sorcery 0.4.1 → 0.5.0

data/Gemfile

@@ -2,13 +2,16 @@ source "http://rubygems.org"
 # Add dependencies required to use your gem here.
 # Example:
 #   gem "activesupport", ">= 2.3.5"
-gem "rails", ">= 3.0.0"
-gem 'json', ">= 1.5.1"
 gem 'oauth', ">= 0.4.4"
 gem 'oauth2', ">= 0.1.1"
+
 # Add dependencies to develop your gem here.
 # Include everything needed to run rake, tests, features, etc.
 group :development do
+  gem "rails", ">= 3.0.0"
+  gem 'json', ">= 1.5.1"
+  gem "mongoid", "~> 2.0"
+  gem "bson_ext", "~> 1.3"
   gem "rspec", "~> 2.5.0"
   gem 'rspec-rails', "~> 2.5.0"
   gem 'ruby-debug19'

data/Gemfile.lock

@@ -31,6 +31,8 @@ GEM
     addressable (2.2.4)
     archive-tar-minitar (0.5.2)
     arel (2.0.6)
+    bson (1.3.0)
+    bson_ext (1.3.0)
     builder (2.1.2)
     columnize (0.3.2)
     diff-lcs (1.1.2)
@@ -55,6 +57,13 @@ GEM
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
     mime-types (1.16)
+    mongo (1.3.0)
+      bson (>= 1.3.0)
+    mongoid (2.0.1)
+      activemodel (~> 3.0)
+      mongo (~> 1.3)
+      tzinfo (~> 0.3.22)
+      will_paginate (~> 3.0.pre)
     multi_json (0.0.5)
     multipart-post (1.1.0)
     oauth (0.4.4)
@@ -113,15 +122,18 @@ GEM
     treetop (1.4.9)
       polyglot (>= 0.3.1)
     tzinfo (0.3.23)
+    will_paginate (3.0.pre2)
     yard (0.6.4)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
+  bson_ext (~> 1.3)
   bundler (~> 1.0.0)
   jeweler (~> 1.5.2)
   json (>= 1.5.1)
+  mongoid (~> 2.0)
   oauth (>= 0.4.4)
   oauth2 (>= 0.1.1)
   rails (>= 3.0.0)

data/README.rdoc

@@ -1,5 +1,6 @@
 = sorcery
 Magical Authentication for Rails 3 and Sinatra.
+Supports ActiveRecord and Mongoid.
 
 Inspired by restful_authentication, Authlogic and Devise.
 Crypto code taken almost unchanged from Authlogic.
@@ -15,7 +16,7 @@ It was built with a few goals in mind:
 * Less is more - less than 20 public methods to remember for the entire feature-set make the lib easy to 'get'.
 * No built-in or generated code - use the library's methods inside *your own* MVC structures, and don't fight to fix someone else's.
 * Magic yes, Voodoo no - the lib should be easy to hack for most developers.
-* Configuration over Confusion - Simple & short configuration as possible, not drowning in syntactic sugar.
+* Configuration over Confusion - Centralized (1 file), Simple & short configuration as possible, not drowning in syntactic sugar.
 * Keep MVC cleanly separated - DB is for models, sessions are for controllers. Models stay unaware of sessions.
 
 Hopefully, I've achieved this. If not, let me know.
@@ -28,7 +29,7 @@ Example Rails 3 app using sorcery: https://github.com/NoamB/sorcery-example-app
 
 Example Sinatra app using sorcery: https://github.com/NoamB/sorcery-example-app-sinatra
 
-Documentation: http://rubydoc.info/gems/sorcery/0.4.1/frames
+Documentation: http://rubydoc.info/gems/sorcery/0.5.0/frames
 
 Check out the tutorials in the github wiki!
 
@@ -66,7 +67,7 @@ Below is a summary of the library methods. Most method names are self explaining
   # reset password
   User.load_from_reset_password_token(token)
   @user.deliver_reset_password_instructions!
-  @user.reset_password!(params)
+  @user.change_password!(new_password)
 
   # user activation
   User.load_from_activation_token(token)
@@ -193,19 +194,23 @@ External (see lib/sorcery/controller/submodules/external.rb):
 == Next Planned Features:
 
 
-I've got many plans which include (by priority):
+I've got some thoughts which include (unordered):
+* Passing a block to encrypt, allowing the developer to define his own mix of salting and encrypting
 * Forgot username, maybe as part of the reset_password module
 * Scoping logins (to a subdomain or another arbitrary field)
-* Mongoid support
+* Allowing storing the salt and crypted password in the same DB field for extra security
 * Other reset password strategies (security questions?)
 * Other brute force protection strategies (captcha)
-* Have an idea? Let me know, and it might get into the gem!
+
+
+Have an idea? Let me know, and it might get into the gem!
+
 
