sorcery 0.2.1 → 0.4.2

data/lib/sorcery/controller/submodules/{oauth → external}/providers/facebook.rb

@@ -1,7 +1,7 @@
 module Sorcery
   module Controller
     module Submodules
-      module Oauth
+      module External
         module Providers
           # This module adds support for OAuth with facebook.com.
           # When included in the 'config.providers' option, it adds a new option, 'config.facebook'.
@@ -16,7 +16,7 @@ module Sorcery
               base.module_eval do
                 class << self
                   attr_reader :facebook                           # access to facebook_client.
-          
+                  
                   def merge_facebook_defaults!
                     @defaults.merge!(:@facebook => FacebookClient)
                   end
@@ -36,7 +36,7 @@ module Sorcery
                               :scope,
                               :user_info_mapping
                             
-                include Oauth2
+                include Protocols::Oauth2
             
                 def init
                   @site           = "https://graph.facebook.com"
@@ -45,13 +45,31 @@ module Sorcery
                   @user_info_mapping = {}
                 end
                 
-                def get_user_hash(access_token)
+                def get_user_hash
                   user_hash = {}
-                  response = access_token.get(@user_info_path)
+                  response = @access_token.get(@user_info_path)
                   user_hash[:user_info] = JSON.parse(response)
-                  user_hash[:uid] = user_hash[:user_info]['id'].to_i
+                  user_hash[:uid] = user_hash[:user_info]['id']
                   user_hash
                 end
+                
+                def has_callback?
+                  true
+                end
+                
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  self.authorize_url
+                end
+                
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  @access_token = self.get_access_token(args)
+                end
+                
               end
               init
             end

data/lib/sorcery/controller/submodules/{oauth → external}/providers/twitter.rb

@@ -1,7 +1,7 @@
 module Sorcery
   module Controller
     module Submodules
-      module Oauth
+      module External
         module Providers
           # This module adds support for OAuth with Twitter.com.
           # When included in the 'config.providers' option, it adds a new option, 'config.twitter'.
@@ -15,7 +15,10 @@ module Sorcery
             def self.included(base)
               base.module_eval do
                 class << self
-                  attr_reader :twitter                           # access to twitter_client.
+                  attr_reader :twitter
+                  # def twitter(&blk) # allows block syntax.
+                  #   yield @twitter
+                  # end                           
 
                   def merge_twitter_defaults!
                     @defaults.merge!(:@twitter => TwitterClient)
@@ -25,7 +28,7 @@ module Sorcery
                 update!
               end
             end
-
+            
             module TwitterClient
               class << self
                 attr_accessor :key,
@@ -35,7 +38,7 @@ module Sorcery
                               :user_info_path,
                               :user_info_mapping
                 
-                include Oauth1
+                include Protocols::Oauth1
                 
                 def init
                   @site           = "https://api.twitter.com"
@@ -43,13 +46,35 @@ module Sorcery
                   @user_info_mapping = {}
                 end
                 
-                def get_user_hash(access_token)
+                def get_user_hash
                   user_hash = {}
-                  response = access_token.get(@user_info_path)
+                  response = @access_token.get(@user_info_path)
                   user_hash[:user_info] = JSON.parse(response.body)
                   user_hash[:uid] = user_hash[:user_info]['id']
                   user_hash
                 end
+                
+                def has_callback?
+                  true
+                end
+                
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  req_token = self.get_request_token
+                  session[:request_token]         = req_token.token
+                  session[:request_token_secret]  = req_token.secret
+                  self.authorize_url({:request_token => req_token.token, :request_token_secret => req_token.secret})
+                end
+                
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:oauth_verifier => params[:oauth_verifier], :request_token => session[:request_token], :request_token_secret => session[:request_token_secret]})
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  @access_token = self.get_access_token(args)
+                end
+
               end  
               init
             end

data/lib/sorcery/controller/submodules/{oauth.rb → external.rb}

@@ -1,27 +1,26 @@
 module Sorcery
   module Controller
     module Submodules
-      # This submodule helps you login users from OAuth providers such as Twitter.
+      # This submodule helps you login users from external auth providers such as Twitter.
       # This is the controller part which handles the http requests and tokens passed between the app and the provider.
-      # For more configuration options see Sorcery::Model::Oauth.
-      module Oauth
+      module External
         def self.included(base)
           base.send(:include, InstanceMethods)
           Config.module_eval do
             class << self
-              attr_reader :oauth_providers                           # oauth providers like twitter.
+              attr_reader :external_providers                           # external providers like twitter.
                                           
