sorcery 0.10.1 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 4a4f8fffc57148ce88fac95615c62974067f30ab
-  data.tar.gz: 742f040d7128342812e667e646e80d4f2dcc9119
+  metadata.gz: bc71bccb13f8e3fcbbf0b94f660a98bc34cc4826
+  data.tar.gz: 9c60fb5db29c7a41378e7c45234b0b0e9df47501
 SHA512:
-  metadata.gz: d5bf556539cc55cfa68727b84b2dfd69f22e6fe145d5797cdbd655360ef4cc7bc918dadca217d7d63420972d0e8f4fd86fe469d7edb10a1530eb4b9100a0c694
-  data.tar.gz: f253c7affbe104709c0f4be6c702ae7f37cecac7ebe7bd1d0609603d8887fe6a4f1c622da5a62b4f85bf542c6e49bdeb322c06ed8d95a34e7f6d880ec4a0c961
+  metadata.gz: c557af8ef3828be476750ba465ea4d3c7a34f5ccbf975c5c731d0841891de4f77d56fa867dfd55be9424a2eea0eed768cdfe1a104e6ed70ae643207bb2573eb1
+  data.tar.gz: 582ea847785099a70c4866feee1b1f891a411e4f572ff89497ac353914cffe78669102d8a7a6b76c208976894ca932f83e61e590645306e7b5a9c3ebc6868bc2

data/.gitignore

@@ -14,6 +14,9 @@ doc
 # jeweler generated
 pkg
 
+# byebug generated
+.byebug_history
+
 # for RVM
 .rvmrc
 

data/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
+## HEAD
+
+## 0.11.0
+
+* Refer to User before calling remove_const to avoid NameError [#58](https://github.com/Sorcery/sorcery/pull/58)
+* Resurrect block authentication, showing auth failure reason. [#41](https://github.com/Sorcery/sorcery/pull/41)
+* Add github scope option to initializer.rb [#50](https://github.com/Sorcery/sorcery/pull/50)
+
+## 0.10.3
+
+* Revert removal of MongoID Adapter (breaks Sorcery for MongoID users until separate gem is created) [#45](https://github.com/Sorcery/sorcery/pull/45)
+
+## 0.10.2
+
+* Added support for Microsoft OAuth (thanks to @athix) [#37](https://github.com/Sorcery/sorcery/pull/37)
+
 ## 0.10.1
+
 * Fixed LinkedIn bug [#36](https://github.com/Sorcery/sorcery/pull/36)
 
 ## 0.10.0
@@ -77,7 +94,7 @@
 
 ## 0.8.4
 
-  * Few security fixes in `external` module
+* Few security fixes in `external` module
 
 ## 0.8.3 (yanked because of bad Jeweler release)
 
@@ -85,38 +102,9 @@
 
 * Activity logging feature has a new column called `last_login_from_ip_address` (string type). If you use ActiveRecord, you will have to add this column to DB ([#465](https://github.com/NoamB/sorcery/issues/465))
 
-## 0.8.1
-<!-- TO BE WRITTEN -->
-
-## 0.8.0
-<!-- TO BE WRITTEN -->
-
-## 0.7.13
-<!-- TO BE WRITTEN -->
-
-## 0.7.12
-<!-- TO BE WRITTEN -->
-
-## 0.7.11
-<!-- TO BE WRITTEN -->
-
-## 0.7.10
-<!-- TO BE WRITTEN -->
-
-## 0.7.9
-<!-- TO BE WRITTEN -->
-
-## 0.7.8
-<!-- TO BE WRITTEN -->
-
-## 0.7.7
-<!-- TO BE WRITTEN -->
-
-## 0.7.6
-<!-- TO BE WRITTEN -->
+## 0.7.5-0.8.1
 
-## 0.7.5
-<!-- TO BE WRITTEN -->
+<!-- HERE BE DRAGONS (Changelogs never written) -->
 
 ## 0.7.1-0.7.4
 

data/lib/generators/sorcery/templates/initializer.rb

@@ -109,12 +109,14 @@ Rails.application.config.sorcery.configure do |config|
   # config.facebook.user_info_mapping = {:email => "name"}
   # config.facebook.access_permissions = ["email", "publish_actions"]
   # config.facebook.display = "page"
-  # config.facebook.api_version = "v2.2"
+  # config.facebook.api_version = "v2.3"
+  # config.facebook.parse = :json
   #
   # config.github.key = ""
   # config.github.secret = ""
   # config.github.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=github"
   # config.github.user_info_mapping = {:email => "name"}
+  # config.github.scope = ""
   #
   # config.paypal.key = ""
   # config.paypal.secret = ""
@@ -131,6 +133,16 @@ Rails.application.config.sorcery.configure do |config|
   # config.google.user_info_mapping = {:email => "email", :username => "name"}
   # config.google.scope = "https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile"
   #
+  # For Microsoft Graph, the key will be your App ID, and the secret will be your app password/public key.
+  # The callback URL "can't contain a query string or invalid special characters", see: https://docs.microsoft.com/en-us/azure/active-directory/active-directory-v2-limitations#restrictions-on-redirect-uris
+  # More information at https://graph.microsoft.io/en-us/docs
+  #
+  # config.microsoft.key = ""
+  # config.microsoft.secret = ""
+  # config.microsoft.callback_url = "http://0.0.0.0:3000/oauth/callback/microsoft"
+  # config.microsoft.user_info_mapping = {:email => "userPrincipalName", :username => "displayName"}
+  # config.microsoft.scope = "openid email https://graph.microsoft.com/User.Read"
+  #
   # config.vk.key = ""
   # config.vk.secret = ""
   # config.vk.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=vk"

