openbill 0.1.6 → 0.1.7

data/vendor/plugins/restful-authentication/lib/authentication/by_password.rb

@@ -1,64 +0,0 @@
-module Authentication
-  module ByPassword
-    # Stuff directives into including module
-    def self.included(recipient)
-      recipient.extend(ModelClassMethods)
-      recipient.class_eval do
-        include ModelInstanceMethods
-        
-        # Virtual attribute for the unencrypted password
-        attr_accessor :password
-        validates_presence_of     :password,                   :if => :password_required?
-        validates_presence_of     :password_confirmation,      :if => :password_required?
-        validates_confirmation_of :password,                   :if => :password_required?
-        validates_length_of       :password, :within => 6..40, :if => :password_required?
-        before_save :encrypt_password
-      end
-    end # #included directives
-
-    #
-    # Class Methods
-    #
-    module ModelClassMethods
-      # This provides a modest increased defense against a dictionary attack if
-      # your db were ever compromised, but will invalidate existing passwords.
-      # See the README and the file config/initializers/site_keys.rb
-      #
-      # It may not be obvious, but if you set REST_AUTH_SITE_KEY to nil and
-      # REST_AUTH_DIGEST_STRETCHES to 1 you'll have backwards compatibility with
-      # older versions of restful-authentication.
-      def password_digest(password, salt)
-        digest = REST_AUTH_SITE_KEY
-        REST_AUTH_DIGEST_STRETCHES.times do
-          digest = secure_digest(digest, salt, password, REST_AUTH_SITE_KEY)
-        end
-        digest
-      end      
-    end # class methods
-
-    #
-    # Instance Methods
-    #
-    module ModelInstanceMethods
-      
-      # Encrypts the password with the user salt
-      def encrypt(password)
-        self.class.password_digest(password, salt)
-      end
-      
-      def authenticated?(password)
-        crypted_password == encrypt(password)
-      end
-      
-      # before filter 
-      def encrypt_password
-        return if password.blank?
-        self.salt = self.class.make_token if new_record?
-        self.crypted_password = encrypt(password)
-      end
-      def password_required?
-        crypted_password.blank? || !password.blank?
-      end
-    end # instance methods
-  end
-end

data/vendor/plugins/restful-authentication/lib/authorization.rb

@@ -1,14 +0,0 @@
-module Authorization
-  def self.included(recipient)
-    recipient.extend(ModelClassMethods)
-    recipient.class_eval do
-      include ModelInstanceMethods
-    end
-  end
-
-  module ModelClassMethods
-  end # class methods
-
-  module ModelInstanceMethods
-  end # instance methods
-end

data/vendor/plugins/restful-authentication/lib/authorization/aasm_roles.rb

@@ -1,63 +0,0 @@
-module Authorization
-  module AasmRoles
-    unless Object.constants.include? "STATEFUL_ROLES_CONSTANTS_DEFINED"
-      STATEFUL_ROLES_CONSTANTS_DEFINED = true # sorry for the C idiom
-    end
-    
-    def self.included( recipient )
-      recipient.extend( StatefulRolesClassMethods )
-      recipient.class_eval do
-        include StatefulRolesInstanceMethods
-        include AASM
-        aasm_column :state
-        aasm_initial_state :initial => :pending
-        aasm_state :passive
-        aasm_state :pending, :enter => :make_activation_code
-        aasm_state :active,  :enter => :do_activate
-        aasm_state :suspended
-        aasm_state :deleted, :enter => :do_delete
-
-        aasm_event :register do
-          transitions :from => :passive, :to => :pending, :guard => Proc.new {|u| !(u.crypted_password.blank? && u.password.blank?) }
-        end
-        
-        aasm_event :activate do
-          transitions :from => :pending, :to => :active 
-        end
-        
-        aasm_event :suspend do
-          transitions :from => [:passive, :pending, :active], :to => :suspended
-        end
-        
-        aasm_event :delete do
-          transitions :from => [:passive, :pending, :active, :suspended], :to => :deleted
-        end
-
-        aasm_event :unsuspend do
-          transitions :from => :suspended, :to => :active,  :guard => Proc.new {|u| !u.activated_at.blank? }
-          transitions :from => :suspended, :to => :pending, :guard => Proc.new {|u| !u.activation_code.blank? }
-          transitions :from => :suspended, :to => :passive
-        end
-      end
-    end
-
-    module StatefulRolesClassMethods
-    end # class methods
-
-    module StatefulRolesInstanceMethods
-      # Returns true if the user has just been activated.
-      def recently_activated?
-        @activated
-      end
-      def do_delete
-        self.deleted_at = Time.now.utc
-      end
-
-      def do_activate
-        @activated = true
-        self.activated_at = Time.now.utc
-        self.deleted_at = self.activation_code = nil
-      end
-    end # instance methods
-  end
-end

