sorcery 0.2.0 → 0.3.0

data/spec/sinatra/Gemfile.lock

@@ -0,0 +1,134 @@
+PATH
+  remote: ../../
+  specs:
+    sorcery (0.3.0)
+      bcrypt-ruby (~> 2.1.4)
+      json (>= 1.5.1)
+      oauth (>= 0.4.4)
+      oauth (>= 0.4.4)
+      oauth2 (>= 0.1.1)
+      oauth2 (>= 0.1.1)
+      rails (>= 3.0.0)
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    abstract (1.0.0)
+    actionmailer (3.0.3)
+      actionpack (= 3.0.3)
+      mail (~> 2.2.9)
+    actionpack (3.0.3)
+      activemodel (= 3.0.3)
+      activesupport (= 3.0.3)
+      builder (~> 2.1.2)
+      erubis (~> 2.6.6)
+      i18n (~> 0.4)
+      rack (~> 1.2.1)
+      rack-mount (~> 0.6.13)
+      rack-test (~> 0.5.6)
+      tzinfo (~> 0.3.23)
+    activemodel (3.0.3)
+      activesupport (= 3.0.3)
+      builder (~> 2.1.2)
+      i18n (~> 0.4)
+    activerecord (3.0.3)
+      activemodel (= 3.0.3)
+      activesupport (= 3.0.3)
+      arel (~> 2.0.2)
+      tzinfo (~> 0.3.23)
+    activeresource (3.0.3)
+      activemodel (= 3.0.3)
+      activesupport (= 3.0.3)
+    activesupport (3.0.3)
+    addressable (2.2.4)
+    archive-tar-minitar (0.5.2)
+    arel (2.0.7)
+    bcrypt-ruby (2.1.4)
+    builder (2.1.2)
+    columnize (0.3.2)
+    diff-lcs (1.1.2)
+    erubis (2.6.6)
+      abstract (>= 1.0.0)
+    faraday (0.5.5)
+      addressable (~> 2.2.4)
+      multipart-post (~> 1.1.0)
+      rack (< 2, >= 1.1.0)
+    i18n (0.5.0)
+    json (1.5.1)
+    linecache19 (0.5.11)
+      ruby_core_source (>= 0.1.4)
+    mail (2.2.15)
+      activesupport (>= 2.3.6)
+      i18n (>= 0.4.0)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    mime-types (1.16)
+    multi_json (0.0.5)
+    multipart-post (1.1.0)
+    oauth (0.4.4)
+    oauth2 (0.1.1)
+      faraday (~> 0.5.0)
+      multi_json (~> 0.0.4)
+    polyglot (0.3.1)
+    rack (1.2.1)
+    rack-mount (0.6.13)
+      rack (>= 1.0.0)
+    rack-test (0.5.7)
+      rack (>= 1.0)
+    rails (3.0.3)
+      actionmailer (= 3.0.3)
+      actionpack (= 3.0.3)
+      activerecord (= 3.0.3)
+      activeresource (= 3.0.3)
+      activesupport (= 3.0.3)
+      bundler (~> 1.0)
+      railties (= 3.0.3)
+    railties (3.0.3)
+      actionpack (= 3.0.3)
+      activesupport (= 3.0.3)
+      rake (>= 0.8.7)
+      thor (~> 0.14.4)
+    rake (0.8.7)
+    rspec (2.4.0)
+      rspec-core (~> 2.4.0)
+      rspec-expectations (~> 2.4.0)
+      rspec-mocks (~> 2.4.0)
+    rspec-core (2.4.0)
+    rspec-expectations (2.4.0)
+      diff-lcs (~> 1.1.2)
+    rspec-mocks (2.4.0)
+    ruby-debug-base19 (0.11.24)
+      columnize (>= 0.3.1)
+      linecache19 (>= 0.5.11)
+      ruby_core_source (>= 0.1.4)
+    ruby-debug19 (0.11.6)
+      columnize (>= 0.3.1)
+      linecache19 (>= 0.5.11)
+      ruby-debug-base19 (>= 0.11.19)
+    ruby_core_source (0.1.4)
+      archive-tar-minitar (>= 0.5.2)
+    simplecov (0.3.9)
+      simplecov-html (>= 0.3.7)
+    simplecov-html (0.3.9)
+    sinatra (1.2.0)
+      rack (~> 1.1)
+      tilt (< 2.0, >= 1.2.2)
+    spork (0.9.0.rc3)
+    sqlite3-ruby (1.3.2)
+    thor (0.14.6)
+    tilt (1.2.2)
+    treetop (1.4.9)
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.24)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  rspec
+  ruby-debug19
+  simplecov (>= 0.3.8)
+  sinatra (>= 1.2.0)
+  sorcery (= 0.3.0)!
+  spork (~> 0.9.0.rc)
+  sqlite3-ruby