data/lib/sorcery/adapters/mongoid_adapter.rb

@@ -0,0 +1,97 @@
+module Sorcery
+  module Adapters
+    class MongoidAdapter < BaseAdapter
+      def increment(attr)
+        mongoid_4? ? @model.inc(attr => 1) : @model.inc(attr, 1)
+      end
+
+      def update_attributes(attrs)
+        attrs.each do |name, value|
+          attrs[name] = value.utc if value.is_a?(ActiveSupport::TimeWithZone)
+          @model.send(:"#{name}=", value)
+        end
+        @model.class.where(:_id => @model.id).update_all(attrs)
+      end
+
+      def update_attribute(name, value)
+        update_attributes(name => value)
+      end
+
+      def save(options = {})
+        mthd = options.delete(:raise_on_failure) ? :save! : :save
+        @model.send(mthd, options)
+      end
+
+      def mongoid_4?
+        Gem::Version.new(::Mongoid::VERSION) >= Gem::Version.new("4.0.0.alpha")
+      end
+
+      class << self
+
+        def define_field(name, type, options={})
+          @klass.field name, options.slice(:default).merge(type: type)
+        end
+
+        def define_callback(time, event, method_name, options={})
+          @klass.send "#{time}_#{event}", method_name, options.slice(:if)
+        end
+
+        def credential_regex(credential)
+          return { :$regex =>  /^#{Regexp.escape(credential)}$/i  } if (@klass.sorcery_config.downcase_username_before_authenticating)
+          credential
+        end
+
+        def find_by_credentials(credentials)
+          @klass.sorcery_config.username_attribute_names.each do |attribute|
+            @user = @klass.where(attribute => credential_regex(credentials[0])).first
+            break if @user
+          end
+          @user
+        end
+
+        def find_by_oauth_credentials(provider, uid)
+          @user_config ||= ::Sorcery::Controller::Config.user_class.to_s.constantize.sorcery_config
+          @klass.where(@user_config.provider_attribute_name => provider, @user_config.provider_uid_attribute_name => uid).first
+        end
+
+        def find_by_activation_token(token)
+          @klass.where(@klass.sorcery_config.activation_token_attribute_name => token).first
+        end
+
+        def find_by_remember_me_token(token)
+          @klass.where(@klass.sorcery_config.remember_me_token_attribute_name => token).first
+        end
+
+        def transaction(&blk)
+          tap(&blk)
+        end
+
+        def find_by_id(id)
+          @klass.find(id)
+        rescue ::Mongoid::Errors::DocumentNotFound
+          nil
+        end
+
+        def find_by_username(username)
+          query = @klass.sorcery_config.username_attribute_names.map {|name| {name => username}}
+          @klass.any_of(*query).first
+        end
+
+        def find_by_token(token_attr_name, token)
+          @klass.where(token_attr_name => token).first
+        end
+
+        def find_by_email(email)
+          @klass.where(@klass.sorcery_config.email_attribute_name => email).first
+        end
+
+        def get_current_users
+          config = @klass.sorcery_config
+          @klass.where(config.last_activity_at_attribute_name.ne => nil) \
+          .where("this.#{config.last_logout_at_attribute_name} == null || this.#{config.last_activity_at_attribute_name} > this.#{config.last_logout_at_attribute_name}") \
+          .where(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc).order_by([:_id,:asc])
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/external.rb

@@ -22,6 +22,7 @@ module Sorcery
           require 'sorcery/providers/paypal'
           require 'sorcery/providers/slack'
           require 'sorcery/providers/wechat'
+          require 'sorcery/providers/microsoft'
 
           Config.module_eval do
             class << self

data/lib/sorcery/controller.rb

@@ -30,8 +30,16 @@ module Sorcery
       # Runs hooks after login or failed login.
       def login(*credentials)
         @current_user = nil
-        user = user_class.authenticate(*credentials)
-        if user
+
+        user_class.authenticate(*credentials) do |user, failure_reason|
+          if failure_reason
+            after_failed_login!(credentials)
+
+            yield(user, failure_reason) if block_given?
+
+            return
+          end
+
           old_session = session.dup.to_hash
           reset_sorcery_session
           old_session.each_pair do |k, v|
@@ -41,10 +49,8 @@ module Sorcery
 
           auto_login(user)
           after_login!(user, credentials)
-          current_user
-        else
-          after_failed_login!(credentials)
-          nil
+
+          block_given? ? yield(current_user, nil) : current_user
         end
       end
 

