sorcery 0.1.4 → 0.3.0

data/spec/rails3/app_root/spec/user_spec.rb

@@ -0,0 +1,317 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+require File.expand_path(File.dirname(__FILE__) + '/../app/mailers/sorcery_mailer')
+
+describe "User with no submodules (core)" do
+  before(:all) do
+    sorcery_reload!
+  end
+
+  describe User, "when app has plugin loaded" do
+    it "should respond to the plugin activation class method" do
+      ActiveRecord::Base.should respond_to(:activate_sorcery!)
+      User.should respond_to(:activate_sorcery!)
+    end
+    
+    it "plugin activation should yield config to block" do
+      User.activate_sorcery! do |config|
+        config.class.should == ::Sorcery::Model::Config 
+      end
+    end
+  end
+
+  # ----------------- PLUGIN ACTIVATION -----------------------
+  describe TestUser, "Testing activated class self-registration" do
+    it "should register itself as user_class if activated" do
+      TestUser.class_eval do
+        activate_sorcery!
+      end
+      ::Sorcery::Controller::Config.user_class.should == TestUser
+    end
+  end
+  
+  # ----------------- PLUGIN CONFIGURATION -----------------------
+  describe User, "loaded plugin configuration" do
+    after(:each) do
+      User.sorcery_config.reset!
+    end
+  
+    it "should enable configuration option 'username_attribute_name'" do
+      sorcery_model_property_set(:username_attribute_name, :email)
+      User.sorcery_config.username_attribute_name.should equal(:email)    
+    end
+  
+    it "should enable configuration option 'password_attribute_name'" do
+      sorcery_model_property_set(:password_attribute_name, :mypassword)
+      User.sorcery_config.password_attribute_name.should equal(:mypassword)
+    end
+    
+    it "should enable configuration option 'email_attribute_name'" do
+      sorcery_model_property_set(:email_attribute_name, :my_email)
+      User.sorcery_config.email_attribute_name.should equal(:my_email)
+    end
+
+    it "should enable configuration option 'crypted_password_attribute_name'" do
+      sorcery_model_property_set(:crypted_password_attribute_name, :password)
+      User.sorcery_config.crypted_password_attribute_name.should equal(:password)
+    end
+    
+    it "should enable configuration option 'salt_attribute_name'" do
+      sorcery_model_property_set(:salt_attribute_name, :my_salt)
+      User.sorcery_config.salt_attribute_name.should equal(:my_salt)
+    end
+
+    it "should enable configuration option 'encryption_algorithm'" do
+      sorcery_model_property_set(:encryption_algorithm, :none)
+      User.sorcery_config.encryption_algorithm.should equal(:none)
+    end
+
+    it "should enable configuration option 'encryption_key'" do
+      sorcery_model_property_set(:encryption_key, 'asdadas424234242')
+      User.sorcery_config.encryption_key.should == 'asdadas424234242'
+    end
+
+    it "should enable configuration option 'custom_encryption_provider'" do
+      sorcery_model_property_set(:encryption_algorithm, :custom)
+      sorcery_model_property_set(:custom_encryption_provider, Array)
+      User.sorcery_config.custom_encryption_provider.should equal(Array)
+    end
+  
+    it "should enable configuration option 'salt_join_token'" do
+      salt_join_token = "--%%*&-"
+      sorcery_model_property_set(:salt_join_token, salt_join_token)
+      User.sorcery_config.salt_join_token.should equal(salt_join_token)
+    end
+    
+    it "should enable configuration option 'stretches'" do
+      stretches = 15
+      sorcery_model_property_set(:stretches, stretches)
+      User.sorcery_config.stretches.should equal(stretches)
+    end
+  
+  end
+
+  # ----------------- PLUGIN ACTIVATED -----------------------
+  describe User, "when activated with sorcery" do
+    before(:all) do
+      sorcery_reload!()
+    end
+  
+    before(:each) do
+      User.delete_all
+    end
+  
+    it "should respond to class method authenticate" do
