sorcery 0.2.1 → 0.3.1

data/lib/sorcery/controller/submodules/{oauth → external}/providers/twitter.rb

@@ -1,7 +1,7 @@
 module Sorcery
   module Controller
     module Submodules
-      module Oauth
+      module External
         module Providers
           # This module adds support for OAuth with Twitter.com.
           # When included in the 'config.providers' option, it adds a new option, 'config.twitter'.
@@ -15,7 +15,10 @@ module Sorcery
             def self.included(base)
               base.module_eval do
                 class << self
-                  attr_reader :twitter                           # access to twitter_client.
+                  attr_reader :twitter
+                  # def twitter(&blk) # allows block syntax.
+                  #   yield @twitter
+                  # end                           
 
                   def merge_twitter_defaults!
                     @defaults.merge!(:@twitter => TwitterClient)
@@ -25,7 +28,7 @@ module Sorcery
                 update!
               end
             end
-
+            
             module TwitterClient
               class << self
                 attr_accessor :key,
@@ -35,7 +38,7 @@ module Sorcery
                               :user_info_path,
                               :user_info_mapping
                 
-                include Oauth1
+                include Protocols::Oauth1
                 
                 def init
                   @site           = "https://api.twitter.com"
@@ -43,13 +46,35 @@ module Sorcery
                   @user_info_mapping = {}
                 end
                 
-                def get_user_hash(access_token)
+                def get_user_hash
                   user_hash = {}
-                  response = access_token.get(@user_info_path)
+                  response = @access_token.get(@user_info_path)
                   user_hash[:user_info] = JSON.parse(response.body)
                   user_hash[:uid] = user_hash[:user_info]['id']
                   user_hash
                 end
+                
+                def has_callback?
+                  true
+                end
+                
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  req_token = self.get_request_token
+                  session[:request_token]         = req_token.token
+                  session[:request_token_secret]  = req_token.secret
+                  self.authorize_url({:request_token => req_token.token, :request_token_secret => req_token.secret})
+                end
+                
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:oauth_verifier => params[:oauth_verifier], :request_token => session[:request_token], :request_token_secret => session[:request_token_secret]})
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  @access_token = self.get_access_token(args)
+                end
+
               end  
               init
             end

data/lib/sorcery/controller/submodules/external.rb

@@ -0,0 +1,83 @@
+module Sorcery
+  module Controller
+    module Submodules
+      # This submodule helps you login users from external auth providers such as Twitter.
+      # This is the controller part which handles the http requests and tokens passed between the app and the provider.
+      module External
+        def self.included(base)
+          base.send(:include, InstanceMethods)
+          Config.module_eval do
+            class << self
+              attr_reader :external_providers                           # external providers like twitter.
+                                          
+              def merge_external_defaults!
+                @defaults.merge!(:@external_providers => [])
+              end
+              
+              def external_providers=(providers)
+                providers.each do |provider|
+                  include Providers.const_get(provider.to_s.split("_").map {|p| p.capitalize}.join(""))
+                end
+              end
+            end
+            merge_external_defaults!
+          end
+        end
+
+        module InstanceMethods
+          protected
+          
+          # sends user to authenticate at the provider's website.
+          # after authentication the user is redirected to the callback defined in the provider config
+          def login_at(provider, args = {})
+            @provider = Config.send(provider)
+            if @provider.has_callback?
+              redirect_to @provider.login_url(params,session)
+            else
+              #@provider.login(args)
+            end
+          end
+          
+          # tries to login the user from provider's callback
+          def login_from(provider)
+            @provider = Config.send(provider)
+            @provider.process_callback(params,session)
+            @user_hash = @provider.get_user_hash
+            if user = Config.user_class.load_from_provider(provider,@user_hash[:uid])
+              reset_session
+              login_user(user)
+              user
+            end
+          end
+          
+          # this method automatically creates a new user from the data in the external user hash.
+          # The mappings from user hash fields to user db fields are set at controller config.
+          # If the hash field you would like to map is nested, use slashes. For example, Given a hash like:
+          #
+          #   "user" => {"name"=>"moishe"}
+          #
+          # You will set the mapping:
+          #
+          #   {:username => "user/name"}
+          #
+          # And this will cause 'moishe' to be set as the value of :username field.
+          def create_from(provider)
+            provider = provider.to_sym
+            @provider = Config.send(provider)
+            @user_hash = @provider.get_user_hash
+            config = Config.user_class.sorcery_config
+            attrs = {}
+            @provider.user_info_mapping.each do |k,v|
+              (varr = v.split("/")).size > 1 ? attrs.merge!(k => varr.inject(@user_hash[:user_info]) {|hsh,v| hsh[v] }) : attrs.merge!(k => @user_hash[:user_info][v])
+            end
+            Config.user_class.transaction do
+              @user = Config.user_class.create!(attrs)
+              Config.user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider, config.provider_uid_attribute_name => @user_hash[:uid]})
+            end
+            @user
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -48,13 +48,17 @@ module Sorcery
           
