salted_login_generator 1.0.4 → 1.0.5

data/templates/notify.rb

@@ -1,56 +1,50 @@
-class Notify < ActionMailer::Base
-  def signup(user, password='<what you entered on the website>', url=nil, sent_on=Time.now)
+class <%= class_name %>Notify < ActionMailer::Base
+  def signup(<%= singular_name %>, password, url=nil)
+    setup_email(<%= singular_name %>)
+
     # Email header info
-    @recipients = "#{user.email}"
-    @from       = CONFIG['email_from'].to_s
-    @subject    = "[#{CONFIG['app_name']}] Welcome to #{CONFIG['app_name']}!"
-    @sent_on    = sent_on
+    @subject += "Welcome to #{<%= class_name %>System::CONFIG[:app_name]}!"
 
     # Email body substitutions
-    @body["name"] = "#{user.firstname} #{user.lastname}"
-    @body["login"] = user.login
+    @body["name"] = "#{<%= singular_name %>.firstname} #{<%= singular_name %>.lastname}"
+    @body["login"] = <%= singular_name %>.login
     @body["password"] = password
-    @body["url"] = url || CONFIG['app_url'].to_s
-    @body["uuid"] = user.uuid
-
-    if CONFIG['inject_mailer_error']
-      raise "Signup mail failed"
-    end
+    @body["url"] = url || <%= class_name %>System::CONFIG[:app_url].to_s
+    @body["app_name"] = <%= class_name %>System::CONFIG[:app_name].to_s
   end
 
-  def forgot_password(user, password, url=nil, sent_on=Time.now)
+  def forgot_password(<%= singular_name %>, url=nil)
+    setup_email(<%= singular_name %>)
+
     # Email header info
-    @recipients = "#{user.email}"
-    @from       = CONFIG['email_from'].to_s
-    @subject    = "[#{CONFIG['app_name']}] Welcome to #{CONFIG['app_name']}!"
-    @sent_on    = sent_on
+    @subject += "Forgotten password notification"
 
     # Email body substitutions
-    @body["name"] = "#{user.firstname} #{user.lastname}"
-    @body["login"] = user.login
-    @body["password"] = password
-    @body["url"] = url || CONFIG['app_url'].to_s
-
-    if CONFIG['inject_mailer_error']
-      raise "Forgot password mail failed"
-    end
+    @body["name"] = "#{<%= singular_name %>.firstname} #{<%= singular_name %>.lastname}"
+    @body["login"] = <%= singular_name %>.login
+    @body["url"] = url || <%= class_name %>System::CONFIG[:app_url].to_s
+    @body["app_name"] = <%= class_name %>System::CONFIG[:app_name].to_s
   end
 
-  def change_password(user, password, url=nil, sent_on=Time.now)
+  def change_password(<%= singular_name %>, password, url=nil)
+    setup_email(<%= singular_name %>)
+
     # Email header info
-    @recipients = "#{user.email}"
-    @from       = CONFIG['email_from'].to_s
-    @subject    = "[#{CONFIG['app_name']}] Welcome to #{CONFIG['app_name']}!"
-    @sent_on    = sent_on
+    @subject += "Changed password notification"
 
     # Email body substitutions
-    @body["name"] = "#{user.firstname} #{user.lastname}"
-    @body["login"] = user.login
+    @body["name"] = "#{<%= singular_name %>.firstname} #{<%= singular_name %>.lastname}"
+    @body["login"] = <%= singular_name %>.login
     @body["password"] = password
-    @body["url"] = url || CONFIG['app_url'].to_s
+    @body["url"] = url || <%= class_name %>System::CONFIG[:app_url].to_s
+    @body["app_name"] = <%= class_name %>System::CONFIG[:app_name].to_s
+  end
 
-    if CONFIG['inject_mailer_error']
-      raise "Change password mail failed"
-    end
+  def setup_email(<%= singular_name %>)
+    @recipients = "#{<%= singular_name %>.email}"
+    @from       = <%= class_name %>System::CONFIG[:email_from].to_s
+    @subject    = "[#{<%= class_name %>System::CONFIG[:app_name]}] "
+    @sent_on    = Time.now
+    @headers['Content-Type'] = "text/plain; charset=#{<%= class_name %>System::CONFIG[:mail_charset]}; format=flowed"
   end
 end

data/templates/notify_change_password.rhtml

@@ -1,6 +1,6 @@
 Dear <%%= @name %>,
 
-At your request, logbook has changed your password. If it was not at your request, then you should be aware that someone has access to your account and requested this change.
+At your request, <%%= @app_name %> has changed your password. If it was not at your request, then you should be aware that someone has access to your account and requested this change.
 
