sorcery 0.1.0 → 0.2.0

data/lib/sorcery/model/submodules/remember_me.rb

@@ -1,6 +1,8 @@
 module Sorcery
   module Model
     module Submodules
+      # The Remember Me submodule takes care of setting the user's cookie so that he will be automatically logged in to the site on every visit,
+      # until the cookie expires.
       module RememberMe
         def self.included(base)
           base.sorcery_config.class_eval do
@@ -22,13 +24,15 @@ module Sorcery
         end
         
         module InstanceMethods
+          # You shouldn't really use this one yourself - it's called by the controller's 'remember_me!' method.
           def remember_me!
             config = sorcery_config
-            self.send(:"#{config.remember_me_token_attribute_name}=", generate_random_code)
+            self.send(:"#{config.remember_me_token_attribute_name}=", generate_random_token)
             self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", Time.now + config.remember_me_for)
             self.save!(:validate => false)
           end
-
+          
+          # You shouldn't really use this one yourself - it's called by the controller's 'forget_me!' method.
           def forget_me!
             config = sorcery_config
             self.send(:"#{config.remember_me_token_attribute_name}=", nil)

data/lib/sorcery/model/submodules/reset_password.rb

@@ -0,0 +1,96 @@
+module Sorcery
+  module Model
+    module Submodules
+      # This submodule adds the ability to reset password via email confirmation.
+      # When the user requests an email is sent to him with a url.
+      # The url includes a token, which is also saved with the user's record in the db.
+      # The token has configurable expiration.
+      # When the user clicks the url in the email, providing the token has not yet expired, he will be able to reset his password via a form.
+      #
+      # When using this submodule, supplying a mailer is mandatory.
+      module ResetPassword       
+        def self.included(base)
+          base.sorcery_config.class_eval do
+            attr_accessor :reset_password_token_attribute_name,              # reset password code attribute name.
+                          :reset_password_token_expires_at_attribute_name,   # expires at attribute name.
+                          :reset_password_email_sent_at_attribute_name,      # when was email sent, used for hammering protection.
+                          :reset_password_mailer,                            # mailer class. Needed.
+                          :reset_password_email_method_name,                 # reset password email method on your mailer class.
+                          :reset_password_expiration_period,                 # how many seconds before the reset request expires. nil for never expires.
+                          :reset_password_time_between_emails                # hammering protection, how long to wait before allowing another email to be sent.
+
+          end
+          
+          base.sorcery_config.instance_eval do
+            @defaults.merge!(:@reset_password_token_attribute_name            => :reset_password_token,
+                             :@reset_password_token_expires_at_attribute_name => :reset_password_token_expires_at,
+                             :@reset_password_email_sent_at_attribute_name    => :reset_password_email_sent_at,
+                             :@reset_password_mailer                          => nil,
+                             :@reset_password_email_method_name               => :reset_password_email,
+                             :@reset_password_expiration_period               => nil,
+                             :@reset_password_time_between_emails             => 5.minutes )
+
+            reset!
+          end
+          
+          base.sorcery_config.after_config << :validate_mailer_defined
+          
+          base.extend(ClassMethods)
+          base.send(:include, TemporaryToken)
+          base.send(:include, InstanceMethods)
+        end
+        
+        module ClassMethods
+          # Find user by token, also checks for expiration.
+          # Returns the user if token found and is valid.
+          def load_from_reset_password_token(token)
+            token_attr_name = @sorcery_config.reset_password_token_attribute_name
+            token_expiration_date_attr = @sorcery_config.reset_password_token_expires_at_attribute_name
+            load_from_token(token, token_attr_name, token_expiration_date_attr)
+          end
+          
+          protected
+          
+          # This submodule requires the developer to define his own mailer class to be used by it.
+          def validate_mailer_defined
+            msg = "To use reset_password submodule, you must define a mailer (config.reset_password_mailer = YourMailerClass)."
+            raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil
+          end
+
+        end
+        
+        module InstanceMethods
+          # generates a reset code with expiration and sends an email to the user.
+          def deliver_reset_password_instructions!
+            config = sorcery_config
+            # hammering protection
+            return if config.reset_password_time_between_emails && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.ago.utc
+            self.send(:"#{config.reset_password_token_attribute_name}=", generate_random_token)
+            self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", Time.now.utc + config.reset_password_expiration_period) if config.reset_password_expiration_period
+            self.send(:"#{config.reset_password_email_sent_at_attribute_name}=", Time.now.utc)
+            self.class.transaction do
+              self.save!(:validate => false)
+              generic_send_email(:reset_password_email_method_name, :reset_password_mailer)
+            end
+          end
+          
+          # Clears token and tries to update the new password for the user.
+          def reset_password!(params)
+            clear_reset_password_token
+            update_attributes(params)
+          end
+
+          protected
+
+          # Clears the token.
+          def clear_reset_password_token
+            config = sorcery_config
+            self.send(:"#{config.reset_password_token_attribute_name}=", nil)
+            self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", nil) if config.reset_password_expiration_period
+          end
+        end
+        
+      end
+    end
+  end
+end