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -41,10 +41,15 @@ module Sorcery
         end
 
         module ClassMethods
-          def load_from_unlock_token(token)
-            return nil if token.blank?
-            user = sorcery_adapter.find_by_token(sorcery_config.unlock_token_attribute_name, token)
-            user
+          # This doesn't check to see if the account is still locked
+          def load_from_unlock_token(token, &block)
+            return if token.blank?
+
+            load_from_token(
+              token,
+              sorcery_config.unlock_token_attribute_name,
+              &block
+            )
           end
 
           protected
@@ -116,7 +121,10 @@ module Sorcery
             if !login_unlocked? && config.login_lock_time_period != 0
               login_unlock! if send(config.lock_expires_at_attribute_name) <= Time.now.in_time_zone
             end
-            login_unlocked?
+
+            return false, :locked unless login_unlocked?
+
+            true
           end
         end
       end

data/lib/sorcery/model/submodules/reset_password.rb

@@ -55,10 +55,13 @@ module Sorcery
         module ClassMethods
           # Find user by token, also checks for expiration.
           # Returns the user if token found and is valid.
-          def load_from_reset_password_token(token)
-            token_attr_name = @sorcery_config.reset_password_token_attribute_name
-            token_expiration_date_attr = @sorcery_config.reset_password_token_expires_at_attribute_name
-            load_from_token(token, token_attr_name, token_expiration_date_attr)
+          def load_from_reset_password_token(token, &block)
+            load_from_token(
+              token,
+              @sorcery_config.reset_password_token_attribute_name,
+              @sorcery_config.reset_password_token_expires_at_attribute_name,
+              &block
+            )
           end
 
           protected

data/lib/sorcery/model/submodules/user_activation.rb

@@ -59,10 +59,13 @@ module Sorcery
         module ClassMethods
           # Find user by token, also checks for expiration.
           # Returns the user if token found and is valid.
-          def load_from_activation_token(token)
-            token_attr_name = @sorcery_config.activation_token_attribute_name
-            token_expiration_date_attr = @sorcery_config.activation_token_expires_at_attribute_name
-            load_from_token(token, token_attr_name, token_expiration_date_attr)
+          def load_from_activation_token(token, &block)
+            load_from_token(
+              token,
+              @sorcery_config.activation_token_attribute_name,
+              @sorcery_config.activation_token_expires_at_attribute_name,
+              &block
+            )
           end
 
           protected
@@ -128,7 +131,14 @@ module Sorcery
 
           def prevent_non_active_login
             config = sorcery_config
-            config.prevent_non_active_users_to_login ? send(config.activation_state_attribute_name) == 'active' : true
+
+            if config.prevent_non_active_users_to_login
+              unless send(config.activation_state_attribute_name) == 'active'
+                return false, :inactive
+              end
+            end
+
+            true
           end
         end
       end

data/lib/sorcery/model/temporary_token.rb

@@ -16,13 +16,34 @@ module Sorcery
       end
 
       module ClassMethods
-        def load_from_token(token, token_attr_name, token_expiration_date_attr)
-          return nil if token.blank?
+        def load_from_token(token, token_attr_name, token_expiration_date_attr = nil, &block)
+          return token_response(failure: :invalid_token, &block) if token.blank?
+
           user = sorcery_adapter.find_by_token(token_attr_name, token)
-          if !user.blank? && !user.send(token_expiration_date_attr).nil?
-            return Time.now.in_time_zone < user.send(token_expiration_date_attr) ? user : nil
+
+          return token_response(failure: :user_not_found, &block) unless user
+
+          unless check_expiration_date(user, token_expiration_date_attr)
+            return token_response(user: user, failure: :token_expired, &block)
           end
-          user
+
+          token_response(user: user, return_value: user, &block)
+        end
+
+        protected
+
+        def check_expiration_date(user, token_expiration_date_attr)
+          return true unless token_expiration_date_attr
+
+          expires_at = user.send(token_expiration_date_attr)
+
+          !expires_at || (Time.now.in_time_zone < expires_at)
+        end
+
+        def token_response(options = {})
+          yield(options[:user], options[:failure]) if block_given?
+
+          options[:return_value]
         end
       end
     end

data/lib/sorcery/model.rb

@@ -80,10 +80,12 @@ module Sorcery
       # Takes a username and password,
       # Finds the user by the username and compares the user's password to the one supplied to the method.
       # returns the user if success, nil otherwise.
-      def authenticate(*credentials)
+      def authenticate(*credentials, &block)
         raise ArgumentError, 'at least 2 arguments required' if credentials.size < 2
 
-        return false if credentials[0].blank?
+        if credentials[0].blank?
+          return authentication_response(return_value: false, failure: :invalid_login, &block)
+        end
 
         if @sorcery_config.downcase_username_before_authenticating
           credentials[0].downcase!
@@ -91,13 +93,29 @@ module Sorcery
 
         user = sorcery_adapter.find_by_credentials(credentials)
 
-        if user.respond_to?(:active_for_authentication?)
-          return nil unless user.active_for_authentication?
+        unless user
+          return authentication_response(failure: :invalid_login, &block)
         end
 
         set_encryption_attributes
 
-        user if user && @sorcery_config.before_authenticate.all? { |c| user.send(c) } && user.valid_password?(credentials[1])
+        unless user.valid_password?(credentials[1])
+          return authentication_response(user: user, failure: :invalid_password, &block)
+        end
+
+        if user.respond_to?(:active_for_authentication?) && !user.active_for_authentication?
+          return authentication_response(user: user, failure: :inactive, &block)
+        end
+
+        @sorcery_config.before_authenticate.each do |callback|
+          success, reason = user.send(callback)
+
+          unless success
+            return authentication_response(user: user, failure: reason, &block)
+          end
+        end
+
+        authentication_response(user: user, return_value: user, &block)
       end
 
