sorcery 0.7.0 → 0.8.0

data/lib/generators/sorcery/templates/initializer.rb

@@ -0,0 +1,417 @@
+# The first thing you need to configure is which modules you need in your app.
+# The default is nothing which will include only core features (password encryption, login/logout).
+# Available submodules are: :user_activation, :http_basic_auth, :remember_me,
+# :reset_password, :session_timeout, :brute_force_protection, :activity_logging, :external
+Rails.application.config.sorcery.submodules = []
+
+# Here you can configure each submodule's features.
+Rails.application.config.sorcery.configure do |config|
+  # -- core --
+  # What controller action to call for non-authenticated users. You can also
+  # override the 'not_authenticated' method of course.
+  # Default: `:not_authenticated`
+  #
+  # config.not_authenticated_action =
+
+
+  # When a non logged in user tries to enter a page that requires login, save
+  # the URL he wanted to reach, and send him there after login, using 'redirect_back_or_to'.
+  # Default: `true`
+  #
+  # config.save_return_to_url =
+
+
+  # Set domain option for cookies; Useful for remember_me submodule.
+  # Default: `nil`
+  #
+  # config.cookie_domain =
+
+  
+  # -- remember_me --
+  # allow the remember_me cookie to settable through AJAX
+  # Default: `true`
+  #
+  # user.remember_me_httponly =
+  
+
+  # -- session timeout --
+  # How long in seconds to keep the session alive.
+  # Default: `3600`
+  #
+  # config.session_timeout =
+
+
+  # Use the last action as the beginning of session timeout.
+  # Default: `false`
+  #
+  # config.session_timeout_from_last_action =
+
+
+  # -- http_basic_auth --
+  # What realm to display for which controller name. For example {"My App" => "Application"}
+  # Default: `{"application" => "Application"}`
+  #
+  # config.controller_to_realm_map =
+
+
+  # -- activity logging --
+  # will register the time of last user login, every login.
+  # Default: `true`
+  #
+  # config.register_login_time =
+
+
+  # will register the time of last user logout, every logout.
+  # Default: `true`
+  #
+  # config.register_logout_time =
+
+
+  # will register the time of last user action, every action.
+  # Default: `true`
+  #
+  # config.register_last_activity_time =
+
+
+  # -- external --
+  # What providers are supported by this app, i.e. [:twitter, :facebook, :github, :google, :liveid] .
+  # Default: `[]`
+  #
+  # config.external_providers =
+
+
+  # You can change it by your local ca_file. i.e. '/etc/pki/tls/certs/ca-bundle.crt'
+  # Path to ca_file. By default use a internal ca-bundle.crt.
+  # Default: `'path/to/ca_file'`
+  #
+  # config.ca_file =
+
+
+  # For information about LinkedIn API:
+  # - user info fields go to https://developer.linkedin.com/documents/profile-fields
+  # - access permissions go to https://developer.linkedin.com/documents/authentication#granting
+  #
+  # config.linkedin.key = ""
+  # config.linkedin.secret = ""
+  # config.linkedin.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=linkedin"
+  # config.linkedin.user_info_fields = ['first-name', 'last-name']
+  # config.linkedin.user_info_mapping = {first_name: "firstName", last_name: "lastName"}
+  # config.linkedin.access_permissions = ['r_basicprofile'] 
+  #
+  # Twitter wil not accept any requests nor redirect uri containing localhost,
+  # make sure you use 0.0.0.0:3000 to access your app in development
+  #
+  # config.twitter.key = ""
+  # config.twitter.secret = ""
+  # config.twitter.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=twitter"
+  # config.twitter.user_info_mapping = {:email => "screen_name"}
+  #
+  # config.facebook.key = ""
+  # config.facebook.secret = ""
+  # config.facebook.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=facebook"
+  # config.facebook.user_info_mapping = {:email => "name"}
+  # config.facebook.access_permissions = ["email", "publish_stream"]
+  #
+  # config.github.key = ""
+  # config.github.secret = ""