data/spec/sinatra/Rakefile

@@ -0,0 +1,10 @@
+require 'rake'
+require 'rspec/core/rake_task'
+
+desc 'Default: Run all specs.'
+task :default => :spec
+
+desc "Run all specs"
+RSpec::Core::RakeTask.new(:spec) do |t|
+  t.pattern = '**/*_spec.rb'
+end

data/spec/sinatra/authentication.rb

@@ -0,0 +1,3 @@
+class Authentication < ActiveRecord::Base
+  belongs_to :user
+end

data/spec/sinatra/db/migrate/activation/20101224223622_add_activation_to_users.rb

@@ -0,0 +1,17 @@
+class AddActivationToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :activation_state, :string, :default => nil
+    add_column :users, :activation_token, :string, :default => nil
+    add_column :users, :activation_token_expires_at, :datetime, :default => nil
+    
+    add_index :users, :activation_token
+  end
+
+  def self.down
+    remove_index :users, :activation_token
+    
+    remove_column :users, :activation_token_expires_at
+    remove_column :users, :activation_token
+    remove_column :users, :activation_state
+  end
+end

data/spec/sinatra/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb

@@ -0,0 +1,17 @@
+class AddActivityLoggingToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :last_login_at,     :datetime, :default => nil
+    add_column :users, :last_logout_at,    :datetime, :default => nil
+    add_column :users, :last_activity_at,  :datetime, :default => nil
+    
+    add_index :users, [:last_logout_at, :last_activity_at]
+  end
+
+  def self.down
+    remove_index :users, [:last_logout_at, :last_activity_at]
+    
+    remove_column :users, :last_activity_at
+    remove_column :users, :last_logout_at
+    remove_column :users, :last_login_at
+  end
+end

data/spec/sinatra/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb

@@ -0,0 +1,11 @@
+class AddBruteForceProtectionToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :failed_logins_count, :integer, :default => 0
+    add_column :users, :lock_expires_at, :datetime, :default => nil
+  end
+
+  def self.down
+    remove_column :users, :lock_expires_at
+    remove_column :users, :failed_logins_count
+  end
+end

data/spec/sinatra/db/migrate/core/20101224223620_create_users.rb

@@ -0,0 +1,16 @@
+class CreateUsers < ActiveRecord::Migration
+  def self.up
+    create_table :users do |t|
+      t.string :username,         :null => false
+      t.string :email,            :default => nil
+      t.string :crypted_password, :default => nil
+      t.string :salt,             :default => nil
+
+      t.timestamps
+    end
+  end
+
+  def self.down
+    drop_table :users
+  end
+end

data/spec/sinatra/db/migrate/oauth/20101224223628_create_authentications.rb

@@ -0,0 +1,14 @@
+class CreateAuthentications < ActiveRecord::Migration
+  def self.up
+    create_table :authentications do |t|
+      t.integer :user_id, :null => false
+      t.string :provider, :uid, :null => false
+
+      t.timestamps
+    end
+  end
+
+  def self.down
+    drop_table :authentications
+  end
+end

data/spec/sinatra/db/migrate/remember_me/20101224223623_add_remember_me_token_to_users.rb

@@ -0,0 +1,15 @@
+class AddRememberMeTokenToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :remember_me_token, :string, :default => nil
+    add_column :users, :remember_me_token_expires_at, :datetime, :default => nil
+    
+    add_index :users, :remember_me_token
+  end
+
+  def self.down
+    remove_index :users, :remember_me_token
+    
+    remove_column :users, :remember_me_token_expires_at
+    remove_column :users, :remember_me_token
+  end
+end

