sorcery 0.6.1 → 0.7.10

data/lib/sorcery/controller.rb

@@ -5,7 +5,7 @@ module Sorcery
         include InstanceMethods
         Config.submodules.each do |mod|
           begin
-            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
+            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
           rescue NameError
             # don't stop on a missing submodule.
           end
@@ -14,7 +14,7 @@ module Sorcery
       Config.update!
       Config.configure!
     end
-    
+
     module InstanceMethods
       # To be used as before_filter.
       # Will trigger auto-login attempts via the call to logged_in?
@@ -22,19 +22,20 @@ module Sorcery
       def require_login
         if !logged_in?
           session[:return_to_url] = request.url if Config.save_return_to_url
-          self.send(Config.not_authenticated_action) 
+          self.send(Config.not_authenticated_action)
         end
       end
-      
+
       # Takes credentials and returns a user on successful authentication.
       # Runs hooks after login or failed login.
       def login(*credentials)
+        @current_user = nil
         user = user_class.authenticate(*credentials)
         if user
           return_to_url = session[:return_to_url]
           reset_session # protect from session fixation attacks
           session[:return_to_url] = return_to_url
-          login_user(user)
+          auto_login(user)
           after_login!(user, credentials)
           current_user
         else
@@ -42,41 +43,63 @@ module Sorcery
           nil
         end
       end
-      
+
       # Resets the session and runs hooks before and after.
       def logout
         if logged_in?
           before_logout!(current_user)
           reset_session
           after_logout!
+          @current_user = nil
         end
       end
-      
+
       def logged_in?
         !!current_user
       end
-      
+
       # attempts to auto-login from the sources defined (session, basic_auth, cookie, etc.)
       # returns the logged in user if found, false if not (using old restful-authentication trick, nil != false).
       def current_user
         @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
       end
-      
-      # used when a user tries to access a page while logged out, is asked to login, 
+
+      def current_user=(user)
+        @current_user = user
+      end
+
+      # used when a user tries to access a page while logged out, is asked to login,
       # and we want to return him back to the page he originally wanted.
       def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
+        session[:return_to_url] = nil
       end
-      
+
       # The default action for denying non-authenticated users.
       # You can override this method in your controllers,
       # or provide a different method in the configuration.
       def not_authenticated
         redirect_to root_path
       end
-      
+
+      # login a user instance
+      #
+      # @param [<User-Model>] user the user instance.
+      # @return - do not depend on the return value.
+      def auto_login(user)
+        session[:user_id] = user.id
+        @current_user = user
+      end
+
+      # Overwrite Rails' handle unverified request
+      def handle_unverified_request
+        cookies[:remember_me_token] = nil
+        @current_user = nil
+        super # call the default behaviour which resets the session
+      end
+
       protected
-      
+
       # Tries all available sources (methods) until one doesn't return false.
       def login_from_other_sources
         result = nil
@@ -85,52 +108,51 @@ module Sorcery
         end
         result || false
       end
-      
-      def login_user(user)
-        session[:user_id] = user.id
-      end
-      
+
       def login_from_session
         @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
       end
-      
+
       def after_login!(user, credentials)
         Config.after_login.each {|c| self.send(c, user, credentials)}
       end
-      
+
       def after_failed_login!(credentials)
         Config.after_failed_login.each {|c| self.send(c, credentials)}
       end
-      
+
       def before_logout!(user)
         Config.before_logout.each {|c| self.send(c, user)}
       end
-      
+
       def after_logout!
         Config.after_logout.each {|c| self.send(c)}
       end
-      
+
       def user_class
         @user_class ||= Config.user_class.to_s.constantize
       end
+
     end
-    
+
     module Config
       class << self
         attr_accessor :submodules,
-                      :user_class,                    # what class to use as the user class. 
+                      :user_class,                    # what class to use as the user class.
                       :not_authenticated_action,      # what controller action to call for non-authenticated users.
-                      
+
                       :save_return_to_url,            # when a non logged in user tries to enter a page that requires
-                                                      # login, save the URL he wanted to reach, 
+                                                      # login, save the URL he wanted to reach,
                                                       # and send him there after login.
-                      
+
+                      :cookie_domain,                 # set domain option for cookies
+
                       :login_sources,
                       :after_login,
                       :after_failed_login,
                       :before_logout,
-                      :after_logout             
-        
+                      :after_logout
+
         def init!
           @defaults = {
             :@user_class                           => nil,
@@ -141,31 +163,32 @@ module Sorcery
             :@after_failed_login                   => [],
             :@before_logout                        => [],
             :@after_logout                         => [],
-            :@save_return_to_url                   => true
+            :@save_return_to_url                   => true,
+            :@cookie_domain                        => nil
           }
         end
-        
+
         # Resets all configuration options to their default values.
         def reset!
           @defaults.each do |k,v|
             instance_variable_set(k,v)
-          end       
+          end
         end
-        
+
         def update!
           @defaults.each do |k,v|
             instance_variable_set(k,v) if !instance_variable_defined?(k)
           end
         end
-        
+
         def user_config(&blk)
           block_given? ? @user_config = blk : @user_config
         end
-        
+
         def configure(&blk)
           @configure_blk = blk
         end
-        
+
         def configure!
           @configure_blk.call(self) if @configure_blk
         end
@@ -174,4 +197,4 @@ module Sorcery
       reset!
     end
   end
-end
+end