+  # config.github.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=github"
+  # config.github.user_info_mapping = {:email => "name"}
+  #
+  # config.google.key = ""
+  # config.google.secret = ""
+  # config.google.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=google"
+  # config.google.user_info_mapping = {:email => "email", :username => "name"}
+  #
+  # To use liveid in development mode you have to replace mydomain.com with
+  # a valid domain even in development. To use a valid domain in development
+  # simply add your domain in your /etc/hosts file in front of 127.0.0.1
+  #
+  # config.liveid.key = ""
+  # config.liveid.secret = ""
+  # config.liveid.callback_url = "http://mydomain.com:3000/oauth/callback?provider=liveid"
+  # config.liveid.user_info_mapping = {:username => "name"}
+
+
+  # --- user config ---
+  config.user_config do |user|
+    # -- core --
+    # specify username attributes, for example: [:username, :email].
+    # Default: `[:username]`
+    #
+    # user.username_attribute_names =
+
+
+    # change *virtual* password attribute, the one which is used until an encrypted one is generated.
+    # Default: `:password`
+    #
+    # user.password_attribute_name =
+
+
+    # downcase the username before trying to authenticate, default is false
+    # Default: `false`
+    #
+    # user.downcase_username_before_authenticating =
+
+
+    # change default email attribute.
+    # Default: `:email`
+    #
+    # user.email_attribute_name =
+
+
+    # change default crypted_password attribute.
+    # Default: `:crypted_password`
+    #
+    # user.crypted_password_attribute_name =
+
+
+    # what pattern to use to join the password with the salt
+    # Default: `""`
+    #
+    # user.salt_join_token =
+
+
+    # change default salt attribute.
+    # Default: `:salt`
+    #
+    # user.salt_attribute_name =
+
+
+    # how many times to apply encryption to the password.
+    # Default: `nil`
+    #
+    # user.stretches =
+
+
+    # encryption key used to encrypt reversible encryptions such as AES256.
+    # WARNING: If used for users' passwords, changing this key will leave passwords undecryptable!
+    # Default: `nil`
+    #
+    # user.encryption_key =
+
+
+    # use an external encryption class.
+    # Default: `nil`
+    #
+    # user.custom_encryption_provider =
+
+
+    # encryption algorithm name. See 'encryption_algorithm=' for available options.
+    # Default: `:bcrypt`
+    #
+    # user.encryption_algorithm =
+
+
+    # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
+    # Default: `false`
+    #
+    # user.subclasses_inherit_config =
+
+
+    # -- user_activation --
+    # the attribute name to hold activation state (active/pending).
+    # Default: `:activation_state`
+    #
+    # user.activation_state_attribute_name =
+
+
+    # the attribute name to hold activation code (sent by email).
+    # Default: `:activation_token`
+    #
+    # user.activation_token_attribute_name =
+
+
+    # the attribute name to hold activation code expiration date.
+    # Default: `:activation_token_expires_at`
+    #
+    # user.activation_token_expires_at_attribute_name =
+
+
+    # how many seconds before the activation code expires. nil for never expires.
+    # Default: `nil`
+    #
+    # user.activation_token_expiration_period =
+
+
+    # your mailer class. Required.
+    # Default: `nil`
+    #
+    # user.user_activation_mailer =
+
+
+    # when true sorcery will not automatically
+    # email activation details and allow you to
+    # manually handle how and when email is sent.
+    # Default: `false`
+    #
+    # user.activation_mailer_disabled =
+
+
+    # activation needed email method on your mailer class.
+    # Default: `:activation_needed_email`
+    #
+    # user.activation_needed_email_method_name =
+
+
+    # activation success email method on your mailer class.
+    # Default: `:activation_success_email`
+    #
