sorcery 0.6.0 → 0.7.0

data/lib/sorcery/controller/submodules/external/protocols/oauth2.rb

@@ -9,18 +9,22 @@ module Sorcery
               "2.0"
             end
           
-            def authorize_url(*args)
-              client = ::OAuth2::Client.new(@key, @secret, :site => @site)
-              client.web_server.authorize_url(:redirect_uri => @callback_url, :scope => @scope)
+            def authorize_url(options = {})
+              defaults = {
+                  :site => @site,
+                  :ssl => { :ca_file => Config.ca_file }
+              }
+              client = ::OAuth2::Client.new(@key, @secret, defaults.merge!(options))
+              client.authorize_url(:redirect_uri => @callback_url, :scope => @scope)
             end
           
             def get_access_token(args)
-              client = ::OAuth2::Client.new(@key, @secret, :site => @site)
-              client.web_server.get_access_token(args[:code], :redirect_uri => @callback_url)
+              client = ::OAuth2::Client.new(@key, @secret, :site => @site, :ssl => { :ca_file => Config.ca_file })
+              client.get_token(args[:code], :redirect_uri => @callback_url)
             end
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/controller/submodules/external/providers/github.rb

@@ -0,0 +1,80 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module External
+        module Providers
+          # This module adds support for OAuth with github.com.
+          # When included in the 'config.providers' option, it adds a new option, 'config.github'.
+          # Via this new option you can configure Github specific settings like your app's key and secret.
+          #
+          #   config.github.key = <key>
+          #   config.github.secret = <secret>
+          #   ...
+          #
+          module Github
+            def self.included(base)
+              base.module_eval do
+                class << self
+                  attr_reader :github                           # access to github_client.
+
+                  def merge_github_defaults!
+                    @defaults.merge!(:@github => GithubClient)
+                  end
+                end
+                merge_github_defaults!
+                update!
+              end
+            end
+
+            module GithubClient
+              class << self
+                attr_accessor :key,
+                              :secret,
+                              :callback_url,
+                              :site,
+                              :user_info_path,
+                              :user_info_mapping
+
+                include Protocols::Oauth2
+
+                def init
+                  @site           = "https://github.com/"
+                  @user_info_path = "/api/v2/json/user/show"
+                  @user_info_mapping = {}
+                end
+
+                def get_user_hash
+                  user_hash = {}
+                  response = @access_token.get(@user_info_path)
+                  user_hash[:user_info] = JSON.parse(response)
+                  user_hash[:uid] = user_hash[:user_info]['id']
+                  user_hash
+                end
+
+                def has_callback?
+                  true
+                end
+
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  self.authorize_url({:authorize_path => '/login/oauth/authorize'})
+                end
+
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  @access_token = self.get_access_token(args)
+                end
+
+              end
+              init
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/external/providers/twitter.rb

@@ -39,6 +39,11 @@ module Sorcery
                               :user_info_mapping
                 
                 include Protocols::Oauth1
+				
+				        # Override included get_consumer method to provide authorize_path
+				        def get_consumer
+                  ::OAuth::Consumer.new(@key, @secret, :site => @site, :authorize_path => "/oauth/authenticate")
+                end
                 
                 def init
                   @site           = "https://api.twitter.com"

data/lib/sorcery/controller/submodules/external.rb

@@ -9,9 +9,11 @@ module Sorcery
           Config.module_eval do
             class << self
               attr_reader :external_providers                           # external providers like twitter.
+              attr_accessor :ca_file                                    # path to ca_file. By default use a internal ca-bundle.crt.
                                           
               def merge_external_defaults!
-                @defaults.merge!(:@external_providers => [])
+                @defaults.merge!(:@external_providers => [],
+                                 :@ca_file => File.join(File.expand_path(File.dirname(__FILE__)), 'external/protocols/certs/ca-bundle.crt'))
               end
               
               def external_providers=(providers)
@@ -45,7 +47,7 @@ module Sorcery
             @user_hash = @provider.get_user_hash
             if user = user_class.load_from_provider(provider,@user_hash[:uid])
               reset_session
-              login_user(user)
+              auto_login(user)
               user
             end
           end
@@ -61,6 +63,7 @@ module Sorcery
           #   {:username => "user/name"}
           #
           # And this will cause 'moishe' to be set as the value of :username field.
+          # Note: Be careful. This method skips validations model.
           def create_from(provider)
             provider = provider.to_sym
             @provider = Config.send(provider)
@@ -76,7 +79,11 @@ module Sorcery
               end
             end
             user_class.transaction do
-              @user = user_class.create!(attrs)
+              @user = user_class.new()
+              attrs.each do |k,v|
+                @user.send(:"#{k}=", v)
+              end
+              @user.save(:validate => false)
               user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider, config.provider_uid_attribute_name => @user_hash[:uid]})
             end
             @user

