sorcery 0.6.1 → 0.7.1

data/lib/sorcery/controller/submodules/external/protocols/oauth2.rb

@@ -8,19 +8,38 @@ module Sorcery
             def oauth_version
               "2.0"
             end
-          
-            def authorize_url(*args)
-              client = ::OAuth2::Client.new(@key, @secret, :site => @site)
-              client.web_server.authorize_url(:redirect_uri => @callback_url, :scope => @scope)
+            
+            def authorize_url(options = {})
+              defaults = {
+                :site => @site,
+                :ssl => { :ca_file => Config.ca_file }
+              }
+              client = ::OAuth2::Client.new(
+                @key,
+                @secret,
+                defaults.merge!(options)
+              )
+              client.web_server.authorize_url(
+                :redirect_uri => @callback_url,
+                :scope => @scope
+              )
             end
-          
+            
             def get_access_token(args)
-              client = ::OAuth2::Client.new(@key, @secret, :site => @site)
-              client.web_server.get_access_token(args[:code], :redirect_uri => @callback_url)
+              client = ::OAuth2::Client.new(
+                @key,
+                @secret,
+                :site => @site,
+                :ssl => { :ca_file => Config.ca_file }
+              )
+              client.web_server.get_access_token(
+                args[:code],
+                :redirect_uri => @callback_url
+              )
             end
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/controller/submodules/external/providers/github.rb

@@ -0,0 +1,80 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module External
+        module Providers
+          # This module adds support for OAuth with github.com.
+          # When included in the 'config.providers' option, it adds a new option, 'config.github'.
+          # Via this new option you can configure Github specific settings like your app's key and secret.
+          #
+          #   config.github.key = <key>
+          #   config.github.secret = <secret>
+          #   ...
+          #
+          module Github
+            def self.included(base)
+              base.module_eval do
+                class << self
+                  attr_reader :github                           # access to github_client.
+
+                  def merge_github_defaults!
+                    @defaults.merge!(:@github => GithubClient)
+                  end
+                end
+                merge_github_defaults!
+                update!
+              end
+            end
+
+            module GithubClient
+              class << self
+                attr_accessor :key,
+                              :secret,
+                              :callback_url,
+                              :site,
+                              :user_info_path,
+                              :user_info_mapping
+
+                include Protocols::Oauth2
+
+                def init
+                  @site           = "https://github.com/"
+                  @user_info_path = "/api/v2/json/user/show"
+                  @user_info_mapping = {}
+                end
+
+                def get_user_hash
+                  user_hash = {}
+                  response = @access_token.get(@user_info_path)
+                  user_hash[:user_info] = JSON.parse(response)
+                  user_hash[:uid] = user_hash[:user_info]['id']
+                  user_hash
+                end
+
+                def has_callback?
+                  true
+                end
+
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  self.authorize_url({:authorize_path => '/login/oauth/authorize'})
+                end
+
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  @access_token = self.get_access_token(args)
+                end
+
+              end
+              init
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/external/providers/twitter.rb

@@ -39,6 +39,11 @@ module Sorcery
                               :user_info_mapping
                 
                 include Protocols::Oauth1
+				
+				        # Override included get_consumer method to provide authorize_path
+				        def get_consumer
+                  ::OAuth::Consumer.new(@key, @secret, :site => @site, :authorize_path => "/oauth/authenticate")
+                end
                 
                 def init
                   @site           = "https://api.twitter.com"

data/lib/sorcery/controller/submodules/external.rb

@@ -9,9 +9,11 @@ module Sorcery
           Config.module_eval do
             class << self
               attr_reader :external_providers                           # external providers like twitter.
+              attr_accessor :ca_file                                    # path to ca_file. By default use a internal ca-bundle.crt.
                                           
               def merge_external_defaults!
-                @defaults.merge!(:@external_providers => [])
+                @defaults.merge!(:@external_providers => [],
+                                 :@ca_file => File.join(File.expand_path(File.dirname(__FILE__)), 'external/protocols/certs/ca-bundle.crt'))
               end
               
               def external_providers=(providers)
@@ -45,7 +47,7 @@ module Sorcery
             @user_hash = @provider.get_user_hash
             if user = user_class.load_from_provider(provider,@user_hash[:uid])
               reset_session
-              login_user(user)
+              auto_login(user)
               user
             end
           end
@@ -61,6 +63,7 @@ module Sorcery
           #   {:username => "user/name"}
           #
           # And this will cause 'moishe' to be set as the value of :username field.
+          # Note: Be careful. This method skips validations model.
           def create_from(provider)
             provider = provider.to_sym
             @provider = Config.send(provider)
@@ -76,7 +79,11 @@ module Sorcery
               end
             end
             user_class.transaction do
-              @user = user_class.create!(attrs)
+              @user = user_class.new()
+              attrs.each do |k,v|
+                @user.send(:"#{k}=", v)
+              end
+              @user.save(:validate => false)
               user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider, config.provider_uid_attribute_name => @user_hash[:uid]})
             end
             @user

