sorcery 0.1.1 → 0.2.0

data/Gemfile

@@ -2,17 +2,18 @@ source "http://rubygems.org"
 # Add dependencies required to use your gem here.
 # Example:
 #   gem "activesupport", ">= 2.3.5"
-
+gem "rails", ">= 3.0.0"
+gem 'json', ">= 1.5.1"
+gem 'oauth', ">= 0.4.4"
+gem 'oauth2', ">= 0.1.1"
 # Add dependencies to develop your gem here.
 # Include everything needed to run rake, tests, features, etc.
 group :development do
-  gem "rails", "3.0.3"
   gem "rspec", "~> 2.3.0"
   gem 'rspec-rails'
   gem 'ruby-debug19'
   gem 'sqlite3-ruby', :require => 'sqlite3'
   gem "yard", "~> 0.6.0"
-  gem "cucumber", ">= 0"
   gem "bundler", "~> 1.0.0"
   gem "jeweler", "~> 1.5.2"
   gem 'simplecov', '>= 0.3.8', :require => false # Will install simplecov-html as a dependency

data/Gemfile.lock

@@ -28,29 +28,25 @@ GEM
       activemodel (= 3.0.3)
       activesupport (= 3.0.3)
     activesupport (3.0.3)
+    addressable (2.2.4)
     archive-tar-minitar (0.5.2)
     arel (2.0.6)
     builder (2.1.2)
     columnize (0.3.2)
-    cucumber (0.10.0)
-      builder (>= 2.1.2)
-      diff-lcs (~> 1.1.2)
-      gherkin (~> 2.3.2)
-      json (~> 1.4.6)
-      term-ansicolor (~> 1.0.5)
     diff-lcs (1.1.2)
     erubis (2.6.6)
       abstract (>= 1.0.0)
-    gherkin (2.3.2)
-      json (~> 1.4.6)
-      term-ansicolor (~> 1.0.5)
+    faraday (0.5.5)
+      addressable (~> 2.2.4)
+      multipart-post (~> 1.1.0)
+      rack (>= 1.1.0, < 2)
     git (1.2.5)
     i18n (0.5.0)
     jeweler (1.5.2)
       bundler (~> 1.0.0)
       git (>= 1.2.5)
       rake
-    json (1.4.6)
+    json (1.5.1)
     linecache19 (0.5.11)
       ruby_core_source (>= 0.1.4)
     mail (2.2.13)
@@ -59,6 +55,12 @@ GEM
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
     mime-types (1.16)
+    multi_json (0.0.5)
+    multipart-post (1.1.0)
+    oauth (0.4.4)
+    oauth2 (0.1.1)
+      faraday (~> 0.5.0)
+      multi_json (~> 0.0.4)
     polyglot (0.3.1)
     rack (1.2.1)
     rack-mount (0.6.13)
@@ -106,7 +108,6 @@ GEM
       simplecov-html (>= 0.3.7)
     simplecov-html (0.3.9)
     sqlite3-ruby (1.3.2)
-    term-ansicolor (1.0.5)
     thor (0.14.6)
     treetop (1.4.9)
       polyglot (>= 0.3.1)
@@ -118,9 +119,11 @@ PLATFORMS
 
 DEPENDENCIES
   bundler (~> 1.0.0)
-  cucumber
   jeweler (~> 1.5.2)
-  rails (= 3.0.3)
+  json (>= 1.5.1)
+  oauth (>= 0.4.4)
+  oauth2 (>= 0.1.1)
+  rails (>= 3.0.0)
   rspec (~> 2.3.0)
   rspec-rails
   ruby-debug19

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2010 Noam Ben-Ari
+Copyright (c) 2010 Noam Ben-Ari <mailto:nbenari@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.rdoc

@@ -3,56 +3,88 @@ Magical Authentication for Rails 3.
 
 Inspired by restful_authentication, Authlogic and Devise.
 Crypto code taken almost unchanged from Authlogic.
+OAuth code inspired by OmniAuth.
 
