sorcery 0.6.0 → 0.7.0

data/Gemfile

@@ -2,8 +2,8 @@ source "http://rubygems.org"
 # Add dependencies required to use your gem here.
 # Example:
 #   gem "activesupport", ">= 2.3.5"
-gem 'oauth', ">= 0.4.4"
-gem 'oauth2', ">= 0.1.1"
+gem 'oauth', "~> 0.4.4"
+gem 'oauth2', "~> 0.5.1"
 
 # Add dependencies to develop your gem here.
 # Include everything needed to run rake, tests, features, etc.

data/Gemfile.lock

@@ -1,100 +1,108 @@
 GEM
   remote: http://rubygems.org/
   specs:
-    abstract (1.0.0)
-    actionmailer (3.0.3)
-      actionpack (= 3.0.3)
-      mail (~> 2.2.9)
-    actionpack (3.0.3)
-      activemodel (= 3.0.3)
-      activesupport (= 3.0.3)
-      builder (~> 2.1.2)
-      erubis (~> 2.6.6)
-      i18n (~> 0.4)
-      rack (~> 1.2.1)
-      rack-mount (~> 0.6.13)
-      rack-test (~> 0.5.6)
-      tzinfo (~> 0.3.23)
-    activemodel (3.0.3)
-      activesupport (= 3.0.3)
-      builder (~> 2.1.2)
-      i18n (~> 0.4)
-    activerecord (3.0.3)
-      activemodel (= 3.0.3)
-      activesupport (= 3.0.3)
-      arel (~> 2.0.2)
-      tzinfo (~> 0.3.23)
-    activeresource (3.0.3)
-      activemodel (= 3.0.3)
-      activesupport (= 3.0.3)
-    activesupport (3.0.3)
-    addressable (2.2.4)
+    actionmailer (3.1.0)
+      actionpack (= 3.1.0)
+      mail (~> 2.3.0)
+    actionpack (3.1.0)
+      activemodel (= 3.1.0)
+      activesupport (= 3.1.0)
+      builder (~> 3.0.0)
+      erubis (~> 2.7.0)
+      i18n (~> 0.6)
+      rack (~> 1.3.2)
+      rack-cache (~> 1.0.3)
+      rack-mount (~> 0.8.2)
+      rack-test (~> 0.6.1)
+      sprockets (~> 2.0.0)
+    activemodel (3.1.0)
+      activesupport (= 3.1.0)
+      bcrypt-ruby (~> 3.0.0)
+      builder (~> 3.0.0)
+      i18n (~> 0.6)
+    activerecord (3.1.0)
+      activemodel (= 3.1.0)
+      activesupport (= 3.1.0)
+      arel (~> 2.2.1)
+      tzinfo (~> 0.3.29)
+    activeresource (3.1.0)
+      activemodel (= 3.1.0)
+      activesupport (= 3.1.0)
+    activesupport (3.1.0)
+      multi_json (~> 1.0)
+    addressable (2.2.6)
     archive-tar-minitar (0.5.2)
-    arel (2.0.6)
-    bson (1.3.0)
-    bson_ext (1.3.0)
-    builder (2.1.2)
-    columnize (0.3.2)
-    diff-lcs (1.1.2)
-    erubis (2.6.6)
-      abstract (>= 1.0.0)
-    faraday (0.5.5)
-      addressable (~> 2.2.4)
+    arel (2.2.1)
+    bcrypt-ruby (3.0.0)
+    bson (1.3.1)
+    bson_ext (1.3.1)
+    builder (3.0.0)
+    columnize (0.3.4)
+    diff-lcs (1.1.3)
+    erubis (2.7.0)
+    faraday (0.7.4)
+      addressable (~> 2.2.6)
       multipart-post (~> 1.1.0)
       rack (< 2, >= 1.1.0)
     git (1.2.5)
-    i18n (0.5.0)
+    hike (1.2.1)
+    i18n (0.6.0)
     jeweler (1.5.2)
       bundler (~> 1.0.0)
       git (>= 1.2.5)
       rake
-    json (1.5.1)
-    linecache19 (0.5.11)
+    json (1.5.4)
+    linecache19 (0.5.12)
       ruby_core_source (>= 0.1.4)
-    mail (2.2.13)
-      activesupport (>= 2.3.6)
+    mail (2.3.0)
       i18n (>= 0.4.0)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