           # Sets the realm name by searching the controller name in the hash given at configuration time.
           def realm_name_by_controller
-            current_controller = self.class
-            while current_controller != ActionController::Base
-              result = Config.controller_to_realm_map[current_controller.controller_name]
-              return result if result
-              current_controller = self.class.superclass
+            if defined?(ActionController::Base)
+              current_controller = self.class
+              while current_controller != ActionController::Base
+                result = Config.controller_to_realm_map[current_controller.controller_name]
+                return result if result
+                current_controller = self.class.superclass
+              end
+              nil
+            else
+              Config.controller_to_realm_map["application"]
             end
-            nil
           end
           
         end

data/lib/sorcery/controller/submodules/oauth.rb

@@ -32,9 +32,12 @@ module Sorcery
           # after authentication the user is redirected to the callback defined in the provider config
           def auth_at_provider(provider)
             @provider = Config.send(provider)
+            args = {}
             if @provider.respond_to?(:get_request_token)
-              args = {:request_token => @provider.get_request_token} 
-              session[:request_token] = args[:request_token]
+              req_token = @provider.get_request_token
+              session[:request_token]         = req_token.token
+              session[:request_token_secret]  = req_token.secret
+              args.merge!({:request_token => req_token.token, :request_token_secret => req_token.secret})
             end
             redirect_to @provider.authorize_url(args)
           end
@@ -43,7 +46,7 @@ module Sorcery
           def login_from_access_token(provider)
             @provider = Config.send(provider)
             args = {}
-            args.merge!({:oauth_verifier => params[:oauth_verifier], :request_token => session[:request_token]}) if @provider.respond_to?(:get_request_token)
+            args.merge!({:oauth_verifier => params[:oauth_verifier], :request_token => session[:request_token], :request_token_secret => session[:request_token_secret]}) if @provider.respond_to?(:get_request_token)
             args.merge!({:code => params[:code]}) if params[:code]
             @access_token = @provider.get_access_token(args)
             @user_hash = @provider.get_user_hash(@access_token)

data/lib/sorcery/controller.rb

@@ -5,7 +5,7 @@ module Sorcery
         extend ClassMethods
         include InstanceMethods
         Config.submodules.each do |mod|
-          begin # FIXME: is this protection needed?
+          begin
             include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
           rescue NameError
             # don't stop on a missing submodule.
@@ -73,12 +73,14 @@ module Sorcery
         @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
       end
       
-      def return_or_redirect_to(url, flash_hash = {})
+      # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
+      def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
       end
       
       # The default action for denying non-authenticated users.
-      # You can override this method in your controllers.
+      # You can override this method in your controllers,
+      # or provide a different method in the configuration.
       def not_authenticated
         redirect_to root_path
       end

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -31,7 +31,7 @@ module Sorcery
             config = sorcery_config
             where("#{config.last_activity_at_attribute_name} IS NOT NULL") \
             .where("#{config.last_logout_at_attribute_name} IS NULL OR #{config.last_activity_at_attribute_name} > #{config.last_logout_at_attribute_name}") \
-            .where("#{config.last_activity_at_attribute_name} > ? ", config.activity_timeout.seconds.ago)
+            .where("#{config.last_activity_at_attribute_name} > ? ", config.activity_timeout.seconds.ago.utc.to_s(:db))
           end
         end
       end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -20,10 +20,6 @@ module Sorcery
             reset!
           end
           