data/spec/sinatra/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb

@@ -0,0 +1,13 @@
+class AddResetPasswordToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :reset_password_token, :string, :default => nil
+    add_column :users, :reset_password_token_expires_at, :datetime, :default => nil
+    add_column :users, :reset_password_email_sent_at, :datetime, :default => nil
+  end
+
+  def self.down
+    remove_column :users, :reset_password_email_sent_at
+    remove_column :users, :reset_password_token_expires_at
+    remove_column :users, :reset_password_token
+  end
+end

data/spec/sinatra/filters.rb

@@ -0,0 +1,21 @@
+# --- before filters
+
+['/test_logout','/some_action','/test_should_be_logged_in'].each do |patt|
+  before patt do
+    require_login
+  end
+end
+
+before '/test_http_basic_auth' do
+  require_login_from_http_basic
+end
+
+# ----- test filters
+
+before do
+  self.class.sorcery_vars = {}
+end
+
+after do
+  save_instance_vars
+end

data/spec/sinatra/myapp.rb

@@ -0,0 +1,133 @@
+require 'sinatra'
+enable :sessions
+
+require 'sqlite3'
+require 'active_record'
+
+# establish connection
+ActiveRecord::Base.establish_connection(
+  :adapter  => "sqlite3",
+  :database => ":memory:",
+  :verbosity => "quiet"
+)
+
+require 'action_mailer'
+ActionMailer::Base.delivery_method = :test
+require File.join(File.dirname(__FILE__),'sorcery_mailer')
+
+# models
+require File.join(File.dirname(__FILE__),'user')
+require 'sorcery'
+
+APP_ROOT = File.dirname(__FILE__)
+
+require File.join(File.dirname(__FILE__),'filters')
+
+get '/' do
+
+end
+
+get '/test_login' do
+  @user = login(params[:username],params[:password])
+  @current_user = current_user
+  @logged_in = logged_in?
+  erb :test_login
+end
+
+get '/test_logout' do
+  session[:user_id] = User.first.id
+  logout
+  @current_user = current_user
+  @logged_in = logged_in?
+end
+
+get '/test_current_user' do
+  session[:user_id] = params[:id]
+  current_user
+end
+
+get '/some_action' do
+  erb ''
+end
+
+post '/test_return_to' do
+  session[:return_to_url] = params[:return_to_url] if params[:return_to_url]
+  @user = login(params[:username], params[:password])
+  return_or_redirect_to(:some_action)
+end
+
+get '/test_should_be_logged_in' do
+  erb ''
+end
+
+def test_not_authenticated_action
+  halt "test_not_authenticated_action"
+end
+
+def not_authenticated2
+  @session = session
+  save_instance_vars
+  redirect '/'
+end
+
+# remember me
+
+post '/test_login_with_remember' do
+  @user = login(params[:username], params[:password])
+  remember_me!
+  erb ''
+end
+
+post '/test_login_with_remember_in_login' do
+  @user = login(params[:username], params[:password], params[:remember])
+  erb ''
+end
+
+get '/test_login_from_cookie' do
+  @user = current_user
+  erb ''
+end
+
+# http_basic
+
+get '/test_http_basic_auth' do
+  erb "HTTP Basic Auth"
+end
+
+# oauth
+
+get '/auth_at_provider_test' do
+  auth_at_provider(:twitter)
+end
+
+get '/test_login_from_access_token' do
+  if @user = login_from_access_token(:twitter)
+    erb "Success!"
+  else
+    erb "Failed!"
+  end
+end
+
+# oauth2
+
+get '/auth_at_provider_test2' do
+  auth_at_provider(:facebook)
+end
+
+get '/test_login_from_access_token2' do
+  if @user = login_from_access_token(:facebook)
+    erb "Success!"
+  else
+    erb "Failed!"
+  end
+end
+
+get '/test_create_from_provider' do
+  provider = params[:provider]
+  login_from_access_token(provider)
+  if @user = create_from_provider!(provider)
+    erb "Success!"
+  else
+    erb "Failed!"
+  end
+end

data/spec/sinatra/sorcery_mailer.rb

@@ -0,0 +1,25 @@
+class SorceryMailer < ActionMailer::Base
+  
+  default :from => "notifications@example.com"
+  
+  def activation_needed_email(user)
+    @user = user
+    @url  = "http://example.com/login"
+    mail(:to => user.email,
+         :subject => "Welcome to My Awesome Site")
+  end
+  
+  def activation_success_email(user)
+    @user = user
+    @url  = "http://example.com/login"
+    mail(:to => user.email,
+         :subject => "Your account is now activated")
+  end
+  
+  def reset_password_email(user)
+    @user = user
+    @url  = "http://example.com/login"
+    mail(:to => user.email,
+         :subject => "Your password has been reset")
+  end
+end

