sorcery 0.4.0 → 0.4.2

data/README.rdoc

@@ -28,7 +28,7 @@ Example Rails 3 app using sorcery: https://github.com/NoamB/sorcery-example-app
 
 Example Sinatra app using sorcery: https://github.com/NoamB/sorcery-example-app-sinatra
 
-Documentation: http://rubydoc.info/gems/sorcery/0.4.0/frames
+Documentation: http://rubydoc.info/gems/sorcery/0.4.2/frames
 
 Check out the tutorials in the github wiki!
 

data/VERSION

@@ -1 +1 @@
-0.4.0
+0.4.2

data/lib/sorcery/crypto_providers/bcrypt.rb

@@ -30,11 +30,9 @@ module Sorcery
     #
     #   gem install bcrypt-ruby
     #
-    # Tell activate_sorcery! to use it:
+    # Update your initializer to use it:
     #
-    #   activate_sorcery! do |c|
-    #     c.encryption_algorithm = :bcrypt
-    #   end
+    #   config.encryption_algorithm = :bcrypt
     #
     # You are good to go!
     class BCrypt

data/lib/sorcery/initializers/initializer.rb

@@ -1,25 +1,26 @@
 # The first thing you need to configure is which modules you need in your app.
 # The default is nothing which will include only core features (password encryption, login/logout).
 # Available submodules are: :user_activation, :http_basic_auth, :remember_me, :reset_password, :session_timeout, :brute_force_protection, :activity_logging, :external
-Collaboration::Application.config.sorcery.submodules = []
+Rails.application.config.sorcery.submodules = []
 
 # Here you can configure each submodule's features.
-Collaboration::Application.config.sorcery.configure do |config|
+Rails.application.config.sorcery.configure do |config|
   # -- core --
-  # config.not_authenticated_action = :not_authenticated      # what controller action to call for non-authenticated users. You can also override 'not_authenticated' instead.
-  # config.save_return_to_url = true                          # when a non logged in user tries to enter a page that requires login, save the URL he wanted to reach, 
-                                                              # and send him there after login, using 'redirect_back_or_to'.
-  
-  # -- session timeout --
-  # config.session_timeout = 3600                             # how long in seconds to keep the session alive.
-  # config.session_timeout_from_last_action = false           # use the last action as the beginning of session timeout.
+  # config.not_authenticated_action = :not_authenticated              # what controller action to call for non-authenticated users. You can also override 'not_authenticated' instead.
+  # config.save_return_to_url = true                                  # when a non logged in user tries to enter a page that requires login, save the URL he wanted to reach, 
+                                                                      # and send him there after login, using 'redirect_back_or_to'.
+  # subclasses_inherit_config = false                                 # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
+                                                                      
+  # -- session timeout --                                             
+  # config.session_timeout = 3600                                     # how long in seconds to keep the session alive.
+  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of session timeout.
   
   # -- http_basic_auth --
   # config.controller_to_realm_map = {"application" => "Application"} # What realm to display for which controller name.
                                                                       # For example {"My App" => "Application"}
   
