sorcery 0.6.1 → 0.7.10

data/spec/rails3/Gemfile

@@ -1,13 +1,15 @@
 source 'http://rubygems.org'
 
+gem 'bcrypt-ruby', '~> 3.0.0'
 gem 'rails', '3.0.3'
 gem 'sqlite3-ruby', :require => 'sqlite3'
-gem "sorcery", '>= 0.1.0', :path => '../../../'
+gem "sorcery", '>= 0.1.0', :path => '../../'
 
 group :development, :test do
-  gem "rspec", "~> 2.5.0"
-  gem 'rspec-rails', "~> 2.5.0"
+  gem 'rspec-rails', "~> 2.7.0"
   gem 'ruby-debug19'
   gem 'simplecov', '>= 0.3.8', :require => false # Will install simplecov-html as a dependency
   gem 'timecop'
+  gem 'capybara', '~> 1.1.1'
+  gem 'launchy', '~> 2.0.5'
 end

data/spec/rails3/Gemfile.lock

@@ -1,12 +1,11 @@
 PATH
-  remote: ../../../
+  remote: ../../
   specs:
-    sorcery (0.6.0)
+    sorcery (0.7.8)
       bcrypt-ruby (~> 3.0.0)
-      oauth (>= 0.4.4)
-      oauth (>= 0.4.4)
-      oauth2 (>= 0.1.1)
-      oauth2 (>= 0.1.1)
+      bundler (>= 1.1.0)
+      oauth (~> 0.4.4)
+      oauth2 (~> 0.5.1)
 
 GEM
   remote: http://rubygems.org/
@@ -38,39 +37,52 @@ GEM
       activemodel (= 3.0.3)
       activesupport (= 3.0.3)
     activesupport (3.0.3)
-    addressable (2.2.6)
+    addressable (2.2.7)
     archive-tar-minitar (0.5.2)
-    arel (2.0.6)
-    bcrypt-ruby (3.0.0)
+    arel (2.0.10)
+    bcrypt-ruby (3.0.1)
     builder (2.1.2)
-    columnize (0.3.2)
-    diff-lcs (1.1.2)
+    capybara (1.1.2)
+      mime-types (>= 1.16)
+      nokogiri (>= 1.3.3)
+      rack (>= 1.0.0)
+      rack-test (>= 0.5.4)
+      selenium-webdriver (~> 2.0)
+      xpath (~> 0.1.4)
+    childprocess (0.3.1)
+      ffi (~> 1.0.6)
+    columnize (0.3.6)
+    diff-lcs (1.1.3)
     erubis (2.6.6)
       abstract (>= 1.0.0)
-    faraday (0.6.1)
-      addressable (~> 2.2.4)
-      multipart-post (~> 1.1.0)
-      rack (< 2, >= 1.1.0)
-    i18n (0.5.0)
-    linecache19 (0.5.11)
+    faraday (0.7.6)
+      addressable (~> 2.2)
+      multipart-post (~> 1.1)
+      rack (~> 1.1)
+    ffi (1.0.11)
+    i18n (0.6.0)
+    launchy (2.0.5)
+      addressable (~> 2.2.6)
+    linecache19 (0.5.12)
       ruby_core_source (>= 0.1.4)
-    mail (2.2.13)
+    mail (2.2.19)
       activesupport (>= 2.3.6)
       i18n (>= 0.4.0)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
-    mime-types (1.16)
-    multi_json (1.0.3)
-    multipart-post (1.1.3)