data/spec/sinatra/spec/controller_activity_logging_spec.rb

@@ -0,0 +1,85 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe 'MyApp' do
+  before(:all) do
+    ActiveRecord::Migrator.migrate("#{APP_ROOT}/db/migrate/activity_logging")
+  end
+  
+  after(:all) do
+    ActiveRecord::Migrator.rollback("#{APP_ROOT}/db/migrate/activity_logging")
+  end
+  
+  # ----------------- ACTIVITY LOGGING -----------------------
+  describe Sinatra::Application, "with activity logging features" do
+    before(:all) do
+      sorcery_reload!([:activity_logging])
+      clear_cookies
+    end
+
+    before(:each) do
+      create_new_user
+    end
+
+    after(:each) do
+      User.delete_all
+    end
+
+    it "should respond to 'current_users'" do
+      get_sinatra_app(subject).should respond_to(:current_users)
+    end
+
+    it "'current_users' should be empty when no users are logged in" do
+      get_sinatra_app(subject).current_users.size.should == 0
+    end
+
+    it "should log login time on login" do
+      now = Time.now.utc
+      get "/test_login", :username => 'gizmo', :password => 'secret'
+      User.first.last_login_at.should_not be_nil
+      User.first.last_login_at.to_s(:db).should >= now.to_s(:db)
+      User.first.last_login_at.to_s(:db).should <= (now+2).to_s(:db)
+    end
+
+    it "should log logout time on logout" do
+      get "/test_login", :username => 'gizmo', :password => 'secret'
+      now = Time.now.utc
+      get "/test_logout"
+      User.first.last_logout_at.should_not be_nil
+      User.first.last_logout_at.to_s(:db).should >= now.to_s(:db)
+      User.first.last_logout_at.to_s(:db).should <= (now+2).to_s(:db)
+    end
+
+    it "should log last activity time when logged in" do
+      get "/test_login", :username => 'gizmo', :password => 'secret'
+      now = Time.now.utc
+      get "/some_action"
+      User.first.last_activity_at.to_s.should >= now.to_s(:db)
+      User.first.last_activity_at.to_s.should <= (now+2).to_s(:db)
+    end
+
+    it "'current_users' should hold the user object when 1 user is logged in" do
+      get "/test_login", :username => 'gizmo', :password => 'secret'
+      get "/some_action"
+      get_sinatra_app(subject).current_users.size.should == 1
+      get_sinatra_app(subject).current_users[0].should == @user
+    end
+
+    it "'current_users' should show all current_users, whether they have logged out before or not." do
+      user1 = create_new_user({:username => 'gizmo1', :email => "bla1@bla.com", :password => 'secret1'})
+      get "/test_login", :username => 'gizmo1', :password => 'secret1'
+      get "/some_action"
+      clear_user_without_logout
+      user2 = create_new_user({:username => 'gizmo2', :email => "bla2@bla.com", :password => 'secret2'})
+      get "/test_login", :username => 'gizmo2', :password => 'secret2'
+      get "/some_action"
+      clear_user_without_logout
+      user3 = create_new_user({:username => 'gizmo3', :email => "bla3@bla.com", :password => 'secret3'})
+      get "/test_login", :username => 'gizmo3', :password => 'secret3'
+      get "/some_action"
+      get_sinatra_app(subject).current_users.size.should == 3
+      get_sinatra_app(subject).current_users[0].should == user1
+      get_sinatra_app(subject).current_users[1].should == user2
+      get_sinatra_app(subject).current_users[2].should == user3
+    end
+  end
+end

