sorcery 0.5.1 → 0.6.0

data/README.rdoc

@@ -29,7 +29,7 @@ Example Rails 3 app using sorcery: https://github.com/NoamB/sorcery-example-app
 
 Example Sinatra app using sorcery: https://github.com/NoamB/sorcery-example-app-sinatra
 
-Documentation: http://rubydoc.info/gems/sorcery/0.5.1/frames
+Documentation: http://rubydoc.info/gems/sorcery/0.6.0/frames
 
 Check out the tutorials in the github wiki!
 
@@ -224,6 +224,14 @@ The patch version changes are backward compatible.
 In short, an app that works with x.3.1 should be able to upgrade to x.3.2 with no code changes.
 The same cannot be said about upgrading to x.4.0 and above, however.
 
+== Upgrading
+
+Important notes while upgrading:
+
+* If upgrading from <= v0.5.1 to >= v0.5.2 you need to explicitly set your user_class model in the initializer file.
+
+    # This line must come after the 'user config' block.
+    config.user_class = User
 
 == Contributing to sorcery
 

data/VERSION

@@ -1 +1 @@
-0.5.1
+0.6.0

data/lib/sorcery/controller/adapters/sinatra.rb

@@ -16,7 +16,7 @@ module Sorcery
                   process_route(*arguments) { instance_eval(&block) }
                 end
               end
-              
+
               def after_filter(filter)
                 after do
                   send(filter)
@@ -24,66 +24,73 @@ module Sorcery
               end
             end
           end
-          
+
           ::Sinatra::Request.class_eval do
             def authorization
-              env['HTTP_AUTHORIZATION']   ||
-              env['X-HTTP_AUTHORIZATION'] ||
-              env['X_HTTP_AUTHORIZATION'] ||
-              env['REDIRECT_X_HTTP_AUTHORIZATION'] || nil
+              env['HTTP_AUTHORIZATION'] ||
+                  env['X-HTTP_AUTHORIZATION'] ||
+                  env['X_HTTP_AUTHORIZATION'] ||
+                  env['REDIRECT_X_HTTP_AUTHORIZATION'] || nil
             end
           end
-          
+
+          base.send(:include, SorceryHelpers)
           base.send(:include, InstanceMethods)
           base.extend(ClassMethods)
         end
-        
+
+        module SorceryHelpers
+
+          def request_http_basic_authentication(realm)
+            response.header['WWW-Authenticate'] = %(Basic realm="#{realm}")
+            response.status = 401
+          end
+
+          def authenticate_with_http_basic(&blk)
+            @auth ||= Rack::Auth::Basic::Request.new(request.env)
+            yield @auth.credentials if (@auth.provided? && @auth.basic? && @auth.credentials)
+          end
+
+        end
+
         module InstanceMethods
           def reset_session
             session.clear
           end
-        
+
           def redirect_to(*args)
             args.pop if args.last.is_a?(Hash)
             redirect(*args)
           end
-        
+
           def root_path
             '/'
           end
-          
-          helpers do
-            def request_http_basic_authentication(realm)
-              response.header['WWW-Authenticate'] = %(Basic realm="#{realm}")
-              response.status = 401
-            end
-            
-            def authenticate_with_http_basic(&blk)
-              @auth ||=  Rack::Auth::Basic::Request.new(request.env)
-              yield @auth.credentials if ( @auth.provided? && @auth.basic? && @auth.credentials )
-            end
+
+          ::Sinatra.helpers do
+            include SorceryHelpers
           end
-          
+
           def cookies
-            @cookie_proxy ||= CookieProxy.new(request,response)
+            @cookie_proxy ||= CookieProxy.new(request, response)
           end
         end
-        
+
         class CookieProxy
-          def initialize(request,response)
+          def initialize(request, response)
             @request = request
             @response = response
           end
-          
+
           def [](key)
             @request.cookies[key.to_s]
           end
-          
+
           def []=(key, value)
             @response.set_cookie(key, value)
           end
         end
-        
+
         module ClassMethods
           def prepend_before_filter(filter)
             prepend_filter(:before) do