 Your new login credentials are:
 

data/templates/notify_forgot_password.rhtml

@@ -1,11 +1,10 @@
 Dear <%%= @name %>,
 
-At your request, logbook has reset your password. If it was not at your request, then you should be aware that someone has entered your email address as theirs in the forgotten password section of logbook.
+At your request, <%%= @app_name %> has sent you the following URL so that you may reset your password. If it was not at your request, then you should be aware that someone has entered your email address as theirs in the forgotten password section of <%%= @app_name %>.
 
-Your new login credentials are:
+Please click on the following link to go to the change password page:
 
-  login:    <%%= @login %>
-  password: <%%= @password %>
+<a href="<%%= @url%>">Click me!</a>
  
 It's advisable for you to change your password as soon as you login. It's as simple as navigating to 'Preferences' and clicking on 'Change Password'.
 

data/templates/notify_signup.rhtml

@@ -7,6 +7,6 @@ Your login credentials are:
 
 Please click on the following link to confirm your registration:
 
-<a href="<%%= @url%>account/verify/<%%= @uuid %>">Click me!</a>
+<a href="<%%= @url%>">Click me!</a>
 
-<%%= @url %>
+<%%= @url %>

data/templates/user.rb

@@ -1,57 +1,120 @@
 require 'digest/sha1'
 
+ActiveRecord::Validations::ClassMethods.module_eval {
+  public
+  def validate_on_virtual(*methods, &block)
+    methods << block if block_given?
+    write_inheritable_set(:validate_on_virtual, methods)
+  end
+
+  private
+  def validation_method(on)
+    case on
+    when :save   then :validate
+    when :create then :validate_on_create
+    when :update then :validate_on_update
+    when :virtual then :validate_on_virtual
+    end
+  end
+}
+
 # this model expects a certain database layout and its based on the name/login pattern. 
-class User < ActiveRecord::Base
+class <%= class_name %> < ActiveRecord::Base
+  
+  def initialize(attributes = nil)
+    super
+    @new_password = true
+  end
 
   def self.authenticate(login, pass)
     u = find_first(["login = ? AND verified = 1", login])
-    if u.nil?
-      return nil
-    end
-    find_first(["login = ? AND password = ? AND verified = 1", login, salted_password(u.salt, hashed(pass))])
+    return nil if u.nil?
+    find_first(["login = ? AND salted_password = ? AND verified = 1", login, salted_password(u.salt, hashed(pass))])
   end
 
-  def change_password(pass)
-    self.password_confirmation = self.password = pass
+  def self.authenticate_by_token(id, token)
+    u = find_first(["id = ? AND security_token = ?", id, token])
+    return nil if u.nil? or u.token_expired?
+    return nil if false == u.update_expiry
+    u
   end
-    
-  def makepass
-    chars = ("a".."z").to_a + (1..9).to_a
-    chars = chars.sort_by { rand }
-    s = chars[0..7].to_s
+
+  def token_expired?
+    self.security_token and self.token_expiry and (Time.now > self.token_expiry)
   end
 
-  def verify
-    toggle("verified")
+  def update_expiry
+    write_attribute('token_expiry', [self.token_expiry, Time.at(Time.now.to_i + 600 * 1000)].min)
+    write_attribute('authenticated_by_token', true)
+    write_attribute("verified", 1)
     update_without_callbacks
   end
 