+    mime-types (1.17.2)
+    multi_json (1.1.0)
+    multipart-post (1.1.5)
+    nokogiri (1.5.0)
     oauth (0.4.5)
-    oauth2 (0.4.1)
-      faraday (~> 0.6.1)
-      multi_json (>= 0.0.5)
-    polyglot (0.3.1)
-    rack (1.2.1)
-    rack-mount (0.6.13)
+    oauth2 (0.5.2)
+      faraday (~> 0.7)
+      multi_json (~> 1.0)
+    polyglot (0.3.3)
+    rack (1.2.5)
+    rack-mount (0.6.14)
       rack (>= 1.0.0)
-    rack-test (0.5.6)
+    rack-test (0.5.7)
       rack (>= 1.0)
     rails (3.0.3)
       actionmailer (= 3.0.3)
@@ -85,21 +97,21 @@ GEM
       activesupport (= 3.0.3)
       rake (>= 0.8.7)
       thor (~> 0.14.4)
-    rake (0.8.7)
-    rspec (2.5.0)
-      rspec-core (~> 2.5.0)
-      rspec-expectations (~> 2.5.0)
-      rspec-mocks (~> 2.5.0)
-    rspec-core (2.5.1)
-    rspec-expectations (2.5.0)
+    rake (0.9.2.2)
+    rspec (2.7.0)
+      rspec-core (~> 2.7.0)
+      rspec-expectations (~> 2.7.0)
+      rspec-mocks (~> 2.7.0)
+    rspec-core (2.7.1)
+    rspec-expectations (2.7.0)
       diff-lcs (~> 1.1.2)
-    rspec-mocks (2.5.0)
-    rspec-rails (2.5.0)
+    rspec-mocks (2.7.0)
+    rspec-rails (2.7.0)
       actionpack (~> 3.0)
       activesupport (~> 3.0)
       railties (~> 3.0)
-      rspec (~> 2.5.0)
-    ruby-debug-base19 (0.11.24)
+      rspec (~> 2.7.0)
+    ruby-debug-base19 (0.11.25)
       columnize (>= 0.3.1)
       linecache19 (>= 0.5.11)
       ruby_core_source (>= 0.1.4)
@@ -107,25 +119,39 @@ GEM
       columnize (>= 0.3.1)
       linecache19 (>= 0.5.11)
       ruby-debug-base19 (>= 0.11.19)
-    ruby_core_source (0.1.4)
+    ruby_core_source (0.1.5)
       archive-tar-minitar (>= 0.5.2)
-    simplecov (0.3.9)
-      simplecov-html (>= 0.3.7)
-    simplecov-html (0.3.9)
-    sqlite3-ruby (1.3.2)
+    rubyzip (0.9.6.1)
+    selenium-webdriver (2.20.0)
+      childprocess (>= 0.2.5)
+      ffi (~> 1.0)
+      multi_json (~> 1.0)
+      rubyzip
+    simplecov (0.6.1)
+      multi_json (~> 1.0)
+      simplecov-html (~> 0.5.3)
+    simplecov-html (0.5.3)
+    sqlite3 (1.3.5)
+    sqlite3-ruby (1.3.3)
+      sqlite3 (>= 1.3.3)
     thor (0.14.6)
     timecop (0.3.5)
-    treetop (1.4.9)
+    treetop (1.4.10)
+      polyglot
       polyglot (>= 0.3.1)
-    tzinfo (0.3.23)
+    tzinfo (0.3.31)
+    xpath (0.1.4)
+      nokogiri (~> 1.3)
 