 Other stuff:
 * Improve specs speed
 * Provide an easy way to run specs after install
 * Improve documentation
-* Tty to reduce the number of library methods, and find better names to some
+* Try to reduce the number of library methods, and find better names to some
 
 
 == Backward compatibility

data/VERSION

@@ -1 +1 @@
-0.4.1
+0.5.0

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -19,7 +19,7 @@ module Sorcery
           # Increments the failed logins counter on every failed login.
           # Runs as a hook after a failed login.
           def update_failed_logins_count!(credentials)
-            user = Config.user_class.where("#{Config.user_class.sorcery_config.username_attribute_name} = ?", credentials[0]).first
+            user = Config.user_class.find_by_credentials(credentials)
             user.register_failed_login! if user
           end
           

data/lib/sorcery/crypto_providers/bcrypt.rb

@@ -30,11 +30,9 @@ module Sorcery
     #
     #   gem install bcrypt-ruby
     #
-    # Tell activate_sorcery! to use it:
+    # Update your initializer to use it:
     #
-    #   activate_sorcery! do |c|
-    #     c.encryption_algorithm = :bcrypt
-    #   end
+    #   config.encryption_algorithm = :bcrypt
     #
     # You are good to go!
     class BCrypt

data/lib/sorcery/crypto_providers/common.rb

@@ -13,14 +13,14 @@ module Sorcery
             attr_writer :stretches
 
             def encrypt(*tokens)
-              digest = tokens.flatten.join(join_token)
+              digest = tokens.flatten.compact.join(join_token)
               stretches.times { digest = secure_digest(digest) }
               digest
             end
 
             # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
             def matches?(crypted, *tokens)
-              encrypt(*tokens) == crypted
+              encrypt(*tokens.compact) == crypted
             end
 
             def reset!

data/lib/sorcery/engine.rb

@@ -7,10 +7,6 @@ module Sorcery
   class Engine < Rails::Engine
     config.sorcery = ::Sorcery::Controller::Config
     
-    initializer "extend Model with sorcery" do |app|
-      ActiveRecord::Base.send(:include, Sorcery::Model) if defined?(ActiveRecord)
-    end
-    
     initializer "extend Controller with sorcery" do |app|
       ActionController::Base.send(:include, Sorcery::Controller)
       ActionController::Base.helper_method :current_user

data/lib/sorcery/initializers/initializer.rb

@@ -9,6 +9,7 @@ Rails.application.config.sorcery.configure do |config|
   # config.not_authenticated_action = :not_authenticated              # what controller action to call for non-authenticated users. You can also override 'not_authenticated' instead.
   # config.save_return_to_url = true                                  # when a non logged in user tries to enter a page that requires login, save the URL he wanted to reach, 
                                                                       # and send him there after login, using 'redirect_back_or_to'.
+  # subclasses_inherit_config = false                                 # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
                                                                       
   # -- session timeout --                                             
   # config.session_timeout = 3600                                     # how long in seconds to keep the session alive.
@@ -44,6 +45,7 @@ Rails.application.config.sorcery.configure do |config|
     # user.encryption_key = nil                                                       # encryption key used to encrypt reversible encryptions such as AES256.
     # user.custom_encryption_provider = nil                                           # use an external encryption class.
     # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See 'encryption_algorithm=' for available options.
+    # user.subclasses_inherit_config = false                                          # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
                                                                                       
     # -- user_activation --                                                           
     # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold activation state (active/pending).