-== Example app using sorcery:
+== Summary
 
-https://github.com/NoamB/sorcery-example-app
+Sorcery aims to make your life easier by giving you an easy API to write your own user authentication flow with.
+It does this with a few goals in mind:
 
-== Current Features:
+* Less is more - less than 20 simple methods to remember for the entire feature-set make the lib easy to 'get'.
+* No built-in or generated code - use the API inside *your own* MVC structures, and don't fight to fix someone else's.
+* Magic yes, Voodoo no - the lib should be easy to hack for most developers.
+* Configuration over Confusion - Simple & short configuration as possible, not drowning in syntactic sugar.
+* Keep MVC cleanly separated - DB is for models, sessions are for controllers. Models stay unaware of sessions.
+
+Hopefully, I've achieved this. If not, let me know.
+
+== Useful Links:
+
+Example app using sorcery: https://github.com/NoamB/sorcery-example-app
 
-* Basic Login/Logout.
-* Password encryption with configurable algorithm.
+Documentation: http://rubydoc.info/gems/sorcery/0.1.4/frames
+
+== Full Features List by module:
+
+Core (see lib/sorcery/model/model.rb and lib/sorcery/controller/controller.rb): 
+* login/logout, optional return user to requested url on login, configurable redirect for non-logged-in users.
+* password encryption, algorithms: bcrypt(default), md5, sha1, sha256, sha512, aes256, custom(yours!), none. Configurable stretches and salt.
+* configurable attribute names for username, password and email.
+
+User Activation (see lib/sorcery/model/submodules/user_activation.rb):
 * User activation by email with optional success email.
+* configurable attribute names.
+* configurable mailer, method name, and attribute name.
+* configurable temporary token expiration.
+* Optionally prevent non-active users to login.
+
+Reset Password (see lib/sorcery/model/submodules/reset_password.rb):
 * Reset password with email verification.
+* configurable mailer, method name, and attribute name.
+* configurable temporary token expiration.
+* configurable time between emails (hammering protection).
+
+Remember Me (see lib/sorcery/model/submodules/remember_me.rb):
 * Remember me with configurable expiration.
+* configurable attribute names.
+
+Session Timeout (see lib/sorcery/controller/submodules/session_timeout.rb):
 * Configurable session timeout.
-* Brute force login hammering protection.
-* Modular design, load only the modules you need.
-* 100% TDD'd code, 100% test coverage.
+* Optionally session timeout will be calculated from last user action.
 
-== Planned Features:
+Brute Force Protection (see lib/sorcery/model/submodules/brute_force_protection.rb):
+* Brute force login hammering protection.
+* configurable logins before lock and lock duration.
 
-I've got many plans which include:
-* Basic HTTP Authentication
-* Auto login
-* Hammering reset password protection
-* Other reset password strategies (security questions?)
-* Sinatra support
-* Mongoid support
-* OmniAuth integration
-* Activity logging
-* Have an idea? Let me know, and it might get into the gem!
+Basic HTTP Authentication (see lib/sorcery/controller/submodules/http_basic_auth.rb):
+* A before filter for requesting authentication with HTTP Basic.
+* automatic login from HTTP Basic.
+* automatic login is disabled if session key changed.
 
-== Project Goals:
+Activity Logging (see lib/sorcery/model/submodules/activity_logging.rb):
+* automatic logging of last login, last logout and last activity time.
+* an easy method of collecting the list of currently logged in users.
+* configurable timeout by which to decide whether to include a user in the list of logged in users.
 
-This gem plugin was started out of a few personal goals which are not related to the problem solved by it at all:
-* I wanted to write something 100% TDD from start to finish.
-* I wanted to learn how to write an engine for Rails 3.
+Oauth (see lib/sorcery/controller/submodules/oauth.rb):
+* OAuth1 and OAuth2 support (currently twitter & facebook)
+* configurable db field names and authentications table.
 
-In addition to the above goals, when I decided this will be an authentication plugin, and while looking at existing solutions, these goals came up:
-* Simple & short configuration as possible, not drowning in syntactic sugar.
-* Keep MVC cleanly separated - DB is for models, sessions are for controllers. Models stay unaware of sessions.
-* Magic yes, Voodoo no.
-* No generated code polluting the application's code.
-* No built-in controllers, models, mailers, migrations or templates; Real apps will need all of these custom made.
+== Next Planned Features:
 
-Hopefully, I've achieved this. If not, let me know.
+I've got many plans which include (by priority):
+* Sinatra support
+* Mongoid support
+* Configurable Auto login on registration/activation
+* Other reset password strategies (security questions?)
+* Other brute force protection strategies (captcha)
+* Have an idea? Let me know, and it might get into the gem!
 
