sorcery 0.7.0 → 0.7.4

data/lib/sorcery/controller/submodules/external/protocols/oauth2.rb

@@ -8,19 +8,34 @@ module Sorcery
             def oauth_version
               "2.0"
             end
-          
+            
             def authorize_url(options = {})
               defaults = {
-                  :site => @site,
-                  :ssl => { :ca_file => Config.ca_file }
+                :site => @site,
+                :ssl => { :ca_file => Config.ca_file }
               }
-              client = ::OAuth2::Client.new(@key, @secret, defaults.merge!(options))
-              client.authorize_url(:redirect_uri => @callback_url, :scope => @scope)
+              client = ::OAuth2::Client.new(
+                @key,
+                @secret,
+                defaults.merge!(options)
+              )
+              client.web_server.authorize_url(
+                :redirect_uri => @callback_url,
+                :scope => @scope
+              )
             end
-          
+            
             def get_access_token(args)
-              client = ::OAuth2::Client.new(@key, @secret, :site => @site, :ssl => { :ca_file => Config.ca_file })
-              client.get_token(args[:code], :redirect_uri => @callback_url)
+              client = ::OAuth2::Client.new(
+                @key,
+                @secret,
+                :site => @site,
+                :ssl => { :ca_file => Config.ca_file }
+              )
+              client.web_server.get_access_token(
+                args[:code],
+                :redirect_uri => @callback_url
+              )
             end
           end
         end

data/lib/sorcery/controller/submodules/external/providers/twitter.rb

@@ -55,7 +55,7 @@ module Sorcery
                   user_hash = {}
                   response = @access_token.get(@user_info_path)
                   user_hash[:user_info] = JSON.parse(response.body)
-                  user_hash[:uid] = user_hash[:user_info]['id']
+                  user_hash[:uid] = user_hash[:user_info]['id'].to_s
                   user_hash
                 end
                 

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -1,7 +1,7 @@
 module Sorcery
   module Controller
     module Submodules
-      # The Remember Me submodule takes care of setting the user's cookie so that he will 
+      # The Remember Me submodule takes care of setting the user's cookie so that he will
       # be automatically logged in to the site on every visit,
       # until the cookie expires.
       # See Sorcery::Model::Submodules::RememberMe for configuration options.
@@ -12,20 +12,20 @@ module Sorcery
           Config.after_login << :remember_me_if_asked_to
           Config.after_logout << :forget_me!
         end
-        
+
         module InstanceMethods
           # This method sets the cookie and calls the user to save the token and the expiration to db.
           def remember_me!
             current_user.remember_me!
-            set_remember_me_cookie!(current_user)      
+            set_remember_me_cookie!(current_user)
           end
 
           # Clears the cookie and clears the token from the db.
           def forget_me!
-            current_user.forget_me!
-            cookies[:remember_me_token] = nil
+            @current_user.forget_me!
+            cookies.delete(:remember_me_token, :domain => Config.cookie_domain)
           end
-          
+
           # Override.
           # logins a user instance, and optionally remembers him.
           def auto_login(user, should_remember = false)
@@ -33,33 +33,35 @@ module Sorcery
             @current_user = user
             remember_me! if should_remember
           end
-          
+
           protected
-          
+
           # calls remember_me! if a third credential was passed to the login method.
           # Runs as a hook after login.
           def remember_me_if_asked_to(user, credentials)
             remember_me! if ( credentials.size == 3 && credentials[2] && credentials[2] != "0" )
           end
-          
-          # Checks the cookie for a remember me token, tried to find a user with that token 
+
+          # Checks the cookie for a remember me token, tried to find a user with that token
           # and logs the user in if found.
           # Runs as a login source. See 'current_user' method for how it is used.
           def login_from_cookie
             user = cookies.signed[:remember_me_token] && user_class.find_by_remember_me_token(cookies.signed[:remember_me_token])
             if user && user.remember_me_token?
               set_remember_me_cookie!(user)
+              session[:user_id] = user.id
               @current_user = user
             else
               @current_user = false
             end
           end
-          
+
           def set_remember_me_cookie!(user)
-            cookies.signed[:remember_me_token] = { 
-              :value => user.send(user.sorcery_config.remember_me_token_attribute_name), 
+            cookies.signed[:remember_me_token] = {
+              :value => user.send(user.sorcery_config.remember_me_token_attribute_name),
               :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name),
-              :httponly => true
+              :httponly => true,
+              :domain => Config.cookie_domain
             }
           end
         end

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -30,18 +30,18 @@ module Sorcery
           # Registers last login to be used as the timeout starting point.
           # Runs as a hook after a successful login.
           def register_login_time(user, credentials)
-            session[:login_time] = session[:last_action_time] = Time.now.utc
+            session[:login_time] = session[:last_action_time] = Time.now.in_time_zone
           end
           