data/vendor/plugins/restful-authentication/lib/authorization/stateful_roles.rb

@@ -1,62 +0,0 @@
-module Authorization
-  module StatefulRoles
-    unless Object.constants.include? "STATEFUL_ROLES_CONSTANTS_DEFINED"
-      STATEFUL_ROLES_CONSTANTS_DEFINED = true # sorry for the C idiom
-    end
-    
-    def self.included( recipient )
-      recipient.extend( StatefulRolesClassMethods )
-      recipient.class_eval do
-        include StatefulRolesInstanceMethods
-        
-        acts_as_state_machine :initial => :pending
-        state :passive
-        state :pending, :enter => :make_activation_code
-        state :active,  :enter => :do_activate
-        state :suspended
-        state :deleted, :enter => :do_delete
-
-        event :register do
-          transitions :from => :passive, :to => :pending, :guard => Proc.new {|u| !(u.crypted_password.blank? && u.password.blank?) }
-        end
-        
-        event :activate do
-          transitions :from => :pending, :to => :active 
-        end
-        
-        event :suspend do
-          transitions :from => [:passive, :pending, :active], :to => :suspended
-        end
-        
-        event :delete do
-          transitions :from => [:passive, :pending, :active, :suspended], :to => :deleted
-        end
-
-        event :unsuspend do
-          transitions :from => :suspended, :to => :active,  :guard => Proc.new {|u| !u.activated_at.blank? }
-          transitions :from => :suspended, :to => :pending, :guard => Proc.new {|u| !u.activation_code.blank? }
-          transitions :from => :suspended, :to => :passive
-        end
-      end
-    end
-
-    module StatefulRolesClassMethods
-    end # class methods
-
-    module StatefulRolesInstanceMethods
-      # Returns true if the user has just been activated.
-      def recently_activated?
-        @activated
-      end
-      def do_delete
-        self.deleted_at = Time.now.utc
-      end
-
-      def do_activate
-        @activated = true
-        self.activated_at = Time.now.utc
-        self.deleted_at = self.activation_code = nil
-      end
-    end # instance methods
-  end
-end

data/vendor/plugins/restful-authentication/lib/trustification.rb

@@ -1,14 +0,0 @@
-module Trustification
-  def self.included(recipient)
-    recipient.extend(ModelClassMethods)
-    recipient.class_eval do
-      include ModelInstanceMethods
-    end
-  end
-
-  module ModelClassMethods
-  end # class methods
-
-  module ModelInstanceMethods
-  end # instance methods
-end

data/vendor/plugins/restful-authentication/lib/trustification/email_validation.rb

@@ -1,20 +0,0 @@
-module Trustification
-  module EmailValidation
-    unless Object.constants.include? "CONSTANTS_DEFINED"
-      CONSTANTS_DEFINED = true # sorry for the C idiom
-    end
-    
-    def self.included(recipient)
-      recipient.extend(ClassMethods)
-      recipient.class_eval do
-        include InstanceMethods
-      end
-    end
-
-    module ClassMethods
-    end # class methods
-
-    module InstanceMethods
-    end # instance methods
-  end
-end

data/vendor/plugins/restful-authentication/notes/AccessControl.txt

@@ -1,2 +0,0 @@
-
-See the notes in [[Authorization]]

data/vendor/plugins/restful-authentication/notes/Authentication.txt

@@ -1,5 +0,0 @@
-Guides to best practices:
-* "The OWASP Guide to Building Secure Web Applications":http://www.owasp.org/index.php/Category:OWASP_Guide_Project
-** specifically, of course, the chapter on Authentication.
-* "Secure Programming for Linux and Unix HOWTO":http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/web-authentication.html
-* "Authentication and Identification,":http://www.downes.ca/post/12 by Stephen Downes **Highly Recommended**