+      ActiveRecord::Base.should_not respond_to(:authenticate)
+      User.should respond_to(:authenticate)
+    end
+  
+    it "authenticate should return true if credentials are good" do
+      create_new_user
+      User.authenticate(@user.send(User.sorcery_config.username_attribute_name), 'secret').should be_true
+    end
+  
+    it "authenticate should return false if credentials are bad" do
+      create_new_user
+      User.authenticate(@user.send(User.sorcery_config.username_attribute_name), 'wrong!').should be_false
+    end
+  
+    it "should respond to the class method encrypt" do
+      User.should respond_to(:encrypt)
+    end
+  end
+
+  # ----------------- REGISTRATION -----------------------
+  describe User, "registration" do
+  
+    before(:all) do
+      sorcery_reload!()
+    end
+
+    before(:each) do
+      User.delete_all
+    end
+  
+    it "by default, encryption_provider should not be nil" do
+      User.sorcery_config.encryption_provider.should_not be_nil
+    end
+    
+    it "should encrypt password when a new user is saved" do
+      create_new_user
+      User.sorcery_config.encryption_provider.matches?(@user.send(User.sorcery_config.crypted_password_attribute_name),'secret',@user.salt).should be_true
+    end
+
+    it "should clear the virtual password field if the encryption process worked" do
+      create_new_user
+      @user.password.should be_nil
+    end
+    
+    it "should not clear the virtual password field if save failed due to validity" do
+      create_new_user
+      User.class_eval do
+        validates_format_of :email, :with => /^(.)+@(.)+$/, :if => Proc.new {|r| r.email}, :message => "is invalid"
+      end
+      @user.password = 'blupush'
+      @user.email = 'asd'
+      @user.save
+      @user.password.should_not be_nil
+    end
+    
+    it "should not clear the virtual password field if save failed due to exception" do
+      create_new_user
+      @user.password = 'blupush'
+      @user.username = nil
+      begin
+        @user.save # triggers SQL exception since username field is defined not null.
+      rescue
+      end
+      @user.password.should_not be_nil
+    end
+    
+    it "should not encrypt the password twice when a user is updated" do
+      create_new_user
+      @user.email = "blup@bla.com"
+      @user.save!
+      User.sorcery_config.encryption_provider.matches?(@user.send(User.sorcery_config.crypted_password_attribute_name),'secret',@user.salt).should be_true
+    end
+
+    it "should replace the crypted_password in case a new password is set" do
+      create_new_user
+      @user.password = 'new_secret'
+      @user.save!
+      User.sorcery_config.encryption_provider.matches?(@user.send(User.sorcery_config.crypted_password_attribute_name),'secret',@user.salt).should be_false
+    end
+
+  end
+
+  # ----------------- PASSWORD ENCRYPTION -----------------------
+  describe User, "special encryption cases" do
+    before(:all) do
+      sorcery_reload!()
+      @text = "Some Text!"
+    end
+  
+    before(:each) do
+      User.delete_all
+    end
+  
+    after(:each) do
+      User.sorcery_config.reset!
+    end
+  
+    it "should work with no password encryption" do
+      sorcery_model_property_set(:encryption_algorithm, :none)
+      create_new_user
+      User.authenticate(@user.send(User.sorcery_config.username_attribute_name), 'secret').should be_true
+    end
+  
+    it "should work with custom password encryption" do
+      class MyCrypto
+        def self.encrypt(*tokens)
+          tokens.flatten.join('').gsub(/e/,'A')
+        end
+        
+        def self.matches?(crypted,*tokens)
+          crypted = encrypt(*tokens)
+        end
+      end
+      sorcery_model_property_set(:encryption_algorithm, :custom)
+      sorcery_model_property_set(:custom_encryption_provider, MyCrypto)
+      create_new_user
+      User.authenticate(@user.send(User.sorcery_config.username_attribute_name), 'secret').should be_true