-          base.class_eval do
-
-          end
-          
           base.sorcery_config.before_authenticate << :prevent_locked_user_login
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)

data/lib/sorcery/model/submodules/{oauth.rb → external.rb}

@@ -1,9 +1,9 @@
 module Sorcery
   module Model
     module Submodules
-      # This submodule helps you login users from OAuth providers such as Twitter.
+      # This submodule helps you login users from external providers such as Twitter.
       # This is the model part which handles finding the user using access tokens.
-      # For the controller options see Sorcery::Controller::Oauth.
+      # For the controller options see Sorcery::Controller::External.
       #
       # Socery assumes (read: requires) you will create external users in the same table where you keep your regular users,
       # but that you will have a separate table for keeping their external authentication data,
@@ -11,7 +11,7 @@ module Sorcery
       #
       # External users will have a null crypted_password field, since we do not hold their password.
       # They will not be sent activation emails on creation.
-      module Oauth
+      module External
         def self.included(base)
           base.sorcery_config.class_eval do
             attr_accessor :authentications_class,

data/lib/sorcery/model.rb

@@ -56,12 +56,6 @@ module Sorcery
         user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && credentials_match?(user.send(@sorcery_config.crypted_password_attribute_name),credentials[1],_salt)
       end
       
-      # Calls the configured encryption provider to compare the supplied password with the encrypted one.
-      def credentials_match?(crypted, *tokens)
-        return crypted == tokens.join if @sorcery_config.encryption_provider.nil?
-        @sorcery_config.encryption_provider.matches?(crypted, *tokens)
-      end
-      
       # encrypt tokens using current encryption_provider.
       def encrypt(*tokens)
         return tokens.first if @sorcery_config.encryption_provider.nil?
@@ -71,6 +65,15 @@ module Sorcery
         CryptoProviders::AES256.key = @sorcery_config.encryption_key if @sorcery_config.encryption_algorithm == :aes256
         @sorcery_config.encryption_provider.encrypt(*tokens)
       end
+      
+      protected
+      
+      # Calls the configured encryption provider to compare the supplied password with the encrypted one.
+      def credentials_match?(crypted, *tokens)
+        return crypted == tokens.join if @sorcery_config.encryption_provider.nil?
+        @sorcery_config.encryption_provider.matches?(crypted, *tokens)
+      end
+      
     end
     
     module InstanceMethods

data/lib/sorcery/sinatra.rb

@@ -0,0 +1,14 @@
+ActiveRecord::Base.send(:include, Sorcery::Model) if defined?(ActiveRecord)
+if defined?(Sinatra::Base)
+  Sinatra::Base.send(:include, Sorcery::Controller::Adapters::Sinatra)
+  Sinatra::Base.send(:include, Sorcery::Controller)
+  # Sorcery::Controller::Config.class_eval do
+  #   class << self
+  #     def submodules=(mods)
+  #       @submodules = mods
+  #       Sinatra::Base.send(:include, Sorcery::Controller::Adapters::Sinatra)
+  #       Sinatra::Base.send(:include, Sorcery::Controller)
+  #     end
+  #   end
+  # end
+end

data/lib/sorcery/test_helpers/rails.rb

@@ -0,0 +1,57 @@
+module Sorcery
+  module TestHelpers
+    module Rails
+      SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS = [:register_last_activity_time_to_db, :deny_banned_user, :validate_session]
+      
+      def sorcery_reload!(submodules = [], options = {})
+        reload_user_class
+
+        # return to no-module configuration
+        ::Sorcery::Controller::Config.init!
+        ::Sorcery::Controller::Config.reset!
+
+        # remove all plugin before_filters so they won't fail other tests.
+        # I don't like this way, but I didn't find another.
+        # hopefully it won't break until Rails 4.
+        ApplicationController._process_action_callbacks.delete_if {|c| SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS.include?(c.filter) }
+
+        # configure
+        ::Sorcery::Controller::Config.submodules = submodules
+        ::Sorcery::Controller::Config.user_class = nil
+        ActionController::Base.send(:include,::Sorcery::Controller)
+
+        User.activate_sorcery! do |config|
+          options.each do |property,value|
+            config.send(:"#{property}=", value)
+          end
+        end
+      end
+      
+      def sorcery_controller_property_set(property, value)
+        ApplicationController.activate_sorcery! do |config|
+          config.send(:"#{property}=", value)
+        end
+      end
+
+      def sorcery_controller_oauth_property_set(provider, property, value)
+        ApplicationController.activate_sorcery! do |config|
+          config.send(provider).send(:"#{property}=", value)
+        end
+      end
+      
+      def login_user(user = nil)
+        user ||= @user
+        subject.send(:login_user,user)
+        subject.send(:after_login!,user,[user.username,'secret'])
+      end
+
+      def logout_user
+        subject.send(:logout)
+      end
+
+      def clear_user_without_logout
+        subject.instance_variable_set(:@current_user,nil)
+      end
+    end
+  end
+end