           # Checks if session timeout was reached and expires the current session if so.
           # To be used as a before_filter, before require_login
           def validate_session
             session_to_use = Config.session_timeout_from_last_action ? session[:last_action_time] : session[:login_time]
-            if session_to_use && (Time.now.utc - session_to_use > Config.session_timeout)
+            if session_to_use && (Time.now.in_time_zone - session_to_use > Config.session_timeout)
               reset_session
               @current_user = nil
             else
-              session[:last_action_time] = Time.now.utc
+              session[:last_action_time] = Time.now.in_time_zone
             end
           end
 

data/lib/sorcery/controller.rb

@@ -5,7 +5,7 @@ module Sorcery
         include InstanceMethods
         Config.submodules.each do |mod|
           begin
-            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
+            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
           rescue NameError
             # don't stop on a missing submodule.
           end
@@ -14,7 +14,7 @@ module Sorcery
       Config.update!
       Config.configure!
     end
-    
+
     module InstanceMethods
       # To be used as before_filter.
       # Will trigger auto-login attempts via the call to logged_in?
@@ -22,10 +22,10 @@ module Sorcery
       def require_login
         if !logged_in?
           session[:return_to_url] = request.url if Config.save_return_to_url
-          self.send(Config.not_authenticated_action) 
+          self.send(Config.not_authenticated_action)
         end
       end
-      
+
       # Takes credentials and returns a user on successful authentication.
       # Runs hooks after login or failed login.
       def login(*credentials)
@@ -42,43 +42,44 @@ module Sorcery
           nil
         end
       end
-      
+
       # Resets the session and runs hooks before and after.
       def logout
         if logged_in?
           before_logout!(current_user)
           reset_session
           after_logout!
+          @current_user = nil
         end
       end
-      
+
       def logged_in?
         !!current_user
       end
-      
+
       # attempts to auto-login from the sources defined (session, basic_auth, cookie, etc.)
       # returns the logged in user if found, false if not (using old restful-authentication trick, nil != false).
       def current_user
         @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
       end
-      
+
       def current_user=(user)
         @current_user = user
       end
-      
-      # used when a user tries to access a page while logged out, is asked to login, 
+
+      # used when a user tries to access a page while logged out, is asked to login,
       # and we want to return him back to the page he originally wanted.
       def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
       end
-      
+
       # The default action for denying non-authenticated users.
       # You can override this method in your controllers,
       # or provide a different method in the configuration.
       def not_authenticated
         redirect_to root_path
       end
-      
+
       # login a user instance
       #
       # @param [<User-Model>] user the user instance.
@@ -87,16 +88,16 @@ module Sorcery
         session[:user_id] = user.id
         @current_user = user
       end
-      
+
       # Overwrite Rails' handle unverified request
       def handle_unverified_request
         cookies[:remember_me_token] = nil
         @current_user = nil
         super # call the default behaviour which resets the session
       end
-      
+
       protected
-      
+
       # Tries all available sources (methods) until one doesn't return false.
       def login_from_other_sources
         result = nil
@@ -105,51 +106,51 @@ module Sorcery
         end
         result || false
       end
-      
+
       def login_from_session
         @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
       end
-      
+
       def after_login!(user, credentials)
         Config.after_login.each {|c| self.send(c, user, credentials)}
       end
-      
+
       def after_failed_login!(credentials)
         Config.after_failed_login.each {|c| self.send(c, credentials)}
       end
-      
+
       def before_logout!(user)
         Config.before_logout.each {|c| self.send(c, user)}
       end
-      
+
       def after_logout!
         Config.after_logout.each {|c| self.send(c)}
       end
-      
+
       def user_class
         @user_class ||= Config.user_class.to_s.constantize
       end
-      
+
     end
-    
+
     module Config
       class << self
         attr_accessor :submodules,
-                      :user_class,                    # what class to use as the user class. 
+                      :user_class,                    # what class to use as the user class.
                       :not_authenticated_action,      # what controller action to call for non-authenticated users.
-                      
+
                       :save_return_to_url,            # when a non logged in user tries to enter a page that requires
-                                                      # login, save the URL he wanted to reach, 
+                                                      # login, save the URL he wanted to reach,
                                                       # and send him there after login.
-                                                      
-                      :sinatra_cookie_secret,         # used to sign cookies in Sinatra.
-                      
+
+                      :cookie_domain,                 # set domain option for cookies
+
                       :login_sources,
                       :after_login,
                       :after_failed_login,
                       :before_logout,
-                      :after_logout             
-        
+                      :after_logout
+
         def init!
           @defaults = {
             :@user_class                           => nil,
@@ -161,31 +162,31 @@ module Sorcery
             :@before_logout                        => [],
             :@after_logout                         => [],
             :@save_return_to_url                   => true,
-            :@sinatra_cookie_secret                => 'ch4ng3M3plz'
+            :@cookie_domain                        => nil
           }
         end
-        
+
         # Resets all configuration options to their default values.
         def reset!
           @defaults.each do |k,v|
             instance_variable_set(k,v)
-          end       
+          end
         end
-        
+
         def update!
           @defaults.each do |k,v|
             instance_variable_set(k,v) if !instance_variable_defined?(k)
           end
         end
-        
+
         def user_config(&blk)
           block_given? ? @user_config = blk : @user_config
         end
-        
+
         def configure(&blk)
           @configure_blk = blk
         end
-        
+
         def configure!
           @configure_blk.call(self) if @configure_blk
         end
@@ -194,4 +195,4 @@ module Sorcery
       reset!
     end
   end
-end
+end