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -46,7 +46,7 @@ module Sorcery
           def login_from_basic_auth
             authenticate_with_http_basic do |username, password|
               @current_user = (user_class.authenticate(username, password) if session[:http_authentication_used]) || false
-              login_user(@current_user) if @current_user
+              auto_login(@current_user) if @current_user
               @current_user
             end
           end

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -26,19 +26,27 @@ module Sorcery
             cookies[:remember_me_token] = nil
           end
           
+          # Override.
+          # logins a user instance, and optionally remembers him.
+          def auto_login(user, should_remember = false)
+            session[:user_id] = user.id
+            @current_user = user
+            remember_me! if should_remember
+          end
+          
           protected
           
           # calls remember_me! if a third credential was passed to the login method.
           # Runs as a hook after login.
           def remember_me_if_asked_to(user, credentials)
-            remember_me! if credentials.size == 3 && credentials[2]
+            remember_me! if ( credentials.size == 3 && credentials[2] && credentials[2] != "0" )
           end
           
           # Checks the cookie for a remember me token, tried to find a user with that token 
           # and logs the user in if found.
           # Runs as a login source. See 'current_user' method for how it is used.
           def login_from_cookie
-            user = cookies[:remember_me_token] && user_class.find_by_remember_me_token(cookies[:remember_me_token])
+            user = cookies.signed[:remember_me_token] && user_class.find_by_remember_me_token(cookies.signed[:remember_me_token])
             if user && user.remember_me_token?
               set_remember_me_cookie!(user)
               @current_user = user
@@ -48,9 +56,10 @@ module Sorcery
           end
           
           def set_remember_me_cookie!(user)
-            cookies[:remember_me_token] = { 
+            cookies.signed[:remember_me_token] = { 
               :value => user.send(user.sorcery_config.remember_me_token_attribute_name), 
-              :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name)
+              :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name),
+              :httponly => true
             }
           end
         end

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -39,7 +39,7 @@ module Sorcery
             session_to_use = Config.session_timeout_from_last_action ? session[:last_action_time] : session[:login_time]
             if session_to_use && (Time.now.utc - session_to_use > Config.session_timeout)
               reset_session
-              @current_user = false
+              @current_user = nil
             else
               session[:last_action_time] = Time.now.utc
             end

data/lib/sorcery/controller.rb

@@ -34,7 +34,7 @@ module Sorcery
           return_to_url = session[:return_to_url]
           reset_session # protect from session fixation attacks
           session[:return_to_url] = return_to_url
-          login_user(user)
+          auto_login(user)
           after_login!(user, credentials)
           current_user
         else
@@ -62,6 +62,10 @@ module Sorcery
         @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
       end
       
+      def current_user=(user)
+        @current_user = user
+      end
+      
       # used when a user tries to access a page while logged out, is asked to login, 
       # and we want to return him back to the page he originally wanted.
       def redirect_back_or_to(url, flash_hash = {})
@@ -75,6 +79,22 @@ module Sorcery
         redirect_to root_path
       end
       
+      # login a user instance
+      #
+      # @param [<User-Model>] user the user instance.
+      # @return - do not depend on the return value.
+      def auto_login(user)
+        session[:user_id] = user.id
+        @current_user = user
+      end
+      
+      # Overwrite Rails' handle unverified request
+      def handle_unverified_request
+        cookies[:remember_me_token] = nil
+        @current_user = nil
+        super # call the default behaviour which resets the session
+      end
+      
       protected
       
       # Tries all available sources (methods) until one doesn't return false.
@@ -86,10 +106,6 @@ module Sorcery
         result || false
       end
       
-      def login_user(user)
-        session[:user_id] = user.id
-      end
-      
       def login_from_session
         @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
       end
@@ -113,6 +129,7 @@ module Sorcery
       def user_class
         @user_class ||= Config.user_class.to_s.constantize
       end
+      
     end
     
     module Config
@@ -124,6 +141,8 @@ module Sorcery
                       :save_return_to_url,            # when a non logged in user tries to enter a page that requires
                                                       # login, save the URL he wanted to reach, 
                                                       # and send him there after login.
+                                                      
+                      :sinatra_cookie_secret,         # used to sign cookies in Sinatra.
                       