       # encrypt tokens using current encryption_provider.
@@ -112,6 +130,12 @@ module Sorcery
 
       protected
 
+      def authentication_response(options = {})
+        yield(options[:user], options[:failure]) if block_given?
+
+        options[:return_value]
+      end
+
       def set_encryption_attributes
         @sorcery_config.encryption_provider.stretches = @sorcery_config.stretches if @sorcery_config.encryption_provider.respond_to?(:stretches) && @sorcery_config.stretches
         @sorcery_config.encryption_provider.join_token = @sorcery_config.salt_join_token if @sorcery_config.encryption_provider.respond_to?(:join_token) && @sorcery_config.salt_join_token

data/lib/sorcery/providers/facebook.rb

@@ -9,9 +9,9 @@ module Sorcery
     class Facebook < Base
       include Protocols::Oauth2
 
-      attr_reader   :mode, :param_name, :parse
+      attr_reader   :mode, :param_name
       attr_accessor :access_permissions, :display, :scope, :token_url,
-                    :user_info_path, :auth_path, :api_version
+                    :user_info_path, :auth_path, :api_version, :parse
 
       def initialize
         super
@@ -24,7 +24,7 @@ module Sorcery
         @token_url      = 'oauth/access_token'
         @auth_path      = 'dialog/oauth'
         @mode           = :query
-        @parse          = :query
+        @parse          = :json
         @param_name     = 'access_token'
       end
 

data/lib/sorcery/providers/microsoft.rb

@@ -0,0 +1,59 @@
+module Sorcery
+  module Providers
+    # This class adds support for OAuth with Microsoft Graph.
+    #
+    #   config.microsoft.key = <key>
+    #   config.microsoft.secret = <secret>
+    #   ...
+    #
+    class Microsoft < Base
+      include Protocols::Oauth2
+
+      attr_accessor :auth_url, :scope, :token_url, :user_info_url
+
+      def initialize
+        super
+
+        @site          = 'https://login.microsoftonline.com'
+        @auth_url      = '/common/oauth2/v2.0/authorize'
+        @token_url     = '/common/oauth2/v2.0/token'
+        @user_info_url = 'https://graph.microsoft.com/v1.0/me'
+        @scope         = 'openid email https://graph.microsoft.com/User.Read'
+        @state         = SecureRandom.hex(16)
+      end
+
+      def authorize_url(options = {})
+        oauth_params = {
+          client_id: @key,
+          response_type: 'code'
+        }
+        options.merge!(oauth_params)
+        super(options)
+      end
+
+      def get_user_hash(access_token)
+        response = access_token.get(user_info_url)
+
+        auth_hash(access_token).tap do |h|
+          h[:user_info] = JSON.parse(response.body)
+          h[:uid] = h[:user_info]['id']
+        end
+      end
+
+      # calculates and returns the url to which the user should be redirected,
+      # to get authenticated at the external provider's site.
+      def login_url(_params, _session)
+        authorize_url(authorize_url: auth_url)
+      end
+
+      # tries to login the user from access token
+      def process_callback(params, _session)
+        args = {}.tap do |a|
+          a[:code] = params[:code] if params[:code]
+        end
+
+        get_access_token(args, token_url: token_url, token_method: :post)
+      end
+    end
+  end
+end

data/lib/sorcery/test_helpers/internal.rb

@@ -67,7 +67,7 @@ module Sorcery
       # reload user class between specs
       # so it will be possible to test the different submodules in isolation
       def reload_user_class
-        Object.send(:remove_const, 'User')
+        User && Object.send(:remove_const, 'User')
         load 'user.rb'
         if User.respond_to?(:reset_column_information)
           User.reset_column_information

data/lib/sorcery/version.rb

@@ -1,3 +1,3 @@
 module Sorcery
-  VERSION = '0.10.1'
+  VERSION = '0.11.0'
 end

data/lib/sorcery.rb

@@ -65,7 +65,7 @@ module Sorcery
 
   require 'sorcery/adapters/base_adapter'
 
-  if defined?(ActiveRecord)
+  if defined?(ActiveRecord::Base)
     require 'sorcery/adapters/active_record_adapter'
     ActiveRecord::Base.extend Sorcery::Model
 