 == Installation:
 
-You can either git clone and then 'rake install',
+You can either git clone and then 'rake install' to live on the edge (unstable),
 
-In the future will be available:
+Or simply (stable):
 
 	gem install sorcery
 
@@ -80,7 +112,7 @@ For example:
 2. app/models/user.rb (or another model of your choice)
 
 	activate_sorcery! do |config|
-  	  config.sorcery_mailer = MyMailer
+  	  config.user_activation_mailer = MyMailer
 	  config.username_attribute_name = :email
 	end
 
@@ -92,45 +124,27 @@ For example:
 
 Also check the migrations in the example app to see what database fields are expected.
 
-
-
 The configuration options vary with the modules you've chosen to use.
 
-== Basic Configuration (in Model):
-
-see lib/sorcery/model.rb
-
-== User Activation Configuration (in Model):
-
-see lib/sorcery/model/submodules/user_activation.rb
-
-== Remember Me Configuration (in Model):
-
-see lib/sorcery/model/submodules/remember_me.rb
-
-== Password Reset Configuration (in Model):
-
-see lib/sorcery/model/submodules/password_reset.rb
-
-
-
-== Session Timeout Configuration (in Controller or config/application.rb):
-
-see lib/sorcery/controller/submodules/session_timeout.rb
-
-== Brute Force Protection Configuration (in Controller or config/application.rb):
-
-see lib/sorcery/controller/submodules/brute_force_protection.rb
 
+== Contributing to sorcery
 
+Your feedback is very welcome and will make this gem much much better for you, me and everyone else.
+Besides feedback on code, features, suggestions and bug reports, you may want to actually make an impact on the code.
+For this:
 
-== Contributing to sorcery
+* Fork the project.
+* Make your feature addition or bug fix.
+* Add tests for it. This is important so I don’t break it in a future version unintentionally.
+* Commit, do not mess with Rakefiles, version, or history. (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
+* Send me a pull request. Bonus points for topic branches.
 
-I can use help of any kind, be it comments on code (code review), suggestions, features, bug reports, bug fixes and even a donation.
+If you feel my work has made your life easier, and you would like to thank me through a donation, my paypal email is in the contact details.
 
 == Contact
 
-	email: nbenari@gmail.com
+	email: nbenari@gmail.com ( also for paypal )
+	twitter: @nbenari
 	
 == Copyright
 

data/Rakefile

@@ -1,4 +1,5 @@
 # require 'bundler'
+# -- Commented because it's slow
 # begin
 #   Bundler.setup(:default, :development)
 # rescue Bundler::BundlerError => e
@@ -6,6 +7,8 @@
 #   $stderr.puts "Run `bundle install` to install missing gems"
 #   exit e.status_code
 # end
+# --
+
 require 'rake'
 
 require 'jeweler'
@@ -22,31 +25,22 @@ Jeweler::Tasks.new do |gem|
   # and development dependencies are only needed for development (ie running rake tasks, tests, etc)
   #  gem.add_runtime_dependency 'jabber4r', '> 0.1'
   #  gem.add_development_dependency 'rspec', '> 1.2.3'
-  #  gem.add_runtime_dependency 'bcrypt-ruby', '~> 2.1.4'
+  gem.add_runtime_dependency 'bcrypt-ruby', '~> 2.1.4'
+  gem.add_runtime_dependency 'oauth', '>= 0.4.4'
+  gem.add_runtime_dependency 'oauth2', '>= 0.1.1'
 end
 Jeweler::RubygemsDotOrgTasks.new
 
 require 'rspec/core'
 require 'rspec/core/rake_task'
+
 RSpec::Core::RakeTask.new(:spec) do |spec|
   spec.pattern = FileList['spec/**/*_spec.rb']
 end
 
-RSpec::Core::RakeTask.new(:rcov) do |spec|
-  spec.pattern = 'spec/**/*_spec.rb'
-  spec.rcov = true
-end
-
-require 'cucumber/rake/task'
-Cucumber::Rake::Task.new(:features)
-
-
-
 require 'yard'
 YARD::Rake::YardocTask.new
 
