sorcery 0.6.1 → 0.7.10

data/lib/sorcery/controller/submodules/external/protocols/oauth2.rb

@@ -8,19 +8,38 @@ module Sorcery
             def oauth_version
               "2.0"
             end
-          
-            def authorize_url(*args)
-              client = ::OAuth2::Client.new(@key, @secret, :site => @site)
-              client.web_server.authorize_url(:redirect_uri => @callback_url, :scope => @scope)
+
+            def authorize_url(options = {})
+              client = build_client(options)
+              client.auth_code.authorize_url(
+                :redirect_uri => @callback_url,
+                :scope => @scope,
+                :display => @display
+              )
             end
-          
-            def get_access_token(args)
-              client = ::OAuth2::Client.new(@key, @secret, :site => @site)
-              client.web_server.get_access_token(args[:code], :redirect_uri => @callback_url)
+
+            def get_access_token(args, options = {})
+              client = build_client(options)
+              client.auth_code.get_token(
+                args[:code],
+                { :redirect_uri => @callback_url, :parse => options.delete(:parse) }, options
+              )
+            end
+
+            def build_client(options = {})
+              defaults = {
+                :site => @site,
+                :ssl => { :ca_file => Config.ca_file }
+              }
+              ::OAuth2::Client.new(
+                @key,
+                @secret,
+                defaults.merge!(options)
+              )
             end
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/controller/submodules/external/providers/facebook.rb

@@ -34,8 +34,10 @@ module Sorcery
                               :site,
                               :user_info_path,
                               :scope,
-                              :user_info_mapping
-                            
+                              :user_info_mapping,
+                              :display
+                attr_reader   :access_token
+
                 include Protocols::Oauth2
             
                 def init
@@ -43,12 +45,17 @@ module Sorcery
                   @user_info_path = "/me"
                   @scope          = "email,offline_access"
                   @user_info_mapping = {}
+                  @display        = "page"
+                  @token_url      = "oauth/access_token"
+                  @mode           = :query
+                  @parse          = :query
+                  @param_name     = "access_token"
                 end
                 
                 def get_user_hash
                   user_hash = {}
                   response = @access_token.get(@user_info_path)
-                  user_hash[:user_info] = JSON.parse(response)
+                  user_hash[:user_info] = JSON.parse(response.body)
                   user_hash[:uid] = user_hash[:user_info]['id']
                   user_hash
                 end
@@ -66,8 +73,9 @@ module Sorcery
                 # tries to login the user from access token
                 def process_callback(params,session)
                   args = {}
+                  options = { :token_url => @token_url, :mode => @mode, :param_name => @param_name, :parse => @parse }
                   args.merge!({:code => params[:code]}) if params[:code]
-                  @access_token = self.get_access_token(args)
+                  @access_token = self.get_access_token(args, options)
                 end
                 
               end

data/lib/sorcery/controller/submodules/external/providers/github.rb

@@ -0,0 +1,89 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module External
+        module Providers
+          # This module adds support for OAuth with github.com.
+          # When included in the 'config.providers' option, it adds a new option, 'config.github'.
+          # Via this new option you can configure Github specific settings like your app's key and secret.
+          #
+          #   config.github.key = <key>
+          #   config.github.secret = <secret>
+          #   ...
+          #
+          module Github
+            def self.included(base)
+              base.module_eval do
+                class << self
+                  attr_reader :github                           # access to github_client.
+
+                  def merge_github_defaults!
+                    @defaults.merge!(:@github => GithubClient)
+                  end
+                end
+                merge_github_defaults!
+                update!
+              end
+            end
+
+            module GithubClient
+              class << self
+                attr_accessor :key,
+                              :secret,
+                              :callback_url,
+                              :auth_path,
+                              :token_path,
+                              :site,
+                              :user_info_path,
+                              :user_info_mapping
+                attr_reader   :access_token
+
+                include Protocols::Oauth2
+
+                def init
+                  @site           = "https://github.com/"
+                  @user_info_path = "https://api.github.com/user"
+                  @auth_path      = "/login/oauth/authorize"
+                  @token_path     = "/login/oauth/access_token"
+                  @user_info_mapping = {}
+                end
+
+                def get_user_hash
+                  user_hash = {}
+                  response = @access_token.get(@user_info_path)
+                  user_hash[:user_info] = JSON.parse(response.body)
+                  user_hash[:uid] = user_hash[:user_info]['id']
+                  user_hash
+                end
+
+                def has_callback?
+                  true
+                end
+
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  self.authorize_url({:authorize_url => @auth_path})
+                end
+
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  options = {
+                    :token_url    => @token_path,
+                    :token_method => :post
+                  }
+                  @access_token = self.get_access_token(args, options)
+                end
+
+              end
+              init
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/external/providers/google.rb