 PLATFORMS
   ruby
 
 DEPENDENCIES
+  bcrypt-ruby (~> 3.0.0)
+  capybara (~> 1.1.1)
+  launchy (~> 2.0.5)
   rails (= 3.0.3)
-  rspec (~> 2.5.0)
-  rspec-rails (~> 2.5.0)
+  rspec-rails (~> 2.7.0)
   ruby-debug19
   simplecov (>= 0.3.8)
   sorcery (>= 0.1.0)!

data/spec/rails3/app/controllers/application_controller.rb

@@ -2,78 +2,101 @@ require 'oauth'
 
 class ApplicationController < ActionController::Base
   protect_from_forgery
-  
+
   #before_filter :validate_session, :only => [:test_should_be_logged_in] if defined?(:validate_session)
   before_filter :require_login_from_http_basic, :only => [:test_http_basic_auth]
   before_filter :require_login, :only => [:test_logout, :test_should_be_logged_in, :some_action]
-  
+
   def index
-    render :text => ""
   end
-  
+
   def some_action
     render :nothing => true
   end
+
+  def some_action_making_a_non_persisted_change_to_the_user
+    current_user.username = "to_be_ignored"
+    render :nothing => true
+  end
   
   def test_login
     @user = login(params[:username], params[:password])
     render :text => ""
   end
-  
+
+  def test_auto_login
+    @user = User.find(:first)
+    auto_login(@user)
+    @result = current_user
+    render :text => ""
+  end
+
   def test_return_to
     @user = login(params[:username], params[:password])
     redirect_back_or_to(:index, :notice => 'haha!')
   end
-  
+
   def test_logout
     logout
     render :text => ""
   end
-  
+
   def test_logout_with_remember
     remember_me!
     logout
     render :text => ""
   end
-  
+
   def test_login_with_remember
     @user = login(params[:username], params[:password])
     remember_me!
-    
+
     render :text => ""
   end
-  
+
   def test_login_with_remember_in_login
     @user = login(params[:username], params[:password], params[:remember])
-    
+
     render :text => ""
   end
-  
+
   def test_login_from_cookie
     @user = current_user
     render :text => ""
   end
-  
+
   def test_not_authenticated_action
     render :text => "test_not_authenticated_action"
   end
-  
+
   def test_should_be_logged_in
     render :text => ""
   end
-  
+
   def test_http_basic_auth
     render :text => "HTTP Basic Auth"
   end
-  
+
   def login_at_test
     login_at(:twitter)
   end
-  
+
   def login_at_test2
     login_at(:facebook)
   end
-  
+
+  def login_at_test3
+    login_at(:github)
+  end
+
+  def login_at_test4
+    login_at(:google)
+  end
+
+  def login_at_test5
+    login_at(:liveid)
+  end
+
   def test_login_from
     if @user = login_from(:twitter)
       redirect_to "bla", :notice => "Success!"
@@ -81,7 +104,7 @@ class ApplicationController < ActionController::Base
       redirect_to "blu", :alert => "Failed!"
     end
   end
-  
+
   def test_login_from2
     if @user = login_from(:facebook)
       redirect_to "bla", :notice => "Success!"
@@ -89,7 +112,31 @@ class ApplicationController < ActionController::Base
       redirect_to "blu", :alert => "Failed!"
     end
   end
-  
+
+  def test_login_from3
+    if @user = login_from(:github)
+      redirect_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
+  def test_login_from4
+    if @user = login_from(:google)
+      redirect_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
+  def test_login_from5
+    if @user = login_from(:liveid)
+      redirect_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
   def test_create_from_provider
     provider = params[:provider]
     login_from(provider)
@@ -99,9 +146,9 @@ class ApplicationController < ActionController::Base
       redirect_to "blu", :alert => "Failed!"
     end
   end
-  
+
   protected
-  
-  
+
+
 
 end

data/spec/rails3/app/mailers/sorcery_mailer.rb

@@ -22,4 +22,11 @@ class SorceryMailer < ActionMailer::Base
     mail(:to => user.email,
          :subject => "Your password has been reset")
   end
+
+  def send_unlock_token_email(user)
+    @user = user
+    @url = "http://example.com/unlock/#{user.unlock_token}"
+    mail(:to => user.email,
+         :subject => "Your account has been locked due to many wrong logins")
+  end
 end

data/spec/rails3/app/views/application/index.html.erb

@@ -0,0 +1,17 @@
+<%= form_tag :action => :test_login, :method => :post do %>
+  <div class="field">
+    <%= label_tag :username %><br />
+    <%= text_field_tag :username %>
+  </div>
+  <div class="field">
+    <%= label_tag :password %><br />
+    <%= password_field_tag :password %>
+  </div>
+  <div class="actions">
+    <%= submit_tag "Login" %>
+  </div>
+  <div>
+  	<%= label_tag "keep me logged in" %><br />
+    <%= check_box_tag :remember %>
+  </div>
+<% end %>

data/spec/rails3/app/views/sorcery_mailer/send_unlock_token_email.text.erb

@@ -0,0 +1 @@
+Please visit <% @url %> for unlock your account.

data/spec/rails3/config/environments/in_memory.rb

@@ -0,0 +1,35 @@
+AppRoot::Application.configure do
+  # Settings specified here will take precedence over those in config/application.rb
+
+  # The test environment is used exclusively to run your application's
+  # test suite.  You never need to work with it otherwise.  Remember that
+  # your test database is "scratch space" for the test suite and is wiped
+  # and recreated between test runs.  Don't rely on the data there!
+  config.cache_classes = true
+
+  # Log error messages when you accidentally call methods on nil.
+  config.whiny_nils = true
+
+  # Show full error reports and disable caching
+  config.consider_all_requests_local       = true
+  config.action_controller.perform_caching = false
+
+  # Raise exceptions instead of rendering exception templates
+  config.action_dispatch.show_exceptions = false
+
+  # Disable request forgery protection in test environment
+  config.action_controller.allow_forgery_protection = true
+
+  # Tell Action Mailer not to deliver emails to the real world.
+  # The :test delivery method accumulates sent emails in the
+  # ActionMailer::Base.deliveries array.
+  config.action_mailer.delivery_method = :test
+
+  # Use SQL instead of Active Record's schema dumper when creating the test database.
+  # This is necessary if your schema can't be completely dumped by the schema dumper,
+  # like if you have constraints or database-specific column types
+  # config.active_record.schema_format = :sql
+
+  # Print deprecation notices to the stderr
+  config.active_support.deprecation = :stderr
+end

data/spec/rails3/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb

@@ -2,9 +2,11 @@ class AddBruteForceProtectionToUsers < ActiveRecord::Migration
   def self.up
     add_column :users, :failed_logins_count, :integer, :default => 0
     add_column :users, :lock_expires_at, :datetime, :default => nil
+    add_column :users, :unlock_token, :string, :default => nil
   end
 
