sorcery 0.5.0 → 0.6.0

data/lib/sorcery/initializers/initializer.rb

@@ -1,26 +1,35 @@
 # The first thing you need to configure is which modules you need in your app.
 # The default is nothing which will include only core features (password encryption, login/logout).
-# Available submodules are: :user_activation, :http_basic_auth, :remember_me, :reset_password, :session_timeout, :brute_force_protection, :activity_logging, :external
+# Available submodules are: :user_activation, :http_basic_auth, :remember_me, 
+# :reset_password, :session_timeout, :brute_force_protection, :activity_logging, :external
 Rails.application.config.sorcery.submodules = []
 
 # Here you can configure each submodule's features.
 Rails.application.config.sorcery.configure do |config|
   # -- core --
-  # config.not_authenticated_action = :not_authenticated              # what controller action to call for non-authenticated users. You can also override 'not_authenticated' instead.
-  # config.save_return_to_url = true                                  # when a non logged in user tries to enter a page that requires login, save the URL he wanted to reach, 
-                                                                      # and send him there after login, using 'redirect_back_or_to'.
-  # subclasses_inherit_config = false                                 # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
+  # config.not_authenticated_action = :not_authenticated              # what controller action to call for
+                                                                      # non-authenticated users. 
+                                                                      # You can also override 'not_authenticated' 
+                                                                      # instead.
                                                                       
+  # config.save_return_to_url = true                                  # when a non logged in user tries to enter 
+                                                                      # a page that requires login, 
+                                                                      # save the URL he wanted to reach, 
+                                                                      # and send him there after login, using
+                                                                      # 'redirect_back_or_to'.
+
   # -- session timeout --                                             
   # config.session_timeout = 3600                                     # how long in seconds to keep the session alive.
-  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of session timeout.
+  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of 
+                                                                      # session timeout.
   
   # -- http_basic_auth --
   # config.controller_to_realm_map = {"application" => "Application"} # What realm to display for which controller name.
                                                                       # For example {"My App" => "Application"}
   
   # -- external --
-  # config.external_providers = []                                    # What providers are supported by this app, i.e. [:twitter, :facebook] .
+  # config.external_providers = []                                    # What providers are supported by this app, 
+                                                                      # i.e. [:twitter, :facebook] .
   # 
   # config.twitter.key = "eYVNBjBDi33aa9GkA3w"
   # config.twitter.secret = "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8"
@@ -35,53 +44,135 @@ Rails.application.config.sorcery.configure do |config|
   # --- user config ---
   config.user_config do |user|
     # -- core --
-    # user.username_attribute_name = :username                                        # change default username attribute, for example, to use :email as the login.
-    # user.password_attribute_name = :password                                        # change *virtual* password attribute, the one which is used until an encrypted one is generated.
+    # user.username_attribute_name = :username                                        # change default username
+                                                                                      # attribute, for example, 
+                                                                                      # to use :email as the login.
+                                                                                      
+    # user.password_attribute_name = :password                                        # change *virtual* password
+                                                                                      # attribute, the one which is used
+                                                                                      # until an encrypted one is
+                                                                                      # generated.
+                                                                                      
     # user.email_attribute_name = :email                                              # change default email attribute.
-    # user.crypted_password_attribute_name =  :crypted_password                       # change default crypted_password attribute.
-    # user.salt_join_token = ""                                                       # what pattern to use to join the password with the salt
+    
+    # user.crypted_password_attribute_name =  :crypted_password                       # change default crypted_password
+                                                                                      # attribute.
+                                                                                      
+    # user.salt_join_token = ""                                                       # what pattern to use to join the
+                                                                                      # password with the salt
+                                                                                      
     # user.salt_attribute_name = :salt                                                # change default salt attribute.
-    # user.stretches = nil                                                            # how many times to apply encryption to the password.
-    # user.encryption_key = nil                                                       # encryption key used to encrypt reversible encryptions such as AES256.
-    # user.custom_encryption_provider = nil                                           # use an external encryption class.
-    # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See 'encryption_algorithm=' for available options.
-    # user.subclasses_inherit_config = false                                          # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
+    
+    # user.stretches = nil                                                            # how many times to apply
+                                                                                      # encryption to the password.
+                                                                                      
+    # user.encryption_key = nil                                                       # encryption key used to encrypt
+                                                                                      # reversible encryptions such as
+                                                                                      # AES256.
+                                                                                      
+    # user.custom_encryption_provider = nil                                           # use an external encryption 
+                                                                                      # class.
+                                                                                      
+    # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See
+                                                                                      # 'encryption_algorithm=' for
+                                                                                      # available options.
+                                                                                      
+    # user.subclasses_inherit_config = false                                          # make this configuration
+                                                                                      # inheritable for subclasses.
+                                                                                      # Useful for ActiveRecord's STI.
                                                                                       
     # -- user_activation --                                                           
-    # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold activation state (active/pending).
-    # user.activation_token_attribute_name = :activation_token                        # the attribute name to hold activation code (sent by email).
-    # user.activation_token_expires_at_attribute_name = :activation_token_expires_at  # the attribute name to hold activation code expiration date. 
-    # user.activation_token_expiration_period =  nil                                  # how many seconds before the activation code expires. nil for never expires.
+    # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold
+                                                                                      # activation state
+                                                                                      # (active/pending).
+                                                                                      
+    # user.activation_token_attribute_name = :activation_token                        # the attribute name to hold
+                                                                                      # activation code (sent by email).
+                                                                                      
+    # user.activation_token_expires_at_attribute_name = :activation_token_expires_at  # the attribute name to hold
+                                                                                      # activation code expiration date. 
+                                                                                      
+    # user.activation_token_expiration_period =  nil                                  # how many seconds before the
+                                                                                      # activation code expires. nil for
+                                                                                      # never expires.
+                                                                                      
     # user.user_activation_mailer = nil                                               # your mailer class. Required.
-    # user.activation_needed_email_method_name = :activation_needed_email             # activation needed email method on your mailer class.
-    # user.activation_success_email_method_name = :activation_success_email           # activation success email method on your mailer class.
-    # user.prevent_non_active_users_to_login = true                                   # do you want to prevent or allow users that did not activate by email to login?                     
+    
+    # user.activation_needed_email_method_name = :activation_needed_email             # activation needed email method
+                                                                                      # on your mailer class.
+                                                                                      
+    # user.activation_success_email_method_name = :activation_success_email           # activation success email method
+                                                                                      # on your mailer class.
+                                                                                      
+    # user.prevent_non_active_users_to_login = true                                   # do you want to prevent or allow
+                                                                                      # users that did not activate by
+                                                                                      # email to login?                     
                                                                   
     # -- reset_password --                                        
-    # user.reset_password_token_attribute_name = :reset_password_token                          # reset password code attribute name.
-    # user.reset_password_token_expires_at_attribute_name = :reset_password_token_expires_at    # expires at attribute name.
-    # user.reset_password_email_sent_at_attribute_name = :reset_password_email_sent_at          # when was email sent, used for hammering protection.
+    # user.reset_password_token_attribute_name = :reset_password_token                          # reset password code
+                                                                                                # attribute name.
+                                                                                                
+    # user.reset_password_token_expires_at_attribute_name = :reset_password_token_expires_at    # expires at attribute
+                                                                                                # name.
+                                                                                                
+    # user.reset_password_email_sent_at_attribute_name = :reset_password_email_sent_at          # when was email sent,
+                                                                                                # used for hammering
+                                                                                                # protection.
+                                                                                                
     # user.reset_password_mailer = nil                                                          # mailer class. Needed.
-    # user.reset_password_email_method_name = :reset_password_email                             # reset password email method on your mailer class.
-    # user.reset_password_expiration_period = nil                                               # how many seconds before the reset request expires. nil for never expires.
-    # user.reset_password_time_between_emails = 5 * 60                                          # hammering protection, how long to wait before allowing another email to be sent.
+    
+    # user.reset_password_email_method_name = :reset_password_email                             # reset password email
+                                                                                                # method on your mailer
+                                                                                                # class.
+                                                                                                
+    # user.reset_password_expiration_period = nil                                               # how many seconds
+                                                                                                # before the reset
+                                                                                                # request expires. nil
+                                                                                                # for never expires.
+                                                                                                
+    # user.reset_password_time_between_emails = 5 * 60                                          # hammering protection,
+                                                                                                # how long to wait
+                                                                                                # before allowing
+                                                                                                # another email to be
+                                                                                                # sent.
                                                                   
     # -- brute_force_protection --                                
     # user.failed_logins_count_attribute_name = :failed_logins_count                  # failed logins attribute name.
-    # user.lock_expires_at_attribute_name = :lock_expires_at                          # this field indicates whether user is banned and when it will be active again.
+    
+    # user.lock_expires_at_attribute_name = :lock_expires_at                          # this field indicates whether
+                                                                                      # user is banned and when it will
+                                                                                      # be active again.
+                                                                                      
     # user.consecutive_login_retries_amount_limit = 50                                # how many failed logins allowed.
-    # user.login_lock_time_period = 60 * 60                                           # how long the user should be banned. in seconds. 0 for permanent.
+    
+    # user.login_lock_time_period = 60 * 60                                           # how long the user should be
+                                                                                      # banned. in seconds. 0 for
+                                                                                      # permanent.
                                                                   
     # -- activity logging --                                      
     # user.last_login_at_attribute_name = :last_login_at                              # last login attribute name.
     # user.last_logout_at_attribute_name = :last_logout_at                            # last logout attribute name.
     # user.last_activity_at_attribute_name = :last_activity_at                        # last activity attribute name.
-    # user.activity_timeout = 10 * 60                                                 # how long since last activity is the user defined logged out?
+    # user.activity_timeout = 10 * 60                                                 # how long since last activity is
+                                                                                      # the user defined logged out?
                                                                                       
     # -- external --                                                                     
-    # user.authentications_class = nil                                                # class which holds the various external provider data for this user.
-    # user.authentications_user_id_attribute_name = :user_id                          # user's identifier in authentications class.
-    # user.provider_attribute_name = :provider                                        # provider's identifier in authentications class.
-    # user.provider_uid_attribute_name = :uid                                         # user's external unique identifier in authentications class.
+    # user.authentications_class = nil                                                # class which holds the various
+                                                                                      # external provider data for this
+                                                                                      # user.
+                                                                                      
+    # user.authentications_user_id_attribute_name = :user_id                          # user's identifier in
+                                                                                      # authentications class.
+                                                                                      
+    # user.provider_attribute_name = :provider                                        # provider's identifier in
+                                                                                      # authentications class.
+                                                                                      
+    # user.provider_uid_attribute_name = :uid                                         # user's external unique
+                                                                                      # identifier in authentications
+                                                                                      # class.
   end
+
+  # This line must come after the 'user config' block.
+  config.user_class = "User"                                                          # define which model authenticates
+                                                                                      # with sorcery.
 end

data/lib/sorcery/model/adapters/active_record.rb

@@ -11,7 +11,7 @@ module Sorcery
             where("#{@sorcery_config.username_attribute_name} = ?", credentials[0]).first
           end
 
-          def find_by_token(token_attr_name, token)
+          def find_by_sorcery_token(token_attr_name, token)
             where("#{token_attr_name} = ?", token).first
           end
 
@@ -25,4 +25,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -15,11 +15,12 @@ module Sorcery
 
         module ClassMethods
           def find_by_credentials(credentials)
-            where(@sorcery_config.username_attribute_name => credentials[0]).first
+            where(sorcery_config.username_attribute_name => credentials[0]).first
           end
 
           def find_by_provider_and_uid(provider, uid)
-            where(:provider => provider, :uid => uid).first
+            @user_klass ||= ::Sorcery::Controller::Config.user_class.to_s.constantize
+            where(@user_klass.sorcery_config.provider_attribute_name => provider, @user_klass.sorcery_config.provider_uid_attribute_name => uid).first
           end
 