-              def merge_oauth_defaults!
-                @defaults.merge!(:@oauth_providers => [])
+              def merge_external_defaults!
+                @defaults.merge!(:@external_providers => [])
               end
               
-              def oauth_providers=(providers)
+              def external_providers=(providers)
                 providers.each do |provider|
                   include Providers.const_get(provider.to_s.split("_").map {|p| p.capitalize}.join(""))
                 end
               end
             end
-            merge_oauth_defaults!
+            merge_external_defaults!
           end
         end
 
@@ -30,23 +29,20 @@ module Sorcery
           
           # sends user to authenticate at the provider's website.
           # after authentication the user is redirected to the callback defined in the provider config
-          def auth_at_provider(provider)
+          def login_at(provider, args = {})
             @provider = Config.send(provider)
-            if @provider.respond_to?(:get_request_token)
-              args = {:request_token => @provider.get_request_token} 
-              session[:request_token] = args[:request_token]
+            if @provider.has_callback?
+              redirect_to @provider.login_url(params,session)
+            else
+              #@provider.login(args)
             end
-            redirect_to @provider.authorize_url(args)
           end
           
-          # tries to login the user from access token
-          def login_from_access_token(provider)
+          # tries to login the user from provider's callback
+          def login_from(provider)
             @provider = Config.send(provider)
-            args = {}
-            args.merge!({:oauth_verifier => params[:oauth_verifier], :request_token => session[:request_token]}) if @provider.respond_to?(:get_request_token)
-            args.merge!({:code => params[:code]}) if params[:code]
-            @access_token = @provider.get_access_token(args)
-            @user_hash = @provider.get_user_hash(@access_token)
+            @provider.process_callback(params,session)
+            @user_hash = @provider.get_user_hash
             if user = Config.user_class.load_from_provider(provider,@user_hash[:uid])
               reset_session
               login_user(user)
@@ -54,11 +50,6 @@ module Sorcery
             end
           end
           
-          def get_user_hash(provider)
-            @provider = Config.send(provider)
-            @provider.get_user_hash(@access_token)
-          end
-          
           # this method automatically creates a new user from the data in the external user hash.
           # The mappings from user hash fields to user db fields are set at controller config.
           # If the hash field you would like to map is nested, use slashes. For example, Given a hash like:
@@ -70,10 +61,10 @@ module Sorcery
           #   {:username => "user/name"}
           #
           # And this will cause 'moishe' to be set as the value of :username field.
-          def create_from_provider!(provider)
+          def create_from(provider)
             provider = provider.to_sym
             @provider = Config.send(provider)
-            @user_hash = get_user_hash(provider)
+            @user_hash = @provider.get_user_hash
             config = Config.user_class.sorcery_config
             attrs = {}
             @provider.user_info_mapping.each do |k,v|

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -9,7 +9,7 @@ module Sorcery
           base.send(:include, InstanceMethods)
           Config.module_eval do
             class << self
-              attr_accessor :controller_to_realm_map            # how many failed logins allowed.
+              attr_accessor :controller_to_realm_map            # What realm to display for which controller name.
                             
               def merge_http_basic_auth_defaults!
                 @defaults.merge!(:@controller_to_realm_map  => {"application" => "Application"})
@@ -48,13 +48,17 @@ module Sorcery
           
           # Sets the realm name by searching the controller name in the hash given at configuration time.
           def realm_name_by_controller
-            current_controller = self.class
-            while current_controller != ActionController::Base
-              result = Config.controller_to_realm_map[current_controller.controller_name]
-              return result if result
-              current_controller = self.class.superclass
+            if defined?(ActionController::Base)
+              current_controller = self.class
+              while current_controller != ActionController::Base
+                result = Config.controller_to_realm_map[current_controller.controller_name]
+                return result if result
+                current_controller = self.class.superclass
+              end
+              nil
+            else
+              Config.controller_to_realm_map["application"]
             end
-            nil
           end
           
         end

data/lib/sorcery/controller.rb

@@ -2,28 +2,17 @@ module Sorcery
   module Controller
     def self.included(klass)
       klass.class_eval do
-        extend ClassMethods
         include InstanceMethods
         Config.submodules.each do |mod|
-          begin # FIXME: is this protection needed?
+          begin
             include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
           rescue NameError
             # don't stop on a missing submodule.
           end
         end
-        Config.update!
-      end
-    end
-    
-    module ClassMethods
-      def activate_sorcery!(&block)
-        yield Config if block_given?
-        after_config!
-      end
-      
-      def after_config!
-        Config.after_config.each {|c| send(c)}       
       end
+      Config.update!
+      Config.configure!
     end
     
     module InstanceMethods
@@ -73,12 +62,14 @@ module Sorcery
         @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
       end
       