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -46,7 +46,7 @@ module Sorcery
           def login_from_basic_auth
             authenticate_with_http_basic do |username, password|
               @current_user = (user_class.authenticate(username, password) if session[:http_authentication_used]) || false
-              login_user(@current_user) if @current_user
+              auto_login(@current_user) if @current_user
               @current_user
             end
           end

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -22,23 +22,31 @@ module Sorcery
 
           # Clears the cookie and clears the token from the db.
           def forget_me!
-            current_user.forget_me!
+            @current_user.forget_me!
             cookies[:remember_me_token] = nil
           end
           
+          # Override.
+          # logins a user instance, and optionally remembers him.
+          def auto_login(user, should_remember = false)
+            session[:user_id] = user.id
+            @current_user = user
+            remember_me! if should_remember
+          end
+          
           protected
           
           # calls remember_me! if a third credential was passed to the login method.
           # Runs as a hook after login.
           def remember_me_if_asked_to(user, credentials)
-            remember_me! if credentials.size == 3 && credentials[2]
+            remember_me! if ( credentials.size == 3 && credentials[2] && credentials[2] != "0" )
           end
           
           # Checks the cookie for a remember me token, tried to find a user with that token 
           # and logs the user in if found.
           # Runs as a login source. See 'current_user' method for how it is used.
           def login_from_cookie
-            user = cookies[:remember_me_token] && user_class.find_by_remember_me_token(cookies[:remember_me_token])
+            user = cookies.signed[:remember_me_token] && user_class.find_by_remember_me_token(cookies.signed[:remember_me_token])
             if user && user.remember_me_token?
               set_remember_me_cookie!(user)
               @current_user = user
@@ -48,9 +56,11 @@ module Sorcery
           end
           
           def set_remember_me_cookie!(user)
-            cookies[:remember_me_token] = { 
+            cookies.signed[:remember_me_token] = { 
               :value => user.send(user.sorcery_config.remember_me_token_attribute_name), 
-              :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name)
+              :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name),
+              :httponly => true,
+              :domain => Config.cookie_domain
             }
           end
         end

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -39,7 +39,7 @@ module Sorcery
             session_to_use = Config.session_timeout_from_last_action ? session[:last_action_time] : session[:login_time]
             if session_to_use && (Time.now.utc - session_to_use > Config.session_timeout)
               reset_session
-              @current_user = false
+              @current_user = nil
             else
               session[:last_action_time] = Time.now.utc
             end