data/lib/sorcery/test_helpers/sinatra.rb

@@ -0,0 +1,131 @@
+module Sorcery
+  module TestHelpers
+    module Sinatra
+      
+      class MyApp
+        class << self
+          def new
+            return this
+          end
+        end
+      end
+      
+      class ::Sinatra::Application
+        class << self
+          attr_accessor :sorcery_vars
+        end
+        @sorcery_vars = {}
+
+        # NOTE: see before and after test filters in filters.rb
+        
+        def save_instance_vars
+          instance_variables.each do |var|
+            self.class.sorcery_vars[:"#{var.to_s.delete("@")}"] = instance_variable_get(var)
+          end
+        end
+      end
+                    
+      ::RSpec::Matchers.define :redirect_to do |expected|
+        match do |actual|
+          actual.status == 302 && actual.location == expected
+        end
+      end
+      
+      def get_sinatra_app(app)
+        while app.class != ::Sinatra::Application do
+          app = app.instance_variable_get(:@app)
+        end
+        app
+      end
+      
+      def login_user(user=nil)
+        user ||= @user
+        get_sinatra_app(subject).send(:login_user,user)
+        get_sinatra_app(subject).send(:after_login!,user,[user.username,'secret'])
+      end
+      
+      def logout_user
+        get_sinatra_app(subject).send(:logout)
+      end
+
+      def clear_user_without_logout
+        get_sinatra_app(subject).instance_variable_set(:@current_user,nil)
+      end
+        
+      def assigns
+        ::Sinatra::Application.sorcery_vars
+      end
+      
+      class SessionData
+        def initialize(cookies)
+          @cookies = cookies
+          @data = cookies['rack.session']
+          if @data
+            @data = @data.unpack("m*").first
+            @data = Marshal.load(@data)
+          else
+            @data = {}
+          end
+        end
+
+        def [](key)
+          @data[key]
+        end
+
+        def []=(key, value)
+          @data[key] = value
+          session_data = Marshal.dump(@data)
+          session_data = [session_data].pack("m*")
+          @cookies.merge("rack.session=#{Rack::Utils.escape(session_data)}", URI.parse("//example.org//"))
+          raise "session variable not set" unless @cookies['rack.session'] == session_data
+        end
+      end
+
+      def session
+        SessionData.new(rack_test_session.instance_variable_get(:@rack_mock_session).cookie_jar)
+      end
+      
+      def cookies
+        rack_test_session.instance_variable_get(:@rack_mock_session).cookie_jar
+      end
+      
+      def sorcery_reload!(submodules = [], options = {})
+        reload_user_class
+
+        # return to no-module configuration
+        ::Sorcery::Controller::Config.init!
+        ::Sorcery::Controller::Config.reset!
+
+        # clear all filters
+        ::Sinatra::Application.instance_variable_set(:@filters,{:before => [],:after => []})
+        ::Sinatra::Application.class_eval do
+          load File.join(File.dirname(__FILE__),'..','..','..','spec','sinatra','filters.rb')
+        end
+        
+        # configure
+        ::Sorcery::Controller::Config.submodules = submodules
+        ::Sorcery::Controller::Config.user_class = nil
+        ::Sinatra::Application.send(:include, Sorcery::Controller::Adapters::Sinatra)
+        ::Sinatra::Application.send(:include, Sorcery::Controller)
+        
+        User.activate_sorcery! do |config|
+          options.each do |property,value|
+            config.send(:"#{property}=", value)
+          end
+        end
+      end
+      
+      def sorcery_controller_property_set(property, value)
+        ::Sinatra::Application.activate_sorcery! do |config|
+          config.send(:"#{property}=", value)
+        end
+      end
+
+      def sorcery_controller_oauth_property_set(provider, property, value)
+        ::Sinatra::Application.activate_sorcery! do |config|
+          config.send(provider).send(:"#{property}=", value)
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/test_helpers.rb

@@ -1,7 +1,13 @@
 module Sorcery
   module TestHelpers
-    SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS = [:register_last_activity_time_to_db, :deny_banned_user, :validate_session]
-
+    # a patch to fix a bug in testing that happens when you 'destroy' a session twice.
+    # After the first destroy, the session is an ordinary hash, and then when destroy is called again there's an exception.
+    class ::Hash
+      def destroy
+        clear
+      end
+    end
+    
     def create_new_user(attributes_hash = nil)
       user_attributes_hash = attributes_hash || {:username => 'gizmo', :email => "bla@bla.com", :password => 'secret'}
       @user = User.new(user_attributes_hash)
@@ -16,62 +22,12 @@ module Sorcery
       @user
     end
     