-      def return_or_redirect_to(url, flash_hash = {})
+      # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
+      def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
       end
       
       # The default action for denying non-authenticated users.
-      # You can override this method in your controllers.
+      # You can override this method in your controllers,
+      # or provide a different method in the configuration.
       def not_authenticated
         redirect_to root_path
       end
@@ -124,7 +115,7 @@ module Sorcery
       class << self
         attr_accessor :submodules,
         
-                      :user_class,                    # what class to use as the user class. Set automatically when you call activate_sorcery! in the User class.
+                      :user_class,                    # what class to use as the user class. Set automatically when you call authenticates_with_sorcery! in the User class.
                       
                       :not_authenticated_action,      # what controller action to call for non-authenticated users.
                       
@@ -135,9 +126,7 @@ module Sorcery
                       :after_login,
                       :after_failed_login,
                       :before_logout,
-                      :after_logout,
-                      :after_config
-                      
+                      :after_logout                      
                       
         def init!
           @defaults = {
@@ -149,7 +138,6 @@ module Sorcery
             :@after_failed_login                   => [],
             :@before_logout                        => [],
             :@after_logout                         => [],
-            :@after_config                         => [],
             :@save_return_to_url                   => true
           }
         end
@@ -166,6 +154,18 @@ module Sorcery
             instance_variable_set(k,v) if !instance_variable_defined?(k)
           end
         end
+        
+        def user_config(&blk)
+          block_given? ? @user_config = blk : @user_config
+        end
+        
+        def configure(&blk)
+          @configure_blk = blk
+        end
+        
+        def configure!
+          @configure_blk.call(self) if @configure_blk
+        end
       end
       init!
       reset!

data/lib/sorcery/crypto_providers/bcrypt.rb

@@ -30,11 +30,9 @@ module Sorcery
     #
     #   gem install bcrypt-ruby
     #
-    # Tell activate_sorcery! to use it:
+    # Update your initializer to use it:
     #
-    #   activate_sorcery! do |c|
-    #     c.encryption_algorithm = :bcrypt
-    #   end
+    #   config.encryption_algorithm = :bcrypt
     #
     # You are good to go!
     class BCrypt
@@ -42,7 +40,7 @@ module Sorcery
         # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
         # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
         def cost
-          @cost ||= 1
+          @cost ||= 10
         end
         attr_writer :cost
         alias :stretches= :cost=

data/lib/sorcery/crypto_providers/common.rb

@@ -0,0 +1,35 @@
+module Sorcery
+  module CryptoProviders
+    module Common
+      def self.included(base)
+        base.class_eval do
+          class << self
+            attr_accessor :join_token
+
+            # The number of times to loop through the encryption.
+            def stretches
+              @stretches ||= 1
+            end
+            attr_writer :stretches
+
+            def encrypt(*tokens)
+              digest = tokens.flatten.join(join_token)
+              stretches.times { digest = secure_digest(digest) }
+              digest
+            end
+
+            # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
+            def matches?(crypted, *tokens)
+              encrypt(*tokens) == crypted
+            end
+
+            def reset!
+              @stretches = 1
+              @join_token = nil
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/crypto_providers/md5.rb

@@ -8,30 +8,10 @@ module Sorcery
     #
     # Please use any other provider offered by Sorcery.
     class MD5
+      include Common
       class << self
-        attr_accessor :join_token
-        
-        # The number of times to loop through the encryption.
-        def stretches
-          @stretches ||= 1
-        end
-        attr_writer :stretches
-        
-        # Turns your raw password into a MD5 hash.
-        def encrypt(*tokens)
-          digest = tokens.flatten.join(join_token)
-          stretches.times { digest = Digest::MD5.hexdigest(digest) }
-          digest
-        end
-        
-        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
-        def matches?(crypted, *tokens)
-          encrypt(*tokens) == crypted
-        end
-        
-        def reset!
-          @stretches = 1
-          @join_token = nil
+        def secure_digest(digest)
+          Digest::MD5.hexdigest(digest)
         end
       end
     end

data/lib/sorcery/crypto_providers/sha1.rb

@@ -5,34 +5,22 @@ module Sorcery
     # This class was made for the users transitioning from restful_authentication. I highly discourage using this
     # crypto provider as it inferior to your other options. Please use any other provider offered by Sorcery.
     class SHA1
+      include Common
       class << self
         def join_token
           @join_token ||= "--"
         end
-        attr_writer :join_token
-        
-        # The number of times to loop through the encryption. This is ten because that is what restful_authentication defaults to.
-        def stretches
-          @stretches ||= 10
-        end
-        attr_writer :stretches
         