+    end
+  
+    it "if encryption algo is aes256, it should set key to crypto provider" do
+      sorcery_model_property_set(:encryption_algorithm, :aes256)
+      sorcery_model_property_set(:encryption_key, nil)
+      expect{User.encrypt(@text)}.to raise_error(ArgumentError)
+      sorcery_model_property_set(:encryption_key, "asd234dfs423fddsmndsflktsdf32343")
+      expect{User.encrypt(@text)}.to_not raise_error(ArgumentError)
+    end
+    
+    it "if encryption algo is aes256, it should set key to crypto provider, even if attributes are set in reverse" do
+      sorcery_model_property_set(:encryption_key, nil)
+      sorcery_model_property_set(:encryption_algorithm, :none)
+      sorcery_model_property_set(:encryption_key, "asd234dfs423fddsmndsflktsdf32343")
+      sorcery_model_property_set(:encryption_algorithm, :aes256)
+      expect{User.encrypt(@text)}.to_not raise_error(ArgumentError)
+    end
+  
+    it "if encryption algo is md5 it should work" do
+      sorcery_model_property_set(:encryption_algorithm, :md5)
+      User.encrypt(@text).should == Sorcery::CryptoProviders::MD5.encrypt(@text)
+    end
+  
+    it "if encryption algo is sha1 it should work" do
+      sorcery_model_property_set(:encryption_algorithm, :sha1)
+      User.encrypt(@text).should == Sorcery::CryptoProviders::SHA1.encrypt(@text)
+    end
+  
+    it "if encryption algo is sha256 it should work" do
+      sorcery_model_property_set(:encryption_algorithm, :sha256)
+      User.encrypt(@text).should == Sorcery::CryptoProviders::SHA256.encrypt(@text)
+    end
+  
+    it "if encryption algo is sha512 it should work" do
+      sorcery_model_property_set(:encryption_algorithm, :sha512)
+      User.encrypt(@text).should == Sorcery::CryptoProviders::SHA512.encrypt(@text)
+    end
+  
+    it "salt should be random for each user and saved in db" do
+      sorcery_model_property_set(:salt_attribute_name, :salt)
+      create_new_user
+      @user.salt.should_not be_nil
+    end
+    
+    it "if salt is set should use it to encrypt" do
+      sorcery_model_property_set(:salt_attribute_name, :salt)
+      sorcery_model_property_set(:encryption_algorithm, :sha512)
+      create_new_user
+      @user.crypted_password.should_not == Sorcery::CryptoProviders::SHA512.encrypt('secret')
+      @user.crypted_password.should == Sorcery::CryptoProviders::SHA512.encrypt('secret',@user.salt)
+    end
+    
+    it "if salt_join_token is set should use it to encrypt" do
+      sorcery_model_property_set(:salt_attribute_name, :salt)
+      sorcery_model_property_set(:salt_join_token, "-@=>")
+      sorcery_model_property_set(:encryption_algorithm, :sha512)
+      create_new_user
+      @user.crypted_password.should_not == Sorcery::CryptoProviders::SHA512.encrypt('secret')
+      Sorcery::CryptoProviders::SHA512.join_token = ""
+      @user.crypted_password.should_not == Sorcery::CryptoProviders::SHA512.encrypt('secret',@user.salt)
+      Sorcery::CryptoProviders::SHA512.join_token = User.sorcery_config.salt_join_token
+      @user.crypted_password.should == Sorcery::CryptoProviders::SHA512.encrypt('secret',@user.salt)
+    end
+    
+  end
+  
+  describe User, "external users" do
+    before(:all) do
+      ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/oauth")
+      sorcery_reload!()
+    end
+  
+    after(:all) do
+      ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/oauth")
+    end
+    
+    before(:each) do
+      User.delete_all
+    end
+    
+    it "should respond to 'external?'" do
+      create_new_user
+      @user.should respond_to(:external?)
+    end
+    
+    it "external? should be false for regular users" do
+      create_new_user
+      @user.external?.should be_false
+    end
+    
+    it "external? should be true for external users" do
+      create_new_external_user(:twitter)
+      @user.external?.should be_true
+    end
+  end
+
+end