     mime-types (1.16)
-    mongo (1.3.0)
-      bson (>= 1.3.0)
-    mongoid (2.0.1)
+    mongo (1.3.1)
+      bson (>= 1.3.1)
+    mongoid (2.2.0)
       activemodel (~> 3.0)
       mongo (~> 1.3)
       tzinfo (~> 0.3.22)
-      will_paginate (~> 3.0.pre)
-    multi_json (0.0.5)
-    multipart-post (1.1.0)
-    oauth (0.4.4)
-    oauth2 (0.1.1)
-      faraday (~> 0.5.0)
-      multi_json (~> 0.0.4)
-    polyglot (0.3.1)
-    rack (1.2.1)
-    rack-mount (0.6.13)
+    multi_json (1.0.3)
+    multipart-post (1.1.3)
+    oauth (0.4.5)
+    oauth2 (0.5.1)
+      faraday (~> 0.7.4)
+      multi_json (~> 1.0.3)
+    polyglot (0.3.2)
+    rack (1.3.3)
+    rack-cache (1.0.3)
+      rack (>= 0.4)
+    rack-mount (0.8.3)
       rack (>= 1.0.0)
-    rack-test (0.5.6)
+    rack-ssl (1.3.2)
+      rack
+    rack-test (0.6.1)
       rack (>= 1.0)
-    rails (3.0.3)
-      actionmailer (= 3.0.3)
-      actionpack (= 3.0.3)
-      activerecord (= 3.0.3)
-      activeresource (= 3.0.3)
-      activesupport (= 3.0.3)
+    rails (3.1.0)
+      actionmailer (= 3.1.0)
+      actionpack (= 3.1.0)
+      activerecord (= 3.1.0)
+      activeresource (= 3.1.0)
+      activesupport (= 3.1.0)
       bundler (~> 1.0)
-      railties (= 3.0.3)
-    railties (3.0.3)
-      actionpack (= 3.0.3)
-      activesupport (= 3.0.3)
+      railties (= 3.1.0)
+    railties (3.1.0)
+      actionpack (= 3.1.0)
+      activesupport (= 3.1.0)
+      rack-ssl (~> 1.3.2)
       rake (>= 0.8.7)
-      thor (~> 0.14.4)
-    rake (0.8.7)
+      rdoc (~> 3.4)
+      thor (~> 0.14.6)
+    rake (0.9.2)
+    rdoc (3.9.4)
     rspec (2.5.0)
       rspec-core (~> 2.5.0)
       rspec-expectations (~> 2.5.0)
       rspec-mocks (~> 2.5.0)
-    rspec-core (2.5.1)
+    rspec-core (2.5.2)
     rspec-expectations (2.5.0)
       diff-lcs (~> 1.1.2)
     rspec-mocks (2.5.0)
@@ -103,7 +111,7 @@ GEM
       activesupport (~> 3.0)
       railties (~> 3.0)
       rspec (~> 2.5.0)
-    ruby-debug-base19 (0.11.24)
+    ruby-debug-base19 (0.11.25)
       columnize (>= 0.3.1)
       linecache19 (>= 0.5.11)
       ruby_core_source (>= 0.1.4)
@@ -111,19 +119,26 @@ GEM
       columnize (>= 0.3.1)
       linecache19 (>= 0.5.11)
       ruby-debug-base19 (>= 0.11.19)
-    ruby_core_source (0.1.4)
+    ruby_core_source (0.1.5)
       archive-tar-minitar (>= 0.5.2)
-    simplecov (0.3.9)
-      simplecov-html (>= 0.3.7)
-    simplecov-html (0.3.9)
-    sqlite3-ruby (1.3.2)
+    simplecov (0.4.2)
+      simplecov-html (~> 0.4.4)
+    simplecov-html (0.4.5)
+    sprockets (2.0.0)
+      hike (~> 1.2)
+      rack (~> 1.0)
+      tilt (!= 1.3.0, ~> 1.1)
+    sqlite3 (1.3.4)
+    sqlite3-ruby (1.3.3)
+      sqlite3 (>= 1.3.3)
     thor (0.14.6)
+    tilt (1.3.3)
     timecop (0.3.5)
-    treetop (1.4.9)
+    treetop (1.4.10)
+      polyglot
       polyglot (>= 0.3.1)
-    tzinfo (0.3.23)
-    will_paginate (3.0.pre2)
-    yard (0.6.4)
+    tzinfo (0.3.29)
+    yard (0.6.8)
 
