mini_auth 0.2.0.beta → 0.2.0

data/README.md

@@ -39,6 +39,8 @@ Synopsis
     
     class User < ActiveRecord::Base
       include MiniAuth
+      
+      attr_accessible :name
     end
     
     a = User.new(:name => "alice", :password => "hotyoga")
@@ -46,14 +48,19 @@ Synopsis
     
     a.save                              # => true
     a.password_digest                   # => "$2a$10$F5YbEd..."
-    a.authenticate("hotyoga)            # => a
-    a.authenticate("wrong")             # => false
     
-    a.attributes = { :current_password => 'hotyoga', :new_password => 'almond' }
-    a.changing_password = true
-    a.save
-    a.authenticate("hotyoga)            # => false
-    a.authenticate("almond")            # => a
+    x = User.find_by_name("alice")
+    x.authenticate("wrong")             # => false
+    x.authenticate("hotyoga)            # => x
+    
+    x.attributes = { :current_password => 'hotyoga', :new_password => 'almond' }
+    x.changing_password = true
+    x.save
+    
+    y = User.find_by_name("alice")
+    y.authenticate("hotyoga)            # => false
+    y.authenticate("almond")            # => y
+
 
 Usage
 -----
@@ -89,7 +96,7 @@ When neither of them is set to `true`, you can NOT set or change the user's `pas
     a.valid?                            # => true
 
 
-### `setting_password` attribute
+### Setting password
 
 When the user's `setting_password` attribute is set to `true`, its password can
 be set without knowing the current password.
@@ -106,7 +113,7 @@ Password can't be blank.
     b.valid?                            # => false
     b.errors[:password]                 # => "can't be blank"
 
-Password can be nil.
+Password can't be nil.
 
     b = User.new(:name => "bob", :password => nil)
     b.setting_password => true
@@ -121,7 +128,7 @@ Password should be given.
     b.errors[:password]                 # => "can't be blank"
 
 
-### `changing_password` attribute
+### Changing password
 
 When the user's `changing_password` attribute is set to `true`, its password can
 NOT be set without knowing the current password. You should provide `current_password`
@@ -144,7 +151,7 @@ When both of the `setting_password` and the `changing_password` are set to `true
 only the latter is effective.
 
 
-### A user whose `password_digest` is nil
+### A user who has no password
 
 You can save a user whose `password_digest` is nil.
 
@@ -152,7 +159,7 @@ You can save a user whose `password_digest` is nil.
     c.save!
     c.password_digest                   # => nil
 
-Such a user can't get authenticated.
+Such a user can't get authenticated, but can exist as a temporary account or placeholder.
 
     c.authenticate(nil)                 # => false
 
@@ -192,7 +199,7 @@ You don't have to use them, however.
 
 ### Mass assignment security
 
-The `password_digest` column is protected against mass assignment.
+The `password_digest` column is protected against _mass assignment_.
 
     c.update_attributes(:password_digest => 'dummy')
     c.password_digest                   # => nil (unchanged)
@@ -202,6 +209,29 @@ Similarly, the `setting_password` and `changing_password` attributes are protect
     c.attributes = { :setting_password => true, :password => '0000' }
     c.setting_password?                 # => false
 
+A class that includes `Miniauth` is forced to adopt the _whitelist-principle_ regarding the mass assignment protection.
+That is, you have to enumerate the names of attributes that can be set via a hash by the `attr_accessible` method.
+
+    class User < ActiveRecord::Base
+      include MiniAuth
+      
+      attr_accessible :name, :address, :phone
+    end
+
+Note that the attributes `password`, `password_confirmation`, `current_password`, `new_password`, and
+`new_password_confirmation` are included in the whitelist by default.
+
+If your class has a _role_ such as :admin, you should enumerate the accessible attributes as follows:
+
+    class User < ActiveRecord::Base
+      include MiniAuth
+      
+      attr_accessible :name, :address, :phone
+      attr_accessible *(accessible_attributes(:default) + [ :is_admin ]), :as => :admin
+    end
+
+For more information about mass assignment security, please refer to the 
+[Mass Assignment](http://guides.rubyonrails.org/security.html#mass-assignment) section of Rails Guides.
 
 License
 -------

data/lib/mini_auth/version.rb

@@ -1,3 +1,3 @@
 module MiniAuth
-  VERSION = "0.2.0.beta"
+  VERSION = "0.2.0"
 end

data/spec/fake_app.rb

@@ -23,4 +23,6 @@ migration.change
 # Models
 class User < ActiveRecord::Base
   include MiniAuth
+  
+  attr_accessible :name
 end

data/spec/mini_auth/setting_password_spec.rb

@@ -6,7 +6,9 @@ describe "setting_password" do
     u.setting_password = true
     u.should be_valid
     u.save!
-    u.authenticate('hotyoga').should be_true
+    
+    v = User.find_by_name('alice')
+    v.authenticate('hotyoga').should be_true
   end
   
   it "should update password" do

metadata

@@ -1,8 +1,8 @@
 --- !ruby/object:Gem::Specification
 name: mini_auth
 version: !ruby/object:Gem::Version
-  version: 0.2.0.beta
-  prerelease: 6
+  version: 0.2.0
+  prerelease: 
 platform: ruby
 authors:
 - Tsutomu Kuroda
@@ -13,7 +13,7 @@ date: 2011-12-19 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
-  requirement: &19514420 !ruby/object:Gem::Requirement
+  requirement: &17342020 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -21,10 +21,10 @@ dependencies:
         version: 3.1.0
   type: :runtime
   prerelease: false
-  version_requirements: *19514420
+  version_requirements: *17342020
 - !ruby/object:Gem::Dependency
   name: bcrypt-ruby
-  requirement: &19513860 !ruby/object:Gem::Requirement
+  requirement: &17268340 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +32,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *19513860
+  version_requirements: *17268340
 - !ruby/object:Gem::Dependency
   name: rspec-rails
-  requirement: &19512860 !ruby/object:Gem::Requirement
+  requirement: &17267280 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -43,10 +43,10 @@ dependencies:
         version: 2.7.0
   type: :development
   prerelease: false
-  version_requirements: *19512860
+  version_requirements: *17267280
 - !ruby/object:Gem::Dependency
   name: sqlite3
-  requirement: &19512320 !ruby/object:Gem::Requirement
+  requirement: &17266540 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,7 +54,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *19512320
+  version_requirements: *17266540
 description: A minimal authentication module for Rails
 email:
 - t-kuroda@oiax.jp
@@ -92,9 +92,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
-  - - ! '>'
+  - - ! '>='
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubyforge_project: mini_auth
 rubygems_version: 1.8.10