sorcery 0.1.0

data/spec/rails3/app_root/public/javascripts/rails.js

@@ -0,0 +1,175 @@
+(function() {
+  // Technique from Juriy Zaytsev
+  // http://thinkweb2.com/projects/prototype/detecting-event-support-without-browser-sniffing/
+  function isEventSupported(eventName) {
+    var el = document.createElement('div');
+    eventName = 'on' + eventName;
+    var isSupported = (eventName in el);
+    if (!isSupported) {
+      el.setAttribute(eventName, 'return;');
+      isSupported = typeof el[eventName] == 'function';
+    }
+    el = null;
+    return isSupported;
+  }
+
+  function isForm(element) {
+    return Object.isElement(element) && element.nodeName.toUpperCase() == 'FORM'
+  }
+
+  function isInput(element) {
+    if (Object.isElement(element)) {
+      var name = element.nodeName.toUpperCase()
+      return name == 'INPUT' || name == 'SELECT' || name == 'TEXTAREA'
+    }
+    else return false
+  }
+
+  var submitBubbles = isEventSupported('submit'),
+      changeBubbles = isEventSupported('change')
+
+  if (!submitBubbles || !changeBubbles) {
+    // augment the Event.Handler class to observe custom events when needed
+    Event.Handler.prototype.initialize = Event.Handler.prototype.initialize.wrap(
+      function(init, element, eventName, selector, callback) {
+        init(element, eventName, selector, callback)
+        // is the handler being attached to an element that doesn't support this event?
+        if ( (!submitBubbles && this.eventName == 'submit' && !isForm(this.element)) ||
+             (!changeBubbles && this.eventName == 'change' && !isInput(this.element)) ) {
+          // "submit" => "emulated:submit"
+          this.eventName = 'emulated:' + this.eventName
+        }
+      }
+    )
+  }
+
+  if (!submitBubbles) {
+    // discover forms on the page by observing focus events which always bubble
+    document.on('focusin', 'form', function(focusEvent, form) {
+      // special handler for the real "submit" event (one-time operation)
+      if (!form.retrieve('emulated:submit')) {
+        form.on('submit', function(submitEvent) {
+          var emulated = form.fire('emulated:submit', submitEvent, true)
+          // if custom event received preventDefault, cancel the real one too
+          if (emulated.returnValue === false) submitEvent.preventDefault()
+        })
+        form.store('emulated:submit', true)
+      }
+    })
+  }
+
+  if (!changeBubbles) {
+    // discover form inputs on the page
+    document.on('focusin', 'input, select, texarea', function(focusEvent, input) {
+      // special handler for real "change" events
+      if (!input.retrieve('emulated:change')) {
+        input.on('change', function(changeEvent) {
+          input.fire('emulated:change', changeEvent, true)
+        })
+        input.store('emulated:change', true)
+      }
+    })
+  }
+
+  function handleRemote(element) {
+    var method, url, params;
+
+    var event = element.fire("ajax:before");
+    if (event.stopped) return false;
+
+    if (element.tagName.toLowerCase() === 'form') {
+      method = element.readAttribute('method') || 'post';
+      url    = element.readAttribute('action');
+      params = element.serialize();
+    } else {
+      method = element.readAttribute('data-method') || 'get';
+      url    = element.readAttribute('href');
+      params = {};
+    }
+
+    new Ajax.Request(url, {
+      method: method,
+      parameters: params,
+      evalScripts: true,
+
+      onComplete:    function(request) { element.fire("ajax:complete", request); },
+      onSuccess:     function(request) { element.fire("ajax:success",  request); },
+      onFailure:     function(request) { element.fire("ajax:failure",  request); }
+    });
+
+    element.fire("ajax:after");
+  }
+
+  function handleMethod(element) {
+    var method = element.readAttribute('data-method'),
+        url = element.readAttribute('href'),
+        csrf_param = $$('meta[name=csrf-param]')[0],
+        csrf_token = $$('meta[name=csrf-token]')[0];
+
+    var form = new Element('form', { method: "POST", action: url, style: "display: none;" });
+    element.parentNode.insert(form);
+
+    if (method !== 'post') {
+      var field = new Element('input', { type: 'hidden', name: '_method', value: method });
+      form.insert(field);
+    }
+
+    if (csrf_param) {
+      var param = csrf_param.readAttribute('content'),
+          token = csrf_token.readAttribute('content'),
+          field = new Element('input', { type: 'hidden', name: param, value: token });
+      form.insert(field);
+    }
+
+    form.submit();
+  }
+
+
+  document.on("click", "*[data-confirm]", function(event, element) {
+    var message = element.readAttribute('data-confirm');
+    if (!confirm(message)) event.stop();
+  });
+
+  document.on("click", "a[data-remote]", function(event, element) {
+    if (event.stopped) return;
+    handleRemote(element);
+    event.stop();
+  });
+
+  document.on("click", "a[data-method]", function(event, element) {
+    if (event.stopped) return;
+    handleMethod(element);
+    event.stop();
+  });
+
+  document.on("submit", function(event) {
+    var element = event.findElement(),
+        message = element.readAttribute('data-confirm');
+    if (message && !confirm(message)) {
+      event.stop();
+      return false;
+    }
+
+    var inputs = element.select("input[type=submit][data-disable-with]");
+    inputs.each(function(input) {
+      input.disabled = true;
+      input.writeAttribute('data-original-value', input.value);
+      input.value = input.readAttribute('data-disable-with');
+    });
+
+    var element = event.findElement("form[data-remote]");
+    if (element) {
+      handleRemote(element);
+      event.stop();
+    }
+  });
+
+  document.on("ajax:after", "form", function(event, element) {
+    var inputs = element.select("input[type=submit][disabled=true][data-disable-with]");
+    inputs.each(function(input) {
+      input.value = input.readAttribute('data-original-value');
+      input.removeAttribute('data-original-value');
+      input.disabled = false;
+    });
+  });
+})();

