sorcery 0.6.1 → 0.7.1

data/lib/{sorcery/initializers → generators/sorcery/templates}/initializer.rb

@@ -1,6 +1,6 @@
 # The first thing you need to configure is which modules you need in your app.
 # The default is nothing which will include only core features (password encryption, login/logout).
-# Available submodules are: :user_activation, :http_basic_auth, :remember_me, 
+# Available submodules are: :user_activation, :http_basic_auth, :remember_me,
 # :reset_password, :session_timeout, :brute_force_protection, :activity_logging, :external
 Rails.application.config.sorcery.submodules = []
 
@@ -8,171 +8,192 @@ Rails.application.config.sorcery.submodules = []
 Rails.application.config.sorcery.configure do |config|
   # -- core --
   # config.not_authenticated_action = :not_authenticated              # what controller action to call for
-                                                                      # non-authenticated users. 
-                                                                      # You can also override 'not_authenticated' 
+                                                                      # non-authenticated users.
+                                                                      # You can also override 'not_authenticated'
                                                                       # instead.
-                                                                      
-  # config.save_return_to_url = true                                  # when a non logged in user tries to enter 
-                                                                      # a page that requires login, 
-                                                                      # save the URL he wanted to reach, 
+
+  # config.save_return_to_url = true                                  # when a non logged in user tries to enter
+                                                                      # a page that requires login,
+                                                                      # save the URL he wanted to reach,
                                                                       # and send him there after login, using
                                                                       # 'redirect_back_or_to'.
 
-  # -- session timeout --                                             
+  # config.cookie_domain = nil                                        # set domain option for cookies
+                                                                      # Useful for remember_me submodule
+
+  # -- session timeout --
   # config.session_timeout = 3600                                     # how long in seconds to keep the session alive.
-  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of 
+  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of
                                                                       # session timeout.
-  
+
   # -- http_basic_auth --
   # config.controller_to_realm_map = {"application" => "Application"} # What realm to display for which controller name.
                                                                       # For example {"My App" => "Application"}
   