@@ -78,5 +78,18 @@ module Sorcery
     end
   end
 
+  if defined?(Mongoid::Document)
+    require 'sorcery/adapters/mongoid_adapter'
+    Mongoid::Document::ClassMethods.send :include, Sorcery::Model
+
+    Mongoid::Document.send :define_method, :sorcery_adapter do
+      @sorcery_adapter ||= Sorcery::Adapters::MongoidAdapter.new(self)
+    end
+
+    Mongoid::Document::ClassMethods.send :define_method, :sorcery_adapter do
+      Sorcery::Adapters::MongoidAdapter.from(self)
+    end
+  end
+
   require 'sorcery/engine' if defined?(Rails)
 end

data/sorcery.gemspec

@@ -10,8 +10,8 @@ Gem::Specification.new do |s|
   s.description = 'Provides common authentication needs such as signing in/out, activating by email and resetting password.'
   s.summary = 'Magical authentication for Rails applications'
   s.homepage = 'https://github.com/Sorcery/sorcery'
-  s.post_install_message = "As of version 1.0 oauth/oauth2 won't be automatically bundled\n"
-  s.post_install_message += 'you need to add those dependencies to your Gemfile'
+  s.post_install_message = "As of version 1.0 oauth/oauth2 won't be automatically bundled so you may need to add those dependencies to your Gemfile.\n"
+  s.post_install_message += 'You may need oauth2 if you use external providers such as any of these: https://github.com/Sorcery/sorcery/tree/master/lib/sorcery/providers'
 
   s.files         = `git ls-files`.split($INPUT_RECORD_SEPARATOR)
   s.require_paths = ['lib']
@@ -29,4 +29,5 @@ Gem::Specification.new do |s|
   s.add_development_dependency 'simplecov', '>= 0.3.8'
   s.add_development_dependency 'rspec-rails', '~> 3.5.0'
   s.add_development_dependency 'test-unit', '~> 3.1.0'
+  s.add_development_dependency 'byebug', '~> 9.0.0'
 end

data/spec/controllers/controller_brute_force_protection_spec.rb

@@ -20,7 +20,7 @@ describe SorceryController, type: :controller do
     end
 
     it 'counts login retries' do
-      allow(User).to receive(:authenticate)
+      allow(User).to receive(:authenticate) { |&block| block.call(nil, :other) }
       allow(User.sorcery_adapter).to receive(:find_by_credentials).with(['bla@bla.com', 'blabla']).and_return(user)
 
       expect(user).to receive(:register_failed_login!).exactly(3).times
@@ -32,7 +32,7 @@ describe SorceryController, type: :controller do
       # dirty hack for rails 4
       allow(@controller).to receive(:register_last_activity_time_to_db)
 
-      allow(User).to receive(:authenticate).and_return(user)
+      allow(User).to receive(:authenticate) { |&block| block.call(user, nil) }
       expect(user).to receive_message_chain(:sorcery_adapter, :update_attribute).with(:failed_logins_count, 0)
 
       get :test_login, params: { email: 'bla@bla.com', password: 'secret' }

data/spec/controllers/controller_oauth2_spec.rb

@@ -151,7 +151,7 @@ describe SorceryController, active_record: true, type: :controller do
       expect(flash[:notice]).to eq 'Success!'
     end
 
-    [:github, :google, :liveid, :vk, :salesforce, :paypal, :slack, :wechat].each do |provider|
+    [:github, :google, :liveid, :vk, :salesforce, :paypal, :slack, :wechat, :microsoft].each do |provider|
       describe "with #{provider}" do
         it 'login_at redirects correctly' do
           get :"login_at_test_#{provider}"
@@ -201,7 +201,7 @@ describe SorceryController, active_record: true, type: :controller do
       end
 
       sorcery_reload!([:user_activation,:external], :user_activation_mailer => ::SorceryMailer)
-      sorcery_controller_property_set(:external_providers, [:facebook, :github, :google, :liveid, :vk, :salesforce, :paypal, :slack, :wechat])
+      sorcery_controller_property_set(:external_providers, [:facebook, :github, :google, :liveid, :vk, :salesforce, :paypal, :slack, :wechat, :microsoft])
 
       # TODO: refactor
       sorcery_controller_external_property_set(:facebook, :key, "eYVNBjBDi33aa9GkA3w")
@@ -231,6 +231,9 @@ describe SorceryController, active_record: true, type: :controller do
       sorcery_controller_external_property_set(:wechat, :key, "eYVNBjBDi33aa9GkA3w")
       sorcery_controller_external_property_set(:wechat, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
       sorcery_controller_external_property_set(:wechat, :callback_url, "http://blabla.com")
+      sorcery_controller_external_property_set(:microsoft, :key, "eYVNBjBDi33aa9GkA3w")
+      sorcery_controller_external_property_set(:microsoft, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+      sorcery_controller_external_property_set(:microsoft, :callback_url, "http://blabla.com")
     end
 
     after(:all) do
@@ -260,7 +263,7 @@ describe SorceryController, active_record: true, type: :controller do
       expect(ActionMailer::Base.deliveries.size).to eq old_size
     end
 
-    [:github, :google, :liveid, :vk, :salesforce, :paypal, :wechat].each do |provider|
+    [:github, :google, :liveid, :vk, :salesforce, :paypal, :wechat, :microsoft].each do |provider|
       it "does not send activation email to external users (#{provider})" do
         old_size = ActionMailer::Base.deliveries.size
         create_new_external_user provider
@@ -409,7 +412,7 @@ describe SorceryController, active_record: true, type: :controller do
   end
 