data/lib/sorcery/controller.rb

@@ -5,7 +5,7 @@ module Sorcery
         include InstanceMethods
         Config.submodules.each do |mod|
           begin
-            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
+            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
           rescue NameError
             # don't stop on a missing submodule.
           end
@@ -14,7 +14,7 @@ module Sorcery
       Config.update!
       Config.configure!
     end
-    
+
     module InstanceMethods
       # To be used as before_filter.
       # Will trigger auto-login attempts via the call to logged_in?
@@ -22,10 +22,10 @@ module Sorcery
       def require_login
         if !logged_in?
           session[:return_to_url] = request.url if Config.save_return_to_url
-          self.send(Config.not_authenticated_action) 
+          self.send(Config.not_authenticated_action)
         end
       end
-      
+
       # Takes credentials and returns a user on successful authentication.
       # Runs hooks after login or failed login.
       def login(*credentials)
@@ -34,7 +34,7 @@ module Sorcery
           return_to_url = session[:return_to_url]
           reset_session # protect from session fixation attacks
           session[:return_to_url] = return_to_url
-          login_user(user)
+          auto_login(user)
           after_login!(user, credentials)
           current_user
         else
@@ -42,41 +42,62 @@ module Sorcery
           nil
         end
       end
-      
+
       # Resets the session and runs hooks before and after.
       def logout
         if logged_in?
           before_logout!(current_user)
           reset_session
           after_logout!
+          @current_user = nil
         end
       end
-      
+
       def logged_in?
         !!current_user
       end
-      
+
       # attempts to auto-login from the sources defined (session, basic_auth, cookie, etc.)
       # returns the logged in user if found, false if not (using old restful-authentication trick, nil != false).
       def current_user
         @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
       end
-      
-      # used when a user tries to access a page while logged out, is asked to login, 
+
+      def current_user=(user)
+        @current_user = user
+      end
+
+      # used when a user tries to access a page while logged out, is asked to login,
       # and we want to return him back to the page he originally wanted.
       def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
       end
-      
+
       # The default action for denying non-authenticated users.
       # You can override this method in your controllers,
       # or provide a different method in the configuration.
       def not_authenticated
         redirect_to root_path
       end
-      
+
+      # login a user instance
+      #
+      # @param [<User-Model>] user the user instance.
+      # @return - do not depend on the return value.
+      def auto_login(user)
+        session[:user_id] = user.id
+        @current_user = user
+      end
+
+      # Overwrite Rails' handle unverified request
+      def handle_unverified_request
+        cookies[:remember_me_token] = nil
+        @current_user = nil
+        super # call the default behaviour which resets the session
+      end
+
       protected
-      
+
       # Tries all available sources (methods) until one doesn't return false.
       def login_from_other_sources
         result = nil
@@ -85,52 +106,51 @@ module Sorcery
         end
         result || false
       end
-      
-      def login_user(user)
-        session[:user_id] = user.id
-      end
-      
+
       def login_from_session
         @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
       end
-      
+
       def after_login!(user, credentials)
         Config.after_login.each {|c| self.send(c, user, credentials)}
       end
-      
+
       def after_failed_login!(credentials)
         Config.after_failed_login.each {|c| self.send(c, credentials)}
       end
-      
+
       def before_logout!(user)
         Config.before_logout.each {|c| self.send(c, user)}
       end
-      
+
       def after_logout!
         Config.after_logout.each {|c| self.send(c)}
       end
-      
+
       def user_class
         @user_class ||= Config.user_class.to_s.constantize
       end
+
     end
-    
+
     module Config
       class << self
         attr_accessor :submodules,
-                      :user_class,                    # what class to use as the user class. 
+                      :user_class,                    # what class to use as the user class.
                       :not_authenticated_action,      # what controller action to call for non-authenticated users.
-                      
+
                       :save_return_to_url,            # when a non logged in user tries to enter a page that requires
-                                                      # login, save the URL he wanted to reach, 
+                                                      # login, save the URL he wanted to reach,
                                                       # and send him there after login.
-                      
+
+                      :cookie_domain,                 # set domain option for cookies
+
                       :login_sources,
                       :after_login,
                       :after_failed_login,
                       :before_logout,
-                      :after_logout             
-        
+                      :after_logout
+
         def init!
           @defaults = {
             :@user_class                           => nil,
@@ -141,31 +161,32 @@ module Sorcery
             :@after_failed_login                   => [],
             :@before_logout                        => [],
             :@after_logout                         => [],
-            :@save_return_to_url                   => true
+            :@save_return_to_url                   => true,
+            :@cookie_domain                        => nil
           }
         end
-        
+
         # Resets all configuration options to their default values.
         def reset!
           @defaults.each do |k,v|
             instance_variable_set(k,v)
-          end       
+          end
         end
-        
+
         def update!
           @defaults.each do |k,v|
             instance_variable_set(k,v) if !instance_variable_defined?(k)
           end
         end
-        
+
         def user_config(&blk)
           block_given? ? @user_config = blk : @user_config
         end
-        
+
         def configure(&blk)
           @configure_blk = blk
         end
-        
+
         def configure!
           @configure_blk.call(self) if @configure_blk
         end
@@ -174,4 +195,4 @@ module Sorcery
       reset!
     end
   end
-end
+end

data/lib/sorcery/crypto_providers/aes256.rb

@@ -28,12 +28,16 @@ module Sorcery
         end
     
         def matches?(crypted, *tokens)
-          aes.decrypt
-          aes.key = @key
-          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
+          decrypt(crypted) == tokens.join
         rescue OpenSSL::CipherError
           false
         end
+        
+        def decrypt(crypted)
+          aes.decrypt
+          aes.key = @key
+          (aes.update(crypted.unpack("m").first) + aes.final)
+        end
     
         private
         

data/lib/sorcery/engine.rb

@@ -10,6 +10,7 @@ module Sorcery
     initializer "extend Controller with sorcery" do |app|
       ActionController::Base.send(:include, Sorcery::Controller)
       ActionController::Base.helper_method :current_user
+      ActionController::Base.helper_method :logged_in?
     end
     