data/lib/sorcery/controller/submodules/activity_logging.rb

@@ -1,13 +1,16 @@
 module Sorcery
   module Controller
     module Submodules
-      # This submodule keeps track of events such as login, logout, and last activity time, per user.
+      # This submodule keeps track of events such as login, logout, 
+      # and last activity time, per user.
       # It helps in estimating which users are active now in the site.
-      # This cannot be determined absolutely because a user might be reading a page without clicking anything for a while.
-      
-      # This is the controller part of the submodule, which adds hooks to register user events, 
+      # This cannot be determined absolutely because a user might be 
+      # reading a page without clicking anything for a while.
+      # This is the controller part of the submodule, which adds hooks 
+      # to register user events, 
       # and methods to collect active users data for use in the app.
-      # see Socery::Model::Submodules::ActivityLogging for configuration options.
+      # see Socery::Model::Submodules::ActivityLogging for configuration
+      # options.
       module ActivityLogging
         def self.included(base)
           base.send(:include, InstanceMethods)
@@ -19,9 +22,10 @@ module Sorcery
         module InstanceMethods
           # Returns an array of the active users.
           def current_users
-            Config.user_class.current_users
+            user_class.current_users
             # A possible patch here:
-            # we'll add the current_user to the users list if he's not in it (can happen when he was inactive for more than activity timeout):
+            # we'll add the current_user to the users list if he's not in it
+            # (can happen when he was inactive for more than activity timeout):
             #
             #   users.unshift!(current_user) if logged_in? && users.find {|u| u.id == current_user.id}.nil?
             #

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -1,9 +1,12 @@
 module Sorcery
   module Controller
     module Submodules
-      # This module helps protect user accounts by locking them down after too many failed attemps to login were detected.
-      # This is the controller part of the submodule which takes care of updating the failed logins and resetting them.
-      # See Sorcery::Model::Submodules::BruteForceProtection for configuration options.
+      # This module helps protect user accounts by locking them down after too
+      # many failed attemps to login were detected.
+      # This is the controller part of the submodule which takes care of
+      # updating the failed logins and resetting them.
+      # See Sorcery::Model::Submodules::BruteForceProtection for configuration
+      # options.
       module BruteForceProtection
         def self.included(base)
           base.send(:include, InstanceMethods)
@@ -19,14 +22,14 @@ module Sorcery
           # Increments the failed logins counter on every failed login.
           # Runs as a hook after a failed login.
           def update_failed_logins_count!(credentials)
-            user = Config.user_class.find_by_credentials(credentials)
+            user = user_class.find_by_credentials(credentials)
             user.register_failed_login! if user
           end
           
           # Resets the failed logins counter.
           # Runs as a hook after a successful login.
           def reset_failed_logins_count!(user, credentials)
-            user.update_attributes!(Config.user_class.sorcery_config.failed_logins_count_attribute_name => 0)
+            user.update_attributes!(user_class.sorcery_config.failed_logins_count_attribute_name => 0)
           end
         end
       end

data/lib/sorcery/controller/submodules/external.rb

@@ -43,7 +43,7 @@ module Sorcery
             @provider = Config.send(provider)
             @provider.process_callback(params,session)
             @user_hash = @provider.get_user_hash
-            if user = Config.user_class.load_from_provider(provider,@user_hash[:uid])
+            if user = user_class.load_from_provider(provider,@user_hash[:uid])
               reset_session
               login_user(user)
               user
@@ -65,14 +65,19 @@ module Sorcery
             provider = provider.to_sym
             @provider = Config.send(provider)
             @user_hash = @provider.get_user_hash
-            config = Config.user_class.sorcery_config
+            config = user_class.sorcery_config
             attrs = {}
             @provider.user_info_mapping.each do |k,v|
-              (varr = v.split("/")).size > 1 ? attrs.merge!(k => varr.inject(@user_hash[:user_info]) {|hsh,v| hsh[v] }) : attrs.merge!(k => @user_hash[:user_info][v])
+              if (varr = v.split("/")).size > 1
+                attribute_value = varr.inject(@user_hash[:user_info]) {|hsh,v| hsh[v] } rescue nil
+                attribute_value.nil? ? attrs : attrs.merge!(k => attribute_value)
+              else
+                attrs.merge!(k => @user_hash[:user_info][v])
+              end
             end
-            Config.user_class.transaction do
-              @user = Config.user_class.create!(attrs)
-              Config.user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider, config.provider_uid_attribute_name => @user_hash[:uid]})
+            user_class.transaction do
+              @user = user_class.create!(attrs)
+              user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider, config.provider_uid_attribute_name => @user_hash[:uid]})
             end
             @user
           end

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -2,8 +2,10 @@ module Sorcery
   module Controller
     module Submodules
       # This submodule integrates HTTP Basic authentication into sorcery.
-      # You are provided with a before filter, require_login_from_http_basic, which requests the browser for authentication.
-      # Then the rest of the submodule takes care of logging the user in into the session, so that the next requests will keep him logged in.
+      # You are provided with a before filter, require_login_from_http_basic, 
+      # which requests the browser for authentication.
+      # Then the rest of the submodule takes care of logging the user in 
+      # into the session, so that the next requests will keep him logged in.
       module HttpBasicAuth
         def self.included(base)
           base.send(:include, InstanceMethods)
@@ -21,16 +23,19 @@ module Sorcery
         end
         
         module InstanceMethods
-          
+
           protected
           
           # to be used as a before_filter.
           # The method sets a session when requesting the user's credentials.
           # This is a trick to overcome the way HTTP authentication works (explained below):
           #
-          # Once the user fills the credentials once, the browser will always send it to the server when visiting the website, until the browser is closed.
-          # This causes wierd behaviour if the user logs out. The session is reset, yet the user is re-logged in by the before_filter calling 'login_from_basic_auth'.
-          # To overcome this, we set a session when requesting the password, which logout will reset, and that's how we know if we need to request for HTTP auth again.
+          # Once the user fills the credentials once, the browser will always send it to the 
+          # server when visiting the website, until the browser is closed.
+          # This causes wierd behaviour if the user logs out. The session is reset, yet the 
+          # user is re-logged in by the before_filter calling 'login_from_basic_auth'.
+          # To overcome this, we set a session when requesting the password, which logout will
+          # reset, and that's how we know if we need to request for HTTP auth again.
           def require_login_from_http_basic
             (request_http_basic_authentication(realm_name_by_controller) and (session[:http_authentication_used] = true) and return) if (request.authorization.nil? || session[:http_authentication_used].nil?)
             require_login
@@ -40,7 +45,7 @@ module Sorcery
           # given to main controller module as a login source callback
           def login_from_basic_auth
             authenticate_with_http_basic do |username, password|
-              @current_user = (Config.user_class.authenticate(username, password) if session[:http_authentication_used]) || false
+              @current_user = (user_class.authenticate(username, password) if session[:http_authentication_used]) || false
               login_user(@current_user) if @current_user
               @current_user
             end

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -1,7 +1,8 @@
 module Sorcery
   module Controller
     module Submodules
-      # The Remember Me submodule takes care of setting the user's cookie so that he will be automatically logged in to the site on every visit,
+      # The Remember Me submodule takes care of setting the user's cookie so that he will 
+      # be automatically logged in to the site on every visit,
       # until the cookie expires.
       # See Sorcery::Model::Submodules::RememberMe for configuration options.
       module RememberMe
@@ -16,7 +17,7 @@ module Sorcery
           # This method sets the cookie and calls the user to save the token and the expiration to db.
           def remember_me!
             current_user.remember_me!
-            cookies[:remember_me_token] = { :value => current_user.remember_me_token, :expires => current_user.remember_me_token_expires_at }        
+            set_remember_me_cookie!(current_user)      
           end
 
           # Clears the cookie and clears the token from the db.
@@ -33,17 +34,25 @@ module Sorcery
             remember_me! if credentials.size == 3 && credentials[2]
           end
           