data/lib/sorcery/model/submodules/user_activation.rb

@@ -8,27 +8,33 @@ module Sorcery
       module UserActivation
         def self.included(base)
           base.sorcery_config.class_eval do
-            attr_accessor :activation_state_attribute_name,         # the attribute name to hold activation state (active/pending).
-                          :activation_code_attribute_name,          # the attribute name to hold activation code (sent by email).
-                          :sorcery_mailer,                          # your mailer class. Needed.
-                          :activation_needed_email_method_name,     # activation needed email method on your mailer class.
-                          :activation_success_email_method_name,    # activation success email method on your mailer class.
-                          :prevent_non_active_users_to_login        # do you want to prevent or allow users that did not activate by email to login?
+            attr_accessor :activation_state_attribute_name,               # the attribute name to hold activation state (active/pending).
+                          :activation_token_attribute_name,               # the attribute name to hold activation code (sent by email).
+                          :activation_token_expires_at_attribute_name,    # the attribute name to hold activation code expiration date. 
+                          :activation_token_expiration_period,            # how many seconds before the activation code expires. nil for never expires.
+                          :user_activation_mailer,                        # your mailer class. Required.
+                          :activation_needed_email_method_name,           # activation needed email method on your mailer class.
+                          :activation_success_email_method_name,          # activation success email method on your mailer class.
+                          :prevent_non_active_users_to_login              # do you want to prevent or allow users that did not activate by email to login?
           end
           
           base.sorcery_config.instance_eval do
-            @defaults.merge!(:@activation_state_attribute_name      => :activation_state,
-                             :@activation_code_attribute_name       => :activation_code,
-                             :@sorcery_mailer                       => nil,
-                             :@activation_needed_email_method_name  => :activation_needed_email,
-                             :@activation_success_email_method_name => :activation_success_email,
-                             :@prevent_non_active_users_to_login    => true)
+            @defaults.merge!(:@activation_state_attribute_name             => :activation_state,
+                             :@activation_token_attribute_name             => :activation_token,
+                             :@activation_token_expires_at_attribute_name  => :activation_token_expires_at,
+                             :@activation_token_expiration_period          => nil,
+                             :@user_activation_mailer                      => nil,
+                             :@activation_needed_email_method_name         => :activation_needed_email,
+                             :@activation_success_email_method_name        => :activation_success_email,
+                             :@prevent_non_active_users_to_login           => true)
             reset!
           end
           
           base.class_eval do
-            before_create :setup_activation
-            after_create :send_activation_needed_email!
+            # don't setup activation if no password supplied - this user is created automatically
+            before_create :setup_activation, :if => Proc.new { |user| user.send(sorcery_config.password_attribute_name).present? }
+            # don't send activation needed email if no crypted password created - this user is external (OAuth etc.)
+            after_create  :send_activation_needed_email!, :if => Proc.new { |user| !user.external?}
           end
           
           base.sorcery_config.after_config << :validate_mailer_defined
@@ -36,40 +42,55 @@ module Sorcery
           base.sorcery_config.before_authenticate << :prevent_non_active_login
           