@@ -0,0 +1,90 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module External
+        module Providers
+          # This module adds support for OAuth with google.com.
+          # When included in the 'config.providers' option, it adds a new option, 'config.google'.
+          # Via this new option you can configure Google specific settings like your app's key and secret.
+          #
+          #   config.google.key = <key>
+          #   config.google.secret = <secret>
+          #   ...
+          #
+          module Google
+            def self.included(base)
+              base.module_eval do
+                class << self
+                  attr_reader :google                           # access to google_client.
+
+                  def merge_google_defaults!
+                    @defaults.merge!(:@google => GoogleClient)
+                  end
+                end
+                merge_google_defaults!
+                update!
+              end
+            end
+
+            module GoogleClient
+              class << self
+                attr_accessor :key,
+                              :secret,
+                              :callback_url,
+                              :site,
+                              :auth_url,
+                              :token_path,
+                              :user_info_url,
+                              :scope,
+                              :user_info_mapping
+                attr_reader   :access_token
+
+                include Protocols::Oauth2
+
+                def init
+                  @site              = "https://accounts.google.com"
+                  @auth_url          = "/o/oauth2/auth"
+                  @token_url         = "/o/oauth2/token"
+                  @user_info_url     = "https://www.googleapis.com/oauth2/v1/userinfo"
+                  @scope             = "https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile"
+                  @user_info_mapping = {}
+                end
+
+                def get_user_hash
+                  user_hash = {}
+                  response = @access_token.get(@user_info_url)
+                  user_hash[:user_info] = JSON.parse(response.body)
+                  user_hash[:uid] = user_hash[:user_info]['id']
+                  user_hash
+                end
+
+                def has_callback?
+                  true
+                end
+
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  self.authorize_url({:authorize_url => @auth_url})
+                end
+
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  options = {
+                    :token_url => @token_url,
+                    :token_method => :post
+                  }
+                  @access_token = self.get_access_token(args, options)
+                end
+              end
+              init
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/external/providers/liveid.rb

@@ -0,0 +1,91 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module External
+        module Providers
+          # This module adds support for OAuth with microsoft liveid
+          # When included in the 'config.providers' option, it adds a new option, 'config.liveid'.
+          # Via this new option you can configure LiveId specific settings like your app's key and secret.
+          #
+          #   config.liveid.key = <key>
+          #   config.liveid.secret = <secret>
+          #   ...
+          #
+          module Liveid
+            def self.included(base)
+              base.module_eval do
+                class << self
+                  attr_reader :liveid                           # access to liveid_client.
+
+                  def merge_liveid_defaults!
+                    @defaults.merge!(:@liveid => LiveidClient)
+                  end
+                end
+                merge_liveid_defaults!
+                update!
+              end
+            end
+
+            module LiveidClient
+              class << self
+                attr_accessor :key,
+                              :secret,
+                              :callback_url,
+                              :site,
+                              :auth_url,
+                              :token_path,
+                              :user_info_url,
+                              :scope,
+                              :user_info_mapping
+                attr_reader   :access_token
+
+                include Protocols::Oauth2
+
+                def init
+                  @site              = "https://oauth.live.com/"
+                  @auth_url          = "/authorize"
+                  @token_path        = "/token"
+                  @user_info_url     = "https://apis.live.net/v5.0/me"
+                  @scope             = "wl.basic wl.emails wl.offline_access"
+                  @user_info_mapping = {}
+                end
+
+                def get_user_hash
+                  user_hash = {}
+                  @access_token.token_param = "access_token"
+                  response = @access_token.get(@user_info_url)
+                  user_hash[:user_info] = JSON.parse(response.body)
+                  user_hash[:uid] = user_hash[:user_info]['id']
+                  user_hash
+                end
+
+                def has_callback?
+                  true
+                end
+
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  self.authorize_url({:authorize_url => @auth_url})
+                end
+
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  options = {
+                    :access_token_path => @token_path,
+                    :access_token_method => :post
+                  }
+                  @access_token = self.get_access_token(args, options)
+                end
+              end
+              init
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/external/providers/twitter.rb