   def set_external_property
-    sorcery_controller_property_set(:external_providers, [:facebook, :github, :google, :liveid, :vk, :salesforce, :paypal, :slack, :wechat])
+    sorcery_controller_property_set(:external_providers, [:facebook, :github, :google, :liveid, :vk, :salesforce, :paypal, :slack, :wechat, :microsoft])
     sorcery_controller_external_property_set(:facebook, :key, "eYVNBjBDi33aa9GkA3w")
     sorcery_controller_external_property_set(:facebook, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
     sorcery_controller_external_property_set(:facebook, :callback_url, "http://blabla.com")
@@ -437,6 +440,9 @@ describe SorceryController, active_record: true, type: :controller do
     sorcery_controller_external_property_set(:wechat, :key, "eYVNBjBDi33aa9GkA3w")
     sorcery_controller_external_property_set(:wechat, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
     sorcery_controller_external_property_set(:wechat, :callback_url, "http://blabla.com")
+    sorcery_controller_external_property_set(:microsoft, :key, "eYVNBjBDi33aa9GkA3w")
+    sorcery_controller_external_property_set(:microsoft, :secret, "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8")
+    sorcery_controller_external_property_set(:microsoft, :callback_url, "http://blabla.com")
   end
 
   def provider_url(provider)
@@ -448,7 +454,8 @@ describe SorceryController, active_record: true, type: :controller do
       vk: "https://oauth.vk.com/authorize?client_id=#{::Sorcery::Controller::Config.vk.key}&display&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=#{::Sorcery::Controller::Config.vk.scope}&state",
       salesforce: "https://login.salesforce.com/services/oauth2/authorize?client_id=#{::Sorcery::Controller::Config.salesforce.key}&display&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope#{'=' + ::Sorcery::Controller::Config.salesforce.scope unless ::Sorcery::Controller::Config.salesforce.scope.nil?}&state",
       slack: "https://slack.com/oauth/authorize?client_id=#{::Sorcery::Controller::Config.slack.key}&display&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=identity.basic%2C+identity.email&state",
-      wechat: "https://open.weixin.qq.com/connect/qrconnect?appid=#{::Sorcery::Controller::Config.wechat.key}&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=snsapi_login&state=#wechat_redirect"
+      wechat: "https://open.weixin.qq.com/connect/qrconnect?appid=#{::Sorcery::Controller::Config.wechat.key}&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=snsapi_login&state=#wechat_redirect",
+      microsoft: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=#{::Sorcery::Controller::Config.microsoft.key}&display&redirect_uri=http%3A%2F%2Fblabla.com&response_type=code&scope=openid+email+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state"
     }[provider]
   end
 end

data/spec/controllers/controller_remember_me_spec.rb

@@ -22,7 +22,7 @@ describe SorceryController, type: :controller do
     end
 
     it 'sets cookie on remember_me!' do
-      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret') { |&block| block.call(user, nil) }
       expect(user).to receive(:remember_me!)
 
       post :test_login_with_remember, params: { email: 'bla@bla.com', password: 'secret' }
@@ -45,7 +45,7 @@ describe SorceryController, type: :controller do
     end
 
     it 'login(email,password,remember_me) logs user in and remembers' do
-      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret', '1').and_return(user)
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret', '1') { |&block| block.call(user, nil) }
       expect(user).to receive(:remember_me!)
       expect(user).to receive(:remember_me_token).and_return('abracadabra').twice
 

data/spec/controllers/controller_session_timeout_spec.rb

@@ -39,7 +39,7 @@ describe SorceryController, type: :controller do
     it 'works if the session is stored as a string or a Time' do
       session[:login_time] = Time.now.to_s
       # TODO: ???
-      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+      expect(User).to receive(:authenticate).with('bla@bla.com', 'secret') { |&block| block.call(user, nil) }
 
       get :test_login, params: { email: 'bla@bla.com', password: 'secret' }
 
@@ -50,7 +50,7 @@ describe SorceryController, type: :controller do
     context "with 'session_timeout_from_last_action'" do
       it 'does not logout if there was activity' do
         sorcery_controller_property_set(:session_timeout_from_last_action, true)
-        expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+        expect(User).to receive(:authenticate).with('bla@bla.com', 'secret') { |&block| block.call(user, nil) }
 
         get :test_login, params: { email: 'bla@bla.com', password: 'secret' }
         Timecop.travel(Time.now.in_time_zone + 0.3)

data/spec/controllers/controller_spec.rb

@@ -52,7 +52,7 @@ describe SorceryController, type: :controller do
     describe '#login' do
       context 'when succeeds' do
         before do
-          expect(User).to receive(:authenticate).with('bla@bla.com', 'secret').and_return(user)
+          expect(User).to receive(:authenticate).with('bla@bla.com', 'secret') { |&block| block.call(user, nil) }
           get :test_login, params: { email: 'bla@bla.com', password: 'secret' }
         end
 

data/spec/rails_app/app/controllers/sorcery_controller.rb

@@ -104,6 +104,10 @@ class SorceryController < ActionController::Base
     login_at(:wechat)
   end
 
+  def login_at_test_microsoft
+    login_at(:microsoft)
+  end
+
   def login_at_test_google
     login_at(:google)
   end
@@ -174,6 +178,14 @@ class SorceryController < ActionController::Base
     end
   end
 
+  def test_login_from_microsoft
+    if @user = login_from(:microsoft)
+      redirect_to 'bla', notice: 'Success!'
+    else
+      redirect_to 'blu', alert: 'Failed!'
+    end
+  end
+
   def test_login_from_google
     if @user = login_from(:google)
       redirect_to 'bla', notice: 'Success!'
@@ -272,6 +284,14 @@ class SorceryController < ActionController::Base
     end
   end
 