   # -- external --
-  # config.external_providers = []                            # What providers are supported by this app, i.e. [:twitter, :facebook] .
+  # config.external_providers = []                                    # What providers are supported by this app, i.e. [:twitter, :facebook] .
   # 
   # config.twitter.key = "eYVNBjBDi33aa9GkA3w"
   # config.twitter.secret = "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8"
@@ -34,53 +35,52 @@ Collaboration::Application.config.sorcery.configure do |config|
   # --- user config ---
   config.user_config do |user|
     # -- core --
-    # user.username_attribute_name =                          # change default username attribute, for example, to use :email as the login.
-    # user.password_attribute_name =                          # change *virtual* password attribute, the one which is used until an encrypted one is generated.
-    # user.email_attribute_name =                             # change default email attribute.
-    # user.crypted_password_attribute_name =                  # change default crypted_password attribute.
-    # user.salt_join_token =                                  # what pattern to use to join the password with the salt
-    # user.salt_attribute_name =                              # change default salt attribute.
-    # user.stretches =                                        # how many times to apply encryption to the password.
-    # user.encryption_key =                                   # encryption key used to encrypt reversible encryptions such as AES256.
-    # user.encryption_provider =                              # change default encryption_provider.
-    # user.custom_encryption_provider =                       # use an external encryption class.
-    # user.encryption_algorithm =                             # encryption algorithm name. See 'encryption_algorithm=' for available options.
-
-    # -- user_activation --
-    # user.activation_state_attribute_name =                  # the attribute name to hold activation state (active/pending).
-    # user.activation_token_attribute_name =                  # the attribute name to hold activation code (sent by email).
-    # user.activation_token_expires_at_attribute_name =       # the attribute name to hold activation code expiration date. 
-    # user.activation_token_expiration_period =               # how many seconds before the activation code expires. nil for never expires.
-    # user.user_activation_mailer =                           # your mailer class. Required.
-    # user.activation_needed_email_method_name =              # activation needed email method on your mailer class.
-    # user.activation_success_email_method_name =             # activation success email method on your mailer class.
-    # user.prevent_non_active_users_to_login =                # do you want to prevent or allow users that did not activate by email to login?                     
-
-    # -- reset_password --
-    # user.reset_password_token_attribute_name =              # reset password code attribute name.
-    # user.reset_password_token_expires_at_attribute_name =   # expires at attribute name.
-    # user.reset_password_email_sent_at_attribute_name =      # when was email sent, used for hammering protection.
-    # user.reset_password_mailer =                            # mailer class. Needed.
-    # user.reset_password_email_method_name =                 # reset password email method on your mailer class.
-    # user.reset_password_expiration_period =                 # how many seconds before the reset request expires. nil for never expires.
-    # user.reset_password_time_between_emails =               # hammering protection, how long to wait before allowing another email to be sent.
-    
-    # -- brute_force_protection --
-    # user.failed_logins_count_attribute_name =               # failed logins attribute name.
-    # user.lock_expires_at_attribute_name =                   # this field indicates whether user is banned and when it will be active again.
-    # user.consecutive_login_retries_amount_limit =           # how many failed logins allowed.
-    # user.login_lock_time_period =                           # how long the user should be banned. in seconds. 0 for permanent.
-                              
-    # -- activity logging --
-    # user.last_login_at_attribute_name =                     # last login attribute name.
-    # user.last_logout_at_attribute_name =                    # last logout attribute name.
-    # user.last_activity_at_attribute_name =                  # last activity attribute name.
-    # user.activity_timeout =                                 # how long since last activity is the user defined logged out?
-
-    # -- external --                                             
-    # user.authentications_class =                            # class which holds the various external provider data for this user.
-    # user.authentications_user_id_attribute_name =           # user's identifier in authentications class.
-    # user.provider_attribute_name =                          # provider's identifier in authentications class.
-    # user.provider_uid_attribute_name =                      # user's external unique identifier in authentications class.
+    # user.username_attribute_name = :username                                        # change default username attribute, for example, to use :email as the login.
+    # user.password_attribute_name = :password                                        # change *virtual* password attribute, the one which is used until an encrypted one is generated.
+    # user.email_attribute_name = :email                                              # change default email attribute.
+    # user.crypted_password_attribute_name =  :crypted_password                       # change default crypted_password attribute.
+    # user.salt_join_token = ""                                                       # what pattern to use to join the password with the salt
+    # user.salt_attribute_name = :salt                                                # change default salt attribute.
+    # user.stretches = nil                                                            # how many times to apply encryption to the password.
+    # user.encryption_key = nil                                                       # encryption key used to encrypt reversible encryptions such as AES256.
+    # user.custom_encryption_provider = nil                                           # use an external encryption class.
+    # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See 'encryption_algorithm=' for available options.
+                                                                                      
+    # -- user_activation --                                                           
+    # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold activation state (active/pending).
+    # user.activation_token_attribute_name = :activation_token                        # the attribute name to hold activation code (sent by email).
+    # user.activation_token_expires_at_attribute_name = :activation_token_expires_at  # the attribute name to hold activation code expiration date. 
+    # user.activation_token_expiration_period =  nil                                  # how many seconds before the activation code expires. nil for never expires.
+    # user.user_activation_mailer = nil                                               # your mailer class. Required.
+    # user.activation_needed_email_method_name = :activation_needed_email             # activation needed email method on your mailer class.
+    # user.activation_success_email_method_name = :activation_success_email           # activation success email method on your mailer class.
+    # user.prevent_non_active_users_to_login = true                                   # do you want to prevent or allow users that did not activate by email to login?                     
+                                                                  
+    # -- reset_password --                                        
+    # user.reset_password_token_attribute_name = :reset_password_token                          # reset password code attribute name.
+    # user.reset_password_token_expires_at_attribute_name = :reset_password_token_expires_at    # expires at attribute name.
+    # user.reset_password_email_sent_at_attribute_name = :reset_password_email_sent_at          # when was email sent, used for hammering protection.
+    # user.reset_password_mailer = nil                                                          # mailer class. Needed.
+    # user.reset_password_email_method_name = :reset_password_email                             # reset password email method on your mailer class.
+    # user.reset_password_expiration_period = nil                                               # how many seconds before the reset request expires. nil for never expires.
+    # user.reset_password_time_between_emails = 5 * 60                                          # hammering protection, how long to wait before allowing another email to be sent.
+                                                                  
+    # -- brute_force_protection --                                
+    # user.failed_logins_count_attribute_name = :failed_logins_count                  # failed logins attribute name.
+    # user.lock_expires_at_attribute_name = :lock_expires_at                          # this field indicates whether user is banned and when it will be active again.
+    # user.consecutive_login_retries_amount_limit = 50                                # how many failed logins allowed.
+    # user.login_lock_time_period = 60 * 60                                           # how long the user should be banned. in seconds. 0 for permanent.
+                                                                  
+    # -- activity logging --                                      
+    # user.last_login_at_attribute_name = :last_login_at                              # last login attribute name.
+    # user.last_logout_at_attribute_name = :last_logout_at                            # last logout attribute name.
+    # user.last_activity_at_attribute_name = :last_activity_at                        # last activity attribute name.
+    # user.activity_timeout = 10 * 60                                                 # how long since last activity is the user defined logged out?
+                                                                                      
+    # -- external --                                                                     
+    # user.authentications_class = nil                                                # class which holds the various external provider data for this user.
+    # user.authentications_user_id_attribute_name = :user_id                          # user's identifier in authentications class.
+    # user.provider_attribute_name = :provider                                        # provider's identifier in authentications class.
+    # user.provider_uid_attribute_name = :uid                                         # user's external unique identifier in authentications class.
   end
 end