+  # -- activity logging --
+  # config.register_login_time = true                                 # will register the time of last user login, every login.
+  # config.register_logout_time = true                                # will register the time of last user logout, every logout.
+  # config.register_last_activity_time = true                         # will register the time of last user action, every action.
+                                                                                                                                          
   # -- external --
-  # config.external_providers = []                                    # What providers are supported by this app, 
-                                                                      # i.e. [:twitter, :facebook] .
-  # 
+  # config.external_providers = []                                    # What providers are supported by this app,
+                                                                      # i.e. [:twitter, :facebook, :github] .
+  # config.ca_file = 'path/to/ca_file'                                # Path to ca_file. By default use a internal ca-bundle.crt.
+                                                                      # You can change it by your local ca_file.
+                                                                      # i.e. '/etc/pki/tls/certs/ca-bundle.crt'
+
   # config.twitter.key = "eYVNBjBDi33aa9GkA3w"
   # config.twitter.secret = "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8"
   # config.twitter.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=twitter"
   # config.twitter.user_info_mapping = {:email => "screen_name"}
-  # 
+  #
   # config.facebook.key = "34cebc81c08a521bc66e212f947d73ec"
   # config.facebook.secret = "5b458d179f61d4f036ee66a497ffbcd0"
   # config.facebook.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=facebook"
   # config.facebook.user_info_mapping = {:email => "name"}
-  
+  #
+  # config.github.key = ""
+  # config.github.secret = ""
+  # config.github.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=github"
+  # config.github.user_info_mapping = {:email => "name"}
+
   # --- user config ---
   config.user_config do |user|
     # -- core --
-    # user.username_attribute_name = :username                                        # change default username
-                                                                                      # attribute, for example, 
-                                                                                      # to use :email as the login.
-                                                                                      
+    # user.username_attribute_names = [:username]                                     # specify username
+                                                                                      # attributes, for example:
+                                                                                      # [:username, :email].
+
     # user.password_attribute_name = :password                                        # change *virtual* password
                                                                                       # attribute, the one which is used
                                                                                       # until an encrypted one is
                                                                                       # generated.
-                                                                                      
+
     # user.email_attribute_name = :email                                              # change default email attribute.
-    
+
     # user.crypted_password_attribute_name =  :crypted_password                       # change default crypted_password
                                                                                       # attribute.
-                                                                                      
+
     # user.salt_join_token = ""                                                       # what pattern to use to join the
                                                                                       # password with the salt
-                                                                                      
+
     # user.salt_attribute_name = :salt                                                # change default salt attribute.
-    
+
     # user.stretches = nil                                                            # how many times to apply
                                                                                       # encryption to the password.
-                                                                                      
+
     # user.encryption_key = nil                                                       # encryption key used to encrypt
                                                                                       # reversible encryptions such as
                                                                                       # AES256.
-                                                                                      
-    # user.custom_encryption_provider = nil                                           # use an external encryption 
+                                                                                      #
+                                                                                      # WARNING:
+                                                                                      #
+                                                                                      # If used for users' passwords, changing this key 
+                                                                                      # will leave passwords undecryptable!
+
+    # user.custom_encryption_provider = nil                                           # use an external encryption
                                                                                       # class.
-                                                                                      
+
     # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See
                                                                                       # 'encryption_algorithm=' for
                                                                                       # available options.
-                                                                                      
+
     # user.subclasses_inherit_config = false                                          # make this configuration
                                                                                       # inheritable for subclasses.
                                                                                       # Useful for ActiveRecord's STI.
-                                                                                      
-    # -- user_activation --                                                           
+
+    # -- user_activation --
     # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold
                                                                                       # activation state
                                                                                       # (active/pending).
-                                                                                      
+
     # user.activation_token_attribute_name = :activation_token                        # the attribute name to hold
                                                                                       # activation code (sent by email).
-                                                                                      
+
     # user.activation_token_expires_at_attribute_name = :activation_token_expires_at  # the attribute name to hold
-                                                                                      # activation code expiration date. 
-                                                                                      
+                                                                                      # activation code expiration date.
+
     # user.activation_token_expiration_period =  nil                                  # how many seconds before the
                                                                                       # activation code expires. nil for
                                                                                       # never expires.
-                                                                                      
+
     # user.user_activation_mailer = nil                                               # your mailer class. Required.
-    
+
     # user.activation_needed_email_method_name = :activation_needed_email             # activation needed email method
                                                                                       # on your mailer class.
-                                                                                      
+
     # user.activation_success_email_method_name = :activation_success_email           # activation success email method
                                                                                       # on your mailer class.
-                                                                                      
+
     # user.prevent_non_active_users_to_login = true                                   # do you want to prevent or allow
                                                                                       # users that did not activate by
-                                                                                      # email to login?                     
-                                                                  
-    # -- reset_password --                                        
+                                                                                      # email to login?
+
+    # -- reset_password --
     # user.reset_password_token_attribute_name = :reset_password_token                          # reset password code
                                                                                                 # attribute name.
-                                                                                                
+
     # user.reset_password_token_expires_at_attribute_name = :reset_password_token_expires_at    # expires at attribute
                                                                                                 # name.
-                                                                                                
+
     # user.reset_password_email_sent_at_attribute_name = :reset_password_email_sent_at          # when was email sent,
                                                                                                 # used for hammering
                                                                                                 # protection.
-                                                                                                
+
     # user.reset_password_mailer = nil                                                          # mailer class. Needed.
-    
+
     # user.reset_password_email_method_name = :reset_password_email                             # reset password email
                                                                                                 # method on your mailer
                                                                                                 # class.
-                                                                                                
+
     # user.reset_password_expiration_period = nil                                               # how many seconds
                                                                                                 # before the reset
                                                                                                 # request expires. nil
                                                                                                 # for never expires.
-                                                                                                
+
     # user.reset_password_time_between_emails = 5 * 60                                          # hammering protection,
                                                                                                 # how long to wait
                                                                                                 # before allowing
                                                                                                 # another email to be
                                                                                                 # sent.
-                                                                  
-    # -- brute_force_protection --                                
+
+    # -- brute_force_protection --
     # user.failed_logins_count_attribute_name = :failed_logins_count                  # failed logins attribute name.
-    
+
     # user.lock_expires_at_attribute_name = :lock_expires_at                          # this field indicates whether
                                                                                       # user is banned and when it will
                                                                                       # be active again.
-                                                                                      
+
     # user.consecutive_login_retries_amount_limit = 50                                # how many failed logins allowed.
-    
+
     # user.login_lock_time_period = 60 * 60                                           # how long the user should be
                                                                                       # banned. in seconds. 0 for
                                                                                       # permanent.
-                                                                  
-    # -- activity logging --                                      
+
+    # -- activity logging --
     # user.last_login_at_attribute_name = :last_login_at                              # last login attribute name.
     # user.last_logout_at_attribute_name = :last_logout_at                            # last logout attribute name.
     # user.last_activity_at_attribute_name = :last_activity_at                        # last activity attribute name.
     # user.activity_timeout = 10 * 60                                                 # how long since last activity is
                                                                                       # the user defined logged out?
-                                                                                      
-    # -- external --                                                                     
+
+    # -- external --
     # user.authentications_class = nil                                                # class which holds the various
                                                                                       # external provider data for this
                                                                                       # user.
-                                                                                      
+
     # user.authentications_user_id_attribute_name = :user_id                          # user's identifier in
                                                                                       # authentications class.
-                                                                                      
+
     # user.provider_attribute_name = :provider                                        # provider's identifier in
                                                                                       # authentications class.
-                                                                                      
+
     # user.provider_uid_attribute_name = :uid                                         # user's external unique
                                                                                       # identifier in authentications
                                                                                       # class.
   end
 