+  def test_return_to_with_external_microsoft
+    if @user = login_from(:microsoft)
+      redirect_back_or_to 'bla', notice: 'Success!'
+    else
+      redirect_to 'blu', alert: 'Failed!'
+    end
+  end
+
   def test_return_to_with_external_google
     if @user = login_from(:google)
       redirect_back_or_to 'bla', notice: 'Success!'

data/spec/rails_app/config/routes.rb

@@ -22,6 +22,7 @@ AppRoot::Application.routes.draw do
     get :test_login_from_github
     get :test_login_from_paypal
     get :test_login_from_wechat
+    get :test_login_from_microsoft
     get :test_login_from_google
     get :test_login_from_liveid
     get :test_login_from_vk
@@ -34,6 +35,7 @@ AppRoot::Application.routes.draw do
     get :login_at_test_github
     get :login_at_test_paypal
     get :login_at_test_wechat
+    get :login_at_test_microsoft
     get :login_at_test_google
     get :login_at_test_liveid
     get :login_at_test_vk
@@ -46,6 +48,7 @@ AppRoot::Application.routes.draw do
     get :test_return_to_with_external_github
     get :test_return_to_with_external_paypal
     get :test_return_to_with_external_wechat
+    get :test_return_to_with_external_microsoft
     get :test_return_to_with_external_google
     get :test_return_to_with_external_liveid
     get :test_return_to_with_external_vk

data/spec/shared_examples/user_activation_shared_examples.rb

@@ -235,6 +235,27 @@ shared_examples_for 'rails_3_activation_model' do
 
       expect(User.authenticate(user.email, 'secret')).to be_truthy
     end
+
+    context 'in block mode' do
+      it 'does not allow a non-active user to authenticate' do
+        sorcery_model_property_set(:prevent_non_active_users_to_login, true)
+
+        User.authenticate(user.email, 'secret') do |user2, failure|
+          expect(user2).to eq user
+          expect(user2.activation_state).to eq 'pending'
+          expect(failure).to eq :inactive
+        end
+      end
+
+      it 'allows a non-active user to authenticate if configured so' do
+        sorcery_model_property_set(:prevent_non_active_users_to_login, false)
+
+        User.authenticate(user.email, 'secret') do |user2, failure|
+          expect(user2).to eq user
+          expect(failure).to be_nil
+        end
+      end
+    end
   end
 
   describe 'load_from_activation_token' do
@@ -279,5 +300,62 @@ shared_examples_for 'rails_3_activation_model' do
 
       expect(User.load_from_activation_token(user.activation_token)).to eq user
     end
+
+    describe '#load_from_activation_token' do
+      context 'in block mode' do
+        it 'yields user when token is found' do
+          User.load_from_activation_token(user.activation_token) do |user2, failure|
+            expect(user2).to eq user
+            expect(failure).to be_nil
+          end
+        end
+
+        it 'does NOT yield user when token is NOT found' do
+          User.load_from_activation_token('a') do |user2, failure|
+            expect(user2).to be_nil
+            expect(failure).to eq :user_not_found
+          end
+        end
+
+        it 'yields user when token is found and not expired' do
+          sorcery_model_property_set(:activation_token_expiration_period, 500)
+
+          User.load_from_activation_token(user.activation_token) do |user2, failure|
+            expect(user2).to eq user
+            expect(failure).to be_nil
+          end
+        end
+
+        it 'yields the user and failure reason when token is found and expired' do
+          sorcery_model_property_set(:activation_token_expiration_period, 0.1)
+          user
+
+          Timecop.travel(Time.now.in_time_zone + 0.5)
+
+          User.load_from_activation_token(user.activation_token) do |user2, failure|
+            expect(user2).to eq user
+            expect(failure).to eq :token_expired
+          end
+        end
+
+        it 'yields a failure reason if token is blank' do
+          [nil, ''].each do |token|
+            User.load_from_activation_token(token) do |user2, failure|
+              expect(user2).to be_nil
+              expect(failure).to eq :invalid_token
+            end
+          end
+        end
+
+        it 'is always valid if expiration period is nil' do
+          sorcery_model_property_set(:activation_token_expiration_period, nil)
+
+          User.load_from_activation_token(user.activation_token) do |user2, failure|
+            expect(user2).to eq user
+            expect(failure).to be_nil
+          end
+        end
+      end
+    end
   end
 end

data/spec/shared_examples/user_reset_password_shared_examples.rb

@@ -128,6 +128,71 @@ shared_examples_for 'rails_3_reset_password_model' do
       expect(User.load_from_reset_password_token('')).to be_nil
     end
 