-          # Checks the cookie for a remember me token, tried to find a user with that token and logs the user in if found.
+          # Checks the cookie for a remember me token, tried to find a user with that token 
+          # and logs the user in if found.
           # Runs as a login source. See 'current_user' method for how it is used.
           def login_from_cookie
-            user = cookies[:remember_me_token] && Config.user_class.find_by_remember_me_token(cookies[:remember_me_token])
+            user = cookies[:remember_me_token] && user_class.find_by_remember_me_token(cookies[:remember_me_token])
             if user && user.remember_me_token?
-              cookies[:remember_me_token] = { :value => user.remember_me_token, :expires => user.remember_me_token_expires_at }
+              set_remember_me_cookie!(user)
               @current_user = user
             else
               @current_user = false
             end
           end
+          
+          def set_remember_me_cookie!(user)
+            cookies[:remember_me_token] = { 
+              :value => user.send(user.sorcery_config.remember_me_token_attribute_name), 
+              :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name)
+            }
+          end
         end
 
       end

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -9,7 +9,9 @@ module Sorcery
           Config.module_eval do
             class << self
               attr_accessor :session_timeout,                     # how long in seconds to keep the session alive.
-                            :session_timeout_from_last_action     # use the last action as the beginning of session timeout.
+              
+                            :session_timeout_from_last_action     # use the last action as the beginning of session
+                                                                  # timeout.
                             
               def merge_session_timeout_defaults!
                 @defaults.merge!(:@session_timeout                      => 3600, # 1.hour

data/lib/sorcery/controller.rb

@@ -29,7 +29,7 @@ module Sorcery
       # Takes credentials and returns a user on successful authentication.
       # Runs hooks after login or failed login.
       def login(*credentials)
-        user = Config.user_class.authenticate(*credentials)
+        user = user_class.authenticate(*credentials)
         if user
           return_to_url = session[:return_to_url]
           reset_session # protect from session fixation attacks
@@ -62,7 +62,8 @@ module Sorcery
         @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
       end
       
-      # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
+      # used when a user tries to access a page while logged out, is asked to login, 
+      # and we want to return him back to the page he originally wanted.
       def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
       end
@@ -90,7 +91,7 @@ module Sorcery
       end
       
       def login_from_session
-        @current_user = (Config.user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
+        @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
       end
       
       def after_login!(user, credentials)
@@ -109,25 +110,27 @@ module Sorcery
         Config.after_logout.each {|c| self.send(c)}
       end
       
+      def user_class
+        @user_class ||= Config.user_class.to_s.constantize
+      end
     end
     
     module Config
       class << self
         attr_accessor :submodules,
-        
-                      :user_class,                    # what class to use as the user class. Set automatically when you call authenticates_with_sorcery! in the User class.
-                      
+                      :user_class,                    # what class to use as the user class. 
                       :not_authenticated_action,      # what controller action to call for non-authenticated users.
                       
-                      :save_return_to_url,            # when a non logged in user tries to enter a page that requires login, save the URL he wanted to reach, 
+                      :save_return_to_url,            # when a non logged in user tries to enter a page that requires
+                                                      # login, save the URL he wanted to reach, 
                                                       # and send him there after login.
                       
                       :login_sources,
                       :after_login,
                       :after_failed_login,
                       :before_logout,
-                      :after_logout                      
-                      
+                      :after_logout             
+        
         def init!
           @defaults = {
             :@user_class                           => nil,

data/lib/sorcery/crypto_providers/aes256.rb

@@ -2,18 +2,21 @@ require "openssl"
 