   # This line must come after the 'user config' block.
-  config.user_class = "User"                                                          # define which model authenticates
+  config.user_class = "<%= model_class_name %>"                                       # define which model authenticates
                                                                                       # with sorcery.
 end

data/lib/generators/sorcery/templates/migration/activity_logging.rb

@@ -0,0 +1,17 @@
+class SorceryActivityLogging < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :last_login_at,     :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :last_logout_at,    :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :last_activity_at,  :datetime, :default => nil
+    
+    add_index :<%= model_class_name.tableize %>, [:last_logout_at, :last_activity_at]
+  end
+
+  def self.down
+    remove_index :<%= model_class_name.tableize %>, [:last_logout_at, :last_activity_at]
+    
+    remove_column :<%= model_class_name.tableize %>, :last_activity_at
+    remove_column :<%= model_class_name.tableize %>, :last_logout_at
+    remove_column :<%= model_class_name.tableize %>, :last_login_at
+  end
+end

data/lib/generators/sorcery/templates/migration/brute_force_protection.rb

@@ -0,0 +1,11 @@
+class SorceryBruteForceProtection < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :failed_logins_count, :integer, :default => 0
+    add_column :<%= model_class_name.tableize %>, :lock_expires_at, :datetime, :default => nil
+  end
+
+  def self.down
+    remove_column :<%= model_class_name.tableize %>, :lock_expires_at
+    remove_column :<%= model_class_name.tableize %>, :failed_logins_count
+  end
+end

data/lib/generators/{sorcery_migration/templates → sorcery/templates/migration}/core.rb

@@ -1,7 +1,7 @@
 class SorceryCore < ActiveRecord::Migration
   def self.up
-    create_table :users do |t|
-      t.string :username,         :null => false  # if you use another filed as a username, for example email, you can safely remove this field.
+    create_table :<%= model_class_name.tableize %> do |t|
+      t.string :username,         :null => false  # if you use another field as a username, for example email, you can safely remove this field.
       t.string :email,            :default => nil # if you use this field as a username, you might want to make it :null => false.
       t.string :crypted_password, :default => nil
       t.string :salt,             :default => nil
@@ -11,6 +11,6 @@ class SorceryCore < ActiveRecord::Migration
   end
 
   def self.down
-    drop_table :users
+    drop_table :<%= model_class_name.tableize %>
   end
 end

data/lib/generators/{sorcery_migration/templates → sorcery/templates/migration}/external.rb

@@ -1,7 +1,7 @@
 class SorceryExternal < ActiveRecord::Migration
   def self.up
     create_table :authentications do |t|
-      t.integer :user_id, :null => false
+      t.integer :<%= model_class_name.tableize.singularize %>_id, :null => false
       t.string :provider, :uid, :null => false
 
       t.timestamps

data/lib/generators/sorcery/templates/migration/remember_me.rb

@@ -0,0 +1,15 @@
+class SorceryRememberMe < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :remember_me_token, :string, :default => nil
+    add_column :<%= model_class_name.tableize %>, :remember_me_token_expires_at, :datetime, :default => nil
+    
+    add_index :<%= model_class_name.tableize %>, :remember_me_token
+  end
+
+  def self.down
+    remove_index :<%= model_class_name.tableize %>, :remember_me_token
+    
+    remove_column :<%= model_class_name.tableize %>, :remember_me_token_expires_at
+    remove_column :<%= model_class_name.tableize %>, :remember_me_token
+  end
+end