+  def generate_security_token
+    if self.security_token.nil? or self.token_expiry.nil? or 
+        (Time.now.to_i + token_lifetime / 2) >= self.token_expiry.to_i
+      return new_security_token
+    else
+      return self.security_token
+    end
+  end
+
+  def change_password(pass, confirm = nil)
+    self.password = pass
+    self.password_confirmation = confirm.nil? ? pass : confirm
+    @new_password = true
+  end
+    
+  def valid?
+    super
+    run_validations(:validate_on_virtual) if do_virtual_validations
+    errors.empty?
+  end
+
   protected
 
+  attr_accessor :password, :password_confirmation
+
+  def do_virtual_validations
+    @new_password
+  end
+
   def self.hashed(str)
     return Digest::SHA1.hexdigest("change-me--#{str}--")[0..39]
   end
 
-  before_create :generate_uuid
-  before_save :crypt_password
-  
+  after_save '@new_password = false'
+  after_validation :crypt_password
   def crypt_password
-    write_attribute("salt", self.class.hashed("salt-#{Time.now}"))
-    write_attribute("password", self.class.salted_password(salt, self.class.hashed(password)))
+    if @new_password
+      write_attribute("salt", self.class.hashed("salt-#{Time.now}"))
+      write_attribute("salted_password", self.class.salted_password(salt, self.class.hashed(@password)))
+    end
+  end
+
+  def new_security_token
+    write_attribute('security_token', self.class.hashed(self.salted_password + Time.now.to_i.to_s + rand.to_s))
+    write_attribute('token_expiry', Time.at(Time.now.to_i + token_lifetime))
+    update_without_callbacks
+    return self.security_token
   end
 
-  def generate_uuid
-    self.uuid = self.class.hashed("uuid-#{Time.now}")
+  def token_lifetime
+    <%= class_name %>System::CONFIG[:security_token_life_hours] * 60 * 60
   end
 
   def self.salted_password(salt, hashed_password)
     hashed(salt + hashed_password)
   end
 
-  validates_length_of :login, :within => 3..40
-  validates_length_of :password, :within => 5..40
-  validates_presence_of :login, :password, :password_confirmation
+  validates_presence_of :login, :on => :create
+  validates_length_of :login, :within => 3..40, :on => :create
   validates_uniqueness_of :login, :on => :create
   validates_uniqueness_of :email, :on => :create
-  validates_confirmation_of :password
+
+  validates_presence_of :password, :on => :virtual
+  validates_confirmation_of :password, :on => :virtual
+  validates_length_of :password, { :minimum => 5, :on => :virtual }
+  validates_length_of :password, { :maximum => 40, :on => :virtual }
 end
+

data/templates/user_model.erbsql

@@ -0,0 +1,16 @@
+CREATE TABLE users (
+  id <%= @pk %>,
+  login VARCHAR(80) NOT NULL,
+  salted_password VARCHAR(40) NOT NULL,
+  email VARCHAR(60) NOT NULL,
+  firstname VARCHAR(40) NOT NULL,
+  lastname VARCHAR(40) NOT NULL,
+  salt CHAR(40) NOT NULL,
+  verified INT default 0,
+  role VARCHAR(40) default NULL,
+  security_token CHAR(40) default NULL,
+  token_expiry <%= @datetime %> default NULL,
+  created_at <%= @datetime %> default NULL,
+  updated_at <%= @datetime %> default NULL,
+  logged_in_at <%= @datetime %> default NULL
+) <%= @options %>;

data/templates/user_test.rb

@@ -1,13 +1,13 @@
 require File.dirname(__FILE__) + '/../test_helper'
 
-class UserTest < Test::Unit::TestCase
+class <%= class_name %>Test < Test::Unit::TestCase
   
-  fixtures :users
+  fixtures :<%= plural_name %>
     
   def test_auth
     
-    assert_equal  @bob, User.authenticate("bob", "atest")    
-    assert_nil    User.authenticate("nonbob", "atest")
+    assert_equal  @bob, <%= class_name %>.authenticate("bob", "atest")    
+    assert_nil <%= class_name %>.authenticate("nonbob", "atest")
     