+    describe '#load_from_reset_password_token' do
+      context 'in block mode' do
+        it 'yields user when token is found' do
+          user.generate_reset_password_token!
+          updated_user = User.sorcery_adapter.find(user.id)
+
+          User.load_from_reset_password_token(user.reset_password_token) do |user2, failure|
+            expect(user2).to eq updated_user
+            expect(failure).to be_nil
+          end
+        end
+
+        it 'does NOT yield user when token is NOT found' do
+          user.generate_reset_password_token!
+
+          User.load_from_reset_password_token('a') do |user2, failure|
+            expect(user2).to be_nil
+            expect(failure).to eq :user_not_found
+          end
+        end
+
+        it 'yields user when token is found and not expired' do
+          sorcery_model_property_set(:reset_password_expiration_period, 500)
+          user.generate_reset_password_token!
+          updated_user = User.sorcery_adapter.find(user.id)
+
+          User.load_from_reset_password_token(user.reset_password_token) do |user2, failure|
+            expect(user2).to eq updated_user
+            expect(failure).to be_nil
+          end
+        end
+
+        it 'yields user and failure reason when token is found and expired' do
+          sorcery_model_property_set(:reset_password_expiration_period, 0.1)
+          user.generate_reset_password_token!
+          Timecop.travel(Time.now.in_time_zone + 0.5)
+
+          User.load_from_reset_password_token(user.reset_password_token) do |user2, failure|
+            expect(user2).to eq user
+            expect(failure).to eq :token_expired
+          end
+        end
+
+        it 'is always valid if expiration period is nil' do
+          sorcery_model_property_set(:reset_password_expiration_period, nil)
+          user.generate_reset_password_token!
+          updated_user = User.sorcery_adapter.find(user.id)
+
+          User.load_from_reset_password_token(user.reset_password_token) do |user2, failure|
+            expect(user2).to eq updated_user
+            expect(failure).to be_nil
+          end
+        end
+
+        it 'returns nil if token is blank' do
+          [nil, ''].each do |token|
+            User.load_from_reset_password_token(token) do |user2, failure|
+              expect(user2).to be_nil
+              expect(failure).to eq :invalid_token
+            end
+          end
+        end
+      end
+    end
+
     it "'deliver_reset_password_instructions!' generates a reset_password_token" do
       expect(user.reset_password_token).to be_nil
 

data/spec/shared_examples/user_shared_examples.rb

@@ -146,6 +146,31 @@ shared_examples_for 'rails_3_core_model' do
           expect(User.authenticate(user.email, 'secret')).to be_nil
         end
       end
+
+      context 'in block mode' do
+        it 'yields the user if credentials are good' do
+          User.authenticate(user.email, 'secret') do |user2, failure|
+            expect(user2).to eq user
+            expect(failure).to be_nil
+          end
+        end
+
+        it 'yields the user and proper error if credentials are bad' do
+          User.authenticate(user.email, 'wrong!') do |user2, failure|
+            expect(user2).to eq user
+            expect(failure).to eq :invalid_password
+          end
+        end
+
+        it 'yields the proper error if no user exists' do
+          [nil, '', 'not@a.user'].each do |email|
+            User.authenticate(email, 'wrong!') do |user2, failure|
+              expect(user2).to be_nil
+              expect(failure).to eq :invalid_login
+            end
+          end
+        end
+      end
     end
 
     specify { expect(User).to respond_to(:encrypt) }

data/spec/spec_helper.rb

@@ -11,6 +11,7 @@ SORCERY_ORM = :active_record
 require 'rails/all'
 require 'rspec/rails'
 require 'timecop'
+require 'byebug'
 
 def setup_orm; end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sorcery
 version: !ruby/object:Gem::Version
-  version: 0.10.1
+  version: 0.11.0
 platform: ruby
 authors:
 - Noam Ben Ari
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-01-03 00:00:00.000000000 Z
+date: 2017-05-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: oauth
@@ -137,6 +137,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 3.1.0
+- !ruby/object:Gem::Dependency
+  name: byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 9.0.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 9.0.0
 description: Provides common authentication needs such as signing in/out, activating
   by email and resetting password.
 email: chase.gilliam@gmail.com
@@ -170,6 +184,7 @@ files:
 - lib/sorcery.rb
 - lib/sorcery/adapters/active_record_adapter.rb
 - lib/sorcery/adapters/base_adapter.rb
+- lib/sorcery/adapters/mongoid_adapter.rb
 - lib/sorcery/controller.rb
 - lib/sorcery/controller/config.rb
 - lib/sorcery/controller/submodules/activity_logging.rb
@@ -206,6 +221,7 @@ files:
 - lib/sorcery/providers/jira.rb
 - lib/sorcery/providers/linkedin.rb
 - lib/sorcery/providers/liveid.rb
+- lib/sorcery/providers/microsoft.rb
 - lib/sorcery/providers/paypal.rb
 - lib/sorcery/providers/salesforce.rb
 - lib/sorcery/providers/slack.rb
@@ -289,8 +305,8 @@ licenses:
 - MIT
 metadata: {}
 post_install_message: |-
-  As of version 1.0 oauth/oauth2 won't be automatically bundled
-  you need to add those dependencies to your Gemfile
+  As of version 1.0 oauth/oauth2 won't be automatically bundled so you may need to add those dependencies to your Gemfile.
+  You may need oauth2 if you use external providers such as any of these: https://github.com/Sorcery/sorcery/tree/master/lib/sorcery/providers
 rdoc_options: []
 require_paths:
 - lib
@@ -311,3 +327,4 @@ signing_key:
 specification_version: 4
 summary: Magical authentication for Rails applications
 test_files: []
+has_rdoc: