sorcery 0.4.1 → 0.5.2

data/Gemfile

@@ -2,13 +2,16 @@ source "http://rubygems.org"
 # Add dependencies required to use your gem here.
 # Example:
 #   gem "activesupport", ">= 2.3.5"
-gem "rails", ">= 3.0.0"
-gem 'json', ">= 1.5.1"
 gem 'oauth', ">= 0.4.4"
 gem 'oauth2', ">= 0.1.1"
+
 # Add dependencies to develop your gem here.
 # Include everything needed to run rake, tests, features, etc.
 group :development do
+  gem "rails", ">= 3.0.0"
+  gem 'json', ">= 1.5.1"
+  gem "mongoid", "~> 2.0"
+  gem "bson_ext", "~> 1.3"
   gem "rspec", "~> 2.5.0"
   gem 'rspec-rails', "~> 2.5.0"
   gem 'ruby-debug19'

data/Gemfile.lock

@@ -31,6 +31,8 @@ GEM
     addressable (2.2.4)
     archive-tar-minitar (0.5.2)
     arel (2.0.6)
+    bson (1.3.0)
+    bson_ext (1.3.0)
     builder (2.1.2)
     columnize (0.3.2)
     diff-lcs (1.1.2)
@@ -55,6 +57,13 @@ GEM
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
     mime-types (1.16)
+    mongo (1.3.0)
+      bson (>= 1.3.0)
+    mongoid (2.0.1)
+      activemodel (~> 3.0)
+      mongo (~> 1.3)
+      tzinfo (~> 0.3.22)
+      will_paginate (~> 3.0.pre)
     multi_json (0.0.5)
     multipart-post (1.1.0)
     oauth (0.4.4)
@@ -113,15 +122,18 @@ GEM
     treetop (1.4.9)
       polyglot (>= 0.3.1)
     tzinfo (0.3.23)
+    will_paginate (3.0.pre2)
     yard (0.6.4)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
+  bson_ext (~> 1.3)
   bundler (~> 1.0.0)
   jeweler (~> 1.5.2)
   json (>= 1.5.1)
+  mongoid (~> 2.0)
   oauth (>= 0.4.4)
   oauth2 (>= 0.1.1)
   rails (>= 3.0.0)

data/README.rdoc

@@ -1,5 +1,6 @@
 = sorcery
 Magical Authentication for Rails 3 and Sinatra.
+Supports ActiveRecord and Mongoid.
 
 Inspired by restful_authentication, Authlogic and Devise.
 Crypto code taken almost unchanged from Authlogic.
@@ -15,7 +16,7 @@ It was built with a few goals in mind:
 * Less is more - less than 20 public methods to remember for the entire feature-set make the lib easy to 'get'.
 * No built-in or generated code - use the library's methods inside *your own* MVC structures, and don't fight to fix someone else's.
 * Magic yes, Voodoo no - the lib should be easy to hack for most developers.
-* Configuration over Confusion - Simple & short configuration as possible, not drowning in syntactic sugar.
+* Configuration over Confusion - Centralized (1 file), Simple & short configuration as possible, not drowning in syntactic sugar.
 * Keep MVC cleanly separated - DB is for models, sessions are for controllers. Models stay unaware of sessions.
 
 Hopefully, I've achieved this. If not, let me know.
@@ -28,7 +29,7 @@ Example Rails 3 app using sorcery: https://github.com/NoamB/sorcery-example-app
 
 Example Sinatra app using sorcery: https://github.com/NoamB/sorcery-example-app-sinatra
 
-Documentation: http://rubydoc.info/gems/sorcery/0.4.1/frames
+Documentation: http://rubydoc.info/gems/sorcery/0.5.2/frames
 
 Check out the tutorials in the github wiki!
 