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -20,7 +20,7 @@ module Sorcery
             @defaults.merge!(:@last_login_at_attribute_name                => :last_login_at,
                              :@last_logout_at_attribute_name               => :last_logout_at,
                              :@last_activity_at_attribute_name             => :last_activity_at,
-                             :@activity_timeout                            => 10.minutes)
+                             :@activity_timeout                            => 10 * 60)
             reset!
           end
         end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -16,7 +16,7 @@ module Sorcery
             @defaults.merge!(:@failed_logins_count_attribute_name              => :failed_logins_count,
                              :@lock_expires_at_attribute_name                  => :lock_expires_at,
                              :@consecutive_login_retries_amount_limit          => 50,
-                             :@login_lock_time_period                          => 3600)
+                             :@login_lock_time_period                          => 60 * 60)
             reset!
           end
           

data/lib/sorcery/model/submodules/reset_password.rb

@@ -28,7 +28,7 @@ module Sorcery
                              :@reset_password_mailer                          => nil,
                              :@reset_password_email_method_name               => :reset_password_email,
                              :@reset_password_expiration_period               => nil,
-                             :@reset_password_time_between_emails             => 5.minutes )
+                             :@reset_password_time_between_emails             => 5 * 60 )
 
             reset!
           end

data/lib/sorcery/model.rb

@@ -22,19 +22,23 @@ module Sorcery
                 begin
                   include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
                 rescue NameError
-                  # don't stop on a missing submodule.
+                  # don't stop on a missing submodule. Needed because some submodules are only defined in the controller side.
                 end
               end
             end
             