                       :login_sources,
                       :after_login,
@@ -141,7 +160,8 @@ module Sorcery
             :@after_failed_login                   => [],
             :@before_logout                        => [],
             :@after_logout                         => [],
-            :@save_return_to_url                   => true
+            :@save_return_to_url                   => true,
+            :@sinatra_cookie_secret                => 'ch4ng3M3plz'
           }
         end
         

data/lib/sorcery/crypto_providers/aes256.rb

@@ -28,12 +28,16 @@ module Sorcery
         end
     
         def matches?(crypted, *tokens)
-          aes.decrypt
-          aes.key = @key
-          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
+          decrypt(crypted) == tokens.join
         rescue OpenSSL::CipherError
           false
         end
+        
+        def decrypt(crypted)
+          aes.decrypt
+          aes.key = @key
+          (aes.update(crypted.unpack("m").first) + aes.final)
+        end
     
         private
         

data/lib/sorcery/engine.rb

@@ -10,6 +10,7 @@ module Sorcery
     initializer "extend Controller with sorcery" do |app|
       ActionController::Base.send(:include, Sorcery::Controller)
       ActionController::Base.helper_method :current_user
+      ActionController::Base.helper_method :logged_in?
     end
     
     rake_tasks do

data/lib/sorcery/initializers/initializer.rb

@@ -1,6 +1,6 @@
 # The first thing you need to configure is which modules you need in your app.
 # The default is nothing which will include only core features (password encryption, login/logout).
-# Available submodules are: :user_activation, :http_basic_auth, :remember_me, 
+# Available submodules are: :user_activation, :http_basic_auth, :remember_me,
 # :reset_password, :session_timeout, :brute_force_protection, :activity_logging, :external
 Rails.application.config.sorcery.submodules = []
 
@@ -8,165 +8,186 @@ Rails.application.config.sorcery.submodules = []
 Rails.application.config.sorcery.configure do |config|
   # -- core --
   # config.not_authenticated_action = :not_authenticated              # what controller action to call for
-                                                                      # non-authenticated users. 
-                                                                      # You can also override 'not_authenticated' 
+                                                                      # non-authenticated users.
+                                                                      # You can also override 'not_authenticated'
                                                                       # instead.
-                                                                      
-  # config.save_return_to_url = true                                  # when a non logged in user tries to enter 
-                                                                      # a page that requires login, 
-                                                                      # save the URL he wanted to reach, 
+
+  # config.save_return_to_url = true                                  # when a non logged in user tries to enter
+                                                                      # a page that requires login,
+                                                                      # save the URL he wanted to reach,
                                                                       # and send him there after login, using
                                                                       # 'redirect_back_or_to'.
 
-  # -- session timeout --                                             
+  # -- session timeout --
   # config.session_timeout = 3600                                     # how long in seconds to keep the session alive.
-  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of 
+  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of
                                                                       # session timeout.
-  
+
   # -- http_basic_auth --
   # config.controller_to_realm_map = {"application" => "Application"} # What realm to display for which controller name.
                                                                       # For example {"My App" => "Application"}
   