@@ -66,7 +67,7 @@ Below is a summary of the library methods. Most method names are self explaining
   # reset password
   User.load_from_reset_password_token(token)
   @user.deliver_reset_password_instructions!
-  @user.reset_password!(params)
+  @user.change_password!(new_password)
 
   # user activation
   User.load_from_activation_token(token)
@@ -193,19 +194,23 @@ External (see lib/sorcery/controller/submodules/external.rb):
 == Next Planned Features:
 
 
-I've got many plans which include (by priority):
+I've got some thoughts which include (unordered):
+* Passing a block to encrypt, allowing the developer to define his own mix of salting and encrypting
 * Forgot username, maybe as part of the reset_password module
 * Scoping logins (to a subdomain or another arbitrary field)
-* Mongoid support
+* Allowing storing the salt and crypted password in the same DB field for extra security
 * Other reset password strategies (security questions?)
 * Other brute force protection strategies (captcha)
-* Have an idea? Let me know, and it might get into the gem!
+
+
+Have an idea? Let me know, and it might get into the gem!
+
 
 Other stuff:
 * Improve specs speed
 * Provide an easy way to run specs after install
 * Improve documentation
-* Tty to reduce the number of library methods, and find better names to some
+* Try to reduce the number of library methods, and find better names to some
 
 
 == Backward compatibility

data/VERSION

@@ -1 +1 @@
-0.4.1
+0.5.2

data/lib/sorcery/controller/adapters/sinatra.rb

@@ -16,7 +16,7 @@ module Sorcery
                   process_route(*arguments) { instance_eval(&block) }
                 end
               end
-              
+
               def after_filter(filter)
                 after do
                   send(filter)
@@ -24,66 +24,73 @@ module Sorcery
               end
             end
           end
-          
+
           ::Sinatra::Request.class_eval do
             def authorization
-              env['HTTP_AUTHORIZATION']   ||
-              env['X-HTTP_AUTHORIZATION'] ||
-              env['X_HTTP_AUTHORIZATION'] ||
-              env['REDIRECT_X_HTTP_AUTHORIZATION'] || nil
+              env['HTTP_AUTHORIZATION'] ||
+                  env['X-HTTP_AUTHORIZATION'] ||
+                  env['X_HTTP_AUTHORIZATION'] ||
+                  env['REDIRECT_X_HTTP_AUTHORIZATION'] || nil
             end
           end
-          
+
+          base.send(:include, SorceryHelpers)
           base.send(:include, InstanceMethods)
           base.extend(ClassMethods)
         end
-        
+
+        module SorceryHelpers
+
+          def request_http_basic_authentication(realm)
+            response.header['WWW-Authenticate'] = %(Basic realm="#{realm}")
+            response.status = 401
+          end
+
+          def authenticate_with_http_basic(&blk)
+            @auth ||= Rack::Auth::Basic::Request.new(request.env)
+            yield @auth.credentials if (@auth.provided? && @auth.basic? && @auth.credentials)
+          end
+
+        end
+
         module InstanceMethods
           def reset_session
             session.clear
           end
-        
+
           def redirect_to(*args)
             args.pop if args.last.is_a?(Hash)
             redirect(*args)
           end
-        
+
           def root_path
             '/'
           end
-          
-          helpers do
-            def request_http_basic_authentication(realm)
-              response.header['WWW-Authenticate'] = %(Basic realm="#{realm}")
-              response.status = 401
-            end
-            
-            def authenticate_with_http_basic(&blk)
-              @auth ||=  Rack::Auth::Basic::Request.new(request.env)
-              yield @auth.credentials if ( @auth.provided? && @auth.basic? && @auth.credentials )
-            end
+
+          ::Sinatra.helpers do
+            include SorceryHelpers
           end
-          
+
           def cookies
-            @cookie_proxy ||= CookieProxy.new(request,response)
+            @cookie_proxy ||= CookieProxy.new(request, response)
           end
         end
-        
+
         class CookieProxy
-          def initialize(request,response)
+          def initialize(request, response)
             @request = request
             @response = response
           end
-          
+
           def [](key)
             @request.cookies[key.to_s]
           end
-          
+
           def []=(key, value)
             @response.set_cookie(key, value)
           end
         end
-        
+
         module ClassMethods
           def prepend_before_filter(filter)
             prepend_filter(:before) do

