sorcery 0.1.3 → 0.2.0

data/Gemfile

@@ -2,17 +2,18 @@ source "http://rubygems.org"
 # Add dependencies required to use your gem here.
 # Example:
 #   gem "activesupport", ">= 2.3.5"
-
+gem "rails", ">= 3.0.0"
+gem 'json', ">= 1.5.1"
+gem 'oauth', ">= 0.4.4"
+gem 'oauth2', ">= 0.1.1"
 # Add dependencies to develop your gem here.
 # Include everything needed to run rake, tests, features, etc.
 group :development do
-  gem "rails", "3.0.3"
   gem "rspec", "~> 2.3.0"
   gem 'rspec-rails'
   gem 'ruby-debug19'
   gem 'sqlite3-ruby', :require => 'sqlite3'
   gem "yard", "~> 0.6.0"
-  gem "cucumber", ">= 0"
   gem "bundler", "~> 1.0.0"
   gem "jeweler", "~> 1.5.2"
   gem 'simplecov', '>= 0.3.8', :require => false # Will install simplecov-html as a dependency

data/Gemfile.lock

@@ -28,29 +28,25 @@ GEM
       activemodel (= 3.0.3)
       activesupport (= 3.0.3)
     activesupport (3.0.3)
+    addressable (2.2.4)
     archive-tar-minitar (0.5.2)
     arel (2.0.6)
     builder (2.1.2)
     columnize (0.3.2)
-    cucumber (0.10.0)
-      builder (>= 2.1.2)
-      diff-lcs (~> 1.1.2)
-      gherkin (~> 2.3.2)
-      json (~> 1.4.6)
-      term-ansicolor (~> 1.0.5)
     diff-lcs (1.1.2)
     erubis (2.6.6)
       abstract (>= 1.0.0)
-    gherkin (2.3.2)
-      json (~> 1.4.6)
-      term-ansicolor (~> 1.0.5)
+    faraday (0.5.5)
+      addressable (~> 2.2.4)
+      multipart-post (~> 1.1.0)
+      rack (>= 1.1.0, < 2)
     git (1.2.5)
     i18n (0.5.0)
     jeweler (1.5.2)
       bundler (~> 1.0.0)
       git (>= 1.2.5)
       rake
-    json (1.4.6)
+    json (1.5.1)
     linecache19 (0.5.11)
       ruby_core_source (>= 0.1.4)
     mail (2.2.13)
@@ -59,6 +55,12 @@ GEM
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
     mime-types (1.16)
+    multi_json (0.0.5)
+    multipart-post (1.1.0)
+    oauth (0.4.4)
+    oauth2 (0.1.1)
+      faraday (~> 0.5.0)
+      multi_json (~> 0.0.4)
     polyglot (0.3.1)
     rack (1.2.1)
     rack-mount (0.6.13)
@@ -106,7 +108,6 @@ GEM
       simplecov-html (>= 0.3.7)
     simplecov-html (0.3.9)
     sqlite3-ruby (1.3.2)
-    term-ansicolor (1.0.5)
     thor (0.14.6)
     treetop (1.4.9)
       polyglot (>= 0.3.1)
@@ -118,9 +119,11 @@ PLATFORMS
 
 DEPENDENCIES
   bundler (~> 1.0.0)
-  cucumber
   jeweler (~> 1.5.2)
-  rails (= 3.0.3)
+  json (>= 1.5.1)
+  oauth (>= 0.4.4)
+  oauth2 (>= 0.1.1)
+  rails (>= 3.0.0)
   rspec (~> 2.3.0)
   rspec-rails
   ruby-debug19

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2010 Noam Ben-Ari
+Copyright (c) 2010 Noam Ben-Ari <mailto:nbenari@gmail.com>
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

data/README.rdoc

@@ -3,27 +3,46 @@ Magical Authentication for Rails 3.
 
 Inspired by restful_authentication, Authlogic and Devise.
 Crypto code taken almost unchanged from Authlogic.
+OAuth code inspired by OmniAuth.
 