+    # user.activation_success_email_method_name =
+
+
+    # do you want to prevent or allow users that did not activate by email to login?
+    # Default: `true`
+    #
+    # user.prevent_non_active_users_to_login =
+
+
+    # -- reset_password --
+    # reset password code attribute name.
+    # Default: `:reset_password_token`
+    #
+    # user.reset_password_token_attribute_name =
+
+
+    # expires at attribute name.
+    # Default: `:reset_password_token_expires_at`
+    #
+    # user.reset_password_token_expires_at_attribute_name =
+
+
+    # when was email sent, used for hammering protection.
+    # Default: `:reset_password_email_sent_at`
+    #
+    # user.reset_password_email_sent_at_attribute_name =
+
+
+    # mailer class. Needed.
+    # Default: `nil`
+    #
+    # user.reset_password_mailer =
+
+
+    # reset password email method on your mailer class.
+    # Default: `:reset_password_email`
+    #
+    # user.reset_password_email_method_name =
+
+
+    # when true sorcery will not automatically
+    # email password reset details and allow you to
+    # manually handle how and when email is sent
+    # Default: `false`
+    #
+    # user.reset_password_mailer_disabled =
+
+
+    # how many seconds before the reset request expires. nil for never expires.
+    # Default: `nil`
+    #
+    # user.reset_password_expiration_period =
+
+
+    # hammering protection, how long to wait before allowing another email to be sent.
+    # Default: `5 * 60`
+    #
+    # user.reset_password_time_between_emails =
+
+
+    # -- brute_force_protection --
+    # Failed logins attribute name.
+    # Default: `:failed_logins_count`
+    #
+    # user.failed_logins_count_attribute_name =
+
+
+    # This field indicates whether user is banned and when it will be active again.
+    # Default: `:lock_expires_at`
+    #
+    # user.lock_expires_at_attribute_name =
+
+
+    # How many failed logins allowed.
+    # Default: `50`
+    #
+    # user.consecutive_login_retries_amount_limit =
+
+
+    # How long the user should be banned. in seconds. 0 for permanent.
+    # Default: `60 * 60`
+    #
+    # user.login_lock_time_period =
+
+    # Unlock token attribute name
+    # Default: `:unlock_token`
+    #
+    # user.unlock_token_attribute_name =
+
+    # Unlock token mailer method
+    # Default: `:send_unlock_token_email`
+    #
+    # user.unlock_token_email_method_name =
+
+    # when true sorcery will not automatically
+    # send email with unlock token
+    # Default: `false`
+    #
+    # user.unlock_token_mailer_disabled = true
+
+    # Unlock token mailer class
+    # Default: `nil`
+    #
+    # user.unlock_token_mailer = UserMailer
+
+    # -- activity logging --
+    # Last login attribute name.
+    # Default: `:last_login_at`
+    #
+    # user.last_login_at_attribute_name =
+
+
+    # Last logout attribute name.
+    # Default: `:last_logout_at`
+    #
+    # user.last_logout_at_attribute_name =
+
+
+    # Last activity attribute name.
+    # Default: `:last_activity_at`
+    #
+    # user.last_activity_at_attribute_name =
+
+
+    # How long since last activity is he user defined logged out?
+    # Default: `10 * 60`
+    #
+    # user.activity_timeout =
+
+
+    # -- external --
+    # Class which holds the various external provider data for this user.
+    # Default: `nil`
+    #
+    # user.authentications_class =
+
+
+    # User's identifier in authentications class.
+    # Default: `:user_id`
+    #
+    # user.authentications_user_id_attribute_name =
+
+
+    # Provider's identifier in authentications class.
+    # Default: `:provider`
+    #
+    # user.provider_attribute_name =
+
+
+    # User's external unique identifier in authentications class.
+    # Default: `:uid`
+    #
+    # user.provider_uid_attribute_name =
+  end
+
+  # This line must come after the 'user config' block.
+  # Define which model authenticates with sorcery.
+  config.user_class = "<%= model_class_name %>"
+end