   def self.down
+    remove_column :users, :unlock_token
     remove_column :users, :lock_expires_at
     remove_column :users, :failed_logins_count
   end

data/spec/rails3/spec/controller_activity_logging_spec.rb

@@ -30,7 +30,7 @@ describe ApplicationController do
     end
 
     it "should log login time on login" do
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       login_user
       @user.last_login_at.should_not be_nil
       @user.last_login_at.to_s(:db).should >= now.to_s(:db)
@@ -39,7 +39,7 @@ describe ApplicationController do
 
     it "should log logout time on logout" do
       login_user
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       logout_user
       User.first.last_logout_at.should_not be_nil
       User.first.last_logout_at.to_s(:db).should >= now.to_s(:db)
@@ -48,12 +48,19 @@ describe ApplicationController do
 
     it "should log last activity time when logged in" do
       login_user
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       get :some_action
       User.first.last_activity_at.to_s(:db).should >= now.to_s(:db)
       User.first.last_activity_at.to_s(:db).should <= (now+2).to_s(:db)
     end
 
+    it "should update nothing but activity fields" do
+      original_user_name = User.first.username
+      login_user
+      get :some_action_making_a_non_persisted_change_to_the_user
+      User.first.username.should == original_user_name
+    end
+    
     it "'current_users' should hold the user object when 1 user is logged in" do
       login_user
       get :some_action
@@ -78,5 +85,28 @@ describe ApplicationController do
       subject.current_users[1].should == user2
       subject.current_users[2].should == user3
     end
+    
+    it "should not register login time if configured so" do
+      sorcery_controller_property_set(:register_login_time, false)
+      now = Time.now.in_time_zone
+      login_user
+      @user.last_login_at.should be_nil
+    end
+    
+    it "should not register logout time if configured so" do
+      sorcery_controller_property_set(:register_logout_time, false)
+      now = Time.now.in_time_zone
+      login_user
+      logout_user
+      @user.last_logout_at.should be_nil
+    end
+    
+    it "should not register last activity time if configured so" do
+      sorcery_controller_property_set(:register_last_activity_time, false)
+      now = Time.now.in_time_zone
+      login_user
+      get :some_action
+      @user.last_activity_at.should be_nil
+    end
   end
 end

data/spec/rails3/spec/controller_brute_force_protection_spec.rb

@@ -21,12 +21,34 @@ describe ApplicationController do
       sorcery_controller_property_set(:user_class, User)
       Timecop.return
     end
-    
+
     it "should count login retries" do
       3.times {get :test_login, :username => 'gizmo', :password => 'blabla'}
       User.find_by_username('gizmo').failed_logins_count.should == 3
     end
     
+    it "should generate unlock token after user locked" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times {get :test_login, :username => "gizmo", :password => "blabla"}
+      User.find_by_username('gizmo').unlock_token.should_not be_nil
+    end
+
+    it "should unlock after entering unlock token" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times {get :test_login, :username => "gizmo", :password => "blabla"}
+      User.find_by_username('gizmo').unlock_token.should_not be_nil
+      token = User.find_by_username('gizmo').unlock_token
+      user = User.load_from_unlock_token(token)
+      user.should_not be_nil
+      user.unlock!
+      User.load_from_unlock_token(token).should be_nil
+    end
+
+    
     it "should reset the counter on a good login" do
       sorcery_model_property_set(:consecutive_login_retries_amount_limit, 5)
       3.times {get :test_login, :username => 'gizmo', :password => 'blabla'}
@@ -47,7 +69,7 @@ describe ApplicationController do
       get :test_login, :username => 'gizmo', :password => 'blabla'
       get :test_login, :username => 'gizmo', :password => 'blabla'
       User.find_by_username('gizmo').lock_expires_at.should_not be_nil
-      Timecop.travel(Time.now + 0.3)
+      Timecop.travel(Time.now.in_time_zone + 0.3)
       get :test_login, :username => 'gizmo', :password => 'blabla'
       User.find_by_username('gizmo').lock_expires_at.should be_nil
     end
@@ -58,7 +80,7 @@ describe ApplicationController do
       get :test_login, :username => 'gizmo', :password => 'blabla'
       get :test_login, :username => 'gizmo', :password => 'blabla'
       unlock_date = User.find_by_username('gizmo').lock_expires_at
-      Timecop.travel(Time.now + 1)
+      Timecop.travel(Time.now.in_time_zone + 1)
       get :test_login, :username => 'gizmo', :password => 'blabla'
       User.find_by_username('gizmo').lock_expires_at.to_s.should == unlock_date.to_s
     end