-== Example app using sorcery:
+== Summary
 
-https://github.com/NoamB/sorcery-example-app
+Sorcery aims to make your life easier by giving you an easy API to write your own user authentication flow with.
+It does this with a few goals in mind:
+
+* Less is more - less than 20 simple methods to remember for the entire feature-set make the lib easy to 'get'.
+* No built-in or generated code - use the API inside *your own* MVC structures, and don't fight to fix someone else's.
+* Magic yes, Voodoo no - the lib should be easy to hack for most developers.
+* Configuration over Confusion - Simple & short configuration as possible, not drowning in syntactic sugar.
+* Keep MVC cleanly separated - DB is for models, sessions are for controllers. Models stay unaware of sessions.
+
+Hopefully, I've achieved this. If not, let me know.
+
+== Useful Links:
+
+Example app using sorcery: https://github.com/NoamB/sorcery-example-app
+
+Documentation: http://rubydoc.info/gems/sorcery/0.1.4/frames
 
 == Full Features List by module:
 
 Core (see lib/sorcery/model/model.rb and lib/sorcery/controller/controller.rb): 
-* login/logout, optional redirect on login to where the user tried to reach before, configurable redirect for non-logged-in users.
+* login/logout, optional return user to requested url on login, configurable redirect for non-logged-in users.
 * password encryption, algorithms: bcrypt(default), md5, sha1, sha256, sha512, aes256, custom(yours!), none. Configurable stretches and salt.
 * configurable attribute names for username, password and email.
 
 User Activation (see lib/sorcery/model/submodules/user_activation.rb):
 * User activation by email with optional success email.
 * configurable attribute names.
-* configurable mailer.
-* Optionally prevent active users to login.
+* configurable mailer, method name, and attribute name.
+* configurable temporary token expiration.
+* Optionally prevent non-active users to login.
 
-Password Reset (see lib/sorcery/model/submodules/password_reset.rb):
+Reset Password (see lib/sorcery/model/submodules/reset_password.rb):
 * Reset password with email verification.
 * configurable mailer, method name, and attribute name.
+* configurable temporary token expiration.
+* configurable time between emails (hammering protection).
 
 Remember Me (see lib/sorcery/model/submodules/remember_me.rb):
 * Remember me with configurable expiration.
@@ -33,51 +52,39 @@ Session Timeout (see lib/sorcery/controller/submodules/session_timeout.rb):
 * Configurable session timeout.
 * Optionally session timeout will be calculated from last user action.
 
-Brute Force Protection (see lib/sorcery/controller/submodules/brute_force_protection.rb):
+Brute Force Protection (see lib/sorcery/model/submodules/brute_force_protection.rb):
 * Brute force login hammering protection.
-* configurable logins before ban, logins within time period before ban, ban time and ban action.
+* configurable logins before lock and lock duration.
 
 Basic HTTP Authentication (see lib/sorcery/controller/submodules/http_basic_auth.rb):
 * A before filter for requesting authentication with HTTP Basic.
 * automatic login from HTTP Basic.
 * automatic login is disabled if session key changed.
 
-Other:
-* Modular design, load only the modules you need.
-* 100% TDD'd code, 100% test coverage.
+Activity Logging (see lib/sorcery/model/submodules/activity_logging.rb):
+* automatic logging of last login, last logout and last activity time.
+* an easy method of collecting the list of currently logged in users.
+* configurable timeout by which to decide whether to include a user in the list of logged in users.
+
+Oauth (see lib/sorcery/controller/submodules/oauth.rb):
+* OAuth1 and OAuth2 support (currently twitter & facebook)
+* configurable db field names and authentications table.
 
 == Next Planned Features:
 
-I've got many plans which include:
-* Hammering reset password protection
-* Configurable Auto login on registration/activation
-* Other reset password strategies (security questions?)
+I've got many plans which include (by priority):
 * Sinatra support
 * Mongoid support
-* OmniAuth integration
-* Activity logging
+* Configurable Auto login on registration/activation
+* Other reset password strategies (security questions?)
+* Other brute force protection strategies (captcha)
 * Have an idea? Let me know, and it might get into the gem!
 
-== Project Goals:
-
-This gem plugin was started out of a few personal goals which are not related to the problem solved by it at all:
-* I wanted to write something 100% TDD from start to finish.
-* I wanted to learn how to write an engine for Rails 3.
-
-In addition to the above goals, when I decided this will be an authentication plugin, and while looking at existing solutions, these goals came up:
-* Simple & short configuration as possible, not drowning in syntactic sugar.
-* Keep MVC cleanly separated - DB is for models, sessions are for controllers. Models stay unaware of sessions.
-* Magic yes, Voodoo no.
-* No generated code polluting the application's code.
-* No built-in controllers, models, mailers, migrations or templates; Real apps will need all of these custom made.
-
-Hopefully, I've achieved this. If not, let me know.
-
 == Installation:
 
-You can either git clone and then 'rake install',
+You can either git clone and then 'rake install' to live on the edge (unstable),
 
-In the future will be available:
+Or simply (stable):
 
 	gem install sorcery
 
@@ -122,11 +129,21 @@ The configuration options vary with the modules you've chosen to use.
 