+  # -- activity logging --
+  # config.register_login_time = true                                 # will register the time of last user login, every login.
+  # config.register_logout_time = true                                # will register the time of last user logout, every logout.
+  # config.register_last_activity_time = true                         # will register the time of last user action, every action.
+                                                                                                                                          
   # -- external --
-  # config.external_providers = []                                    # What providers are supported by this app, 
-                                                                      # i.e. [:twitter, :facebook] .
-  # 
+  # config.external_providers = []                                    # What providers are supported by this app,
+                                                                      # i.e. [:twitter, :facebook, :github] .
+  # config.ca_file = 'path/to/ca_file'                                # Path to ca_file. By default use a internal ca-bundle.crt.
+                                                                      # You can change it by your local ca_file.
+                                                                      # i.e. '/etc/pki/tls/certs/ca-bundle.crt'
+
   # config.twitter.key = "eYVNBjBDi33aa9GkA3w"
   # config.twitter.secret = "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8"
   # config.twitter.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=twitter"
   # config.twitter.user_info_mapping = {:email => "screen_name"}
-  # 
+  #
   # config.facebook.key = "34cebc81c08a521bc66e212f947d73ec"
   # config.facebook.secret = "5b458d179f61d4f036ee66a497ffbcd0"
   # config.facebook.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=facebook"
   # config.facebook.user_info_mapping = {:email => "name"}
-  
+  #
+  # config.github.key = ""
+  # config.github.secret = ""
+  # config.github.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=github"
+  # config.github.user_info_mapping = {:email => "name"}
+
+  # config.sinatra_cookie_secret = 'ch4ng3M3plz'                      # key used to sign cookies in Sinatra
+                                                                      # changing it will invalidate all signed cookies!        
+
   # --- user config ---
   config.user_config do |user|
     # -- core --
-    # user.username_attribute_name = :username                                        # change default username
-                                                                                      # attribute, for example, 
-                                                                                      # to use :email as the login.
-                                                                                      
+    # user.username_attribute_names = [:username]                                     # specify username
+                                                                                      # attributes, for example:
+                                                                                      # [:username, :email].
+
     # user.password_attribute_name = :password                                        # change *virtual* password
                                                                                       # attribute, the one which is used
                                                                                       # until an encrypted one is
                                                                                       # generated.
-                                                                                      
+
     # user.email_attribute_name = :email                                              # change default email attribute.
-    
+
     # user.crypted_password_attribute_name =  :crypted_password                       # change default crypted_password
                                                                                       # attribute.
-                                                                                      
+
     # user.salt_join_token = ""                                                       # what pattern to use to join the
                                                                                       # password with the salt
-                                                                                      
+
     # user.salt_attribute_name = :salt                                                # change default salt attribute.
-    
+
     # user.stretches = nil                                                            # how many times to apply
                                                                                       # encryption to the password.
-                                                                                      
+
     # user.encryption_key = nil                                                       # encryption key used to encrypt
                                                                                       # reversible encryptions such as
                                                                                       # AES256.
-                                                                                      
-    # user.custom_encryption_provider = nil                                           # use an external encryption 
+                                                                                      #
+                                                                                      # WARNING:
+                                                                                      #
+                                                                                      # If used for users' passwords, changing this key 
+                                                                                      # will leave passwords undecryptable!
+
+    # user.custom_encryption_provider = nil                                           # use an external encryption
                                                                                       # class.
-                                                                                      
+
     # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See
                                                                                       # 'encryption_algorithm=' for
                                                                                       # available options.
-                                                                                      
+
     # user.subclasses_inherit_config = false                                          # make this configuration
                                                                                       # inheritable for subclasses.
                                                                                       # Useful for ActiveRecord's STI.
-                                                                                      
-    # -- user_activation --                                                           
+
+    # -- user_activation --
     # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold
                                                                                       # activation state
                                                                                       # (active/pending).
-                                                                                      
+
     # user.activation_token_attribute_name = :activation_token                        # the attribute name to hold
                                                                                       # activation code (sent by email).
-                                                                                      
+
     # user.activation_token_expires_at_attribute_name = :activation_token_expires_at  # the attribute name to hold
-                                                                                      # activation code expiration date. 
-                                                                                      
+                                                                                      # activation code expiration date.
+
     # user.activation_token_expiration_period =  nil                                  # how many seconds before the
                                                                                       # activation code expires. nil for
                                                                                       # never expires.
-                                                                                      
+
     # user.user_activation_mailer = nil                                               # your mailer class. Required.
-    
+
     # user.activation_needed_email_method_name = :activation_needed_email             # activation needed email method
                                                                                       # on your mailer class.
-                                                                                      
+
     # user.activation_success_email_method_name = :activation_success_email           # activation success email method
                                                                                       # on your mailer class.
-                                                                                      
+
     # user.prevent_non_active_users_to_login = true                                   # do you want to prevent or allow
                                                                                       # users that did not activate by
-                                                                                      # email to login?                     
-                                                                  
-    # -- reset_password --                                        
+                                                                                      # email to login?
+
+    # -- reset_password --
     # user.reset_password_token_attribute_name = :reset_password_token                          # reset password code
                                                                                                 # attribute name.
-                                                                                                
+
     # user.reset_password_token_expires_at_attribute_name = :reset_password_token_expires_at    # expires at attribute
                                                                                                 # name.
-                                                                                                
+
     # user.reset_password_email_sent_at_attribute_name = :reset_password_email_sent_at          # when was email sent,
                                                                                                 # used for hammering
                                                                                                 # protection.
-                                                                                                
+
     # user.reset_password_mailer = nil                                                          # mailer class. Needed.
-    
+
     # user.reset_password_email_method_name = :reset_password_email                             # reset password email
                                                                                                 # method on your mailer
                                                                                                 # class.
-                                                                                                
+
     # user.reset_password_expiration_period = nil                                               # how many seconds
                                                                                                 # before the reset
                                                                                                 # request expires. nil
                                                                                                 # for never expires.
-                                                                                                
+
     # user.reset_password_time_between_emails = 5 * 60                                          # hammering protection,
                                                                                                 # how long to wait
                                                                                                 # before allowing
                                                                                                 # another email to be
                                                                                                 # sent.
-                                                                  
-    # -- brute_force_protection --                                
+
+    # -- brute_force_protection --
     # user.failed_logins_count_attribute_name = :failed_logins_count                  # failed logins attribute name.
-    
+
     # user.lock_expires_at_attribute_name = :lock_expires_at                          # this field indicates whether
                                                                                       # user is banned and when it will
                                                                                       # be active again.
-                                                                                      
+
     # user.consecutive_login_retries_amount_limit = 50                                # how many failed logins allowed.
-    
+
     # user.login_lock_time_period = 60 * 60                                           # how long the user should be
                                                                                       # banned. in seconds. 0 for
                                                                                       # permanent.
-                                                                  
-    # -- activity logging --                                      
+
+    # -- activity logging --
     # user.last_login_at_attribute_name = :last_login_at                              # last login attribute name.
     # user.last_logout_at_attribute_name = :last_logout_at                            # last logout attribute name.
     # user.last_activity_at_attribute_name = :last_activity_at                        # last activity attribute name.
     # user.activity_timeout = 10 * 60                                                 # how long since last activity is
                                                                                       # the user defined logged out?
-                                                                                      
-    # -- external --                                                                     
+
+    # -- external --
     # user.authentications_class = nil                                                # class which holds the various
                                                                                       # external provider data for this
                                                                                       # user.
-                                                                                      
+
     # user.authentications_user_id_attribute_name = :user_id                          # user's identifier in
                                                                                       # authentications class.
-                                                                                      
+
     # user.provider_attribute_name = :provider                                        # provider's identifier in
                                                                                       # authentications class.
-                                                                                      
+
     # user.provider_uid_attribute_name = :uid                                         # user's external unique
                                                                                       # identifier in authentications
                                                                                       # class.