data/spec/sinatra/Gemfile

@@ -0,0 +1,12 @@
+source 'http://rubygems.org'
+
+gem 'sinatra', '>= 1.2.0'
+gem 'sqlite3-ruby', :require => 'sqlite3'
+gem "sorcery", '0.3.0', :path => '../../'
+
+group :development, :test do
+  gem 'rspec'
+  gem 'ruby-debug19'
+  gem 'simplecov', '>= 0.3.8', :require => false # Will install simplecov-html as a dependency
+  gem 'spork', '~> 0.9.0.rc'
+end

data/spec/sinatra/Gemfile.lock

@@ -0,0 +1,134 @@
+PATH
+  remote: ../../
+  specs:
+    sorcery (0.3.0)
+      bcrypt-ruby (~> 2.1.4)
+      json (>= 1.5.1)
+      oauth (>= 0.4.4)
+      oauth (>= 0.4.4)
+      oauth2 (>= 0.1.1)
+      oauth2 (>= 0.1.1)
+      rails (>= 3.0.0)
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    abstract (1.0.0)
+    actionmailer (3.0.3)
+      actionpack (= 3.0.3)
+      mail (~> 2.2.9)
+    actionpack (3.0.3)
+      activemodel (= 3.0.3)
+      activesupport (= 3.0.3)
+      builder (~> 2.1.2)
+      erubis (~> 2.6.6)
+      i18n (~> 0.4)
+      rack (~> 1.2.1)
+      rack-mount (~> 0.6.13)
+      rack-test (~> 0.5.6)
+      tzinfo (~> 0.3.23)
+    activemodel (3.0.3)
+      activesupport (= 3.0.3)
+      builder (~> 2.1.2)
+      i18n (~> 0.4)
+    activerecord (3.0.3)
+      activemodel (= 3.0.3)
+      activesupport (= 3.0.3)
+      arel (~> 2.0.2)
+      tzinfo (~> 0.3.23)
+    activeresource (3.0.3)
+      activemodel (= 3.0.3)
+      activesupport (= 3.0.3)
+    activesupport (3.0.3)
+    addressable (2.2.4)
+    archive-tar-minitar (0.5.2)
+    arel (2.0.7)
+    bcrypt-ruby (2.1.4)
+    builder (2.1.2)
+    columnize (0.3.2)
+    diff-lcs (1.1.2)
+    erubis (2.6.6)
+      abstract (>= 1.0.0)
+    faraday (0.5.5)
+      addressable (~> 2.2.4)
+      multipart-post (~> 1.1.0)
+      rack (< 2, >= 1.1.0)
+    i18n (0.5.0)
+    json (1.5.1)
+    linecache19 (0.5.11)
+      ruby_core_source (>= 0.1.4)
+    mail (2.2.15)
+      activesupport (>= 2.3.6)
+      i18n (>= 0.4.0)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    mime-types (1.16)
+    multi_json (0.0.5)
+    multipart-post (1.1.0)
+    oauth (0.4.4)
+    oauth2 (0.1.1)
+      faraday (~> 0.5.0)
+      multi_json (~> 0.0.4)
+    polyglot (0.3.1)
+    rack (1.2.1)
+    rack-mount (0.6.13)
+      rack (>= 1.0.0)
+    rack-test (0.5.7)
+      rack (>= 1.0)
+    rails (3.0.3)
+      actionmailer (= 3.0.3)
+      actionpack (= 3.0.3)
+      activerecord (= 3.0.3)
+      activeresource (= 3.0.3)
+      activesupport (= 3.0.3)
+      bundler (~> 1.0)
+      railties (= 3.0.3)
+    railties (3.0.3)
+      actionpack (= 3.0.3)
+      activesupport (= 3.0.3)
+      rake (>= 0.8.7)
+      thor (~> 0.14.4)
+    rake (0.8.7)
+    rspec (2.4.0)
+      rspec-core (~> 2.4.0)
+      rspec-expectations (~> 2.4.0)
+      rspec-mocks (~> 2.4.0)
+    rspec-core (2.4.0)
+    rspec-expectations (2.4.0)
+      diff-lcs (~> 1.1.2)
+    rspec-mocks (2.4.0)
+    ruby-debug-base19 (0.11.24)
+      columnize (>= 0.3.1)
+      linecache19 (>= 0.5.11)
+      ruby_core_source (>= 0.1.4)
+    ruby-debug19 (0.11.6)
+      columnize (>= 0.3.1)
+      linecache19 (>= 0.5.11)
+      ruby-debug-base19 (>= 0.11.19)
+    ruby_core_source (0.1.4)
+      archive-tar-minitar (>= 0.5.2)
+    simplecov (0.3.9)
+      simplecov-html (>= 0.3.7)
+    simplecov-html (0.3.9)
+    sinatra (1.2.0)
+      rack (~> 1.1)
+      tilt (< 2.0, >= 1.2.2)
+    spork (0.9.0.rc3)
+    sqlite3-ruby (1.3.2)
+    thor (0.14.6)
+    tilt (1.2.2)
+    treetop (1.4.9)
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.24)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  rspec
+  ruby-debug19
+  simplecov (>= 0.3.8)
+  sinatra (>= 1.2.0)
+  sorcery (= 0.3.0)!
+  spork (~> 0.9.0.rc)
+  sqlite3-ruby

data/spec/sinatra/Rakefile

@@ -0,0 +1,10 @@
+require 'rake'
+require 'rspec/core/rake_task'
+
+desc 'Default: Run all specs.'
+task :default => :spec
+
+desc "Run all specs"
+RSpec::Core::RakeTask.new(:spec) do |t|
+  t.pattern = '**/*_spec.rb'
+end

data/spec/sinatra/authentication.rb

@@ -0,0 +1,3 @@
+class Authentication < ActiveRecord::Base
+  belongs_to :user
+end

data/spec/sinatra/db/migrate/activation/20101224223622_add_activation_to_users.rb