 == Contributing to sorcery
 
-I can use help of any kind, be it comments on code, suggestions, features, bug reports, bug fixes, documentation and if you like, a donation.
+Your feedback is very welcome and will make this gem much much better for you, me and everyone else.
+Besides feedback on code, features, suggestions and bug reports, you may want to actually make an impact on the code.
+For this:
+
+* Fork the project.
+* Make your feature addition or bug fix.
+* Add tests for it. This is important so I don’t break it in a future version unintentionally.
+* Commit, do not mess with Rakefiles, version, or history. (if you want to have your own version, that is fine but bump version in a commit by itself I can ignore when I pull)
+* Send me a pull request. Bonus points for topic branches.
+
+If you feel my work has made your life easier, and you would like to thank me through a donation, my paypal email is in the contact details.
 
 == Contact
 
-	email: nbenari@gmail.com
+	email: nbenari@gmail.com ( also for paypal )
 	twitter: @nbenari
 	
 == Copyright

data/Rakefile

@@ -1,4 +1,5 @@
 # require 'bundler'
+# -- Commented because it's slow
 # begin
 #   Bundler.setup(:default, :development)
 # rescue Bundler::BundlerError => e
@@ -6,6 +7,8 @@
 #   $stderr.puts "Run `bundle install` to install missing gems"
 #   exit e.status_code
 # end
+# --
+
 require 'rake'
 
 require 'jeweler'
@@ -22,31 +25,22 @@ Jeweler::Tasks.new do |gem|
   # and development dependencies are only needed for development (ie running rake tasks, tests, etc)
   #  gem.add_runtime_dependency 'jabber4r', '> 0.1'
   #  gem.add_development_dependency 'rspec', '> 1.2.3'
-  #  gem.add_runtime_dependency 'bcrypt-ruby', '~> 2.1.4'
+  gem.add_runtime_dependency 'bcrypt-ruby', '~> 2.1.4'
+  gem.add_runtime_dependency 'oauth', '>= 0.4.4'
+  gem.add_runtime_dependency 'oauth2', '>= 0.1.1'
 end
 Jeweler::RubygemsDotOrgTasks.new
 
 require 'rspec/core'
 require 'rspec/core/rake_task'
+
 RSpec::Core::RakeTask.new(:spec) do |spec|
   spec.pattern = FileList['spec/**/*_spec.rb']
 end
 
-RSpec::Core::RakeTask.new(:rcov) do |spec|
-  spec.pattern = 'spec/**/*_spec.rb'
-  spec.rcov = true
-end
-
-require 'cucumber/rake/task'
-Cucumber::Rake::Task.new(:features)
-
-
-
 require 'yard'
 YARD::Rake::YardocTask.new
 
-
-#task :default => :spec
 desc 'Default: Run all specs.'
 task :default => :all_specs
 