         # Turns your raw password into a Sha1 hash.
         def encrypt(*tokens)
           tokens = tokens.flatten
           digest = tokens.shift
-          stretches.times { digest = Digest::SHA1.hexdigest([digest, *tokens].join(join_token)) }
+          stretches.times { digest = secure_digest([digest, *tokens].join(join_token)) }
           digest
         end
         
-        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
-        def matches?(crypted, *tokens)
-          encrypt(*tokens) == crypted
-        end
-        
-        def reset!
-          @stretches = 10
-          @join_token = nil
+        def secure_digest(digest)
+          Digest::SHA1.hexdigest(digest)
         end
       end
     end

data/lib/sorcery/crypto_providers/sha256.rb

@@ -24,30 +24,10 @@ module Sorcery
     #
     # Uses the Sha256 hash algorithm to encrypt passwords.
     class SHA256
+      include Common
       class << self
-        attr_accessor :join_token
-        
-        # The number of times to loop through the encryption.
-        def stretches
-          @stretches ||= 20
-        end
-        attr_writer :stretches
-        
-        # Turns your raw password into a Sha256 hash.
-        def encrypt(*tokens)
-          digest = tokens.flatten.join(join_token)
-          stretches.times { digest = Digest::SHA256.hexdigest(digest) }
-          digest
-        end
-        
-        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
-        def matches?(crypted, *tokens)
-          encrypt(*tokens) == crypted
-        end
-        
-        def reset!
-          @stretches = 20
-          @join_token = nil
+        def secure_digest(digest)
+          Digest::SHA256.hexdigest(digest)
         end
       end
     end

data/lib/sorcery/crypto_providers/sha512.rb

@@ -24,30 +24,10 @@ module Sorcery
     #
     # Uses the Sha512 hash algorithm to encrypt passwords.
     class SHA512
+      include Common
       class << self
-        attr_accessor :join_token
-        
-        # The number of times to loop through the encryption.
-        def stretches
-          @stretches ||= 20
-        end
-        attr_writer :stretches
-        
-        # Turns your raw password into a Sha512 hash.
-        def encrypt(*tokens)
-          digest = tokens.flatten.join(join_token)
-          stretches.times { digest = Digest::SHA512.hexdigest(digest) }
-          digest
-        end
-        
-        # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
-        def matches?(crypted, *tokens)
-          encrypt(*tokens) == crypted
-        end
-        
-        def reset!
-          @stretches = 20
-          @join_token = nil
+        def secure_digest(digest)
+          Digest::SHA512.hexdigest(digest)
         end
       end
     end

data/lib/sorcery/engine.rb

@@ -23,5 +23,9 @@ module Sorcery
       end
     end
     
+    rake_tasks do
+      load "sorcery/railties/tasks.rake"
+    end
+    
   end
 end