     rake_tasks do

data/lib/sorcery/model/adapters/active_record.rb

@@ -8,7 +8,8 @@ module Sorcery
 
         module ClassMethods
           def find_by_credentials(credentials)
-            where("#{@sorcery_config.username_attribute_name} = ?", credentials[0]).first
+             sql = @sorcery_config.username_attribute_names.map{|attribute| "#{attribute} = :login"}
+             where(sql.join(' OR '), :login => credentials[0]).first
           end
 
           def find_by_sorcery_token(token_attr_name, token)

data/lib/sorcery/model/adapters/mongo_mapper.rb

@@ -0,0 +1,49 @@
+module Sorcery
+  module Model
+    module Adapters
+      module MongoMapper
+        extend ActiveSupport::Concern
+        
+        included do
+          include Sorcery::Model
+        end
+        
+        module InstanceMethods
+          def increment(attr)
+            self.inc(attr,1)
+          end
+          
+          def save!(options = {})
+            save(options)
+          end
+        end
+
+        module ClassMethods
+          def find_by_credentials(credentials)
+            @sorcery_config.username_attribute_names.each do |attribute|
+              @user = where(attribute => credentials[0]).first
+              break if @user
+            end
+            @user
+          end
+          
+          def find_by_id(id)
+            find(id)
+          end
+          
+          def find_by_activation_token(token)
+            where(sorcery_config.activation_token_attribute_name => token).first
+          end
+          
+          def transaction(&blk)
+            tap(&blk)
+          end
+          
+          def find_by_sorcery_token(token_attr_name, token)
+            where(token_attr_name => token).first
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -15,7 +15,11 @@ module Sorcery
 
         module ClassMethods
           def find_by_credentials(credentials)
-            where(sorcery_config.username_attribute_name => credentials[0]).first
+            @sorcery_config.username_attribute_names.each do |attribute|
+              @user = where(attribute => credentials[0]).first
+              break if @user
+            end
+            @user
           end
 
           def find_by_provider_and_uid(provider, uid)
@@ -36,7 +40,8 @@ module Sorcery
           end
 
           def find_by_username(username)
-            where(sorcery_config.username_attribute_name => username).first
+            query = sorcery_config.username_attribute_names.map {|name| {name => username}}
+            any_of(*query).first
           end
 
           def transaction(&blk)

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -26,6 +26,9 @@ module Sorcery
           
           base.sorcery_config.before_authenticate << :prevent_locked_user_login
           base.sorcery_config.after_config << :define_brute_force_protection_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_brute_force_protection_mongo_mapper_fields
+          end
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
         end
@@ -37,6 +40,11 @@ module Sorcery
             field sorcery_config.failed_logins_count_attribute_name,  :type => Integer
             field sorcery_config.lock_expires_at_attribute_name,      :type => DateTime
           end
+
+          def define_brute_force_protection_mongo_mapper_fields
+            key sorcery_config.failed_logins_count_attribute_name, Integer
+            key sorcery_config.lock_expires_at_attribute_name, DateTime
+          end
         end
         
         module InstanceMethods
@@ -54,13 +62,15 @@ module Sorcery
 
           def lock!
             config = sorcery_config
-            self.update_attributes!(config.lock_expires_at_attribute_name => Time.now.utc + config.login_lock_time_period)
+            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.utc + config.login_lock_time_period)
+            self.save!
           end
 
           def unlock!
             config = sorcery_config
-            self.update_attributes!(config.lock_expires_at_attribute_name => nil, 
-                                    config.failed_logins_count_attribute_name => 0)
+            self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
+            self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
+            self.save!
           end
           
           def unlocked?

data/lib/sorcery/model/submodules/remember_me.rb

@@ -24,7 +24,10 @@ module Sorcery
           base.send(:include, InstanceMethods)
 
           base.sorcery_config.after_config << :define_remember_me_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
-
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_remember_me_mongo_mapper_fields
+          end
+          
           base.extend(ClassMethods)
         end
 
@@ -36,13 +39,17 @@ module Sorcery
             field sorcery_config.remember_me_token_expires_at_attribute_name, :type => Time
           end
 
+          def define_remember_me_mongo_mapper_fields
+            key sorcery_config.remember_me_token_attribute_name, String
+            key sorcery_config.remember_me_token_expires_at_attribute_name, Time
+          end
         end
 
         module InstanceMethods
           # You shouldn't really use this one yourself - it's called by the controller's 'remember_me!' method.
           def remember_me!
             config = sorcery_config
-            self.send(:"#{config.remember_me_token_attribute_name}=", generate_random_token)
+            self.send(:"#{config.remember_me_token_attribute_name}=", TemporaryToken.generate_random_token)
             self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", Time.now + config.remember_me_for)
             self.save!(:validate => false)
           end