data/VERSION

@@ -1 +1 @@
-0.1.3
+0.2.0

data/lib/sorcery/controller/submodules/activity_logging.rb

@@ -0,0 +1,58 @@
+module Sorcery
+  module Controller
+    module Submodules
+      # This submodule keeps track of events such as login, logout, and last activity time, per user.
+      # It helps in estimating which users are active now in the site.
+      # This cannot be determined absolutely because a user might be reading a page without clicking anything for a while.
+      
+      # This is the controller part of the submodule, which adds hooks to register user events, 
+      # and methods to collect active users data for use in the app.
+      # see Socery::Model::Submodules::ActivityLogging for configuration options.
+      module ActivityLogging
+        def self.included(base)
+          base.send(:include, InstanceMethods)
+          Config.after_login << :register_login_time_to_db
+          Config.before_logout << :register_logout_time_to_db
+          base.after_filter :register_last_activity_time_to_db
+        end
+        
+        module InstanceMethods
+          # Returns an array of the active users.
+          def current_users
+            Config.user_class.current_users
+            # A possible patch here:
+            # we'll add the current_user to the users list if he's not in it (can happen when he was inactive for more than activity timeout):
+            #
+            #   users.unshift!(current_user) if logged_in? && users.find {|u| u.id == current_user.id}.nil?
+            #
+            # disadvantages: can hurt performance.
+          end
+          
+          protected
+          
+          # registers last login time on every login.
+          # This runs as a hook just after a successful login.
+          def register_login_time_to_db(user, credentials)
+            user.send(:"#{user.sorcery_config.last_login_at_attribute_name}=", Time.now.utc.to_s(:db))
+            user.save!(:validate => false)
+          end
+          
+          # registers last logout time on every logout.
+          # This runs as a hook just before a logout.
+          def register_logout_time_to_db(user)
+            user.send(:"#{user.sorcery_config.last_logout_at_attribute_name}=", Time.now.utc.to_s(:db))
+            user.save!(:validate => false)
+          end
+          
+          # Updates last activity time on every request.
+          # The only exception is logout - we do not update activity on logout
+          def register_last_activity_time_to_db
+            return if !logged_in?
+            current_user.send(:"#{current_user.sorcery_config.last_activity_at_attribute_name}=", Time.now.utc.to_s(:db))
+            current_user.save!(:validate => false)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -1,86 +1,32 @@
 module Sorcery
   module Controller
     module Submodules
+      # This module helps protect user accounts by locking them down after too many failed attemps to login were detected.
+      # This is the controller part of the submodule which takes care of updating the failed logins and resetting them.
+      # See Sorcery::Model::Submodules::BruteForceProtection for configuration options.
       module BruteForceProtection
         def self.included(base)
           base.send(:include, InstanceMethods)
-          Config.module_eval do
-            class << self
-              attr_accessor :login_retries_amount_allowed,      # how many failed logins allowed.
-                            :login_retries_time_period,         # the time after which the failed logins counter is reset.
-                            :login_ban_time_period,             # how long the user should be banned. in seconds.
-                            :banned_action                      # what controller action should be called when a banned user tries.
-                            
-              def merge_brute_force_protection_defaults!
-                @defaults.merge!(:@login_retries_amount_allowed  => 50,
-                                 :@login_retries_time_period     => 30,
-                                 :@login_ban_time_period         => 3600,
-                                 :@banned_action                 => :default_banned_action)
-              end
-            end
-            merge_brute_force_protection_defaults!
-          end
-          Config.after_failed_login << :check_failed_logins_limit_reached
-          base.prepend_before_filter :deny_banned_user
+
+          Config.after_login << :reset_failed_logins_count!
+          Config.after_failed_login << :update_failed_logins_count!
         end
         
         module InstanceMethods
-          def check_failed_logins_limit_reached(user, credentials)
-            now = Time.now.utc
-              
-            # not banned
-            if session[:first_failed_login_time]
-              reset_failed_logins_if_time_passed(now)
-            else
-              session[:first_failed_login_time] = now
-            end
-            increment_failed_logins
-            # ban
-            ban_if_above_limit(now)
-          end
           
           protected
           
-          def release_ban_if_time_passed(now)
-            if now - session[:ban_start_time] > Config.login_ban_time_period
-              session[:banned] = nil
-              session[:failed_logins] = 0
-              return true
-            end
-            false
-          end
-          
-          def increment_failed_logins
-            session[:failed_logins] ||= 0
-            session[:failed_logins] += 1
-          end
-          
-          def reset_failed_logins_if_time_passed(now)
-            if now - session[:first_failed_login_time] > Config.login_retries_time_period
-              session[:failed_logins] = 0 
-              session[:first_failed_login_time] = now
-            end
-          end
-          
-          def ban_if_above_limit(now)
-            if session[:failed_logins] > Config.login_retries_amount_allowed
-              session[:banned] = true
-              session[:ban_start_time] = now
-            end
-          end
-          
-          def deny_banned_user
-            if session[:banned]
-              now = Time.now.utc
-              release_ban_if_time_passed(now)
-            end
-            
-            # if still banned
-            send(Config.banned_action) if session[:banned]
+          # Increments the failed logins counter on every failed login.
+          # Runs as a hook after a failed login.
+          def update_failed_logins_count!(credentials)
+            user = Config.user_class.where("#{Config.user_class.sorcery_config.username_attribute_name} = ?", credentials[0]).first
+            user.register_failed_login! if user
           end
           
-          def default_banned_action
-            render :nothing => true
+          # Resets the failed logins counter.
+          # Runs as a hook after a successful login.
+          def reset_failed_logins_count!(user, credentials)
+            user.update_attributes!(Config.user_class.sorcery_config.failed_logins_count_attribute_name => 0)
           end
         end
       end

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -1,6 +1,9 @@
 module Sorcery
   module Controller
     module Submodules
+      # This submodule integrates HTTP Basic authentication into sorcery.
+      # You are provided with a before filter, require_login_from_http_basic, which requests the browser for authentication.
+      # Then the rest of the submodule takes care of logging the user in into the session, so that the next requests will keep him logged in.
       module HttpBasicAuth
         def self.included(base)
           base.send(:include, InstanceMethods)
@@ -23,22 +26,27 @@ module Sorcery
           