data/lib/sorcery/crypto_providers/aes256.rb

@@ -28,12 +28,16 @@ module Sorcery
         end
     
         def matches?(crypted, *tokens)
-          aes.decrypt
-          aes.key = @key
-          (aes.update(crypted.unpack("m").first) + aes.final) == tokens.join
+          decrypt(crypted) == tokens.join
         rescue OpenSSL::CipherError
           false
         end
+        
+        def decrypt(crypted)
+          aes.decrypt
+          aes.key = @key
+          (aes.update(crypted.unpack("m").first) + aes.final)
+        end
     
         private
         

data/lib/sorcery/engine.rb

@@ -10,6 +10,7 @@ module Sorcery
     initializer "extend Controller with sorcery" do |app|
       ActionController::Base.send(:include, Sorcery::Controller)
       ActionController::Base.helper_method :current_user
+      ActionController::Base.helper_method :logged_in?
     end
     
     rake_tasks do

data/lib/sorcery/model/adapters/active_record.rb

@@ -4,11 +4,27 @@ module Sorcery
       module ActiveRecord
         def self.included(klass)
           klass.extend ClassMethods
+          klass.send(:include, InstanceMethods)
         end
 
+        module InstanceMethods
+          def update_single_attribute(name, value)
+            self.send(:"#{name}=", value)
+            
+            primary_key = self.class.primary_key
+            self.class.where(:"#{primary_key}" => self.send(:"#{primary_key}")).update_all(name => value)
+          end
+        end
+        
         module ClassMethods
+          def column_name(attribute)
+            return "LOWER(#{attribute})" if (@sorcery_config.downcase_username_before_authenticating)
+            return "#{attribute}"
+          end
+
           def find_by_credentials(credentials)
-            where("#{@sorcery_config.username_attribute_name} = ?", credentials[0]).first
+             sql = @sorcery_config.username_attribute_names.map{|attribute| column_name(attribute) + " = :login"}
+             where(sql.join(' OR '), :login => credentials[0]).first
           end
 
           def find_by_sorcery_token(token_attr_name, token)

data/lib/sorcery/model/adapters/mongo_mapper.rb

@@ -0,0 +1,54 @@
+module Sorcery
+  module Model
+    module Adapters
+      module MongoMapper
+        extend ActiveSupport::Concern
+        
+        included do
+          include Sorcery::Model
+        end
+        
+        module InstanceMethods
+          def increment(attr)
+            self.class.increment(id, attr => 1)
+          end
+          
+          def save!(options = {})
+            save(options)
+          end
+        end
+
+        module ClassMethods
+          def credential_regex(credential)
+            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
+            return credential
+          end
+
+          def find_by_credentials(credentials)
+            @sorcery_config.username_attribute_names.each do |attribute|
+              @user = where(attribute => credential_regex(credentials[0])).first
+              break if @user
+            end
+            @user
+          end
+          
+          def find_by_id(id)
+            find(id)
+          end
+          
+          def find_by_activation_token(token)
+            where(sorcery_config.activation_token_attribute_name => token).first
+          end
+          
+          def transaction(&blk)
+            tap(&blk)
+          end
+          
+          def find_by_sorcery_token(token_attr_name, token)
+            where(token_attr_name => token).first
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -11,11 +11,26 @@ module Sorcery
           def increment(attr)
             self.inc(attr,1)
           end
+          
+          def update_single_attribute(name, value)
+            value = value.utc if value.is_a?(ActiveSupport::TimeWithZone)
+            self.send(:"#{name}=", value)
+            self.class.where(:_id => self.id).update_all(name => value)
+          end
         end
 