           def find_by_id(id)
@@ -27,25 +28,29 @@ module Sorcery
           end
 
           def find_by_activation_token(token)
-            where(:activation_token => token).first
+            where(sorcery_config.activation_token_attribute_name => token).first
           end
 
           def find_by_remember_me_token(token)
-            where(:remember_me_token => token).first
+            where(sorcery_config.remember_me_token_attribute_name => token).first
           end
 
           def find_by_username(username)
-            where(:username => username).first
+            where(sorcery_config.username_attribute_name => username).first
           end
 
           def transaction(&blk)
             tap(&blk)
           end
 
-          def find_by_token(token_attr_name, token)
+          def find_by_sorcery_token(token_attr_name, token)
             where(token_attr_name => token).first
           end
 
+          def find_by_email(email)
+            where(sorcery_config.email_attribute_name => email).first
+          end
+
           def get_current_users
             config = sorcery_config
             where(config.last_activity_at_attribute_name.ne => nil) \
@@ -56,4 +61,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -3,8 +3,8 @@ module Sorcery
     module Submodules
       # This submodule keeps track of events such as login, logout, and last activity time, per user.
       # It helps in estimating which users are active now in the site.
-      # This cannot be determined absolutely because a user might be reading a page without clicking anything for a while.
-      
+      # This cannot be determined absolutely because a user might be reading a page without clicking anything 
+      # for a while.
       # This is the model part of the submodule, which provides configuration options.
       module ActivityLogging
         def self.included(base)
@@ -14,7 +14,8 @@ module Sorcery
             attr_accessor :last_login_at_attribute_name,                  # last login attribute name.
                           :last_logout_at_attribute_name,                 # last logout attribute name.
                           :last_activity_at_attribute_name,               # last activity attribute name.
-                          :activity_timeout                               # how long since last activity is the user defined logged out?
+                          :activity_timeout                               # how long since last activity is 
+                                                                          #the user defined logged out?
           end
           
           base.sorcery_config.instance_eval do
@@ -38,9 +39,9 @@ module Sorcery
           protected
 
           def define_activity_logging_mongoid_fields
-            field sorcery_config.last_login_at_attribute_name, type: DateTime
-            field sorcery_config.last_logout_at_attribute_name, type: DateTime
-            field sorcery_config.last_activity_at_attribute_name, type: DateTime
+            field sorcery_config.last_login_at_attribute_name,    :type => DateTime
+            field sorcery_config.last_logout_at_attribute_name,   :type => DateTime
+            field sorcery_config.last_activity_at_attribute_name, :type => DateTime
           end
         end
       end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -1,15 +1,19 @@
 module Sorcery
   module Model
     module Submodules
-      # This module helps protect user accounts by locking them down after too many failed attemps to login were detected.
-      # This is the model part of the submodule which provides configuration options and methods for locking and unlocking the user.
+      # This module helps protect user accounts by locking them down after too many failed attemps 
+      # to login were detected.
+      # This is the model part of the submodule which provides configuration options and methods 
+      # for locking and unlocking the user.
       module BruteForceProtection
         def self.included(base)
           base.sorcery_config.class_eval do
             attr_accessor :failed_logins_count_attribute_name,        # failed logins attribute name.
-                          :lock_expires_at_attribute_name,            # this field indicates whether user is banned and when it will be active again.
+                          :lock_expires_at_attribute_name,            # this field indicates whether user 
+                                                                      # is banned and when it will be active again.
                           :consecutive_login_retries_amount_limit,    # how many failed logins allowed.
-                          :login_lock_time_period                     # how long the user should be banned. in seconds. 0 for permanent.
+                          :login_lock_time_period                     # how long the user should be banned. 
+                                                                      # in seconds. 0 for permanent.
           end
           
           base.sorcery_config.instance_eval do
@@ -30,8 +34,8 @@ module Sorcery
           protected
 
           def define_brute_force_protection_mongoid_fields
-            field sorcery_config.failed_logins_count_attribute_name, type: Integer
-            field sorcery_config.lock_expires_at_attribute_name, type: DateTime
+            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer
+            field sorcery_config.lock_expires_at_attribute_name,      :type => DateTime
           end
         end
         