data/lib/sorcery/model/adapters/active_record.rb

@@ -0,0 +1,28 @@
+module Sorcery
+  module Model
+    module Adapters
+      module ActiveRecord
+        def self.included(klass)
+          klass.extend ClassMethods
+        end
+
+        module ClassMethods
+          def find_by_credentials(credentials)
+            where("#{@sorcery_config.username_attribute_name} = ?", credentials[0]).first
+          end
+
+          def find_by_token(token_attr_name, token)
+            where("#{token_attr_name} = ?", token).first
+          end
+
+          def get_current_users
+            config = sorcery_config
+            where("#{config.last_activity_at_attribute_name} IS NOT NULL") \
+            .where("#{config.last_logout_at_attribute_name} IS NULL OR #{config.last_activity_at_attribute_name} > #{config.last_logout_at_attribute_name}") \
+            .where("#{config.last_activity_at_attribute_name} > ? ", config.activity_timeout.seconds.ago.utc.to_s(:db))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -0,0 +1,59 @@
+module Sorcery
+  module Model
+    module Adapters
+      module Mongoid
+        def self.included(klass)
+          klass.extend ClassMethods
+          klass.send(:include, InstanceMethods)
+        end
+
+        module InstanceMethods
+          def increment(attr)
+            self.inc(attr,1)
+          end
+        end
+
+        module ClassMethods
+          def find_by_credentials(credentials)
+            where(@sorcery_config.username_attribute_name => credentials[0]).first
+          end
+
+          def find_by_provider_and_uid(provider, uid)
+            where(:provider => provider, :uid => uid).first
+          end
+
+          def find_by_id(id)
+            find(id)
+          end
+
+          def find_by_activation_token(token)
+            where(:activation_token => token).first
+          end
+
+          def find_by_remember_me_token(token)
+            where(:remember_me_token => token).first
+          end
+
+          def find_by_username(username)
+            where(:username => username).first
+          end
+
+          def transaction(&blk)
+            tap(&blk)
+          end
+
+          def find_by_token(token_attr_name, token)
+            where(token_attr_name => token).first
+          end
+
+          def get_current_users
+            config = sorcery_config
+            where(config.last_activity_at_attribute_name.ne => nil) \
+            .any_of({config.last_logout_at_attribute_name => nil},{config.last_activity_at_attribute_name.gt => config.last_logout_at_attribute_name}) \
+            .and(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc.to_s(:db)).order_by([:_id,:asc])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -9,6 +9,7 @@ module Sorcery
       module ActivityLogging
         def self.included(base)
           base.extend(ClassMethods)
+
           base.sorcery_config.class_eval do
             attr_accessor :last_login_at_attribute_name,                  # last login attribute name.
                           :last_logout_at_attribute_name,                 # last logout attribute name.
@@ -23,15 +24,23 @@ module Sorcery
                              :@activity_timeout                            => 10 * 60)
             reset!
           end
+
+          base.sorcery_config.after_config << :define_activity_logging_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
         end
         
         module ClassMethods
           # get all users with last_activity within timeout
           def current_users
             config = sorcery_config
-            where("#{config.last_activity_at_attribute_name} IS NOT NULL") \
-            .where("#{config.last_logout_at_attribute_name} IS NULL OR #{config.last_activity_at_attribute_name} > #{config.last_logout_at_attribute_name}") \
-            .where("#{config.last_activity_at_attribute_name} > ? ", config.activity_timeout.seconds.ago.utc.to_s(:db))
+            get_current_users
+          end
+
+          protected
+
+          def define_activity_logging_mongoid_fields
+            field sorcery_config.last_login_at_attribute_name, type: DateTime
+            field sorcery_config.last_logout_at_attribute_name, type: DateTime
+            field sorcery_config.last_activity_at_attribute_name, type: DateTime
           end
         end
       end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -21,13 +21,18 @@ module Sorcery
           end
           
           base.sorcery_config.before_authenticate << :prevent_locked_user_login
+          base.sorcery_config.after_config << :define_brute_force_protection_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
         end
         
         module ClassMethods
           protected
-          
+
+          def define_brute_force_protection_mongoid_fields
+            field sorcery_config.failed_logins_count_attribute_name, type: Integer
+            field sorcery_config.lock_expires_at_attribute_name, type: DateTime
+          end
         end
         
         module InstanceMethods

data/lib/sorcery/model/submodules/external.rb

@@ -32,6 +32,7 @@ module Sorcery
           
           base.send(:include, InstanceMethods)
           base.extend(ClassMethods)
+
         end
         
         module ClassMethods

data/lib/sorcery/model/submodules/remember_me.rb

@@ -21,8 +21,22 @@ module Sorcery
           end
           
           base.send(:include, InstanceMethods)
+
+          base.sorcery_config.after_config << :define_remember_me_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+
+          base.extend(ClassMethods)
+        end
+
+        module ClassMethods
+          protected
+
+          def define_remember_me_mongoid_fields
+            field sorcery_config.remember_me_token_attribute_name, type: String
+            field sorcery_config.remember_me_token_expires_at_attribute_name, type: DateTime
+          end
+
         end
-        
+
         module InstanceMethods
           # You shouldn't really use this one yourself - it's called by the controller's 'remember_me!' method.
           def remember_me!