         module ClassMethods
+          def credential_regex(credential)
+            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
+            return credential
+          end
+
           def find_by_credentials(credentials)
-            where(sorcery_config.username_attribute_name => credentials[0]).first
+            @sorcery_config.username_attribute_names.each do |attribute|
+              @user = where(attribute => credential_regex(credentials[0])).first
+              break if @user
+            end
+            @user
           end
 
           def find_by_provider_and_uid(provider, uid)
@@ -25,6 +40,8 @@ module Sorcery
 
           def find_by_id(id)
             find(id)
+          rescue ::Mongoid::Errors::DocumentNotFound
+            nil
           end
 
           def find_by_activation_token(token)
@@ -36,7 +53,8 @@ module Sorcery
           end
 
           def find_by_username(username)
-            where(sorcery_config.username_attribute_name => username).first
+            query = sorcery_config.username_attribute_names.map {|name| {name => username}}
+            any_of(*query).first
           end
 
           def transaction(&blk)
@@ -54,8 +72,8 @@ module Sorcery
           def get_current_users
             config = sorcery_config
             where(config.last_activity_at_attribute_name.ne => nil) \
-            .any_of({config.last_logout_at_attribute_name => nil},{config.last_activity_at_attribute_name.gt => config.last_logout_at_attribute_name}) \
-            .and(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc.to_s(:db)).order_by([:_id,:asc])
+            .where("this.#{config.last_logout_at_attribute_name} == null || this.#{config.last_activity_at_attribute_name} > this.#{config.last_logout_at_attribute_name}") \
+            .where(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc).order_by([:_id,:asc])
           end
         end
       end

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -39,12 +39,12 @@ module Sorcery
           protected
 
           def define_activity_logging_mongoid_fields
-            field sorcery_config.last_login_at_attribute_name,    :type => DateTime
-            field sorcery_config.last_logout_at_attribute_name,   :type => DateTime
-            field sorcery_config.last_activity_at_attribute_name, :type => DateTime
+            field sorcery_config.last_login_at_attribute_name,    :type => Time
+            field sorcery_config.last_logout_at_attribute_name,   :type => Time
+            field sorcery_config.last_activity_at_attribute_name, :type => Time
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -12,30 +12,58 @@ module Sorcery
                           :lock_expires_at_attribute_name,            # this field indicates whether user 
                                                                       # is banned and when it will be active again.
                           :consecutive_login_retries_amount_limit,    # how many failed logins allowed.
-                          :login_lock_time_period                     # how long the user should be banned. 
+                          :login_lock_time_period,                    # how long the user should be banned. 
                                                                       # in seconds. 0 for permanent.
+
+                          :unlock_token_attribute_name,               # Unlock token attribute name
+                          :unlock_token_email_method_name,            # Mailer method name
+                          :unlock_token_mailer_disabled,              # When true, dont send unlock token via email
+                          :unlock_token_mailer                        # Mailer class
           end
           
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@failed_logins_count_attribute_name              => :failed_logins_count,
                              :@lock_expires_at_attribute_name                  => :lock_expires_at,
                              :@consecutive_login_retries_amount_limit          => 50,
-                             :@login_lock_time_period                          => 60 * 60)
+                             :@login_lock_time_period                          => 60 * 60,
+
+                             :@unlock_token_attribute_name                     => :unlock_token,
+                             :@unlock_token_email_method_name                  => :send_unlock_token_email,
+                             :@unlock_token_mailer_disabled                    => false,
+                             :@unlock_token_mailer                             => nil)
             reset!
           end
           