-
-#task :default => :spec
 desc 'Default: Run all specs.'
 task :default => :all_specs
 

data/VERSION

@@ -1 +1 @@
-0.1.1
+0.2.0

data/lib/sorcery/controller/submodules/activity_logging.rb

@@ -0,0 +1,58 @@
+module Sorcery
+  module Controller
+    module Submodules
+      # This submodule keeps track of events such as login, logout, and last activity time, per user.
+      # It helps in estimating which users are active now in the site.
+      # This cannot be determined absolutely because a user might be reading a page without clicking anything for a while.
+      
+      # This is the controller part of the submodule, which adds hooks to register user events, 
+      # and methods to collect active users data for use in the app.
+      # see Socery::Model::Submodules::ActivityLogging for configuration options.
+      module ActivityLogging
+        def self.included(base)
+          base.send(:include, InstanceMethods)
+          Config.after_login << :register_login_time_to_db
+          Config.before_logout << :register_logout_time_to_db
+          base.after_filter :register_last_activity_time_to_db
+        end
+        
+        module InstanceMethods
+          # Returns an array of the active users.
+          def current_users
+            Config.user_class.current_users
+            # A possible patch here:
+            # we'll add the current_user to the users list if he's not in it (can happen when he was inactive for more than activity timeout):
+            #
+            #   users.unshift!(current_user) if logged_in? && users.find {|u| u.id == current_user.id}.nil?
+            #
+            # disadvantages: can hurt performance.
+          end
+          
+          protected
+          
+          # registers last login time on every login.
+          # This runs as a hook just after a successful login.
+          def register_login_time_to_db(user, credentials)
+            user.send(:"#{user.sorcery_config.last_login_at_attribute_name}=", Time.now.utc.to_s(:db))
+            user.save!(:validate => false)
+          end
+          
+          # registers last logout time on every logout.
+          # This runs as a hook just before a logout.
+          def register_logout_time_to_db(user)
+            user.send(:"#{user.sorcery_config.last_logout_at_attribute_name}=", Time.now.utc.to_s(:db))
+            user.save!(:validate => false)
+          end
+          
+          # Updates last activity time on every request.
+          # The only exception is logout - we do not update activity on logout
+          def register_last_activity_time_to_db
+            return if !logged_in?
+            current_user.send(:"#{current_user.sorcery_config.last_activity_at_attribute_name}=", Time.now.utc.to_s(:db))
+            current_user.save!(:validate => false)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -1,86 +1,32 @@
 module Sorcery
   module Controller
     module Submodules
+      # This module helps protect user accounts by locking them down after too many failed attemps to login were detected.
+      # This is the controller part of the submodule which takes care of updating the failed logins and resetting them.
+      # See Sorcery::Model::Submodules::BruteForceProtection for configuration options.
       module BruteForceProtection
         def self.included(base)
           base.send(:include, InstanceMethods)
-          Config.module_eval do
-            class << self
-              attr_accessor :login_retries_amount_allowed,      # how many failed logins allowed.
-                            :login_retries_time_period,         # the time after which the failed logins counter is reset.
-                            :login_ban_time_period,             # how long the user should be banned. in seconds.
-                            :banned_action                      # what controller action should be called when a banned user tries.
-                            
-              def merge_brute_force_protection_defaults!
-                @defaults.merge!(:@login_retries_amount_allowed  => 50,
-                                 :@login_retries_time_period     => 30,
-                                 :@login_ban_time_period         => 3600,
-                                 :@banned_action                 => :default_banned_action)
-              end
-            end
-            merge_brute_force_protection_defaults!
-          end
-          Config.after_failed_login << :check_failed_logins_limit_reached
-          base.prepend_before_filter :deny_banned_user
+
+          Config.after_login << :reset_failed_logins_count!
+          Config.after_failed_login << :update_failed_logins_count!
         end
         
         module InstanceMethods
-          def check_failed_logins_limit_reached(user, credentials)
-            now = Time.now.utc
-              
-            # not banned
-            if session[:first_failed_login_time]
-              reset_failed_logins_if_time_passed(now)
-            else
-              session[:first_failed_login_time] = now
-            end
-            increment_failed_logins
-            # ban
-            ban_if_above_limit(now)
-          end
           
           protected
           
-          def release_ban_if_time_passed(now)
-            if now - session[:ban_start_time] > Config.login_ban_time_period
-              session[:banned] = nil
-              session[:failed_logins] = 0
-              return true
-            end
-            false
-          end
-          
-          def increment_failed_logins
-            session[:failed_logins] ||= 0
-            session[:failed_logins] += 1
-          end
-          
-          def reset_failed_logins_if_time_passed(now)
-            if now - session[:first_failed_login_time] > Config.login_retries_time_period
-              session[:failed_logins] = 0 
-              session[:first_failed_login_time] = now
-            end
-          end
-          
-          def ban_if_above_limit(now)
-            if session[:failed_logins] > Config.login_retries_amount_allowed
-              session[:banned] = true
-              session[:ban_start_time] = now
-            end
-          end
-          
-          def deny_banned_user
-            if session[:banned]
-              now = Time.now.utc
-              release_ban_if_time_passed(now)
-            end
-            
-            # if still banned
-            send(Config.banned_action) if session[:banned]
+          # Increments the failed logins counter on every failed login.
+          # Runs as a hook after a failed login.
+          def update_failed_logins_count!(credentials)
+            user = Config.user_class.where("#{Config.user_class.sorcery_config.username_attribute_name} = ?", credentials[0]).first
+            user.register_failed_login! if user
           end
           