+            # This runs the options block set in the initializer on the model class.
             ::Sorcery::Controller::Config.user_config.tap{|blk| blk.call(@sorcery_config) if blk}
             
+            # add virtual password accessor and ORM callbacks
             self.class_eval do
               attr_accessor @sorcery_config.password_attribute_name
               attr_protected @sorcery_config.crypted_password_attribute_name, @sorcery_config.salt_attribute_name
               before_save :encrypt_password, :if => Proc.new { |record| record.send(sorcery_config.password_attribute_name).present? }
               after_save :clear_virtual_password, :if => Proc.new { |record| record.send(sorcery_config.password_attribute_name).present? }
             end
+            
+            @sorcery_config.after_config << :add_config_inheritence if @sorcery_config.subclasses_inherit_config
             @sorcery_config.after_config.each { |c| send(c) }
           end
         end
@@ -76,6 +80,20 @@ module Sorcery
         @sorcery_config.encryption_provider.matches?(crypted, *tokens)
       end
       
+      def add_config_inheritence
+        self.class_eval do
+          def self.inherited(subclass)
+            subclass.class_eval do
+              class << self
+                attr_accessor :sorcery_config
+              end
+            end
+            subclass.sorcery_config = sorcery_config
+            super
+          end
+        end
+      end
+      
     end
     
     module InstanceMethods
@@ -133,6 +151,7 @@ module Sorcery
                     :salt_attribute_name,               # change default salt attribute.
                     :stretches,                         # how many times to apply encryption to the password.
                     :encryption_key,                    # encryption key used to encrypt reversible encryptions such as AES256.
+                    :subclasses_inherit_config,         # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
                     
                     :submodules,                        # configured in config/application.rb
                     :before_authenticate,               # an array of method names to call before authentication completes. used internally.
@@ -156,6 +175,7 @@ module Sorcery
           :@salt_join_token                      => "",
           :@salt_attribute_name                  => :salt,
           :@stretches                            => nil,
+          :@subclasses_inherit_config            => false,
           :@before_authenticate                  => [],
           :@after_config                         => []
         }

data/lib/sorcery/test_helpers/internal/rails.rb

@@ -0,0 +1,52 @@
+module Sorcery
+  module TestHelpers
+    module Internal
+      module Rails
+        include ::Sorcery::TestHelpers::Rails
+
+        SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS = [:register_last_activity_time_to_db, :deny_banned_user, :validate_session]
+
+        def sorcery_reload!(submodules = [], options = {})
+          reload_user_class
+
+          # return to no-module configuration
+          ::Sorcery::Controller::Config.init!
+          ::Sorcery::Controller::Config.reset!
+
+          # remove all plugin before_filters so they won't fail other tests.
+          # I don't like this way, but I didn't find another.
+          # hopefully it won't break until Rails 4.
+          ApplicationController._process_action_callbacks.delete_if {|c| SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS.include?(c.filter) }
+
+          # configure
+          ::Sorcery::Controller::Config.submodules = submodules
+          ::Sorcery::Controller::Config.user_class = nil
+          ActionController::Base.send(:include,::Sorcery::Controller)
+
+          ::Sorcery::Controller::Config.user_config do |user|
+            options.each do |property,value|
+              user.send(:"#{property}=", value)
+            end
+          end
+          User.authenticates_with_sorcery!
+        end
+
+        def sorcery_controller_property_set(property, value)
+          ::Sorcery::Controller::Config.send(:"#{property}=", value)
+        end
+
+        def sorcery_controller_external_property_set(provider, property, value)
+          ::Sorcery::Controller::Config.send(provider).send(:"#{property}=", value)
+        end
+
+        # This helper is used to fake multiple users signing in in tests.
+        # It does so by clearing @current_user, thus allowing a new user to login,
+        # all this without calling the :logout action explicitly.
+        # A dirty dirty hack.
+        def clear_user_without_logout
+          subject.instance_variable_set(:@current_user,nil)
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/test_helpers/internal/sinatra.rb