           base.extend(ClassMethods)
+          base.send(:include, TemporaryToken)
           base.send(:include, InstanceMethods)
         end
         
         module ClassMethods
+          # Find user by token, also checks for expiration.
+          # Returns the user if token found and is valid.
+          def load_from_activation_token(token)
+            token_attr_name = @sorcery_config.activation_token_attribute_name
+            token_expiration_date_attr = @sorcery_config.activation_token_expires_at_attribute_name
+            load_from_token(token, token_attr_name, token_expiration_date_attr)
+          end
+          
+          protected
+          
+          # This submodule requires the developer to define his own mailer class to be used by it.
           def validate_mailer_defined
-            msg = "To use user_activation submodule, you must define a mailer (config.sorcery_mailer = YourMailerClass)."
-            raise ArgumentError, msg if @sorcery_config.sorcery_mailer == nil
+            msg = "To use user_activation submodule, you must define a mailer (config.user_activation_mailer = YourMailerClass)."
+            raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil
           end
         end
         
         module InstanceMethods
+          # clears activation code, sets the user as 'active' and optionaly sends a success email.
           def activate!
             config = sorcery_config
-            self.send(:"#{config.activation_code_attribute_name}=", nil)
+            self.send(:"#{config.activation_token_attribute_name}=", nil)
             self.send(:"#{config.activation_state_attribute_name}=", "active")
-            send_activation_success_email!
+            send_activation_success_email! unless self.external?
             save!(:validate => false) # don't run validations
           end
-
+          
           protected
 
           def setup_activation
             config = sorcery_config
-            generated_activation_code = CryptoProviders::SHA1.encrypt( Time.now.to_s.split(//).sort_by {rand}.join )
-            self.send(:"#{config.activation_code_attribute_name}=", generated_activation_code)
+            generated_activation_token = generate_random_token
+            self.send(:"#{config.activation_token_attribute_name}=", generated_activation_token)
             self.send(:"#{config.activation_state_attribute_name}=", "pending")
+            self.send(:"#{config.activation_token_expires_at_attribute_name}=", Time.now.utc + config.activation_token_expiration_period) if config.activation_token_expiration_period
           end
 
+          # called automatically after user initial creation.
           def send_activation_needed_email!
-            generic_send_email(:activation_needed_email_method_name) unless sorcery_config.activation_needed_email_method_name.nil?
+            generic_send_email(:activation_needed_email_method_name, :user_activation_mailer) unless sorcery_config.activation_needed_email_method_name.nil?
           end
 
           def send_activation_success_email!
-            generic_send_email(:activation_success_email_method_name) unless sorcery_config.activation_success_email_method_name.nil?
+            generic_send_email(:activation_success_email_method_name, :user_activation_mailer) unless sorcery_config.activation_success_email_method_name.nil?
           end
           
           def prevent_non_active_login

data/lib/sorcery/model/temporary_token.rb

@@ -0,0 +1,22 @@
+module Sorcery
+  module Model
+    # This module encapsulates the logic for temporary token.
+    # A temporary token is created to identify a user in scenarios such as reseting password and activating the user by email.
+    module TemporaryToken
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+      
+      module ClassMethods
+        def load_from_token(token, token_attr_name, token_expiration_date_attr)
+          return nil if token.blank?
+          user = where("#{token_attr_name} = ?", token).first
+          if !user.blank? && !user.send(token_expiration_date_attr).nil?
+            return Time.now.utc < user.send(token_expiration_date_attr) ? user : nil
+          end
+          user
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model.rb

@@ -52,10 +52,17 @@ module Sorcery
       def authenticate(*credentials)
         raise ArgumentError, "at least 2 arguments required" if credentials.size < 2
         user = where("#{@sorcery_config.username_attribute_name} = ?", credentials[0]).first
-        salt = user.send(@sorcery_config.salt_attribute_name) if user && !@sorcery_config.salt_attribute_name.nil?
-        user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && (user.send(@sorcery_config.crypted_password_attribute_name)) == encrypt(credentials[1],salt)
+        _salt = user.send(@sorcery_config.salt_attribute_name) if user && !@sorcery_config.salt_attribute_name.nil? && !@sorcery_config.encryption_provider.nil?
+        user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && credentials_match?(user.send(@sorcery_config.crypted_password_attribute_name),credentials[1],_salt)
       end
       