data/spec/rails3/app_root/public/robots.txt

@@ -0,0 +1,5 @@
+# See http://www.robotstxt.org/wc/norobots.html for documentation on how to use the robots.txt file
+#
+# To ban all spiders from the entire site uncomment the next two lines:
+# User-Agent: *
+# Disallow: /

data/spec/rails3/app_root/script/rails

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
+
+APP_PATH = File.expand_path('../../config/application',  __FILE__)
+require File.expand_path('../../config/boot',  __FILE__)
+require 'rails/commands'

data/spec/rails3/app_root/test/fixtures/users.yml

@@ -0,0 +1,9 @@
+# Read about fixtures at http://ar.rubyonrails.org/classes/Fixtures.html
+
+one:
+  email: MyString
+  crypted_password: MyString
+
+two:
+  email: MyString
+  crypted_password: MyString

data/spec/rails3/app_root/test/performance/browsing_test.rb

@@ -0,0 +1,9 @@
+require 'test_helper'
+require 'rails/performance_test_help'
+
+# Profiling results for each test method are written to tmp/performance.
+class BrowsingTest < ActionDispatch::PerformanceTest
+  def test_homepage
+    get '/'
+  end
+end

data/spec/rails3/app_root/test/test_helper.rb

@@ -0,0 +1,13 @@
+ENV["RAILS_ENV"] = "test"
+require File.expand_path('../../config/environment', __FILE__)
+require 'rails/test_help'
+
+class ActiveSupport::TestCase
+  # Setup all fixtures in test/fixtures/*.(yml|csv) for all tests in alphabetical order.
+  #
+  # Note: You'll currently still have to declare fixtures explicitly in integration tests
+  # -- they do not yet inherit this setting
+  fixtures :all
+
+  # Add more helper methods to be used by all tests here...
+end

data/spec/rails3/app_root/test/unit/user_test.rb

@@ -0,0 +1,8 @@
+require 'test_helper'
+
+class UserTest < ActiveSupport::TestCase
+  # Replace this with your real tests.
+  test "the truth" do
+    assert true
+  end
+end