-          def default_banned_action
-            render :nothing => true
+          # Resets the failed logins counter.
+          # Runs as a hook after a successful login.
+          def reset_failed_logins_count!(user, credentials)
+            user.update_attributes!(Config.user_class.sorcery_config.failed_logins_count_attribute_name => 0)
           end
         end
       end

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -0,0 +1,65 @@
+module Sorcery
+  module Controller
+    module Submodules
+      # This submodule integrates HTTP Basic authentication into sorcery.
+      # You are provided with a before filter, require_login_from_http_basic, which requests the browser for authentication.
+      # Then the rest of the submodule takes care of logging the user in into the session, so that the next requests will keep him logged in.
+      module HttpBasicAuth
+        def self.included(base)
+          base.send(:include, InstanceMethods)
+          Config.module_eval do
+            class << self
+              attr_accessor :controller_to_realm_map            # how many failed logins allowed.
+                            
+              def merge_http_basic_auth_defaults!
+                @defaults.merge!(:@controller_to_realm_map  => {"application" => "Application"})
+              end
+            end
+            merge_http_basic_auth_defaults!
+          end
+          Config.login_sources << :login_from_basic_auth
+        end
+        
+        module InstanceMethods
+          
+          protected
+          
+          # to be used as a before_filter.
+          # The method sets a session when requesting the user's credentials.
+          # This is a trick to overcome the way HTTP authentication works (explained below):
+          #
+          # Once the user fills the credentials once, the browser will always send it to the server when visiting the website, until the browser is closed.
+          # This causes wierd behaviour if the user logs out. The session is reset, yet the user is re-logged in by the before_filter calling 'login_from_basic_auth'.
+          # To overcome this, we set a session when requesting the password, which logout will reset, and that's how we know if we need to request for HTTP auth again.
+          def require_login_from_http_basic
+            (request_http_basic_authentication(realm_name_by_controller) and (session[:http_authentication_used] = true) and return) if (request.authorization.nil? || session[:http_authentication_used].nil?)
+            require_login
+            session[:http_authentication_used] = nil unless logged_in?
+          end
+          
+          # given to main controller module as a login source callback
+          def login_from_basic_auth
+            authenticate_with_http_basic do |username, password|
+              @current_user = (Config.user_class.authenticate(username, password) if session[:http_authentication_used]) || false
+              login_user(@current_user) if @current_user
+              @current_user
+            end
+          end
+          
+          # Sets the realm name by searching the controller name in the hash given at configuration time.
+          def realm_name_by_controller
+            current_controller = self.class
+            while current_controller != ActionController::Base
+              result = Config.controller_to_realm_map[current_controller.controller_name]
+              return result if result
+              current_controller = self.class.superclass
+            end
+            nil
+          end
+          
+        end
+
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/oauth/oauth1.rb

@@ -0,0 +1,25 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module Oauth
+        module Oauth1
+          def oauth_version
+            "1.0"
+          end
+          
+          def get_request_token
+            ::OAuth::Consumer.new(@key, @secret, :site => @site).get_request_token(:oauth_callback => @callback_url)
+          end
+          
+          def authorize_url(args)
+            args[:request_token].authorize_url(:oauth_callback => @callback_url)
+          end
+          
+          def get_access_token(args)
+            args[:request_token].get_access_token(:oauth_verifier => args[:oauth_verifier])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/oauth/oauth2.rb

@@ -0,0 +1,23 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module Oauth
+        module Oauth2
+          def oauth_version
+            "2.0"
+          end
+          
+          def authorize_url(args)
+            client = ::OAuth2::Client.new(@key, @secret, :site => @site)
+            client.web_server.authorize_url(:redirect_uri => @callback_url, :scope => @scope)
+          end
+          
+          def get_access_token(args)
+            client = ::OAuth2::Client.new(@key, @secret, :site => @site)
+            client.web_server.get_access_token(args[:code], :redirect_uri => @callback_url)
+          end
+        end
+      end
+    end
+  end
+end