   end
 
@@ -16,33 +16,33 @@ class UserTest < Test::Unit::TestCase
         
     @longbob.change_password("nonbobpasswd")
     @longbob.save
-    assert_equal @longbob, User.authenticate("longbob", "nonbobpasswd")
-    assert_nil   User.authenticate("longbob", "alongtest")
+    assert_equal @longbob, <%= class_name %>.authenticate("longbob", "nonbobpasswd")
+    assert_nil <%= class_name %>.authenticate("longbob", "alongtest")
     @longbob.change_password("alongtest")
     @longbob.save
-    assert_equal @longbob, User.authenticate("longbob", "alongtest")
-    assert_nil   User.authenticate("longbob", "nonbobpasswd")
+    assert_equal @longbob, <%= class_name %>.authenticate("longbob", "alongtest")
+    assert_nil <%= class_name %>.authenticate("longbob", "nonbobpasswd")
         
   end
   
   def test_disallowed_passwords
     
-    u = User.new    
+    u = <%= class_name %>.new    
     u.login = "nonbob"
 
-    u.password = u.password_confirmation = "tiny"
+    u.change_password("tiny")
     assert !u.save     
     assert u.errors.invalid?('password')
 
-    u.password = u.password_confirmation = "hugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehuge"
+    u.change_password("hugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehugehuge")
     assert !u.save     
     assert u.errors.invalid?('password')
         
-    u.password = u.password_confirmation = ""
+    u.change_password("")
     assert !u.save    
     assert u.errors.invalid?('password')
         
-    u.password = u.password_confirmation = "bobs_secure_password"
+    u.change_password("bobs_secure_password")
     assert u.save     
     assert u.errors.empty?
         
@@ -50,8 +50,8 @@ class UserTest < Test::Unit::TestCase
   
   def test_bad_logins
 
-    u = User.new  
-    u.password = u.password_confirmation = "bobs_secure_password"
+    u = <%= class_name %>.new  
+    u.change_password("bobs_secure_password")
 
     u.login = "x"
     assert !u.save     
@@ -73,17 +73,17 @@ class UserTest < Test::Unit::TestCase
 
 
   def test_collision
-    u = User.new
-    u.login      = "existingbob"
-    u.password = u.password_confirmation = "bobs_secure_password"
+    u = <%= class_name %>.new
+    u.login = "existingbob"
+    u.change_password("bobs_secure_password")
     assert !u.save
   end
 
 
   def test_create
-    u = User.new
-    u.login      = "nonexistingbob"
-    u.password = u.password_confirmation = "bobs_secure_password"
+    u = <%= class_name %>.new
+    u.login = "nonexistingbob"
+    u.change_password("bobs_secure_password")
       
     assert u.save  
     

data/templates/users.yml

@@ -3,7 +3,7 @@
 bob:
   id: 1000001
   login: bob
-  password: ef94c16f6c124a4e84cc215c164767bfa25f6e92 # atest
+  salted_password: ef94c16f6c124a4e84cc215c164767bfa25f6e92 # atest
   salt: 7f8b036f9b647d46d22abdbfc8113f44a88f9889
   email: bob@test.com
   verified: 1
@@ -11,7 +11,7 @@ bob:
 existingbob:
   id: 1000002
   login: existingbob
-  password: 99d6b680d4bfa81cbd383ffa0390bb03323a0b9a # atest
+  salted_password: 99d6b680d4bfa81cbd383ffa0390bb03323a0b9a # atest
   salt: fc76daa7bc4e4b7833375cf9deca38beee4c5581
   email: existingbob@test.com
   verified: 1  
@@ -19,7 +19,7 @@ existingbob:
 longbob:
   id: 1000003
   login: longbob
-  password: c841391e1d29100a4920de7a8fbb4b0fd180c6c0 # alongtest
+  salted_password: c841391e1d29100a4920de7a8fbb4b0fd180c6c0 # alongtest
   salt: c068e3671780f16898c0a8295ae8d82cc59713e2
   email: longbob@test.com
   verified: 1

data/templates/view_change_password.rhtml

@@ -1,35 +1,15 @@
-<%%= start_form_tag :action=> "change_password" %>
+<div title="<%%= title_helper %>" class="form">
+  <%%= head_helper :error => true %>
 