data/spec/rails3/controller_brute_force_protection_spec.rb

@@ -0,0 +1,72 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe ApplicationController do
+  
+  # ----------------- SESSION TIMEOUT -----------------------
+  describe ApplicationController, "with brute force protection features" do
+    before(:all) do
+      plugin_model_configure([:brute_force_protection])
+      create_new_user
+    end
+    
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      plugin_set_controller_config_property(:user_class, User)
+    end
+    
+    it "should have configuration for 'login_retries_amount_allowed' per session" do
+      plugin_set_controller_config_property(:login_retries_amount_allowed, 32)
+      Sorcery::Controller::Config.login_retries_amount_allowed.should equal(32)
+    end
+    
+    it "should have configuration for 'login_retries_counter_reset_time'" do
+      plugin_set_controller_config_property(:login_retries_time_period, 32)
+      Sorcery::Controller::Config.login_retries_time_period.should equal(32)
+    end
+    
+    it "should count login retries per session" do
+      3.times {get :test_login, :username => 'gizmo', :password => 'blabla'}
+      session[:failed_logins].should == 3
+    end
+    
+    it "should reset the counter if enough time has passed" do
+      plugin_set_controller_config_property(:login_retries_amount_allowed, 5)
+      plugin_set_controller_config_property(:login_retries_time_period, 0.2)
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      sleep 0.4
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      session[:failed_logins].should == 1
+    end
+    
+    it "should ban session when number of retries reached within an amount of time" do
+      plugin_set_controller_config_property(:login_retries_amount_allowed, 1)
+      plugin_set_controller_config_property(:login_retries_time_period, 50)
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      session[:banned].should == true
+    end
+
+    it "should clear ban after ban time limit passes" do
+      plugin_set_controller_config_property(:login_retries_amount_allowed, 1)
+      plugin_set_controller_config_property(:login_retries_time_period, 50)
+      plugin_set_controller_config_property(:login_ban_time_period, 0.2)
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      session[:banned].should == true
+      sleep 0.3
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      session[:banned].should == nil
+    end
+    
+    it "banned session calls the configured banned action" do
+      plugin_set_controller_config_property(:login_retries_amount_allowed, 1)
+      plugin_set_controller_config_property(:login_retries_time_period, 50)
+      plugin_set_controller_config_property(:login_ban_time_period, 50)
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      get :test_login, :username => 'gizmo', :password => 'blabla'
+      session[:banned].should == true
+      response.body.should == " "
+    end
+  end
+end

data/spec/rails3/controller_remember_me_spec.rb

@@ -0,0 +1,65 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe ApplicationController do
+  
+  # ----------------- REMEMBER ME -----------------------
+  describe ApplicationController, "with remember me features" do
+    before(:all) do
+      ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/remember_me")
+      plugin_model_configure([:remember_me])
+    end
+    
+    before(:each) do
+      create_new_user
+    end
+    
+    after(:all) do
+      ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/remember_me")
+    end
+    
+    after(:each) do
+      session = nil
+      cookies = nil
+      User.delete_all
+    end
+    
+    it "should set cookie on remember_me!" do
+      post :test_login_with_remember, :username => 'gizmo', :password => 'secret'
+      cookies["remember_me_token"].should == assigns[:logged_in_user].remember_me_token
+    end
+    
+    it "should clear cookie on forget_me!" do
+      cookies["remember_me_token"] == {:value => 'asd54234dsfsd43534', :expires => 3600}
+      get :test_logout
+      cookies["remember_me_token"].should == nil
+    end
+    
+    it "login(username,password,remember_me) should login and remember" do
+      post :test_login_with_remember_in_login, :username => 'gizmo', :password => 'secret', :remember => "1"
+      cookies["remember_me_token"].should_not be_nil
+      cookies["remember_me_token"].should == assigns[:user].remember_me_token
+    end
+    
+    it "logout should also forget_me!" do
+      session[:user_id] = @user.id
+      get :test_logout_with_remember
+      cookies["remember_me_token"].should == nil
+    end
+    
+    it "should login_from_cookie" do
+      session[:user_id] = @user.id
+      subject.remember_me!
+      subject.instance_eval do
+        @logged_in_user = nil
+      end
+      session[:user_id] = nil
+      get :test_login_from_cookie
+      assigns[:logged_in_user].should == @user
+    end
+    
+    it "should not remember_me! when not asked to" do
+      post :test_login, :username => 'gizmo', :password => 'secret'
+      cookies["remember_me_token"].should == nil
+    end
+  end
+end