data/lib/sorcery/model/submodules/reset_password.rb

@@ -34,10 +34,12 @@ module Sorcery
           end
           
           base.sorcery_config.after_config << :validate_mailer_defined
-          
+          base.sorcery_config.after_config << :define_reset_password_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+
           base.extend(ClassMethods)
           base.send(:include, TemporaryToken)
           base.send(:include, InstanceMethods)
+
         end
         
         module ClassMethods
@@ -57,6 +59,11 @@ module Sorcery
             raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil
           end
 
+          def define_reset_password_mongoid_fields
+            field sorcery_config.reset_password_token_attribute_name, type: String
+            field sorcery_config.reset_password_token_expires_at_attribute_name, type: DateTime
+            field sorcery_config.reset_password_email_sent_at_attribute_name, type: DateTime
+          end
         end
         
         module InstanceMethods
@@ -75,9 +82,9 @@ module Sorcery
           end
           
           # Clears token and tries to update the new password for the user.
-          def reset_password!(params)
+          def change_password!(new_password)
             clear_reset_password_token
-            update_attributes(params)
+            update_attributes(sorcery_config.password_attribute_name => new_password)
           end
 
           protected

data/lib/sorcery/model/submodules/user_activation.rb

@@ -38,12 +38,14 @@ module Sorcery
           end
           
           base.sorcery_config.after_config << :validate_mailer_defined
-          
+          base.sorcery_config.after_config << :define_user_activation_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
           base.sorcery_config.before_authenticate << :prevent_non_active_login
           
           base.extend(ClassMethods)
           base.send(:include, TemporaryToken)
           base.send(:include, InstanceMethods)
+
+
         end
         
         module ClassMethods
@@ -62,6 +64,14 @@ module Sorcery
             msg = "To use user_activation submodule, you must define a mailer (config.user_activation_mailer = YourMailerClass)."
             raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil
           end
+
+          def define_user_activation_mongoid_fields
+            self.class_eval do
+              field sorcery_config.activation_state_attribute_name, type: String
+              field sorcery_config.activation_token_attribute_name, type: String
+              field sorcery_config.activation_token_expires_at_attribute_name, type: DateTime
+            end
+          end
         end
         
         module InstanceMethods

data/lib/sorcery/model/temporary_token.rb

@@ -10,7 +10,7 @@ module Sorcery
       module ClassMethods
         def load_from_token(token, token_attr_name, token_expiration_date_attr)
           return nil if token.blank?
-          user = where("#{token_attr_name} = ?", token).first
+          user = find_by_token(token_attr_name,token)
           if !user.blank? && !user.send(token_expiration_date_attr).nil?
             return Time.now.utc < user.send(token_expiration_date_attr) ? user : nil
           end

data/lib/sorcery/model.rb

@@ -22,19 +22,31 @@ module Sorcery
                 begin
                   include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
                 rescue NameError
-                  # don't stop on a missing submodule.
+                  # don't stop on a missing submodule. Needed because some submodules are only defined in the controller side.
                 end
               end
             end
-            
+
+            # This runs the options block set in the initializer on the model class.
             ::Sorcery::Controller::Config.user_config.tap{|blk| blk.call(@sorcery_config) if blk}
-            
+
+            self.class_eval do
+              field sorcery_config.username_attribute_name, type: String
+              field sorcery_config.password_attribute_name, type: String
+              field sorcery_config.email_attribute_name, type: String unless sorcery_config.username_attribute_name == sorcery_config.email_attribute_name
+              field sorcery_config.crypted_password_attribute_name, type: String
+              field sorcery_config.salt_attribute_name, type: String
+            end if defined?(Mongoid) and self.ancestors.include?(Mongoid::Document)
+
+            # add virtual password accessor and ORM callbacks
             self.class_eval do
               attr_accessor @sorcery_config.password_attribute_name
               attr_protected @sorcery_config.crypted_password_attribute_name, @sorcery_config.salt_attribute_name
               before_save :encrypt_password, :if => Proc.new { |record| record.send(sorcery_config.password_attribute_name).present? }
               after_save :clear_virtual_password, :if => Proc.new { |record| record.send(sorcery_config.password_attribute_name).present? }
             end
+            
+            @sorcery_config.after_config << :add_config_inheritance if @sorcery_config.subclasses_inherit_config
             @sorcery_config.after_config.each { |c| send(c) }
           end
         end
@@ -53,7 +65,7 @@ module Sorcery
       # returns the user if success, nil otherwise.
       def authenticate(*credentials)
         raise ArgumentError, "at least 2 arguments required" if credentials.size < 2
-        user = where("#{@sorcery_config.username_attribute_name} = ?", credentials[0]).first
+        user = find_by_credentials(credentials)
         _salt = user.send(@sorcery_config.salt_attribute_name) if user && !@sorcery_config.salt_attribute_name.nil? && !@sorcery_config.encryption_provider.nil?
         user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && credentials_match?(user.send(@sorcery_config.crypted_password_attribute_name),credentials[1],_salt)
       end
@@ -76,6 +88,20 @@ module Sorcery
         @sorcery_config.encryption_provider.matches?(crypted, *tokens)
       end
       