data/lib/sorcery/model/adapters/mongo_mapper.rb

@@ -0,0 +1,49 @@
+module Sorcery
+  module Model
+    module Adapters
+      module MongoMapper
+        extend ActiveSupport::Concern
+        
+        included do
+          include Sorcery::Model
+        end
+        
+        module InstanceMethods
+          def increment(attr)
+            self.inc(attr,1)
+          end
+          
+          def save!(options = {})
+            save(options)
+          end
+        end
+
+        module ClassMethods
+          def find_by_credentials(credentials)
+            @sorcery_config.username_attribute_names.each do |attribute|
+              @user = where(attribute => credentials[0]).first
+              break if @user
+            end
+            @user
+          end
+          
+          def find_by_id(id)
+            find(id)
+          end
+          
+          def find_by_activation_token(token)
+            where(sorcery_config.activation_token_attribute_name => token).first
+          end
+          
+          def transaction(&blk)
+            tap(&blk)
+          end
+          
+          def find_by_sorcery_token(token_attr_name, token)
+            where(token_attr_name => token).first
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -29,6 +29,8 @@ module Sorcery
 
           def find_by_id(id)
             find(id)
+          rescue ::Mongoid::Errors::DocumentNotFound
+            nil
           end
 
           def find_by_activation_token(token)
@@ -41,7 +43,7 @@ module Sorcery
 
           def find_by_username(username)
             query = sorcery_config.username_attribute_names.map {|name| {name => username}}
-            where(query).first
+            any_of(*query).first
           end
 
           def transaction(&blk)

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -26,6 +26,9 @@ module Sorcery
           
           base.sorcery_config.before_authenticate << :prevent_locked_user_login
           base.sorcery_config.after_config << :define_brute_force_protection_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_brute_force_protection_mongo_mapper_fields
+          end
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
         end
@@ -37,6 +40,11 @@ module Sorcery
             field sorcery_config.failed_logins_count_attribute_name,  :type => Integer
             field sorcery_config.lock_expires_at_attribute_name,      :type => DateTime
           end
+
+          def define_brute_force_protection_mongo_mapper_fields
+            key sorcery_config.failed_logins_count_attribute_name, Integer
+            key sorcery_config.lock_expires_at_attribute_name, DateTime
+          end
         end
         
         module InstanceMethods
@@ -46,7 +54,7 @@ module Sorcery
             config = sorcery_config
             return if !unlocked?
             self.increment(config.failed_logins_count_attribute_name)
-            save!
+            save!(:validate => false)
             self.lock! if self.send(config.failed_logins_count_attribute_name) >= config.consecutive_login_retries_amount_limit
           end
           
@@ -54,15 +62,15 @@ module Sorcery
 
           def lock!
             config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.utc + config.login_lock_time_period)
-            self.save!
+            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.in_time_zone + config.login_lock_time_period)
+            self.save!(validate: false)
           end
 
           def unlock!
             config = sorcery_config
             self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
             self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
-            self.save!
+            self.save!(validate: false)
           end
           
           def unlocked?
@@ -75,7 +83,7 @@ module Sorcery
           def prevent_locked_user_login
             config = sorcery_config
             if !self.unlocked? && config.login_lock_time_period != 0
-              self.unlock! if self.send(config.lock_expires_at_attribute_name) <= Time.now.utc
+              self.unlock! if self.send(config.lock_expires_at_attribute_name) <= Time.now.in_time_zone
             end
             unlocked?
           end
@@ -83,4 +91,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/remember_me.rb

@@ -24,7 +24,10 @@ module Sorcery
           base.send(:include, InstanceMethods)
 
           base.sorcery_config.after_config << :define_remember_me_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
-
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_remember_me_mongo_mapper_fields
+          end
+          
           base.extend(ClassMethods)
         end
 
@@ -36,6 +39,10 @@ module Sorcery
             field sorcery_config.remember_me_token_expires_at_attribute_name, :type => Time
           end
 