           base.sorcery_config.before_authenticate << :prevent_locked_user_login
           base.sorcery_config.after_config << :define_brute_force_protection_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_brute_force_protection_mongo_mapper_fields
+          end
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
+
+          base.class_eval do
+            after_update :send_unlock_token_email!, :if => Proc.new { |user| user.send(sorcery_config.unlock_token_attribute_name).present? }
+          end
         end
         
         module ClassMethods
+          def load_from_unlock_token(token)
+            return nil if token.blank?
+            user = find_by_sorcery_token(sorcery_config.unlock_token_attribute_name,token)
+            user
+          end
+
           protected
 
           def define_brute_force_protection_mongoid_fields
-            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer
-            field sorcery_config.lock_expires_at_attribute_name,      :type => DateTime
+            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer, :default => 0
+            field sorcery_config.lock_expires_at_attribute_name,      :type => Time
+          end
+
+          def define_brute_force_protection_mongo_mapper_fields
+            key sorcery_config.failed_logins_count_attribute_name, Integer, :default => 0
+            key sorcery_config.lock_expires_at_attribute_name, Time
           end
         end
         
@@ -46,34 +74,45 @@ module Sorcery
             config = sorcery_config
             return if !unlocked?
             self.increment(config.failed_logins_count_attribute_name)
-            save!
+            self.save!(:validate => false)
             self.lock! if self.send(config.failed_logins_count_attribute_name) >= config.consecutive_login_retries_amount_limit
           end
           
-          protected
-
-          def lock!
+          # /!\
+          # Moved out of protected for use like activate! in controller
+          # /!\
+          def unlock!
             config = sorcery_config
-            self.update_attributes!(config.lock_expires_at_attribute_name => Time.now.utc + config.login_lock_time_period)
+            self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
+            self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
+            self.send(:"#{config.unlock_token_attribute_name}=", nil) unless config.unlock_token_mailer_disabled or config.unlock_token_mailer.nil?
+            self.save!(:validate => false)
           end
 
-          def unlock!
+          protected
+
+          def lock!
             config = sorcery_config
-            self.update_attributes!(config.lock_expires_at_attribute_name => nil, 
-                                    config.failed_logins_count_attribute_name => 0)
+            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.in_time_zone + config.login_lock_time_period)
+            self.send(:"#{config.unlock_token_attribute_name}=", TemporaryToken.generate_random_token) unless config.unlock_token_mailer_disabled or config.unlock_token_mailer.nil?
+            self.save!(:validate => false)
           end
           
           def unlocked?
             config = sorcery_config
             self.send(config.lock_expires_at_attribute_name).nil?
           end
+
+          def send_unlock_token_email!
+            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer) unless sorcery_config.unlock_token_email_method_name.nil? or sorcery_config.unlock_token_mailer_disabled == true
+          end
           
           # Prevents a locked user from logging in, and unlocks users that expired their lock time.
           # Runs as a hook before authenticate.
           def prevent_locked_user_login
             config = sorcery_config
             if !self.unlocked? && config.login_lock_time_period != 0
-              self.unlock! if self.send(config.lock_expires_at_attribute_name) <= Time.now.utc
+              self.unlock! if self.send(config.lock_expires_at_attribute_name) <= Time.now.in_time_zone
             end
             unlocked?
           end
@@ -81,4 +120,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/remember_me.rb

@@ -24,7 +24,10 @@ module Sorcery
           base.send(:include, InstanceMethods)
 
           base.sorcery_config.after_config << :define_remember_me_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
-
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_remember_me_mongo_mapper_fields
+          end
+          
           base.extend(ClassMethods)
         end
 
@@ -36,14 +39,18 @@ module Sorcery
             field sorcery_config.remember_me_token_expires_at_attribute_name, :type => Time
           end
 
+          def define_remember_me_mongo_mapper_fields
+            key sorcery_config.remember_me_token_attribute_name, String
+            key sorcery_config.remember_me_token_expires_at_attribute_name, Time
+          end
         end
 
         module InstanceMethods
           # You shouldn't really use this one yourself - it's called by the controller's 'remember_me!' method.
           def remember_me!
             config = sorcery_config
-            self.send(:"#{config.remember_me_token_attribute_name}=", generate_random_token)
-            self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", Time.now + config.remember_me_for)
+            self.send(:"#{config.remember_me_token_attribute_name}=", TemporaryToken.generate_random_token)
+            self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.remember_me_for)
             self.save!(:validate => false)
           end
           

data/lib/sorcery/model/submodules/reset_password.rb

@@ -18,6 +18,11 @@ module Sorcery
                                                                              # protection.
                                                                              