-    def login_user(user = nil)
-      user ||= @user
-      subject.send(:login_user,user)
-      subject.send(:after_login!,user,[user.username,'secret'])
-    end
-
-    def logout_user
-      subject.send(:logout)
-    end
-
-    def clear_user_without_logout
-      subject.instance_variable_set(:@current_user,nil)
-    end
-
-    def sorcery_reload!(submodules = [], options = {})
-      reload_user_class
-
-      # return to no-module configuration
-      ::Sorcery::Controller::Config.init!
-      ::Sorcery::Controller::Config.reset!
-
-      # remove all plugin before_filters so they won't fail other tests.
-      # I don't like this way, but I didn't find another.
-      # hopefully it won't break until Rails 4.
-      ApplicationController._process_action_callbacks.delete_if {|c| SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS.include?(c.filter) }
-
-      # configure
-      ::Sorcery::Controller::Config.submodules = submodules
-      ::Sorcery::Controller::Config.user_class = nil
-      ActionController::Base.send(:include,::Sorcery::Controller)
-
-      User.activate_sorcery! do |config|
-        options.each do |property,value|
-          config.send(:"#{property}=", value)
-        end
-      end
-    end
-
     def sorcery_model_property_set(property, *values)
       User.class_eval do
         sorcery_config.send(:"#{property}=", *values)
       end
     end
-
-    def sorcery_controller_property_set(property, value)
-      ApplicationController.activate_sorcery! do |config|
-        config.send(:"#{property}=", value)
-      end
-    end
     
-    def sorcery_controller_oauth_property_set(provider, property, value)
-      ApplicationController.activate_sorcery! do |config|
-        config.send(provider).send(:"#{property}=", value)
-      end
-    end
-
     private
 
     # reload user class between specs

data/lib/sorcery.rb

@@ -8,7 +8,7 @@ module Sorcery
       autoload :RememberMe, 'sorcery/model/submodules/remember_me'
       autoload :ActivityLogging, 'sorcery/model/submodules/activity_logging'
       autoload :BruteForceProtection, 'sorcery/model/submodules/brute_force_protection'
-      autoload :Oauth, 'sorcery/model/submodules/oauth'
+      autoload :External, 'sorcery/model/submodules/external'
     end
   end
   autoload :Controller, 'sorcery/controller'
@@ -19,16 +19,21 @@ module Sorcery
       autoload :BruteForceProtection, 'sorcery/controller/submodules/brute_force_protection'
       autoload :HttpBasicAuth, 'sorcery/controller/submodules/http_basic_auth'
       autoload :ActivityLogging, 'sorcery/controller/submodules/activity_logging'
-      autoload :Oauth, 'sorcery/controller/submodules/oauth'
-      module Oauth
-        autoload :Oauth1, 'sorcery/controller/submodules/oauth/oauth1'
-        autoload :Oauth2, 'sorcery/controller/submodules/oauth/oauth2'
+      autoload :External, 'sorcery/controller/submodules/external'
+      module External
+        module Protocols
+          autoload :Oauth1, 'sorcery/controller/submodules/external/protocols/oauth1'
+          autoload :Oauth2, 'sorcery/controller/submodules/external/protocols/oauth2'
+        end
         module Providers
-          autoload :Twitter, 'sorcery/controller/submodules/oauth/providers/twitter'
-          autoload :Facebook, 'sorcery/controller/submodules/oauth/providers/facebook'
+          autoload :Twitter, 'sorcery/controller/submodules/external/providers/twitter'
+          autoload :Facebook, 'sorcery/controller/submodules/external/providers/facebook'
         end
       end
     end
+    module Adapters
+      autoload :Sinatra, 'sorcery/controller/adapters/sinatra'
+    end
   end
   module CryptoProviders
     autoload :AES256, 'sorcery/crypto_providers/aes256'
@@ -39,6 +44,11 @@ module Sorcery
     autoload :SHA512, 'sorcery/crypto_providers/sha512'
   end
   autoload :TestHelpers, 'sorcery/test_helpers'
+  module TestHelpers
+    autoload :Rails, 'sorcery/test_helpers/rails'
+    autoload :Sinatra, 'sorcery/test_helpers/sinatra'
+  end
   
   require 'sorcery/engine' if defined?(Rails) && Rails::VERSION::MAJOR == 3
+  require 'sorcery/sinatra' if defined?(Sinatra)
 end