@@ -0,0 +1,17 @@
+class AddActivationToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :activation_state, :string, :default => nil
+    add_column :users, :activation_token, :string, :default => nil
+    add_column :users, :activation_token_expires_at, :datetime, :default => nil
+    
+    add_index :users, :activation_token
+  end
+
+  def self.down
+    remove_index :users, :activation_token
+    
+    remove_column :users, :activation_token_expires_at
+    remove_column :users, :activation_token
+    remove_column :users, :activation_state
+  end
+end

data/spec/sinatra/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb

@@ -0,0 +1,17 @@
+class AddActivityLoggingToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :last_login_at,     :datetime, :default => nil
+    add_column :users, :last_logout_at,    :datetime, :default => nil
+    add_column :users, :last_activity_at,  :datetime, :default => nil
+    
+    add_index :users, [:last_logout_at, :last_activity_at]
+  end
+
+  def self.down
+    remove_index :users, [:last_logout_at, :last_activity_at]
+    
+    remove_column :users, :last_activity_at
+    remove_column :users, :last_logout_at
+    remove_column :users, :last_login_at
+  end
+end

data/spec/sinatra/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb

@@ -0,0 +1,11 @@
+class AddBruteForceProtectionToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :failed_logins_count, :integer, :default => 0
+    add_column :users, :lock_expires_at, :datetime, :default => nil
+  end
+
+  def self.down
+    remove_column :users, :lock_expires_at
+    remove_column :users, :failed_logins_count
+  end
+end

data/spec/sinatra/db/migrate/core/20101224223620_create_users.rb

@@ -0,0 +1,16 @@
+class CreateUsers < ActiveRecord::Migration
+  def self.up
+    create_table :users do |t|
+      t.string :username,         :null => false
+      t.string :email,            :default => nil
+      t.string :crypted_password, :default => nil
+      t.string :salt,             :default => nil
+
+      t.timestamps
+    end
+  end
+
+  def self.down
+    drop_table :users
+  end
+end

data/spec/sinatra/db/migrate/oauth/20101224223628_create_authentications.rb

@@ -0,0 +1,14 @@
+class CreateAuthentications < ActiveRecord::Migration
+  def self.up
+    create_table :authentications do |t|
+      t.integer :user_id, :null => false
+      t.string :provider, :uid, :null => false
+
+      t.timestamps
+    end
+  end
+
+  def self.down
+    drop_table :authentications
+  end
+end

data/spec/sinatra/db/migrate/remember_me/20101224223623_add_remember_me_token_to_users.rb

@@ -0,0 +1,15 @@
+class AddRememberMeTokenToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :remember_me_token, :string, :default => nil
+    add_column :users, :remember_me_token_expires_at, :datetime, :default => nil
+    
+    add_index :users, :remember_me_token
+  end
+
+  def self.down
+    remove_index :users, :remember_me_token
+    
+    remove_column :users, :remember_me_token_expires_at
+    remove_column :users, :remember_me_token
+  end
+end

data/spec/sinatra/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb

@@ -0,0 +1,13 @@
+class AddResetPasswordToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :reset_password_token, :string, :default => nil
+    add_column :users, :reset_password_token_expires_at, :datetime, :default => nil
+    add_column :users, :reset_password_email_sent_at, :datetime, :default => nil
+  end
+
+  def self.down
+    remove_column :users, :reset_password_email_sent_at
+    remove_column :users, :reset_password_token_expires_at
+    remove_column :users, :reset_password_token
+  end
+end

data/spec/sinatra/filters.rb

@@ -0,0 +1,21 @@
+# --- before filters
+
+['/test_logout','/some_action','/test_should_be_logged_in'].each do |patt|
+  before patt do
+    require_login
+  end
+end
+
+before '/test_http_basic_auth' do
+  require_login_from_http_basic
+end
+
+# ----- test filters
+
+before do
+  self.class.sorcery_vars = {}
+end
+
+after do
+  save_instance_vars
+end