                           :reset_password_mailer,                            # mailer class. Needed.
+
+                          :reset_password_mailer_disabled,                   # when true sorcery will not automatically
+                                                                             # email password reset details and allow you to
+                                                                             # manually handle how and when email is sent
+
                           :reset_password_email_method_name,                 # reset password email method on your
                                                                              # mailer class.
                                                                              
@@ -34,6 +39,7 @@ module Sorcery
                              :@reset_password_token_expires_at_attribute_name => :reset_password_token_expires_at,
                              :@reset_password_email_sent_at_attribute_name    => :reset_password_email_sent_at,
                              :@reset_password_mailer                          => nil,
+                             :@reset_password_mailer_disabled                 => false,
                              :@reset_password_email_method_name               => :reset_password_email,
                              :@reset_password_expiration_period               => nil,
                              :@reset_password_time_between_emails             => 5 * 60 )
@@ -45,8 +51,10 @@ module Sorcery
 
           base.sorcery_config.after_config << :validate_mailer_defined
           base.sorcery_config.after_config << :define_reset_password_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_reset_password_mongo_mapper_fields
+          end
 
-          base.send(:include, TemporaryToken)
           base.send(:include, InstanceMethods)
 
         end
@@ -62,16 +70,23 @@ module Sorcery
           
           protected
           
-          # This submodule requires the developer to define his own mailer class to be used by it.
+          # This submodule requires the developer to define his own mailer class to be used by it
+          # when reset_password_mailer_disabled is false
           def validate_mailer_defined
             msg = "To use reset_password submodule, you must define a mailer (config.reset_password_mailer = YourMailerClass)."
-            raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil
+            raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil and @sorcery_config.reset_password_mailer_disabled == false
           end
 
           def define_reset_password_mongoid_fields
             field sorcery_config.reset_password_token_attribute_name,             :type => String
-            field sorcery_config.reset_password_token_expires_at_attribute_name,  :type => DateTime
-            field sorcery_config.reset_password_email_sent_at_attribute_name,     :type => DateTime
+            field sorcery_config.reset_password_token_expires_at_attribute_name,  :type => Time
+            field sorcery_config.reset_password_email_sent_at_attribute_name,     :type => Time
+          end
+          
+          def define_reset_password_mongo_mapper_fields
+            key sorcery_config.reset_password_token_attribute_name, String
+            key sorcery_config.reset_password_token_expires_at_attribute_name, Time
+            key sorcery_config.reset_password_email_sent_at_attribute_name, Time
           end
         end
         
@@ -80,13 +95,13 @@ module Sorcery
           def deliver_reset_password_instructions!
             config = sorcery_config
             # hammering protection
-            return if config.reset_password_time_between_emails && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.ago.utc
-            self.send(:"#{config.reset_password_token_attribute_name}=", generate_random_token)
-            self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", Time.now.utc + config.reset_password_expiration_period) if config.reset_password_expiration_period
-            self.send(:"#{config.reset_password_email_sent_at_attribute_name}=", Time.now.utc)
+            return false if config.reset_password_time_between_emails && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.ago.utc
+            self.send(:"#{config.reset_password_token_attribute_name}=", TemporaryToken.generate_random_token)
+            self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.reset_password_expiration_period) if config.reset_password_expiration_period
+            self.send(:"#{config.reset_password_email_sent_at_attribute_name}=", Time.now.in_time_zone)
             self.class.transaction do
               self.save!(:validate => false)
-              generic_send_email(:reset_password_email_method_name, :reset_password_mailer)
+              generic_send_email(:reset_password_email_method_name, :reset_password_mailer) unless config.reset_password_mailer_disabled
             end
           end
           
@@ -110,4 +125,4 @@ module Sorcery
       end
     end
   end
-end
+end