 module Sorcery
   module CryptoProviders
-    # This encryption method is reversible if you have the supplied key. So in order to use this encryption method you must supply it with a key first.
+    # This encryption method is reversible if you have the supplied key. 
+    # So in order to use this encryption method you must supply it with a key first.
     # In an initializer, or before your application initializes, you should do the following:
     #
     #   Sorcery::Model::ConfigAES256.key = "my 32 bytes long key"
     #
-    # My final comment is that this is a strong encryption method, but its main weakness is that its reversible. If you do not need to reverse the hash
+    # My final comment is that this is a strong encryption method, 
+    # but its main weakness is that its reversible. If you do not need to reverse the hash
     # then you should consider Sha512 or BCrypt instead.
     #
     # Keep your key in a safe place, some even say the key should be stored on a separate server.
-    # This won't hurt performance because the only time it will try and access the key on the separate server is during initialization, which only
-    # happens once. The reasoning behind this is if someone does compromise your server they won't have the key also. Basically, you don't want to
-    # store the key with the lock.
+    # This won't hurt performance because the only time it will try and access the key on the 
+    # separate server is during initialization, which only
+    # happens once. The reasoning behind this is if someone does compromise your server they 
+    # won't have the key also. Basically, you don't want to store the key with the lock.
     class AES256
       class << self
         attr_writer :key

data/lib/sorcery/crypto_providers/bcrypt.rb

@@ -2,9 +2,12 @@ require 'bcrypt'
 
 module Sorcery
   module CryptoProviders
-    # For most apps Sha512 is plenty secure, but if you are building an app that stores nuclear launch codes you might want to consier BCrypt. This is an extremely
-    # secure hashing algorithm, mainly because it is slow. A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a
-    # password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this, generating a password takes exponentially longer than any
+    # For most apps Sha512 is plenty secure, but if you are building an app that stores nuclear 
+    # launch codes you might want to consier BCrypt. This is an extremely
+    # secure hashing algorithm, mainly because it is slow. 
+    # A brute force attack on a BCrypt encrypted password would take much longer than a brute force attack on a
+    # password encrypted with a Sha algorithm. Keep in mind you are sacrificing performance by using this,
+    # generating a password takes exponentially longer than any
     # of the Sha algorithms. I did some benchmarking to save you some time with your decision:
     #
     #   require "bcrypt"
@@ -37,8 +40,10 @@ module Sorcery
     # You are good to go!
     class BCrypt
       class << self
-        # This is the :cost option for the BCrpyt library. The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
-        # Set this to whatever you want, play around with it to get that perfect balance between security and performance.
+        # This is the :cost option for the BCrpyt library. 
+        # The higher the cost the more secure it is and the longer is take the generate a hash. By default this is 10.
+        # Set this to whatever you want, play around with it to get that perfect balance between 
+        # security and performance.
         def cost
           @cost ||= 10
         end
@@ -57,7 +62,8 @@ module Sorcery
           hash == join_tokens(tokens)
         end
         
-        # This method is used as a flag to tell Sorcery to "resave" the password upon a successful login, using the new cost
+        # This method is used as a flag to tell Sorcery to "resave" the password 
+        # upon a successful login, using the new cost
         def cost_matches?(hash)
           hash = new_from_hash(hash)
           if hash.nil? || hash == {}

data/lib/sorcery/crypto_providers/sha256.rb

@@ -1,7 +1,8 @@
 require "digest/sha2"
 
 module Sorcery
-  # The activate_sorcery method has a custom_crypto_provider configuration option. This allows you to use any type of encryption you like.
+  # The activate_sorcery method has a custom_crypto_provider configuration option. 
+  # This allows you to use any type of encryption you like.
   # Just create a class with a class level encrypt and matches? method. See example below.
   #
   # === Example

data/lib/sorcery/crypto_providers/sha512.rb

@@ -1,7 +1,8 @@
 require "digest/sha2"
 
 module Sorcery
-  # The activate_sorcery method has a custom_crypto_provider configuration option. This allows you to use any type of encryption you like.
+  # The activate_sorcery method has a custom_crypto_provider configuration option. 
+  # This allows you to use any type of encryption you like.
   # Just create a class with a class level encrypt and matches? method. See example below.
   #
   # === Example

data/lib/sorcery/engine.rb

@@ -12,13 +12,6 @@ module Sorcery
       ActionController::Base.helper_method :current_user
     end
     
-    initializer "attempt to preload user model" do |app|
-      begin
-        require Rails.root + "app/models/user.rb"
-      rescue LoadError
-      end
-    end
-    
     rake_tasks do
       load "sorcery/railties/tasks.rake"
     end