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -19,7 +19,7 @@ module Sorcery
           # Increments the failed logins counter on every failed login.
           # Runs as a hook after a failed login.
           def update_failed_logins_count!(credentials)
-            user = Config.user_class.where("#{Config.user_class.sorcery_config.username_attribute_name} = ?", credentials[0]).first
+            user = Config.user_class.find_by_credentials(credentials)
             user.register_failed_login! if user
           end
           

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -21,7 +21,7 @@ module Sorcery
         end
         
         module InstanceMethods
-          
+
           protected
           
           # to be used as a before_filter.

data/lib/sorcery/crypto_providers/bcrypt.rb

@@ -30,11 +30,9 @@ module Sorcery
     #
     #   gem install bcrypt-ruby
     #
-    # Tell activate_sorcery! to use it:
+    # Update your initializer to use it:
     #
-    #   activate_sorcery! do |c|
-    #     c.encryption_algorithm = :bcrypt
-    #   end
+    #   config.encryption_algorithm = :bcrypt
     #
     # You are good to go!
     class BCrypt

data/lib/sorcery/crypto_providers/common.rb

@@ -13,14 +13,14 @@ module Sorcery
             attr_writer :stretches
 
             def encrypt(*tokens)
-              digest = tokens.flatten.join(join_token)
+              digest = tokens.flatten.compact.join(join_token)
               stretches.times { digest = secure_digest(digest) }
               digest
             end
 
             # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.
             def matches?(crypted, *tokens)
-              encrypt(*tokens) == crypted
+              encrypt(*tokens.compact) == crypted
             end
 
             def reset!

data/lib/sorcery/engine.rb

@@ -7,22 +7,11 @@ module Sorcery
   class Engine < Rails::Engine
     config.sorcery = ::Sorcery::Controller::Config
     
-    initializer "extend Model with sorcery" do |app|
-      ActiveRecord::Base.send(:include, Sorcery::Model) if defined?(ActiveRecord)
-    end
-    
     initializer "extend Controller with sorcery" do |app|
       ActionController::Base.send(:include, Sorcery::Controller)
       ActionController::Base.helper_method :current_user
     end
     
-    initializer "attempt to preload user model" do |app|
-      begin
-        require Rails.root + "app/models/user.rb"
-      rescue LoadError
-      end
-    end
-    
     rake_tasks do
       load "sorcery/railties/tasks.rake"
     end

data/lib/sorcery/initializers/initializer.rb

@@ -9,7 +9,7 @@ Rails.application.config.sorcery.configure do |config|
   # config.not_authenticated_action = :not_authenticated              # what controller action to call for non-authenticated users. You can also override 'not_authenticated' instead.
   # config.save_return_to_url = true                                  # when a non logged in user tries to enter a page that requires login, save the URL he wanted to reach, 
                                                                       # and send him there after login, using 'redirect_back_or_to'.
-                                                                      
+
   # -- session timeout --                                             
   # config.session_timeout = 3600                                     # how long in seconds to keep the session alive.
   # config.session_timeout_from_last_action = false                   # use the last action as the beginning of session timeout.
@@ -44,6 +44,7 @@ Rails.application.config.sorcery.configure do |config|
     # user.encryption_key = nil                                                       # encryption key used to encrypt reversible encryptions such as AES256.
     # user.custom_encryption_provider = nil                                           # use an external encryption class.
     # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See 'encryption_algorithm=' for available options.
+    # user.subclasses_inherit_config = false                                          # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
                                                                                       
     # -- user_activation --                                                           
     # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold activation state (active/pending).
@@ -82,4 +83,7 @@ Rails.application.config.sorcery.configure do |config|
     # user.provider_attribute_name = :provider                                        # provider's identifier in authentications class.
     # user.provider_uid_attribute_name = :uid                                         # user's external unique identifier in authentications class.
   end
+
+  # This line must come after the 'user config' block.
+  config.user_class_name = User                                                       # define which model authenticates with sorcery.
 end