+      # Calls the configured encryption provider to compare the supplied password with the encrypted one.
+      def credentials_match?(crypted, *tokens)
+        return crypted == tokens.join if @sorcery_config.encryption_provider.nil?
+        @sorcery_config.encryption_provider.matches?(crypted, *tokens)
+      end
+      
+      # encrypt tokens using current encryption_provider.
       def encrypt(*tokens)
         return tokens.first if @sorcery_config.encryption_provider.nil?
         
@@ -72,14 +79,20 @@ module Sorcery
         self.class.sorcery_config
       end
       
+      # identifies whether this user is regular, i.e. we hold his credentials in our db,
+      # or that he is external, and his credentials are saved elsewhere (twitter/facebook etc.).
+      def external?
+        send(sorcery_config.crypted_password_attribute_name).nil?
+      end
+      
       protected
       
       # creates new salt and saves it.
       # encrypts password with salt and save it.
       def encrypt_password
         config = sorcery_config
-        self.send(:"#{config.salt_attribute_name}=", generate_random_code) if !config.salt_attribute_name.nil?
-        self.send(:"#{config.crypted_password_attribute_name}=", self.class.encrypt(self.send(config.password_attribute_name),salt))
+        new_salt = self.send(:"#{config.salt_attribute_name}=", generate_random_token) if !config.salt_attribute_name.nil?
+        self.send(:"#{config.crypted_password_attribute_name}=", self.class.encrypt(self.send(config.password_attribute_name),new_salt))
       end
 
       def clear_virtual_password
@@ -89,16 +102,16 @@ module Sorcery
       
       # calls the requested email method on the configured mailer
       # supports both the ActionMailer 3 way of calling, and the plain old Ruby object way.
-      def generic_send_email(method)
+      def generic_send_email(method, mailer)
         config = sorcery_config
-        mail = config.sorcery_mailer.send(config.send(method),self)
-        if defined?(ActionMailer) and config.sorcery_mailer.superclass == ActionMailer::Base
+        mail = config.send(mailer).send(config.send(method),self)
+        if defined?(ActionMailer) and config.send(mailer).superclass == ActionMailer::Base
           mail.deliver
         end
       end
       
       # Random code, used for salt and temporary tokens.
-      def generate_random_code
+      def generate_random_token
         return Digest::SHA1.hexdigest( Time.now.to_s.split(//).sort_by {rand}.join )
       end
     end
@@ -131,7 +144,7 @@ module Sorcery
           :@password_attribute_name              => :password,
           :@email_attribute_name                 => :email,
           :@crypted_password_attribute_name      => :crypted_password,
-          :@encryption_algorithm                 => :sha256,
+          :@encryption_algorithm                 => :bcrypt,
           :@encryption_provider                  => CryptoProviders::BCrypt,
           :@custom_encryption_provider           => nil,
           :@encryption_key                       => nil,