-<div title="Change password" class="form">
-  <h3>Change Password</h3> 
-  <%% if @flash['notice'] %>
-    <div>
-      <p><%%= @flash['notice'] %></p>
-    </div>
-  <%% end %>
-  <%% if @flash['message'] %>
-    <div id="ErrorExplanation">
-      <h2><%%= @flash['message'] %></h2>
-    </div>
-  <%% end %>
-  <%%= error_messages_for 'user' %><br/>
-   
   <div class="form-padding">
-    <p>
-      Enter your new password in the fields below and click 'Change Password'
-      to have a new password sent to your email inbox.
-    </p>
-    <label for="user_password">Choose password:</label><br/>
-    <%%= password_field "user", "password", :size => 30, :value => "" %><br/>
-    <label for="user_password_confirmation">Confirm password:</label><br/>
-    <%%= password_field "user", "password_confirmation", :size => 30, :value => "" %><br/>
-
-    <div class="button-bar">
-      <%%= submit_tag "Change password" %>
-      <%%= link_to 'Cancel', :action=> 'login' %>
-    </div>
+    <%%= message_helper 'change' %>
+
+    <%%= start_form_tag_helper %>
+      <%%= render_partial 'password', :<%= singular_name %> => @<%= singular_name %>, :submit => false %>
+      <div class="button-bar">
+        <%%= button_helper 'change_password' %>
+        <%%= link_helper 'change_cancel_welcome', :action => 'welcome' %>
+      </div>
+    <%%= end_form_tag %>
   </div>
-</div>
-
-<%%= end_form_tag %>
-
+</div>

data/templates/view_edit.rhtml

@@ -0,0 +1,12 @@
+<div title="<%%= title_helper %>" class="form">
+  <%%= head_helper :error => true %>
+
+    <%%= start_form_tag_helper %>
+      <%%= render_partial 'edit', :<%= singular_name %> => @<%= singular_name %>, :submit => true %>
+    <%%= end_form_tag %>
+    </br>
+    <%%= start_form_tag_helper %>
+      <%%= render_partial 'password', :submit => true %>
+    <%%= end_form_tag %>
+  </div>
+</div>                                                                          

data/templates/view_forgot_password.rhtml

@@ -1,32 +1,16 @@
-<%%= start_form_tag :action=> "forgot_password" %>
-
-<div title="Forgotten password" class="form">
-  <h3>Forgotten Password</h3> 
-  <%% if @flash['notice'] %>
-    <div>
-      <p><%%= @flash['notice'] %></p>
-    </div>
-  <%% end %>
-  <%% if @flash['message'] %>
-    <div id="ErrorExplanation">
-      <h2><%%= @flash['message'] %></h2>
-    </div>
-  <%% end %>
+<div title="<%%= title_helper %>" class="form">
+  <%%= head_helper %>
    
   <div class="form-padding">
-    <p>
-      Enter your email address in the field below and click 'Reset Password'
-      to have a new password sent to your email inbox.
-    </p>
-    <label for="user_email">Email:</label><br/>
-    <%%= text_field "user", "email", :size => 30, :value => "" %><br/>
-
-    <div class="button-bar">
-      <%%= submit_tag "Reset password" %>
-      <%%= link_to 'Cancel', :action=> 'login' %>
-    </div>
-  </div>
-</div>
+    <p><%%= message_helper 'forgot_reset' %></p>
 
-<%%= end_form_tag %>
+    <%%= start_form_tag_helper %>
+      <%%= form_input :text_field, "email", :size => 30 %><br/>
 
+      <div class="button-bar">
+        <%%= button_helper 'forgot_reset' %>
+        <%%= link_helper 'forgot_cancel_login', :action => 'login' %>
+      </div>
+    <%%= end_form_tag %>
+  </div>
+</div>                                                                          

data/templates/view_login.rhtml

@@ -1,31 +1,18 @@
-<%%= start_form_tag :action=> "login" %>
-
-<div title="Account login" class="form">
-  <h3>Please login</h3>
-  <%% if @flash['notice'] %>
-    <div>
-      <p><%%= @flash['notice'] %></p>
-    </div>
-  <%% end %>
-  <%% if @flash['message'] %>
-    <div id="ErrorExplanation">
-      <h2><%%= @flash['message'] %></h2>
-    </div>
-  <%% end %>
+<div title="<%%= title_helper %>" class="form">
+  <%%= head_helper %>
 