data/lib/sorcery/model/adapters/active_record.rb

@@ -0,0 +1,28 @@
+module Sorcery
+  module Model
+    module Adapters
+      module ActiveRecord
+        def self.included(klass)
+          klass.extend ClassMethods
+        end
+
+        module ClassMethods
+          def find_by_credentials(credentials)
+            where("#{@sorcery_config.username_attribute_name} = ?", credentials[0]).first
+          end
+
+          def find_by_token(token_attr_name, token)
+            where("#{token_attr_name} = ?", token).first
+          end
+
+          def get_current_users
+            config = sorcery_config
+            where("#{config.last_activity_at_attribute_name} IS NOT NULL") \
+            .where("#{config.last_logout_at_attribute_name} IS NULL OR #{config.last_activity_at_attribute_name} > #{config.last_logout_at_attribute_name}") \
+            .where("#{config.last_activity_at_attribute_name} > ? ", config.activity_timeout.seconds.ago.utc.to_s(:db))
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -0,0 +1,64 @@
+module Sorcery
+  module Model
+    module Adapters
+      module Mongoid
+        def self.included(klass)
+          klass.extend ClassMethods
+          klass.send(:include, InstanceMethods)
+        end
+
+        module InstanceMethods
+          def increment(attr)
+            self.inc(attr,1)
+          end
+        end
+
+        module ClassMethods
+          def find_by_credentials(credentials)
+            where(sorcery_config.username_attribute_name => credentials[0]).first
+          end
+
+          def find_by_provider_and_uid(provider, uid)
+            user_klass = ::Sorcery::Controller::Config.user_class
+            where(user_klass.sorcery_config.provider_attribute_name => provider, user_klass.sorcery_config.provider_uid_attribute_name => uid).first
+          end
+
+          def find_by_id(id)
+            find(id)
+          end
+
+          def find_by_activation_token(token)
+            where(sorcery_config.activation_token_attribute_name => token).first
+          end
+
+          def find_by_remember_me_token(token)
+            where(sorcery_config.remember_me_token_attribute_name => token).first
+          end
+
+          def find_by_username(username)
+            where(sorcery_config.username_attribute_name => username).first
+          end
+
+          def transaction(&blk)
+            tap(&blk)
+          end
+
+          def find_by_token(token_attr_name, token)
+            where(token_attr_name => token).first
+          end
+
+          def find_by_email(email)
+            where(sorcery_config.email_attribute_name => email).first
+          end
+
+          def get_current_users
+            config = sorcery_config
+            where(config.last_activity_at_attribute_name.ne => nil) \
+            .any_of({config.last_logout_at_attribute_name => nil},{config.last_activity_at_attribute_name.gt => config.last_logout_at_attribute_name}) \
+            .and(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc.to_s(:db)).order_by([:_id,:asc])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -9,6 +9,7 @@ module Sorcery
       module ActivityLogging
         def self.included(base)
           base.extend(ClassMethods)
+
           base.sorcery_config.class_eval do
             attr_accessor :last_login_at_attribute_name,                  # last login attribute name.
                           :last_logout_at_attribute_name,                 # last logout attribute name.
@@ -23,15 +24,23 @@ module Sorcery
                              :@activity_timeout                            => 10 * 60)
             reset!
           end
+
+          base.sorcery_config.after_config << :define_activity_logging_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
         end
         
         module ClassMethods
           # get all users with last_activity within timeout
           def current_users
             config = sorcery_config
-            where("#{config.last_activity_at_attribute_name} IS NOT NULL") \
-            .where("#{config.last_logout_at_attribute_name} IS NULL OR #{config.last_activity_at_attribute_name} > #{config.last_logout_at_attribute_name}") \
-            .where("#{config.last_activity_at_attribute_name} > ? ", config.activity_timeout.seconds.ago.utc.to_s(:db))
+            get_current_users
+          end
+
+          protected
+
+          def define_activity_logging_mongoid_fields
+            field sorcery_config.last_login_at_attribute_name, type: DateTime
+            field sorcery_config.last_logout_at_attribute_name, type: DateTime
+            field sorcery_config.last_activity_at_attribute_name, type: DateTime
           end
         end
       end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -21,13 +21,18 @@ module Sorcery
           end
           
           base.sorcery_config.before_authenticate << :prevent_locked_user_login
+          base.sorcery_config.after_config << :define_brute_force_protection_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
         end
         