data/lib/sorcery/initializers/initializer.rb

@@ -0,0 +1,86 @@
+# The first thing you need to configure is which modules you need in your app.
+# The default is nothing which will include only core features (password encryption, login/logout).
+# Available submodules are: :user_activation, :http_basic_auth, :remember_me, :reset_password, :session_timeout, :brute_force_protection, :activity_logging, :external
+Rails.application.config.sorcery.submodules = []
+
+# Here you can configure each submodule's features.
+Rails.application.config.sorcery.configure do |config|
+  # -- core --
+  # config.not_authenticated_action = :not_authenticated              # what controller action to call for non-authenticated users. You can also override 'not_authenticated' instead.
+  # config.save_return_to_url = true                                  # when a non logged in user tries to enter a page that requires login, save the URL he wanted to reach, 
+                                                                      # and send him there after login, using 'redirect_back_or_to'.
+  # subclasses_inherit_config = false                                 # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
+                                                                      
+  # -- session timeout --                                             
+  # config.session_timeout = 3600                                     # how long in seconds to keep the session alive.
+  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of session timeout.
+  
+  # -- http_basic_auth --
+  # config.controller_to_realm_map = {"application" => "Application"} # What realm to display for which controller name.
+                                                                      # For example {"My App" => "Application"}
+  
+  # -- external --
+  # config.external_providers = []                                    # What providers are supported by this app, i.e. [:twitter, :facebook] .
+  # 
+  # config.twitter.key = "eYVNBjBDi33aa9GkA3w"
+  # config.twitter.secret = "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8"
+  # config.twitter.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=twitter"
+  # config.twitter.user_info_mapping = {:email => "screen_name"}
+  # 
+  # config.facebook.key = "34cebc81c08a521bc66e212f947d73ec"
+  # config.facebook.secret = "5b458d179f61d4f036ee66a497ffbcd0"
+  # config.facebook.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=facebook"
+  # config.facebook.user_info_mapping = {:email => "name"}
+  
+  # --- user config ---
+  config.user_config do |user|
+    # -- core --
+    # user.username_attribute_name = :username                                        # change default username attribute, for example, to use :email as the login.
+    # user.password_attribute_name = :password                                        # change *virtual* password attribute, the one which is used until an encrypted one is generated.
+    # user.email_attribute_name = :email                                              # change default email attribute.
+    # user.crypted_password_attribute_name =  :crypted_password                       # change default crypted_password attribute.
+    # user.salt_join_token = ""                                                       # what pattern to use to join the password with the salt
+    # user.salt_attribute_name = :salt                                                # change default salt attribute.
+    # user.stretches = nil                                                            # how many times to apply encryption to the password.
+    # user.encryption_key = nil                                                       # encryption key used to encrypt reversible encryptions such as AES256.
+    # user.custom_encryption_provider = nil                                           # use an external encryption class.
+    # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See 'encryption_algorithm=' for available options.
+                                                                                      
+    # -- user_activation --                                                           
+    # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold activation state (active/pending).
+    # user.activation_token_attribute_name = :activation_token                        # the attribute name to hold activation code (sent by email).
+    # user.activation_token_expires_at_attribute_name = :activation_token_expires_at  # the attribute name to hold activation code expiration date. 
+    # user.activation_token_expiration_period =  nil                                  # how many seconds before the activation code expires. nil for never expires.
+    # user.user_activation_mailer = nil                                               # your mailer class. Required.
+    # user.activation_needed_email_method_name = :activation_needed_email             # activation needed email method on your mailer class.
+    # user.activation_success_email_method_name = :activation_success_email           # activation success email method on your mailer class.
+    # user.prevent_non_active_users_to_login = true                                   # do you want to prevent or allow users that did not activate by email to login?                     
+                                                                  
+    # -- reset_password --                                        
+    # user.reset_password_token_attribute_name = :reset_password_token                          # reset password code attribute name.
+    # user.reset_password_token_expires_at_attribute_name = :reset_password_token_expires_at    # expires at attribute name.
+    # user.reset_password_email_sent_at_attribute_name = :reset_password_email_sent_at          # when was email sent, used for hammering protection.
+    # user.reset_password_mailer = nil                                                          # mailer class. Needed.
+    # user.reset_password_email_method_name = :reset_password_email                             # reset password email method on your mailer class.
+    # user.reset_password_expiration_period = nil                                               # how many seconds before the reset request expires. nil for never expires.
+    # user.reset_password_time_between_emails = 5 * 60                                          # hammering protection, how long to wait before allowing another email to be sent.
+                                                                  
+    # -- brute_force_protection --                                
+    # user.failed_logins_count_attribute_name = :failed_logins_count                  # failed logins attribute name.
+    # user.lock_expires_at_attribute_name = :lock_expires_at                          # this field indicates whether user is banned and when it will be active again.
+    # user.consecutive_login_retries_amount_limit = 50                                # how many failed logins allowed.
+    # user.login_lock_time_period = 60 * 60                                           # how long the user should be banned. in seconds. 0 for permanent.
+                                                                  
+    # -- activity logging --                                      
+    # user.last_login_at_attribute_name = :last_login_at                              # last login attribute name.
+    # user.last_logout_at_attribute_name = :last_logout_at                            # last logout attribute name.
+    # user.last_activity_at_attribute_name = :last_activity_at                        # last activity attribute name.
+    # user.activity_timeout = 10 * 60                                                 # how long since last activity is the user defined logged out?
+                                                                                      
+    # -- external --                                                                     
+    # user.authentications_class = nil                                                # class which holds the various external provider data for this user.
+    # user.authentications_user_id_attribute_name = :user_id                          # user's identifier in authentications class.
+    # user.provider_attribute_name = :provider                                        # provider's identifier in authentications class.
+    # user.provider_uid_attribute_name = :uid                                         # user's external unique identifier in authentications class.
+  end
+end