 PLATFORMS
   ruby
@@ -134,8 +149,8 @@ DEPENDENCIES
   jeweler (~> 1.5.2)
   json (>= 1.5.1)
   mongoid (~> 2.0)
-  oauth (>= 0.4.4)
-  oauth2 (>= 0.1.1)
+  oauth (~> 0.4.4)
+  oauth2 (~> 0.5.1)
   rails (>= 3.0.0)
   rspec (~> 2.5.0)
   rspec-rails (~> 2.5.0)

data/README.rdoc

@@ -5,7 +5,7 @@ Supports ActiveRecord and Mongoid.
 Inspired by restful_authentication, Authlogic and Devise.
 Crypto code taken almost unchanged from Authlogic.
 OAuth code inspired by OmniAuth and Ryan Bates's railscasts about it.
-
+ 
 
 == Philosophy
 
@@ -24,12 +24,13 @@ Hopefully, I've achieved this. If not, let me know.
 
 == Useful Links:
 
+Railscast: http://railscasts.com/episodes/283-authentication-with-sorcery
 
 Example Rails 3 app using sorcery: https://github.com/NoamB/sorcery-example-app
 
 Example Sinatra app using sorcery: https://github.com/NoamB/sorcery-example-app-sinatra
 
-Documentation: http://rubydoc.info/gems/sorcery/0.6.0/frames
+Documentation: http://rubydoc.info/gems/sorcery/0.7.0/frames
 
 Check out the tutorials in the github wiki!
 
@@ -42,9 +43,10 @@ Below is a summary of the library methods. Most method names are self explaining
   # core
   require_login # this is a before filter
   login(username,password,remember_me = false)
+  auto_login(user)# login without credentials
   logout
-  logged_in?
-  current_user
+  logged_in?      # available to view
+  current_user    # available to view
   redirect_back_or_to # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
   @user.external? # external users, such as facebook/twitter etc.
   User.authenticates_with_sorcery!
@@ -61,6 +63,7 @@ Below is a summary of the library methods. Most method names are self explaining
   create_from(provider) # create the user in the local app db.
 
   # remember me
+  auto_login(user, should_remember=false)  # login without credentials, optional remember_me
   remember_me!
   forget_me!
 
@@ -106,6 +109,7 @@ For your convenience, Sorcery includes a migrations generator for Rails, which c
 
   rails g sorcery_migration [list of submodules]
 
+Note: There is no migration for the session_timeout module. 
 For example, for only the core functionality use:
 
   rails g sorcery_migration core
@@ -116,7 +120,12 @@ To generate migrations for both the core AND 'remember_me' submodule:
 
 These migrations use the default fields. You can choose to use these migrations or make your own tables and fields. Sorcery tries not to impose a database structure and naming scheme on your application.
 
+Finally, add sorcery to the the model that you will use for authentication:
 
+    class User < ActiveRecord::Base
+      authenticates_with_sorcery!
+    end
+    
 == Sinatra Configuration:
 
 
@@ -150,6 +159,7 @@ Core (see lib/sorcery/model.rb and lib/sorcery/controller.rb):
 * login/logout, optional return user to requested url on login, configurable redirect for non-logged-in users.
 * password encryption, algorithms: bcrypt(default), md5, sha1, sha256, sha512, aes256, custom(yours!), none. Configurable stretches and salt.
 * configurable attribute names for username, password and email.
+* allow multiple fields to serve as username.
 
 User Activation (see lib/sorcery/model/submodules/user_activation.rb):
 * User activation by email with optional success email.

data/Rakefile

@@ -25,9 +25,9 @@ Jeweler::Tasks.new do |gem|
   # and development dependencies are only needed for development (ie running rake tasks, tests, etc)
   #  gem.add_runtime_dependency 'jabber4r', '> 0.1'
   #  gem.add_development_dependency 'rspec', '> 1.2.3'
-  gem.add_runtime_dependency 'bcrypt-ruby', '~> 2.1.4'
-  gem.add_runtime_dependency 'oauth', '>= 0.4.4'
-  gem.add_runtime_dependency 'oauth2', '>= 0.1.1'
+  gem.add_runtime_dependency 'bcrypt-ruby', '~> 3.0.0'
+  gem.add_runtime_dependency 'oauth', '~> 0.4.4'
+  gem.add_runtime_dependency 'oauth2', '~> 0.5.1'
 end
 Jeweler::RubygemsDotOrgTasks.new
 