           # to be used as a before_filter.
           # The method sets a session when requesting the user's credentials.
-          # This is a trick to overcome the way HTTP authentication work (explained below):
+          # This is a trick to overcome the way HTTP authentication works (explained below):
           #
           # Once the user fills the credentials once, the browser will always send it to the server when visiting the website, until the browser is closed.
           # This causes wierd behaviour if the user logs out. The session is reset, yet the user is re-logged in by the before_filter calling 'login_from_basic_auth'.
           # To overcome this, we set a session when requesting the password, which logout will reset, and that's how we know if we need to request for HTTP auth again.
-          def require_user_login_from_http
-            request_http_basic_authentication(realm_name_by_controller) and (session[:http_authentication_used] = true) and return if request.authorization.nil? || session[:http_authentication_used].nil?
-            require_user_login
+          def require_login_from_http_basic
+            (request_http_basic_authentication(realm_name_by_controller) and (session[:http_authentication_used] = true) and return) if (request.authorization.nil? || session[:http_authentication_used].nil?)
+            require_login
+            session[:http_authentication_used] = nil unless logged_in?
           end
           
+          # given to main controller module as a login source callback
           def login_from_basic_auth
             authenticate_with_http_basic do |username, password|
-              @logged_in_user = (Config.user_class.authenticate(username, password) if session[:http_authentication_used]) || false
+              @current_user = (Config.user_class.authenticate(username, password) if session[:http_authentication_used]) || false
+              login_user(@current_user) if @current_user
+              @current_user
             end
           end
           
+          # Sets the realm name by searching the controller name in the hash given at configuration time.
           def realm_name_by_controller
             current_controller = self.class
             while current_controller != ActionController::Base

data/lib/sorcery/controller/submodules/oauth/oauth1.rb

@@ -0,0 +1,25 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module Oauth
+        module Oauth1
+          def oauth_version
+            "1.0"
+          end
+          
+          def get_request_token
+            ::OAuth::Consumer.new(@key, @secret, :site => @site).get_request_token(:oauth_callback => @callback_url)
+          end
+          
+          def authorize_url(args)
+            args[:request_token].authorize_url(:oauth_callback => @callback_url)
+          end
+          
+          def get_access_token(args)
+            args[:request_token].get_access_token(:oauth_verifier => args[:oauth_verifier])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/oauth/oauth2.rb

@@ -0,0 +1,23 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module Oauth
+        module Oauth2
+          def oauth_version
+            "2.0"
+          end
+          
+          def authorize_url(args)
+            client = ::OAuth2::Client.new(@key, @secret, :site => @site)
+            client.web_server.authorize_url(:redirect_uri => @callback_url, :scope => @scope)
+          end
+          
+          def get_access_token(args)
+            client = ::OAuth2::Client.new(@key, @secret, :site => @site)
+            client.web_server.get_access_token(args[:code], :redirect_uri => @callback_url)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/oauth/providers/facebook.rb

@@ -0,0 +1,64 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module Oauth
+        module Providers
+          # This module adds support for OAuth with facebook.com.
+          # When included in the 'config.providers' option, it adds a new option, 'config.facebook'.
+          # Via this new option you can configure Facebook specific settings like your app's key and secret.
+          #
+          #   config.facebook.key = <key>
+          #   config.facebook.secret = <secret>
+          #   ...
+          #
+          module Facebook
+            def self.included(base)
+              base.module_eval do
+                class << self
+                  attr_reader :facebook                           # access to facebook_client.
+          
+                  def merge_facebook_defaults!
+                    @defaults.merge!(:@facebook => FacebookClient)
+                  end
+                end
+                merge_facebook_defaults!
+                update!
+              end
+            end
+          
+            module FacebookClient
+              class << self
+                attr_accessor :key,
+                              :secret,
+                              :callback_url,
+                              :site,
+                              :user_info_path,
+                              :scope,
+                              :user_info_mapping
+                            
+                include Oauth2
+            
+                def init
+                  @site           = "https://graph.facebook.com"
+                  @user_info_path = "/me"
+                  @scope          = "email,offline_access"
+                  @user_info_mapping = {}
+                end
+                
+                def get_user_hash(access_token)
+                  user_hash = {}
+                  response = access_token.get(@user_info_path)
+                  user_hash[:user_info] = JSON.parse(response)
+                  user_hash[:uid] = user_hash[:user_info]['id'].to_i
+                  user_hash
+                end
+              end
+              init
+            end
+            
+          end
+        end    
+      end
+    end
+  end
+end