data/lib/sorcery/model/adapters/active_record.rb

@@ -8,7 +8,8 @@ module Sorcery
 
         module ClassMethods
           def find_by_credentials(credentials)
-            where("#{@sorcery_config.username_attribute_name} = ?", credentials[0]).first
+             sql = @sorcery_config.username_attribute_names.map{|attribute| "#{attribute} = :login"}
+             where(sql.join(' OR '), :login => credentials[0]).first
           end
 
           def find_by_sorcery_token(token_attr_name, token)

data/lib/sorcery/model/adapters/mongoid.rb

@@ -15,7 +15,11 @@ module Sorcery
 
         module ClassMethods
           def find_by_credentials(credentials)
-            where(sorcery_config.username_attribute_name => credentials[0]).first
+            @sorcery_config.username_attribute_names.each do |attribute|
+              @user = where(attribute => credentials[0]).first
+              break if @user
+            end
+            @user
           end
 
           def find_by_provider_and_uid(provider, uid)
@@ -36,7 +40,8 @@ module Sorcery
           end
 
           def find_by_username(username)
-            where(sorcery_config.username_attribute_name => username).first
+            query = sorcery_config.username_attribute_names.map {|name| {name => username}}
+            where(query).first
           end
 
           def transaction(&blk)

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -54,13 +54,15 @@ module Sorcery
 
           def lock!
             config = sorcery_config
-            self.update_attributes!(config.lock_expires_at_attribute_name => Time.now.utc + config.login_lock_time_period)
+            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.utc + config.login_lock_time_period)
+            self.save!
           end
 
           def unlock!
             config = sorcery_config
-            self.update_attributes!(config.lock_expires_at_attribute_name => nil, 
-                                    config.failed_logins_count_attribute_name => 0)
+            self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
+            self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
+            self.save!
           end
           
           def unlocked?