@@ -0,0 +1,122 @@
+module Sorcery
+  module TestHelpers
+    module Internal
+      module Sinatra
+
+        class ::Sinatra::Application
+          class << self
+            attr_accessor :sorcery_vars
+          end
+          @sorcery_vars = {}
+
+          # NOTE: see before and after test filters in filters.rb
+
+          def save_instance_vars
+            instance_variables.each do |var|
+              self.class.sorcery_vars[:"#{var.to_s.delete("@")}"] = instance_variable_get(var)
+            end
+          end
+        end
+
+        ::RSpec::Matchers.define :redirect_to do |expected|
+          match do |actual|
+            actual.status == 302 && actual.location == expected
+          end
+        end
+
+        def get_sinatra_app(app)
+          while app.class != ::Sinatra::Application do
+            app = app.instance_variable_get(:@app)
+          end
+          app
+        end
+
+        def login_user(user=nil)
+          user ||= @user
+          get_sinatra_app(subject).send(:login_user,user)
+          get_sinatra_app(subject).send(:after_login!,user,[user.username,'secret'])
+        end
+
+        def logout_user
+          get_sinatra_app(subject).send(:logout)
+        end
+
+        def clear_user_without_logout
+          get_sinatra_app(subject).instance_variable_set(:@current_user,nil)
+        end
+
+        def assigns
+          ::Sinatra::Application.sorcery_vars
+        end
+
+        class SessionData
+          def initialize(cookies)
+            @cookies = cookies
+            @data = cookies['rack.session']
+            if @data
+              @data = @data.unpack("m*").first
+              @data = Marshal.load(@data)
+            else
+              @data = {}
+            end
+          end
+
+          def [](key)
+            @data[key]
+          end
+
+          def []=(key, value)
+            @data[key] = value
+            session_data = Marshal.dump(@data)
+            session_data = [session_data].pack("m*")
+            @cookies.merge("rack.session=#{Rack::Utils.escape(session_data)}", URI.parse("//example.org//"))
+            raise "session variable not set" unless @cookies['rack.session'] == session_data
+          end
+        end
+
+        def session
+          SessionData.new(rack_test_session.instance_variable_get(:@rack_mock_session).cookie_jar)
+        end
+
+        def cookies
+          rack_test_session.instance_variable_get(:@rack_mock_session).cookie_jar
+        end
+
+        def sorcery_reload!(submodules = [], options = {})
+          reload_user_class
+
+          # return to no-module configuration
+          ::Sorcery::Controller::Config.init!
+          ::Sorcery::Controller::Config.reset!
+
+          # clear all filters
+          ::Sinatra::Application.instance_variable_set(:@filters,{:before => [],:after => []})
+          ::Sinatra::Application.class_eval do
+            load File.join(File.dirname(__FILE__),'..','..','..','..','spec','sinatra','filters.rb')
+          end
+
+          # configure
+          ::Sorcery::Controller::Config.submodules = submodules
+          ::Sorcery::Controller::Config.user_class = nil
+          ::Sinatra::Application.send(:include, Sorcery::Controller::Adapters::Sinatra)
+          ::Sinatra::Application.send(:include, Sorcery::Controller)
+
+          ::Sorcery::Controller::Config.user_config do |user|
+            options.each do |property,value|
+              user.send(:"#{property}=", value)
+            end
+          end
+          User.authenticates_with_sorcery!
+        end
+
+        def sorcery_controller_property_set(property, value)
+          ::Sorcery::Controller::Config.send(:"#{property}=", value)
+        end
+
+        def sorcery_controller_external_property_set(provider, property, value)
+          ::Sorcery::Controller::Config.send(provider).send(:"#{property}=", value)
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/test_helpers/internal.rb