data/vendor/plugins/restful-authentication/notes/Authorization.txt

@@ -1,154 +0,0 @@
-h2. Authorization
-
-"Best Practices for Authorization":http://www.owasp.org/index.php/Guide_to_Authorization
-# auth system should deny by default
-# Principle of least privilege (fine-grain)
-# each non-anonymous entry point have an access control check
-# authorization check at or near the beginning of code implementing sensitive activities
-# Ensure that Model code checks to ensure that the requesting user should have access to the protected resource.
-# Reauthorization for high value activities or after idle out
-# If custom code is required to perform authorization functions, consider
-  fail-safe authentication and exception handling – ensure that if an exception
-  is thrown, the user is logged out or at least prevented from accessing the
-  protected resource or function.
-# Well written applications centralize access control routines, so if any bugs
-  are found, they can be fixed once and the results apply throughout the
-  application immediately.
-
-h2. Authorization in a trust context
-
-* [http://en.wikipedia.org/wiki/Authorization]
-* remember: goal is **prediction** not **control**
-
-h2. Patterns for Policy definition / Authorization / access control
-
-*Reference Monitor (SecPatt p256)
-** Set of authorization rules
-** Actor, Action, Resource => Monitor+(rules) => ctrlr
-* Role based:
-   subj, role, right. action, resource
-  RBAC, access is controlled at the system level, outside of the user's control
-* Filter based
-  User x Controller x Action x Params --
-* Object based
-  model security delegation
-* Access Control Matrix http://en.wikipedia.org/wiki/Access_Control_Matrix
-* CommandProcessor pattern (DSL approach)
-* DENY FROM ... / ALLOW FROM ... approach
-* Capability based control: bundle together the designation of an object and the permission to access that object
-  ie. I can name it if and only if I am allowed to get at it.
-
-h2. Notes from "Security patterns":http://www.amazon.com/Security-Patterns-Integrating-Engineering-Software/dp/0470858842
-by M Schumacher ("website for book":http://www.securitypatterns.org/)
-
-Reference Monitor (SecPatt p256)
- * Set of authorization rules
- * Actor, Action, Resource  => Monitor+(rules) => ctrlr
-
-= Full access with Errors (SecPatt p305)
-
-* Users should not be able to view data or perform operations for which they
-  have no permissions.
-* Hiding an available and accessible function is inappropriate, because users
-  must be able to see what they can do.
-* The visual appeal and usability of a graphical user interface (GUI) can be de-
-  graded by varying layouts depending on the (current) access rights of a
-  user. For example, blank space might appear for some users where others see
-  options they can access, or sequence and number of menu items might differ,
-  depending on the current user’s rights, and thus ‘blind’ operation of the menu
-  by an expe- rienced user is no longer possible.
-* Showing currently unavailable functions can tease users to into upgrading
-  their access rights, for example by paying for the access or buying a license
-  after us- ing a demo version.
-* Trial and error are ineffective means of learning which functions are
-  accessible.  Invoking an operation only to learn that it doesn’t work with
-  your access rights is confusing.
-* The privilege grouping of the typical user community might not be known at the
-  design time of the GUI, and it might change over time, for example through
-  organizational or business process changes, so that providing a few special
-  modes of the GUI depending on the corresponding user roles is inappropriate.
-* Checking whether a function is allowed by a user is most efficient, robust and
-  secure, if done by the function itself—at least the code performing the checks
-  is then closely related to the code performing the subsequent operation
-  afterwards.
-
-h2. Outcomes / Obligations
-
--- forbid
--- ask for trust escalation (eg log in, prove_as_human, validate_email, are_you_sure, send_me_ten_cents)
--- drag ass
--- permit
-
--- reinterpret past actions based on future evolution of trust
--- prioritize changesets based on trust.
-
-
-h2. Notes from "Core Security Patterns":http://www.coresecuritypatterns.com/patterns.htm website
-
-# Authentication Enforcer 	who the hell are you
-# Intercepting Validator	Is your request well-formed
-# Authorization Enforcer  	Are you allowed to do that
-# Secure Logger 		Know what's happening/happened
-#
-
-h2. notes from "XACML":http://www.nsitonline.in/hemant/stuff/xacml/XACML%20Tutorial%20with%20a%20Use%20Case%20Scenario%20for%20Academic%20Institutions.htm
-
-PolicySets [Policy Combining Algorithm]
-Policy [Rule Combining Algorithm] (defines access to particular resources.)
-# Target
-## Subject Attributes
-## Resource Attributes
-## Action Attributes
-## Environment Attributes
-# Rule [Effect]		Identify various conditions or cases under which a policy may become applicable
-## Subject Attributes	user who has made an access request
-## Resource Attributes	object to which access is requested
-## Action Attributes	action the subject wants to take on the resource
-## Environment Attributes	request environment (time of day, ip, etc)
-## Conditions
-# Obligations
-
-Roles    -- student, janitor, dean, stranger, ...
-Branches -- Departments, etc.
-
-* Examine applicable rules until you get an outcome, failure or passes thru (in which case rejected)
-* Rule combining Algorithms
-
-* Obligations -- things to do once requests have been denied or permitted
-
-Reference Monitor (SecPatt p256)
- * Set of authorization rules
- * Actor, Action, Resource  --> Monitor+(rules) --> ctrlr
-
-#
-# ask for permissions on arbitrary (subject, action, resource)
-  * roles
-# get filtered object based on action (:public_info, :admin_info, etc.)
-# attach a rule to a (subject|role, action, resource) triple
-  "subject should have role R"
-  "subject should have role R on resource X"
-  "should meet the
-
-* Role supervisor:
-  * adds, defines, removes roles.  no policy -- just attaches roles to users
-
-* Policy
-  answers "can Actor do Action to Resource"
-  * Rules
-  * Rule resolution
-  * outcome, obligations.
-  policy definitions can come from many places, go to policy mgr.
-* Hall monitor
-  enforces policy (before filters)
-* Policy observers
-  handle policy obligations
-
-* Athentication   --  identification, really: securely attach visitor to identity
-* Validation      -- qualify trust
-* Access control  -- define policy
-** Roles
-** Acc. matrix
-* Authorization	-- enforce policy (reference monitor ; filter chain)
-* Obligations
-**  Audit 	-- (observer)
-