data/spec/sinatra/spec/controller_brute_force_protection_spec.rb

@@ -0,0 +1,69 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+describe Sinatra::Application do
+  before(:all) do
+    ActiveRecord::Migrator.migrate("#{APP_ROOT}/db/migrate/brute_force_protection")
+  end
+  
+  after(:all) do
+    ActiveRecord::Migrator.rollback("#{APP_ROOT}/db/migrate/brute_force_protection")
+  end
+  
+  # ----------------- SESSION TIMEOUT -----------------------
+  describe Sinatra::Application, "with brute force protection features" do
+    before(:all) do
+      sorcery_reload!([:brute_force_protection])
+    end
+    
+    before(:each) do
+      create_new_user
+    end
+    
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      sorcery_controller_property_set(:user_class, User)
+      User.delete_all
+    end
+    
+    it "should count login retries" do
+      3.times {get "/test_login", :username => 'gizmo', :password => 'blabla'}
+      User.find_by_username('gizmo').failed_logins_count.should == 3
+    end
+    
+    it "should reset the counter on a good login" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 5)
+      3.times {get "/test_login", :username => 'gizmo', :password => 'blabla'}
+      get "/test_login", :username => 'gizmo', :password => 'secret'
+      User.find_by_username('gizmo').failed_logins_count.should == 0
+    end
+    
+    it "should lock user when number of retries reached the limit" do
+      User.find_by_username('gizmo').lock_expires_at.should be_nil
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 1)
+      get "/test_login", :username => 'gizmo', :password => 'blabla'
+      User.find_by_username('gizmo').lock_expires_at.should_not be_nil
+    end
+
+    it "should unlock after lock time period passes" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0.2)
+      get "/test_login", :username => 'gizmo', :password => 'blabla'
+      get "/test_login", :username => 'gizmo', :password => 'blabla'
+      User.find_by_username('gizmo').lock_expires_at.should_not be_nil
+      sleep 0.3
+      get "/test_login", :username => 'gizmo', :password => 'blabla'
+      User.find_by_username('gizmo').lock_expires_at.should be_nil
+    end
+
+    it "should not unlock if time period is 0 (permanent lock)" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      get "/test_login", :username => 'gizmo', :password => 'blabla'
+      get "/test_login", :username => 'gizmo', :password => 'blabla'
+      unlock_date = User.find_by_username('gizmo').lock_expires_at
+      sleep 1
+      get "/test_login", :username => 'gizmo', :password => 'blabla'
+      User.find_by_username('gizmo').lock_expires_at.to_s.should == unlock_date.to_s
+    end
+  end
+end

data/spec/sinatra/spec/controller_http_basic_auth_spec.rb

@@ -0,0 +1,53 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+require 'base64'
+
+describe Sinatra::Application do
+  
+  # ----------------- HTTP BASIC AUTH -----------------------
+  describe Sinatra::Application, "with http basic auth features" do
+    before(:all) do
+      sorcery_reload!([:http_basic_auth])
+      create_new_user
+    end
+    
+    after(:each) do
+      get "/test_logout"
+    end
+    
+    it "requests basic authentication when before_filter is used" do
+      session[:http_authentication_used] = nil
+      get "/test_http_basic_auth"
+      last_response.status.should == 401
+      session[:http_authentication_used].should == true
+    end
+    
+    it "authenticates from http basic if credentials are sent" do
+      session[:http_authentication_used] = true
+      get "/test_http_basic_auth", {}, {"HTTP_AUTHORIZATION" => "Basic " + Base64::encode64("#{@user.username}:secret")}
+      last_response.should be_ok
+    end
+    
+    it "fails authentication if credentials are wrong" do
+      session[:http_authentication_used] = true
+      get "/test_http_basic_auth", {}, {"HTTP_AUTHORIZATION" => "Basic " + Base64::encode64("#{@user.username}:wrong!")}
+      last_response.should redirect_to 'http://example.org/'
+    end
+    
+    it "should allow configuration option 'controller_to_realm_map'" do
+      sorcery_controller_property_set(:controller_to_realm_map, {"1" => "2"})
+      Sorcery::Controller::Config.controller_to_realm_map.should == {"1" => "2"}
+    end
+    
+    it "should display the correct realm name configured for the controller" do
+      sorcery_controller_property_set(:controller_to_realm_map, {"application" => "Salad"})
+      get "/test_http_basic_auth"
+      last_response.headers["WWW-Authenticate"].should == "Basic realm=\"Salad\""
+    end
+    
+    it "should sign in the user's session on successful login" do
+      session[:http_authentication_used] = true
+      get "/test_http_basic_auth", {}, {"HTTP_AUTHORIZATION" => "Basic " + Base64::encode64("#{@user.username}:secret")}
+      session[:user_id].should == User.find_by_username(@user.username).id
+    end
+  end
+end