data/spec/rails3/controller_session_timeout_spec.rb

@@ -0,0 +1,49 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe ApplicationController do
+  
+  # ----------------- SESSION TIMEOUT -----------------------
+  describe ApplicationController, "with session timeout features" do
+    before(:all) do
+      plugin_model_configure([:session_timeout])
+      plugin_set_controller_config_property(:session_timeout,0.5)
+      create_new_user
+    end
+    
+    it "should not reset session before session timeout" do
+      login_user
+      get :test_should_be_logged_in
+      session[:user_id].should_not be_nil
+      response.should be_a_success
+    end
+    
+    it "should reset session after session timeout" do
+      login_user
+      sleep 0.6
+      get :test_should_be_logged_in
+      session[:user_id].should be_nil
+      response.should be_a_redirect
+    end
+    
+    it "with 'session_timeout_from_last_action' should not logout if there was activity" do
+      plugin_set_controller_config_property(:session_timeout_from_last_action, true)
+      login_user
+      sleep 0.3
+      get :test_should_be_logged_in
+      session[:user_id].should_not be_nil
+      sleep 0.3
+      get :test_should_be_logged_in
+      session[:user_id].should_not be_nil
+      response.should be_a_success
+    end
+    
+    it "with 'session_timeout_from_last_action' should logout if there was no activity" do
+      plugin_set_controller_config_property(:session_timeout_from_last_action, true)
+      login_user
+      sleep 0.6
+      get :test_should_be_logged_in
+      session[:user_id].should be_nil
+      response.should be_a_redirect
+    end
+  end
+end

data/spec/rails3/controller_spec.rb

@@ -0,0 +1,115 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe ApplicationController do
+ 
+  # ----------------- PLUGIN CONFIGURATION -----------------------
+  describe ApplicationController, "plugin configuration" do
+    before(:all) do
+      plugin_model_configure
+    end
+    
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      plugin_model_configure
+    end
+    
+    it "should enable configuration option 'user_class'" do
+      plugin_set_controller_config_property(:user_class, TestUser)
+      Sorcery::Controller::Config.user_class.should equal(TestUser)
+    end
+    
+    it "should enable configuration option 'not_authenticated_action'" do
+      plugin_set_controller_config_property(:not_authenticated_action, :my_action)
+      Sorcery::Controller::Config.not_authenticated_action.should equal(:my_action)
+    end
+    
+  end
+
+  # ----------------- PLUGIN ACTIVATED -----------------------
+  describe ApplicationController, "when activated with sorcery" do
+    before(:all) do
+      User.delete_all
+      create_new_user
+    end
+  
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      plugin_set_controller_config_property(:user_class, User)
+    end
+    
+    it "should respond to the instance method login" do
+      should respond_to(:login)
+    end
+  
+    it "should respond to the instance method logout" do
+      should respond_to(:logout)
+    end
+  
+    it "should respond to the instance method logged_in?" do
+      should respond_to(:logged_in?)
+    end
+    
+    it "should respond to the instance method logged_in_user" do
+      should respond_to(:logged_in_user)
+    end
+  
+    it "login(username,password) should return the user when success and set the session with user.id" do
+      get :test_login, :username => 'gizmo', :password => 'secret'
+      assigns[:user].should == @user
+      session[:user_id].should == @user.id
+    end
+  
+    it "login(username,password) should return nil and not set the session when failure" do
+      get :test_login, :username => 'gizmo', :password => 'opensesame!'
+      assigns[:user].should be_nil
+      session[:user_id].should be_nil
+    end
+  
+    it "logout should clear the session" do
+      cookies[:remember_me_token] = nil
+      session[:user_id] = @user.id
+      get :test_logout
+      session[:user_id].should be_nil
+    end
+  
+    it "logged_in? should return true if logged in" do
+      session[:user_id] = @user.id
+      subject.logged_in?.should be_true
+    end
+  
+    it "logged_in? should return false if not logged in" do
+      session[:user_id] = nil
+      subject.logged_in?.should be_false
+    end
+    
+    it "logged_in_user should return the user instance if logged in" do
+      create_new_user
+      session[:user_id] = @user.id
+      subject.logged_in_user.should == @user
+    end
+    
+    it "logged_in_user should return false if not logged in" do
+      session[:user_id] = nil
+      subject.logged_in_user.should == false
+    end
+    
+    it "should respond to 'require_user_login'" do
+      should respond_to(:require_user_login)
+    end
+    
+    it "should call the configured 'not_authenticated_action' when authenticate before_filter fails" do
+      session[:user_id] = nil
+      plugin_set_controller_config_property(:not_authenticated_action, :test_not_authenticated_action)
+      get :test_logout
+      response.body.should == "test_not_authenticated_action"
+    end
+    
+    it "require_user_login before_filter should save the url that the user originally wanted" do
+      get :some_action
+      session[:user_wanted_url].should == "http://test.host/some_action"
+      response.should redirect_to("http://test.host/")
+    end
+    
+  end
+  
+end