #  A path within the host application, with added segments.
+      def app_path_for(type, *segments)
+        ::MerbAuthSliceMultisite.app_path_for(type, *segments)
+      end
+      
+      # Construct a slice-level path.
+      # 
+      # @param <Symbol> The type of component.
+      # @param *segments<Array[#to_s]> Path segments to append.
+      #
+      # @return <String> 
+      #  A path within the slice source (Gem), with added segments.
+      def slice_path_for(type, *segments)
+        ::MerbAuthSliceMultisite.slice_path_for(type, *segments)
+      end
+      
+    end
+  end
+end

data/app/mailers/send_password_mailer.rb

@@ -0,0 +1,11 @@
+class MerbAuthSliceMultisite::SendPasswordMailer < Merb::MailController
+ 
+  controller_for_slice MerbAuthSliceMultisite, :templates_for => :mailer, :path => "views"
+ 
+  def send_password
+    @user = params[:user]
+    Merb.logger.info "Sending Password to #{@user.email}"
+    render_mail :layout => nil
+  end
+ 
+end

data/app/mailers/views/send_password_mailer/send_password.text.erb

@@ -0,0 +1,3 @@
+Your new password is <%= @user.password %>
+
+	Log on at http://<%= @user.site.subdomain %>.<%= Merb::Slices::config[:merb_auth_slice_multisite][:domain] %>

data/app/models/site.rb

@@ -0,0 +1,26 @@
+class Site
+  include DataMapper::Resource
+  include DataMapper::Timestamp
+  
+  # Schema
+  property :id, Serial
+  property :subdomain, String, :nullable => false, :length => (1..40), :unique => true, :format => /^[a-zA-Z0-9\-]*?$/
+  property :created_at, DateTime
+  property :updated_at, DateTime
+  
+  # Relationships/Associates
+  has n, :users, :order => [:login.asc]
+  
+  # Validations
+  validates_with_method :check_subdomain
+  
+  ReservedSubdomains = %w[backstage admin blog dev ftp mail email pop pop3 imap smtp stage stats status www]
+  def check_subdomain
+    if ReservedSubdomains.include?(self.subdomain)
+      [false, "Subdomain '#{self.subdomain}' is reserved."]
+    else
+      true
+    end
+  end
+  
+end

data/app/views/exceptions/unauthenticated.html.erb

@@ -0,0 +1,61 @@
+<% @login_param = Merb::Authentication::Strategies::Multisite::Base.login_param %>
+<% @password_param = Merb::Authentication::Strategies::Multisite::Base.password_param %>
+<% @site_id_param = Merb::Authentication::Strategies::Multisite::Base.site_id_param %>
+<% 
+# make @current_site value. application.rb does not get call 
+# because the authentication is protected at the rack level - which is better, 
+# but it means I have to add the following duplicate line of code as far as I know.
+@current_site = Site.first(:subdomain => request.first_subdomain)
+%>
+
+<%= error_messages_for session.authentication %>
+<form action="<%= slice_url(:merb_auth_slice_multisite, :perform_login) %>" method="post" id="loginForm">
+	<h3>Login</h3>
+	<input type="hidden" name="<%= @site_id_param.to_s %>" value="<%= @current_site.id %>" id="<%= @site_id_param.to_s %>">
+	<input type="hidden" name="_method" value="PUT" />
+	
+  <div id="loginFields" class="fields">
+    <div id="loginElements" class="elements">
+      <label for="<%= @login_param.to_s %>"><%= @login_param.to_s.capitalize %>:</label>
+      <div id="loginElement" class="element">
+				<input type="text" name="<%= @login_param.to_s %>" value="" id="<%= @login_param.to_s %>">
+      </div>
+    </div>
+    <div id="passwordElements" class="elements">
+      <label for="<%= @password_param.to_s %>"><%= @password_param.to_s.capitalize %>:</label>
+      <div id="passwordElement" class="element">
+				<input type="password" name="<%= @password_param.to_s %>" value="" id="<%= @password_param.to_s %>">
+      </div>
+    </div>
+		<div id="remember_meElements" class="elements">
+      <div id="remember_meElement" class="element">
+				<input type="checkbox" name="remember_me" value="1" id="remember_me" /> <label for="remember_me">Remember me</label>
+      </div>
+    </div>
+    <div id="loginActions" class="actions">
+      <div id="loginAction" class="action">
+        <input type="submit" name="loginSubmit" value="Log In" id="loginSubmit" />
+      </div>
+      <div id="forgotToggleAction" class="action">
+        <a href="#" id="forgotToggle">Forgot password</a>
+      </div>
+    </div>
+  </div>
+</form>
+
+<form action="<%= slice_url(:merb_auth_slice_multisite, :send_password) %>" method="post" id="forgotForm">
+	<input type="hidden" name="<%= @site_id_param.to_s %>" value="<%= @current_site.id %>" id="<%= @site_id_param.to_s %>">
+  <div id="forgotFields" class="fields">
+    <div id="forgotLoginElements" class="elements">
+      <label for="<%= @login_param.to_s %>"><%= @login_param.to_s.capitalize %>:</label>
+      <div id="forgotLoginElement" class="element">
+				<input type="text" class="text" name="<%= @login_param.to_s %>" id="<%= @login_param.to_s %>" />
+      </div>
+    </div>
+    <div id="forgotLoginActions" class="actions">
+      <div id="forgotLoginAction" class="action">
+        <input type="submit" name="forgotLoginSubmit" value="Reset Password" id="forgotLoginSubmit" />
+      </div>
+    </div>
+  </div>
+</form>