data/lib/sorcery/model/submodules/external.rb

@@ -5,9 +5,11 @@ module Sorcery
       # This is the model part which handles finding the user using access tokens.
       # For the controller options see Sorcery::Controller::External.
       #
-      # Socery assumes (read: requires) you will create external users in the same table where you keep your regular users,
+      # Socery assumes (read: requires) you will create external users in the same table where
+      # you keep your regular users,
       # but that you will have a separate table for keeping their external authentication data,
-      # and that that separate table has a few rows for each user, facebook and twitter for example (a one-to-many relationship).
+      # and that that separate table has a few rows for each user, facebook and twitter 
+      # for example (a one-to-many relationship).
       #
       # External users will have a null crypted_password field, since we do not hold their password.
       # They will not be sent activation emails on creation.

data/lib/sorcery/model/submodules/remember_me.rb

@@ -1,7 +1,8 @@
 module Sorcery
   module Model
     module Submodules
-      # The Remember Me submodule takes care of setting the user's cookie so that he will be automatically logged in to the site on every visit,
+      # The Remember Me submodule takes care of setting the user's cookie so that he will 
+      # be automatically logged in to the site on every visit,
       # until the cookie expires.
       module RememberMe
         def self.included(base)
@@ -31,8 +32,8 @@ module Sorcery
           protected
 
           def define_remember_me_mongoid_fields
-            field sorcery_config.remember_me_token_attribute_name, type: String
-            field sorcery_config.remember_me_token_expires_at_attribute_name, type: DateTime
+            field sorcery_config.remember_me_token_attribute_name,            :type => String
+            field sorcery_config.remember_me_token_expires_at_attribute_name, :type => Time
           end
 
         end

data/lib/sorcery/model/submodules/reset_password.rb

@@ -5,7 +5,8 @@ module Sorcery
       # When the user requests an email is sent to him with a url.
       # The url includes a token, which is also saved with the user's record in the db.
       # The token has configurable expiration.
-      # When the user clicks the url in the email, providing the token has not yet expired, he will be able to reset his password via a form.
+      # When the user clicks the url in the email, providing the token has not yet expired,
+      # he will be able to reset his password via a form.
       #
       # When using this submodule, supplying a mailer is mandatory.
       module ResetPassword       
@@ -13,11 +14,18 @@ module Sorcery
           base.sorcery_config.class_eval do
             attr_accessor :reset_password_token_attribute_name,              # reset password code attribute name.
                           :reset_password_token_expires_at_attribute_name,   # expires at attribute name.
-                          :reset_password_email_sent_at_attribute_name,      # when was email sent, used for hammering protection.
+                          :reset_password_email_sent_at_attribute_name,      # when was email sent, used for hammering
+                                                                             # protection.
+                                                                             
                           :reset_password_mailer,                            # mailer class. Needed.
-                          :reset_password_email_method_name,                 # reset password email method on your mailer class.
-                          :reset_password_expiration_period,                 # how many seconds before the reset request expires. nil for never expires.
-                          :reset_password_time_between_emails                # hammering protection, how long to wait before allowing another email to be sent.
+                          :reset_password_email_method_name,                 # reset password email method on your
+                                                                             # mailer class.
+                                                                             
+                          :reset_password_expiration_period,                 # how many seconds before the reset request
+                                                                             # expires. nil for never expires.
+                                                                             
+                          :reset_password_time_between_emails                # hammering protection, how long to wait
+                                                                             # before allowing another email to be sent.
 
           end
           
@@ -32,11 +40,12 @@ module Sorcery
 
             reset!
           end
-          
+
+          base.extend(ClassMethods)
+
           base.sorcery_config.after_config << :validate_mailer_defined
           base.sorcery_config.after_config << :define_reset_password_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
 
-          base.extend(ClassMethods)
           base.send(:include, TemporaryToken)
           base.send(:include, InstanceMethods)
 