+          def define_remember_me_mongo_mapper_fields
+            key sorcery_config.remember_me_token_attribute_name, String
+            key sorcery_config.remember_me_token_expires_at_attribute_name, Time
+          end
         end
 
         module InstanceMethods
@@ -43,7 +50,7 @@ module Sorcery
           def remember_me!
             config = sorcery_config
             self.send(:"#{config.remember_me_token_attribute_name}=", TemporaryToken.generate_random_token)
-            self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", Time.now + config.remember_me_for)
+            self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.remember_me_for)
             self.save!(:validate => false)
           end
           

data/lib/sorcery/model/submodules/reset_password.rb

@@ -45,6 +45,9 @@ module Sorcery
 
           base.sorcery_config.after_config << :validate_mailer_defined
           base.sorcery_config.after_config << :define_reset_password_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_reset_password_mongo_mapper_fields
+          end
 
           base.send(:include, InstanceMethods)
 
@@ -72,6 +75,13 @@ module Sorcery
             field sorcery_config.reset_password_token_expires_at_attribute_name,  :type => DateTime
             field sorcery_config.reset_password_email_sent_at_attribute_name,     :type => DateTime
           end
+          
+          def define_reset_password_mongo_mapper_fields
+            key sorcery_config.reset_password_token_attribute_name, String
+            # no DateTime in MM
+            key sorcery_config.reset_password_token_expires_at_attribute_name, Time
+            key sorcery_config.reset_password_email_sent_at_attribute_name, Time
+          end
         end
         
         module InstanceMethods
@@ -81,8 +91,8 @@ module Sorcery
             # hammering protection
             return if config.reset_password_time_between_emails && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.ago.utc
             self.send(:"#{config.reset_password_token_attribute_name}=", TemporaryToken.generate_random_token)
-            self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", Time.now.utc + config.reset_password_expiration_period) if config.reset_password_expiration_period
-            self.send(:"#{config.reset_password_email_sent_at_attribute_name}=", Time.now.utc)
+            self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.reset_password_expiration_period) if config.reset_password_expiration_period
+            self.send(:"#{config.reset_password_email_sent_at_attribute_name}=", Time.now.in_time_zone)
             self.class.transaction do
               self.save!(:validate => false)
               generic_send_email(:reset_password_email_method_name, :reset_password_mailer)

data/lib/sorcery/model/submodules/user_activation.rb

@@ -52,6 +52,9 @@ module Sorcery
           
           base.sorcery_config.after_config << :validate_mailer_defined
           base.sorcery_config.after_config << :define_user_activation_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_user_activation_mongo_mapper_fields
+          end
           base.sorcery_config.before_authenticate << :prevent_non_active_login
           
           base.extend(ClassMethods)
@@ -84,6 +87,15 @@ module Sorcery
               field sorcery_config.activation_token_expires_at_attribute_name, :type => DateTime
             end
           end
+
+          def define_user_activation_mongo_mapper_fields
+            self.class_eval do
+              key sorcery_config.activation_state_attribute_name, String
+              key sorcery_config.activation_token_attribute_name, String
+              # no DateTime in MM
+              key sorcery_config.activation_token_expires_at_attribute_name, Time
+            end
+          end
         end
         
         module InstanceMethods
@@ -103,7 +115,7 @@ module Sorcery
             generated_activation_token = TemporaryToken.generate_random_token
             self.send(:"#{config.activation_token_attribute_name}=", generated_activation_token)
             self.send(:"#{config.activation_state_attribute_name}=", "pending")
-            self.send(:"#{config.activation_token_expires_at_attribute_name}=", Time.now.utc + config.activation_token_expiration_period) if config.activation_token_expiration_period
+            self.send(:"#{config.activation_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.activation_token_expiration_period) if config.activation_token_expiration_period
           end
 
           # called automatically after user initial creation.

data/lib/sorcery/model/temporary_token.rb

@@ -1,3 +1,5 @@
+require 'securerandom'
+
 module Sorcery
   module Model
     # This module encapsulates the logic for temporary token.
@@ -10,7 +12,7 @@ module Sorcery
       
       # Random code, used for salt and temporary tokens.
       def self.generate_random_token
-        Digest::SHA1.hexdigest( Time.now.to_s.split(//).sort_by {rand}.join )
+        SecureRandom.base64(15).tr('+/=lIO0', 'pqrsxyz')
       end
       
       module ClassMethods
@@ -18,7 +20,7 @@ module Sorcery
           return nil if token.blank?
           user = find_by_sorcery_token(token_attr_name,token)
           if !user.blank? && !user.send(token_expiration_date_attr).nil?
-            return Time.now.utc < user.send(token_expiration_date_attr) ? user : nil
+            return Time.now.in_time_zone < user.send(token_expiration_date_attr) ? user : nil
           end
           user
         end