data/VERSION

@@ -1 +1 @@
-0.6.0
+0.7.0

data/lib/generators/sorcery_migration/templates/core.rb

@@ -1,7 +1,7 @@
 class SorceryCore < ActiveRecord::Migration
   def self.up
     create_table :users do |t|
-      t.string :username,         :null => false  # if you use another filed as a username, for example email, you can safely remove this field.
+      t.string :username,         :null => false  # if you use another field as a username, for example email, you can safely remove this field.
       t.string :email,            :default => nil # if you use this field as a username, you might want to make it :null => false.
       t.string :crypted_password, :default => nil
       t.string :salt,             :default => nil

data/lib/generators/sorcery_migration/templates/reset_password.rb

@@ -3,9 +3,13 @@ class SorceryResetPassword < ActiveRecord::Migration
     add_column :users, :reset_password_token, :string, :default => nil
     add_column :users, :reset_password_token_expires_at, :datetime, :default => nil
     add_column :users, :reset_password_email_sent_at, :datetime, :default => nil
+    
+    add_index :users, :reset_password_token
   end
 
   def self.down
+    remove_index :users, :reset_password_token
+    
     remove_column :users, :reset_password_email_sent_at
     remove_column :users, :reset_password_token_expires_at
     remove_column :users, :reset_password_token

data/lib/sorcery/controller/adapters/sinatra.rb

@@ -80,15 +80,26 @@ module Sorcery
           def initialize(request, response)
             @request = request
             @response = response
+            @secure = false
           end
 
           def [](key)
-            @request.cookies[key.to_s]
+            value = @request.cookies[key.to_s]
           end
 
           def []=(key, value)
+            if @secure
+              value.merge(:secret => Config.sinatra_cookie_secret)
+              @secure = false
+            end
             @response.set_cookie(key, value)
           end
+          
+          # mark cookie as signed, which will light a flag, which will cause the next set_cookie to be encrypted.
+          def signed
+            @secure = true
+            self
+          end
         end
 
         module ClassMethods

data/lib/sorcery/controller/submodules/activity_logging.rb

@@ -14,6 +14,20 @@ module Sorcery
       module ActivityLogging
         def self.included(base)
           base.send(:include, InstanceMethods)
+          Config.module_eval do
+            class << self
+              attr_accessor :register_login_time
+              attr_accessor :register_logout_time
+              attr_accessor :register_last_activity_time
+            
+              def merge_activity_logging_defaults!
+                @defaults.merge!(:@register_login_time  => true,
+                                 :@register_logout_time => true,
+                                 :@register_last_activity_time => true)
+              end
+            end
+            merge_activity_logging_defaults!
+          end
           Config.after_login << :register_login_time_to_db
           Config.before_logout << :register_logout_time_to_db
           base.after_filter :register_last_activity_time_to_db
@@ -37,6 +51,7 @@ module Sorcery
           # registers last login time on every login.
           # This runs as a hook just after a successful login.
           def register_login_time_to_db(user, credentials)
+            return unless Config.register_login_time
             user.send(:"#{user.sorcery_config.last_login_at_attribute_name}=", Time.now.utc.to_s(:db))
             user.save!(:validate => false)
           end
@@ -44,6 +59,7 @@ module Sorcery
           # registers last logout time on every logout.
           # This runs as a hook just before a logout.
           def register_logout_time_to_db(user)
+            return unless Config.register_logout_time
             user.send(:"#{user.sorcery_config.last_logout_at_attribute_name}=", Time.now.utc.to_s(:db))
             user.save!(:validate => false)
           end
@@ -51,7 +67,8 @@ module Sorcery
           # Updates last activity time on every request.
           # The only exception is logout - we do not update activity on logout
           def register_last_activity_time_to_db
-            return if !logged_in?
+            return unless Config.register_last_activity_time
+            return unless logged_in?
             current_user.send(:"#{current_user.sorcery_config.last_activity_at_attribute_name}=", Time.now.utc.to_s(:db))
             current_user.save!(:validate => false)
           end

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -29,7 +29,8 @@ module Sorcery
           # Resets the failed logins counter.
           # Runs as a hook after a successful login.
           def reset_failed_logins_count!(user, credentials)
-            user.update_attributes!(user_class.sorcery_config.failed_logins_count_attribute_name => 0)
+            user.send(:"#{user_class.sorcery_config.failed_logins_count_attribute_name}=", 0)
+            user.save!
           end
         end
       end