@@ -60,9 +69,9 @@ module Sorcery
           end
 
           def define_reset_password_mongoid_fields
-            field sorcery_config.reset_password_token_attribute_name, type: String
-            field sorcery_config.reset_password_token_expires_at_attribute_name, type: DateTime
-            field sorcery_config.reset_password_email_sent_at_attribute_name, type: DateTime
+            field sorcery_config.reset_password_token_attribute_name,             :type => String
+            field sorcery_config.reset_password_token_expires_at_attribute_name,  :type => DateTime
+            field sorcery_config.reset_password_email_sent_at_attribute_name,     :type => DateTime
           end
         end
         
@@ -84,7 +93,8 @@ module Sorcery
           # Clears token and tries to update the new password for the user.
           def change_password!(new_password)
             clear_reset_password_token
-            update_attributes(sorcery_config.password_attribute_name => new_password)
+            self.send(:"#{sorcery_config.password_attribute_name}=", new_password)
+            save
           end
 
           protected

data/lib/sorcery/model/submodules/user_activation.rb

@@ -8,14 +8,27 @@ module Sorcery
       module UserActivation
         def self.included(base)
           base.sorcery_config.class_eval do
-            attr_accessor :activation_state_attribute_name,               # the attribute name to hold activation state (active/pending).
-                          :activation_token_attribute_name,               # the attribute name to hold activation code (sent by email).
-                          :activation_token_expires_at_attribute_name,    # the attribute name to hold activation code expiration date. 
-                          :activation_token_expiration_period,            # how many seconds before the activation code expires. nil for never expires.
+            attr_accessor :activation_state_attribute_name,               # the attribute name to hold activation state
+                                                                          # (active/pending).
+                                                                          
+                          :activation_token_attribute_name,               # the attribute name to hold activation code
+                                                                          # (sent by email).
+                                                                          
+                          :activation_token_expires_at_attribute_name,    # the attribute name to hold activation code
+                                                                          # expiration date. 
+                                                                          
+                          :activation_token_expiration_period,            # how many seconds before the activation code
+                                                                          # expires. nil for never expires.
+                                                                          
                           :user_activation_mailer,                        # your mailer class. Required.
-                          :activation_needed_email_method_name,           # activation needed email method on your mailer class.
-                          :activation_success_email_method_name,          # activation success email method on your mailer class.
-                          :prevent_non_active_users_to_login              # do you want to prevent or allow users that did not activate by email to login?
+                          :activation_needed_email_method_name,           # activation needed email method on your
+                                                                          # mailer class.
+                                                                          
+                          :activation_success_email_method_name,          # activation success email method on your
+                                                                          # mailer class.
+                                                                          
+                          :prevent_non_active_users_to_login              # do you want to prevent or allow users that
+                                                                          # did not activate by email to login?
           end
           
           base.sorcery_config.instance_eval do
@@ -67,9 +80,9 @@ module Sorcery
 
           def define_user_activation_mongoid_fields
             self.class_eval do
-              field sorcery_config.activation_state_attribute_name, type: String
-              field sorcery_config.activation_token_attribute_name, type: String
-              field sorcery_config.activation_token_expires_at_attribute_name, type: DateTime
+              field sorcery_config.activation_state_attribute_name,            :type => String
+              field sorcery_config.activation_token_attribute_name,            :type => String
+              field sorcery_config.activation_token_expires_at_attribute_name, :type => DateTime
             end
           end
         end

data/lib/sorcery/model/temporary_token.rb

@@ -1,7 +1,8 @@
 module Sorcery
   module Model
     # This module encapsulates the logic for temporary token.
-    # A temporary token is created to identify a user in scenarios such as reseting password and activating the user by email.
+    # A temporary token is created to identify a user in scenarios 
+    # such as reseting password and activating the user by email.
     module TemporaryToken
       def self.included(base)
         base.extend(ClassMethods)
@@ -10,7 +11,7 @@ module Sorcery
       module ClassMethods
         def load_from_token(token, token_attr_name, token_expiration_date_attr)
           return nil if token.blank?
-          user = find_by_token(token_attr_name,token)
+          user = find_by_sorcery_token(token_attr_name,token)
           if !user.blank? && !user.send(token_expiration_date_attr).nil?
             return Time.now.utc < user.send(token_expiration_date_attr) ? user : nil
           end