   <div class="form-padding">
-    <label for="user_login">Login:</label><br/>
-    <%%= text_field "user", "login", :size => 30 %><br/>
-    <label for="user_password">Password:</label><br/>
-    <%%= password_field "user", "password", :size => 30, :value => "" %><br/>
+    <%%= start_form_tag_helper  %>
+      <table>
+        <%%= form_input :text_field, "login", :size => 30 %><br/>
+        <%%= form_input :password_field, "password", :size => 30 %><br/>
+      </table>
 
-    <div class="button-bar">
-      <%%= submit_tag "Login" %>
-      <%%= link_to 'Register for an account', :action => 'signup' %> | 
-      <%%= link_to 'Forgot your password?', :action => 'forgot_password' %>
-    </div>
+      <div class="button-bar">
+        <%%= button_helper 'login' %>
+        <%%= link_helper 'login_signup', :action => 'signup' %> | 
+        <%%= link_helper 'login_forgot_password', :action => 'forgot_password' %>      </div>
+    <%%= end_form_tag %>
   </div>
 </div>
-
-<%%= end_form_tag %>
-
+                                                                                

data/templates/view_logout.rhtml

@@ -1,10 +1,8 @@
+<div title="<%%= title_helper %>" class="memo">
+  <%%= head_helper :notice => false, :message => false %>
 
-<div class="memo">
-    <h3>Logoff</h3>
+  <p><%%= message_helper 'logged_off' %>
 
-    <p>You are now logged out of the system...</p>
-      
-    <%%= link_to "&#171; login", :action=>"login"%>  
-      
+  <%%= link_helper 'logout_login', :action => 'login' %>
 </div>
 

data/templates/view_signup.rhtml

@@ -1,27 +1,14 @@
-<%%= start_form_tag :action=> "signup" %>
+<div title="<%%= title_helper %>" class="form">
+  <%%= head_helper :error => true %>
 
-<div title="Account signup" class="form">
-  <h3>Signup</h3>
-  <%% if @flash['message'] %>
-    <div id="ErrorExplanation">
-      <h2><%%= @flash['message'] %></h2>
-    </div>
-  <%% end %>
-  <%%= error_messages_for 'user' %><br/>
-  
   <div class="form-padding">
-    <label for="user_login">Desired login:</label><br/>
-    <%%= text_field "user", "login", :size => 30 %><br/>
-    <label for="user_email">Email address:</label><br/>
-    <%%= text_field "user", "email", :size => 30 %><br/>
-    <label for="user_password">Choose password:</label><br/>
-    <%%= password_field "user", "password", :size => 30, :value => "" %><br/>
-    <label for="user_password_confirmation">Confirm password:</label><br/>
-    <%%= password_field "user", "password_confirmation", :size => 30, :value => "" %><br/>
-
-    <div class="button-bar">
-      <%%= submit_tag "Signup" %>
-    </div>
-  <div>
-<%%= end_form_tag %>
-
+    <%%= start_form_tag_helper %>
+      <%%= render_partial 'edit', :<%= singular_name %> => @<%= singular_name %>, :submit => false %></br>
+      <%%= render_partial 'password', :submit => false %>
+      
+      <div class="button-bar">
+        <%%= button_helper 'signup' %>
+      </div>
+    <%%= end_form_tag %>
+  </div>
+</div>

data/templates/view_welcome.rhtml

@@ -1,13 +1,7 @@
-
-<div class="memo">
-    <h3>Welcome</h3>
-
-    <p>You are now logged into the system...</p>
-    <p>
-    Since you are here it's safe to assume the application never called store_location, otherwise
-    you would have been redirected somewhere else after a successful login.
-    </p>
-      
-    <%%= link_to "&#171; logout", :action=>"logout"%>  
+<div title="<%%= title_helper %>" class="memo">
+  <%%= head_helper :notice => false, :message => false %>
+  <p><%%= message_helper 'now_logged_in' %></p>
+  <p><%%= message_helper 'redirect' %></p>
       
+  <%%= link_helper 'welcome_logout', :action => 'logout' %>
 </div>