+      def add_config_inheritance
+        self.class_eval do
+          def self.inherited(subclass)
+            subclass.class_eval do
+              class << self
+                attr_accessor :sorcery_config
+              end
+            end
+            subclass.sorcery_config = sorcery_config
+            super
+          end
+        end
+      end
+      
     end
     
     module InstanceMethods
@@ -93,7 +119,7 @@ module Sorcery
       protected
       
       # creates new salt and saves it.
-      # encrypts password with salt and save it.
+      # encrypts password with salt and saves it.
       def encrypt_password
         config = sorcery_config
         new_salt = self.send(:"#{config.salt_attribute_name}=", generate_random_token) if !config.salt_attribute_name.nil?
@@ -117,7 +143,7 @@ module Sorcery
       
       # Random code, used for salt and temporary tokens.
       def generate_random_token
-        return Digest::SHA1.hexdigest( Time.now.to_s.split(//).sort_by {rand}.join )
+        Digest::SHA1.hexdigest( Time.now.to_s.split(//).sort_by {rand}.join )
       end
     end
 
@@ -133,6 +159,7 @@ module Sorcery
                     :salt_attribute_name,               # change default salt attribute.
                     :stretches,                         # how many times to apply encryption to the password.
                     :encryption_key,                    # encryption key used to encrypt reversible encryptions such as AES256.
+                    :subclasses_inherit_config,         # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
                     
                     :submodules,                        # configured in config/application.rb
                     :before_authenticate,               # an array of method names to call before authentication completes. used internally.
@@ -156,6 +183,7 @@ module Sorcery
           :@salt_join_token                      => "",
           :@salt_attribute_name                  => :salt,
           :@stretches                            => nil,
+          :@subclasses_inherit_config            => false,
           :@before_authenticate                  => [],
           :@after_config                         => []
         }

data/lib/sorcery/sinatra.rb

@@ -1,4 +1,3 @@
-ActiveRecord::Base.send(:include, Sorcery::Model) if defined?(ActiveRecord)
 if defined?(Sinatra::Base)
   Sinatra::Base.send(:include, Sorcery::Controller::Adapters::Sinatra)
   Sinatra::Base.send(:include, Sorcery::Controller)

data/lib/sorcery/test_helpers/internal/rails.rb

@@ -0,0 +1,52 @@
+module Sorcery
+  module TestHelpers
+    module Internal
+      module Rails
+        include ::Sorcery::TestHelpers::Rails
+
+        SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS = [:register_last_activity_time_to_db, :deny_banned_user, :validate_session]
+
+        def sorcery_reload!(submodules = [], options = {})
+          reload_user_class
+
+          # return to no-module configuration
+          ::Sorcery::Controller::Config.init!
+          ::Sorcery::Controller::Config.reset!
+
+          # remove all plugin before_filters so they won't fail other tests.
+          # I don't like this way, but I didn't find another.
+          # hopefully it won't break until Rails 4.
+          ApplicationController._process_action_callbacks.delete_if {|c| SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS.include?(c.filter) }
+
+          # configure
+          ::Sorcery::Controller::Config.submodules = submodules
+          ::Sorcery::Controller::Config.user_class = nil
+          ActionController::Base.send(:include,::Sorcery::Controller)
+
+          ::Sorcery::Controller::Config.user_config do |user|
+            options.each do |property,value|
+              user.send(:"#{property}=", value)
+            end
+          end
+          User.authenticates_with_sorcery!
+        end
+
+        def sorcery_controller_property_set(property, value)
+          ::Sorcery::Controller::Config.send(:"#{property}=", value)
+        end
+
+        def sorcery_controller_external_property_set(provider, property, value)
+          ::Sorcery::Controller::Config.send(provider).send(:"#{property}=", value)
+        end
+
+        # This helper is used to fake multiple users signing in in tests.
+        # It does so by clearing @current_user, thus allowing a new user to login,
+        # all this without calling the :logout action explicitly.
+        # A dirty dirty hack.
+        def clear_user_without_logout
+          subject.instance_variable_set(:@current_user,nil)
+        end
+      end
+    end
+  end
+end