@@ -37,8 +37,14 @@ module Sorcery
                               :site,
                               :user_info_path,
                               :user_info_mapping
-                
+                attr_reader   :access_token
+
                 include Protocols::Oauth1
+				
+				        # Override included get_consumer method to provide authorize_path
+				        def get_consumer
+                  ::OAuth::Consumer.new(@key, @secret, :site => @site, :authorize_path => "/oauth/authenticate")
+                end
                 
                 def init
                   @site           = "https://api.twitter.com"
@@ -50,7 +56,7 @@ module Sorcery
                   user_hash = {}
                   response = @access_token.get(@user_info_path)
                   user_hash[:user_info] = JSON.parse(response.body)
-                  user_hash[:uid] = user_hash[:user_info]['id']
+                  user_hash[:uid] = user_hash[:user_info]['id'].to_s
                   user_hash
                 end
                 

data/lib/sorcery/controller/submodules/external.rb

@@ -9,9 +9,11 @@ module Sorcery
           Config.module_eval do
             class << self
               attr_reader :external_providers                           # external providers like twitter.
+              attr_accessor :ca_file                                    # path to ca_file. By default use a internal ca-bundle.crt.
                                           
               def merge_external_defaults!
-                @defaults.merge!(:@external_providers => [])
+                @defaults.merge!(:@external_providers => [],
+                                 :@ca_file => File.join(File.expand_path(File.dirname(__FILE__)), 'external/protocols/certs/ca-bundle.crt'))
               end
               
               def external_providers=(providers)
@@ -43,12 +45,18 @@ module Sorcery
             @provider = Config.send(provider)
             @provider.process_callback(params,session)
             @user_hash = @provider.get_user_hash
-            if user = user_class.load_from_provider(provider,@user_hash[:uid])
+            if user = user_class.load_from_provider(provider,@user_hash[:uid].to_s)
               reset_session
-              login_user(user)
+              auto_login(user)
               user
             end
           end
+
+          # get provider access account
+          def access_token(provider)
+            @provider = Config.send(provider)
+            @provider.access_token
+          end
           
           # this method automatically creates a new user from the data in the external user hash.
           # The mappings from user hash fields to user db fields are set at controller config.
@@ -61,6 +69,7 @@ module Sorcery
           #   {:username => "user/name"}
           #
           # And this will cause 'moishe' to be set as the value of :username field.
+          # Note: Be careful. This method skips validations model.
           def create_from(provider)
             provider = provider.to_sym
             @provider = Config.send(provider)
@@ -76,7 +85,11 @@ module Sorcery
               end
             end
             user_class.transaction do
-              @user = user_class.create!(attrs)
+              @user = user_class.new()
+              attrs.each do |k,v|
+                @user.send(:"#{k}=", v)
+              end
+              @user.save(:validate => false)
               user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider, config.provider_uid_attribute_name => @user_hash[:uid]})
             end
             @user