         module ClassMethods
           protected
-          
+
+          def define_brute_force_protection_mongoid_fields
+            field sorcery_config.failed_logins_count_attribute_name, type: Integer
+            field sorcery_config.lock_expires_at_attribute_name, type: DateTime
+          end
         end
         
         module InstanceMethods

data/lib/sorcery/model/submodules/external.rb

@@ -32,6 +32,7 @@ module Sorcery
           
           base.send(:include, InstanceMethods)
           base.extend(ClassMethods)
+
         end
         
         module ClassMethods

data/lib/sorcery/model/submodules/remember_me.rb

@@ -21,8 +21,22 @@ module Sorcery
           end
           
           base.send(:include, InstanceMethods)
+
+          base.sorcery_config.after_config << :define_remember_me_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+
+          base.extend(ClassMethods)
+        end
+
+        module ClassMethods
+          protected
+
+          def define_remember_me_mongoid_fields
+            field sorcery_config.remember_me_token_attribute_name, type: String
+            field sorcery_config.remember_me_token_expires_at_attribute_name, type: DateTime
+          end
+
         end
-        
+
         module InstanceMethods
           # You shouldn't really use this one yourself - it's called by the controller's 'remember_me!' method.
           def remember_me!

data/lib/sorcery/model/submodules/reset_password.rb

@@ -32,12 +32,15 @@ module Sorcery
 
             reset!
           end
-          
-          base.sorcery_config.after_config << :validate_mailer_defined
-          
+
           base.extend(ClassMethods)
+
+          base.sorcery_config.after_config << :validate_mailer_defined
+          base.sorcery_config.after_config << :define_reset_password_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+
           base.send(:include, TemporaryToken)
           base.send(:include, InstanceMethods)
+
         end
         
         module ClassMethods
@@ -57,6 +60,11 @@ module Sorcery
             raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil
           end
 
+          def define_reset_password_mongoid_fields
+            field sorcery_config.reset_password_token_attribute_name, type: String
+            field sorcery_config.reset_password_token_expires_at_attribute_name, type: DateTime
+            field sorcery_config.reset_password_email_sent_at_attribute_name, type: DateTime
+          end
         end
         
         module InstanceMethods
@@ -75,9 +83,10 @@ module Sorcery
           end
           
           # Clears token and tries to update the new password for the user.
-          def reset_password!(params)
+          def change_password!(new_password)
             clear_reset_password_token
-            update_attributes(params)
+            self.send(:"#{sorcery_config.password_attribute_name}=", new_password)
+            save
           end
 
           protected

data/lib/sorcery/model/submodules/user_activation.rb

@@ -38,12 +38,14 @@ module Sorcery
           end
           
           base.sorcery_config.after_config << :validate_mailer_defined
-          
+          base.sorcery_config.after_config << :define_user_activation_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
           base.sorcery_config.before_authenticate << :prevent_non_active_login
           
           base.extend(ClassMethods)
           base.send(:include, TemporaryToken)
           base.send(:include, InstanceMethods)
+
+
         end
         
         module ClassMethods
@@ -62,6 +64,14 @@ module Sorcery
             msg = "To use user_activation submodule, you must define a mailer (config.user_activation_mailer = YourMailerClass)."
             raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil
           end
+
+          def define_user_activation_mongoid_fields
+            self.class_eval do
+              field sorcery_config.activation_state_attribute_name, type: String
+              field sorcery_config.activation_token_attribute_name, type: String
+              field sorcery_config.activation_token_expires_at_attribute_name, type: DateTime
+            end
+          end
         end
         
         module InstanceMethods

data/lib/sorcery/model/temporary_token.rb

@@ -10,7 +10,7 @@ module Sorcery
       module ClassMethods
         def load_from_token(token, token_attr_name, token_expiration_date_attr)
           return nil if token.blank?
-          user = where("#{token_attr_name} = ?", token).first
+          user = find_by_token(token_attr_name,token)
           if !user.blank? && !user.send(token_expiration_date_attr).nil?
             return Time.now.utc < user.send(token_expiration_date_attr) ? user : nil
           end