data/lib/sorcery/test_helpers.rb

@@ -0,0 +1,84 @@
+module Sorcery
+  module TestHelpers
+    SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS = [:register_last_activity_time_to_db, :deny_banned_user, :validate_session]
+
+    def create_new_user(attributes_hash = nil)
+      user_attributes_hash = attributes_hash || {:username => 'gizmo', :email => "bla@bla.com", :password => 'secret'}
+      @user = User.new(user_attributes_hash)
+      @user.save!
+      @user
+    end
+
+    def create_new_external_user(provider, attributes_hash = nil)
+      user_attributes_hash = attributes_hash || {:username => 'gizmo', :authentications_attributes => [{:provider => provider, :uid => 123}]}
+      @user = User.new(user_attributes_hash)
+      @user.save!
+      @user
+    end
+    
+    def login_user(user = nil)
+      user ||= @user
+      subject.send(:login_user,user)
+      subject.send(:after_login!,user,[user.username,'secret'])
+    end
+
+    def logout_user
+      subject.send(:logout)
+    end
+
+    def clear_user_without_logout
+      subject.instance_variable_set(:@current_user,nil)
+    end
+
+    def sorcery_reload!(submodules = [], options = {})
+      reload_user_class
+
+      # return to no-module configuration
+      ::Sorcery::Controller::Config.init!
+      ::Sorcery::Controller::Config.reset!
+
+      # remove all plugin before_filters so they won't fail other tests.
+      # I don't like this way, but I didn't find another.
+      # hopefully it won't break until Rails 4.
+      ApplicationController._process_action_callbacks.delete_if {|c| SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS.include?(c.filter) }
+
+      # configure
+      ::Sorcery::Controller::Config.submodules = submodules
+      ::Sorcery::Controller::Config.user_class = nil
+      ActionController::Base.send(:include,::Sorcery::Controller)
+
+      User.activate_sorcery! do |config|
+        options.each do |property,value|
+          config.send(:"#{property}=", value)
+        end
+      end
+    end
+
+    def sorcery_model_property_set(property, *values)
+      User.class_eval do
+        sorcery_config.send(:"#{property}=", *values)
+      end
+    end
+
+    def sorcery_controller_property_set(property, value)
+      ApplicationController.activate_sorcery! do |config|
+        config.send(:"#{property}=", value)
+      end
+    end
+    
+    def sorcery_controller_oauth_property_set(provider, property, value)
+      ApplicationController.activate_sorcery! do |config|
+        config.send(provider).send(:"#{property}=", value)
+      end
+    end
+
+    private
+
+    # reload user class between specs
+    # so it will be possible to test the different submodules in isolation
+    def reload_user_class
+      Object.send(:remove_const,:User)
+      load 'user.rb'
+    end
+  end
+end

data/lib/sorcery.rb

@@ -1,10 +1,14 @@
 module Sorcery
   autoload :Model, 'sorcery/model'
   module Model
+    autoload :TemporaryToken, 'sorcery/model/temporary_token'
     module Submodules
       autoload :UserActivation, 'sorcery/model/submodules/user_activation'
-      autoload :PasswordReset, 'sorcery/model/submodules/password_reset'
+      autoload :ResetPassword, 'sorcery/model/submodules/reset_password'
       autoload :RememberMe, 'sorcery/model/submodules/remember_me'
+      autoload :ActivityLogging, 'sorcery/model/submodules/activity_logging'
+      autoload :BruteForceProtection, 'sorcery/model/submodules/brute_force_protection'
+      autoload :Oauth, 'sorcery/model/submodules/oauth'
     end
   end
   autoload :Controller, 'sorcery/controller'
@@ -13,6 +17,17 @@ module Sorcery
       autoload :RememberMe, 'sorcery/controller/submodules/remember_me'
       autoload :SessionTimeout, 'sorcery/controller/submodules/session_timeout'
       autoload :BruteForceProtection, 'sorcery/controller/submodules/brute_force_protection'
+      autoload :HttpBasicAuth, 'sorcery/controller/submodules/http_basic_auth'
+      autoload :ActivityLogging, 'sorcery/controller/submodules/activity_logging'
+      autoload :Oauth, 'sorcery/controller/submodules/oauth'
+      module Oauth
+        autoload :Oauth1, 'sorcery/controller/submodules/oauth/oauth1'
+        autoload :Oauth2, 'sorcery/controller/submodules/oauth/oauth2'
+        module Providers
+          autoload :Twitter, 'sorcery/controller/submodules/oauth/providers/twitter'
+          autoload :Facebook, 'sorcery/controller/submodules/oauth/providers/facebook'
+        end
+      end
     end
   end
   module CryptoProviders
@@ -23,6 +38,7 @@ module Sorcery
     autoload :SHA256, 'sorcery/crypto_providers/sha256'
     autoload :SHA512, 'sorcery/crypto_providers/sha512'
   end
+  autoload :TestHelpers, 'sorcery/test_helpers'
   
   require 'sorcery/engine' if defined?(Rails) && Rails::VERSION::MAJOR == 3
 end