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -46,7 +46,7 @@ module Sorcery
           def login_from_basic_auth
             authenticate_with_http_basic do |username, password|
               @current_user = (user_class.authenticate(username, password) if session[:http_authentication_used]) || false
-              login_user(@current_user) if @current_user
+              auto_login(@current_user) if @current_user
               @current_user
             end
           end

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -1,7 +1,7 @@
 module Sorcery
   module Controller
     module Submodules
-      # The Remember Me submodule takes care of setting the user's cookie so that he will 
+      # The Remember Me submodule takes care of setting the user's cookie so that he will
       # be automatically logged in to the site on every visit,
       # until the cookie expires.
       # See Sorcery::Model::Submodules::RememberMe for configuration options.
@@ -12,45 +12,56 @@ module Sorcery
           Config.after_login << :remember_me_if_asked_to
           Config.after_logout << :forget_me!
         end
-        
+
         module InstanceMethods
           # This method sets the cookie and calls the user to save the token and the expiration to db.
           def remember_me!
             current_user.remember_me!
-            set_remember_me_cookie!(current_user)      
+            set_remember_me_cookie!(current_user)
           end
 
           # Clears the cookie and clears the token from the db.
           def forget_me!
-            current_user.forget_me!
-            cookies[:remember_me_token] = nil
+            @current_user.forget_me!
+            cookies.delete(:remember_me_token, :domain => Config.cookie_domain)
+          end
+
+          # Override.
+          # logins a user instance, and optionally remembers him.
+          def auto_login(user, should_remember = false)
+            session[:user_id] = user.id
+            @current_user = user
+            remember_me! if should_remember
           end
-          
+
           protected
-          
+
           # calls remember_me! if a third credential was passed to the login method.
           # Runs as a hook after login.
           def remember_me_if_asked_to(user, credentials)
-            remember_me! if credentials.size == 3 && credentials[2]
+            remember_me! if ( credentials.size == 3 && credentials[2] && credentials[2] != "0" )
           end
-          
-          # Checks the cookie for a remember me token, tried to find a user with that token 
+
+          # Checks the cookie for a remember me token, tried to find a user with that token
           # and logs the user in if found.
           # Runs as a login source. See 'current_user' method for how it is used.
           def login_from_cookie
-            user = cookies[:remember_me_token] && user_class.find_by_remember_me_token(cookies[:remember_me_token])
+            user = cookies.signed[:remember_me_token] && user_class.find_by_remember_me_token(cookies.signed[:remember_me_token])
             if user && user.remember_me_token?
               set_remember_me_cookie!(user)
+              session[:user_id] = user.id
               @current_user = user
             else
               @current_user = false
             end
           end
-          
+
           def set_remember_me_cookie!(user)
-            cookies[:remember_me_token] = { 
-              :value => user.send(user.sorcery_config.remember_me_token_attribute_name), 
-              :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name)
+            cookies.signed[:remember_me_token] = {
+              :value => user.send(user.sorcery_config.remember_me_token_attribute_name),
+              :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name),
+              :httponly => true,
+              :domain => Config.cookie_domain
             }
           end
         end

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -30,18 +30,18 @@ module Sorcery
           # Registers last login to be used as the timeout starting point.
           # Runs as a hook after a successful login.
           def register_login_time(user, credentials)
-            session[:login_time] = session[:last_action_time] = Time.now.utc
+            session[:login_time] = session[:last_action_time] = Time.now.in_time_zone
           end
           
           # Checks if session timeout was reached and expires the current session if so.
           # To be used as a before_filter, before require_login
           def validate_session
             session_to_use = Config.session_timeout_from_last_action ? session[:last_action_time] : session[:login_time]
-            if session_to_use && (Time.now.utc - session_to_use > Config.session_timeout)
+            if session_to_use && (Time.now.in_time_zone - session_to_use > Config.session_timeout)
               reset_session
-              @current_user = false
+              @current_user = nil
             else
-              session[:last_action_time] = Time.now.utc
+              session[:last_action_time] = Time.now.in_time_zone
             end
           end