data/lib/generators/sorcery/templates/migration/reset_password.rb

@@ -0,0 +1,17 @@
+class SorceryResetPassword < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :reset_password_token, :string, :default => nil
+    add_column :<%= model_class_name.tableize %>, :reset_password_token_expires_at, :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :reset_password_email_sent_at, :datetime, :default => nil
+    
+    add_index :<%= model_class_name.tableize %>, :reset_password_token
+  end
+
+  def self.down
+    remove_index :users, :reset_password_token
+    
+    remove_column :<%= model_class_name.tableize %>, :reset_password_email_sent_at
+    remove_column :<%= model_class_name.tableize %>, :reset_password_token_expires_at
+    remove_column :<%= model_class_name.tableize %>, :reset_password_token
+  end
+end

data/lib/generators/sorcery/templates/migration/user_activation.rb

@@ -0,0 +1,17 @@
+class SorceryUserActivation < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :activation_state, :string, :default => nil
+    add_column :<%= model_class_name.tableize %>, :activation_token, :string, :default => nil
+    add_column :<%= model_class_name.tableize %>, :activation_token_expires_at, :datetime, :default => nil
+    
+    add_index :<%= model_class_name.tableize %>, :activation_token
+  end
+
+  def self.down
+    remove_index :<%= model_class_name.tableize %>, :activation_token
+    
+    remove_column :<%= model_class_name.tableize %>, :activation_token_expires_at
+    remove_column :<%= model_class_name.tableize %>, :activation_token
+    remove_column :<%= model_class_name.tableize %>, :activation_state
+  end
+end

data/lib/sorcery/controller/submodules/activity_logging.rb

@@ -14,8 +14,22 @@ module Sorcery
       module ActivityLogging
         def self.included(base)
           base.send(:include, InstanceMethods)
-          Config.after_login << :register_login_time_to_db
-          Config.before_logout << :register_logout_time_to_db
+          Config.module_eval do
+            class << self
+              attr_accessor :register_login_time
+              attr_accessor :register_logout_time
+              attr_accessor :register_last_activity_time
+            
+              def merge_activity_logging_defaults!
+                @defaults.merge!(:@register_login_time         => true,
+                                 :@register_logout_time        => true,
+                                 :@register_last_activity_time => true)
+              end
+            end
+            merge_activity_logging_defaults!
+          end
+          Config.after_login    << :register_login_time_to_db
+          Config.before_logout  << :register_logout_time_to_db
           base.after_filter :register_last_activity_time_to_db
         end
         
@@ -37,23 +51,23 @@ module Sorcery
           # registers last login time on every login.
           # This runs as a hook just after a successful login.
           def register_login_time_to_db(user, credentials)
-            user.send(:"#{user.sorcery_config.last_login_at_attribute_name}=", Time.now.utc.to_s(:db))
-            user.save!(:validate => false)
+            return unless Config.register_login_time
+            user.update_attributes!(user.sorcery_config.last_login_at_attribute_name => Time.now.utc)
           end
           
           # registers last logout time on every logout.
           # This runs as a hook just before a logout.
           def register_logout_time_to_db(user)
-            user.send(:"#{user.sorcery_config.last_logout_at_attribute_name}=", Time.now.utc.to_s(:db))
-            user.save!(:validate => false)
+            return unless Config.register_logout_time
+            user.update_attributes!(user.sorcery_config.last_logout_at_attribute_name => Time.now.utc)
           end
           
           # Updates last activity time on every request.
           # The only exception is logout - we do not update activity on logout
           def register_last_activity_time_to_db
-            return if !logged_in?
-            current_user.send(:"#{current_user.sorcery_config.last_activity_at_attribute_name}=", Time.now.utc.to_s(:db))
-            current_user.save!(:validate => false)
+            return unless Config.register_last_activity_time
+            return unless logged_in?
+            current_user.update_attributes!(current_user.sorcery_config.last_activity_at_attribute_name => Time.now.utc)
           end
         end
       end

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -29,7 +29,8 @@ module Sorcery
           # Resets the failed logins counter.
           # Runs as a hook after a successful login.
           def reset_failed_logins_count!(user, credentials)
-            user.update_attributes!(user_class.sorcery_config.failed_logins_count_attribute_name => 0)
+            user.send(:"#{user_class.sorcery_config.failed_logins_count_attribute_name}=", 0)
+            user.save!
           end
         end
       end