data/vendor/plugins/restful-authentication/notes/RailsPlugins.txt

@@ -1,78 +0,0 @@
-h1. Rails Authentication, Authorization and Access Control plugins
-
-h2. Authentication plugins
-
-* http://github.com/technoweenie/restful-authentication/tree/master -- the accepted standard for authentication
-* http://github.com/mrflip/restful-authentication/tree/master -- my fork of restful_authentication with more modularity, more specs and a few security tweaks
-* http://github.com/josh/open_id_authentication/tree/master -- OpenID authentication
-
-h2. Authorization plugins
-
-From
-* http://agilewebdevelopment.com/plugins/tag/security
-* http://www.vaporbase.com/postings/Authorization_in_Rails
-
-* http://github.com/jbarket/restful-authorization/tree/master
-
-* http://agilewebdevelopment.com/plugins/rolerequirement
-  http://code.google.com/p/rolerequirement/
-  http://rolerequirement.googlecode.com/svn/tags/role_requirement/
-  9 votes
-
-* http://github.com/ezmobius/acl_system2/
-  http://agilewebdevelopment.com/plugins/acl_system
-  http://opensvn.csie.org/ezra/rails/plugins/dev/acl_system2/
-  last touched 2006
-  57 votes on AWD
-  * also: http://agilewebdevelopment.com/plugins/acl_system2_ownership
-
-  bq. access_control [:new, :create, :update, :edit] => '(admin | user |
-                      moderator)', :delete => 'admin'
-      <% restrict_to "(admin | moderator) & !blacklist" do %>
-        <%= link_to "Admin & Moderator only link", :action =>'foo' %>
-      <% end %>
-
-* Authorization Recipe (from Rails Recipes #32)
-  http://www.vaporbase.com/postings/Authorization_in_Rails
-  http://opensvn.csie.org/mabs29/plugins/simple_access_control
-
-* Active ACL
-  http://phpgacl.sourceforge.net/demo/phpgacl/docs/manual.html
-  (Access-matrix driven)
-
-* http://github.com/aiwilliams/access_controlled_system
-
-* http://agilewebdevelopment.com/plugins/access
-
-* http://robzon.aenima.pl/2007/12/base-auth-is-out.html
-  http://agilewebdevelopment.com/plugins/base_auth
-  http://base-auth.googlecode.com/svn/trunk/
-  40 votes
-
-* http://agilewebdevelopment.com/plugins/authorization
-  http://www.writertopia.com/developers/authorization
-  http://github.com/DocSavage/rails-authorization-plugin/tree/master
-  Opaque policy descriptions
-  19 votes
-
-* http://github.com/shuber/access_control_list/
-  Not much there yet
-
-* https://opensvn.csie.org/traccgi/tobionrails
-  http://agilewebdevelopment.com/plugins/access_control
-  http://opensvn.csie.org/tobionrails/plugins/access_control
-  last touched 1 year ago
-
-* http://github.com/mdarby/restful_acl/
-  -- google code too --
-  Just does REST?  More of an app than a plugin.
-
-* http://github.com/stonean/lockdown/tree/master
-  http://lockdown.rubyforge.org
-  http://groups.google.com/group/stonean_lockdown?hl=en
-  "Lockdown stores an array of access rights in the session"
-
-h2. Trust / Validation etc. plugins
-
-
-* http://agilewebdevelopment.com/plugins/recaptcha