@@ -0,0 +1,55 @@
+module Sorcery
+  module TestHelpers
+    # Internal TestHelpers are used to test the gem, internally, and should not be used to test apps *using* sorcery.
+    # This file will be included in the spec_helper file.
+    module Internal
+      def self.included(base)
+        # reducing default cost for specs speed
+        CryptoProviders::BCrypt.class_eval do
+          class << self
+            def cost
+              1
+            end
+          end
+        end
+      end
+
+      # a patch to fix a bug in testing that happens when you 'destroy' a session twice.
+      # After the first destroy, the session is an ordinary hash, and then when destroy is called again there's an exception.
+      class ::Hash
+        def destroy
+          clear
+        end
+      end
+
+      def create_new_user(attributes_hash = nil)
+        user_attributes_hash = attributes_hash || {:username => 'gizmo', :email => "bla@bla.com", :password => 'secret'}
+        @user = User.new(user_attributes_hash)
+        @user.save!
+        @user
+      end
+
+      def create_new_external_user(provider, attributes_hash = nil)
+        user_attributes_hash = attributes_hash || {:username => 'gizmo', :authentications_attributes => [{:provider => provider, :uid => 123}]}
+        @user = User.new(user_attributes_hash)
+        @user.save!
+        @user
+      end
+
+      def sorcery_model_property_set(property, *values)
+        User.class_eval do
+          sorcery_config.send(:"#{property}=", *values)
+        end
+      end
+
+      private
+
+      # reload user class between specs
+      # so it will be possible to test the different submodules in isolation
+      def reload_user_class
+        Object.send(:remove_const,:User)
+        load 'user.rb'
+      end
+    end
+  end
+end

data/lib/sorcery/test_helpers/rails.rb

@@ -1,54 +1,16 @@
 module Sorcery
   module TestHelpers
     module Rails
-      SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS = [:register_last_activity_time_to_db, :deny_banned_user, :validate_session]
-      
-      def sorcery_reload!(submodules = [], options = {})
-        reload_user_class
-
-        # return to no-module configuration
-        ::Sorcery::Controller::Config.init!
-        ::Sorcery::Controller::Config.reset!
-
-        # remove all plugin before_filters so they won't fail other tests.
-        # I don't like this way, but I didn't find another.
-        # hopefully it won't break until Rails 4.
-        ApplicationController._process_action_callbacks.delete_if {|c| SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS.include?(c.filter) }
-
-        # configure
-        ::Sorcery::Controller::Config.submodules = submodules
-        ::Sorcery::Controller::Config.user_class = nil
-        ActionController::Base.send(:include,::Sorcery::Controller)
-
-        ::Sorcery::Controller::Config.user_config do |user|
-          options.each do |property,value|
-            user.send(:"#{property}=", value)
-          end
-        end
-        User.authenticates_with_sorcery!
-      end
-      
-      def sorcery_controller_property_set(property, value)
-        ::Sorcery::Controller::Config.send(:"#{property}=", value)
-      end
-
-      def sorcery_controller_external_property_set(provider, property, value)
-        ::Sorcery::Controller::Config.send(provider).send(:"#{property}=", value)
-      end
-      
+      # logins a user and calls all callbacks
       def login_user(user = nil)
         user ||= @user
-        subject.send(:login_user,user)
-        subject.send(:after_login!,user,[user.username,'secret'])
+        @controller.send(:login_user,user)
+        @controller.send(:after_login!,user,[user.send(user.sorcery_config.username_attribute_name),'secret'])
       end
 
       def logout_user
-        subject.send(:logout)
-      end
-
-      def clear_user_without_logout
-        subject.instance_variable_set(:@current_user,nil)
+        @controller.send(:logout)
       end
     end
   end
-end
+end