data/lib/generators/sorcery/templates/migration/activity_logging.rb

@@ -0,0 +1,17 @@
+class SorceryActivityLogging < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :last_login_at,     :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :last_logout_at,    :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :last_activity_at,  :datetime, :default => nil
+    
+    add_index :<%= model_class_name.tableize %>, [:last_logout_at, :last_activity_at]
+  end
+
+  def self.down
+    remove_index :<%= model_class_name.tableize %>, [:last_logout_at, :last_activity_at]
+    
+    remove_column :<%= model_class_name.tableize %>, :last_activity_at
+    remove_column :<%= model_class_name.tableize %>, :last_logout_at
+    remove_column :<%= model_class_name.tableize %>, :last_login_at
+  end
+end

data/lib/generators/sorcery/templates/migration/brute_force_protection.rb

@@ -0,0 +1,13 @@
+class SorceryBruteForceProtection < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :failed_logins_count, :integer, :default => 0
+    add_column :<%= model_class_name.tableize %>, :lock_expires_at, :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :unlock_token, :string, :default => nil
+  end
+
+  def self.down
+    remove_column :<%= model_class_name.tableize %>, :lock_expires_at
+    remove_column :<%= model_class_name.tableize %>, :failed_logins_count
+    remove_column :<%= model_class_name.tableize %>, :unlock_token
+  end
+end

data/lib/generators/{sorcery_migration/templates → sorcery/templates/migration}/core.rb

@@ -1,6 +1,6 @@
 class SorceryCore < ActiveRecord::Migration
   def self.up
-    create_table :users do |t|
+    create_table :<%= model_class_name.tableize %> do |t|
       t.string :username,         :null => false  # if you use another field as a username, for example email, you can safely remove this field.
       t.string :email,            :default => nil # if you use this field as a username, you might want to make it :null => false.
       t.string :crypted_password, :default => nil
@@ -11,6 +11,6 @@ class SorceryCore < ActiveRecord::Migration
   end
 
   def self.down
-    drop_table :users
+    drop_table :<%= model_class_name.tableize %>
   end
 end

data/lib/generators/{sorcery_migration/templates → sorcery/templates/migration}/external.rb

@@ -1,7 +1,7 @@
 class SorceryExternal < ActiveRecord::Migration
   def self.up
     create_table :authentications do |t|
-      t.integer :user_id, :null => false
+      t.integer :<%= model_class_name.tableize.singularize %>_id, :null => false
       t.string :provider, :uid, :null => false
 
       t.timestamps

data/lib/generators/sorcery/templates/migration/remember_me.rb

@@ -0,0 +1,15 @@
+class SorceryRememberMe < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :remember_me_token, :string, :default => nil
+    add_column :<%= model_class_name.tableize %>, :remember_me_token_expires_at, :datetime, :default => nil
+    
+    add_index :<%= model_class_name.tableize %>, :remember_me_token
+  end
+
+  def self.down
+    remove_index :<%= model_class_name.tableize %>, :remember_me_token
+    
+    remove_column :<%= model_class_name.tableize %>, :remember_me_token_expires_at
+    remove_column :<%= model_class_name.tableize %>, :remember_me_token
+  end
+end

data/lib/generators/sorcery/templates/migration/reset_password.rb

@@ -0,0 +1,17 @@
+class SorceryResetPassword < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :reset_password_token, :string, :default => nil
+    add_column :<%= model_class_name.tableize %>, :reset_password_token_expires_at, :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :reset_password_email_sent_at, :datetime, :default => nil
+    
+    add_index :<%= model_class_name.tableize %>, :reset_password_token
+  end
+
+  def self.down
+    remove_index :<%= model_class_name.tableize %>, :reset_password_token
+    
+    remove_column :<%= model_class_name.tableize %>, :reset_password_email_sent_at
+    remove_column :<%= model_class_name.tableize %>, :reset_password_token_expires_at
+    remove_column :<%= model_class_name.tableize %>, :reset_password_token
+  end
+end

data/lib/generators/sorcery/templates/migration/user_activation.rb

@@ -0,0 +1,17 @@
+class SorceryUserActivation < ActiveRecord::Migration
+  def self.up
+    add_column :<%= model_class_name.tableize %>, :activation_state, :string, :default => nil
+    add_column :<%= model_class_name.tableize %>, :activation_token, :string, :default => nil
+    add_column :<%= model_class_name.tableize %>, :activation_token_expires_at, :datetime, :default => nil
+    
+    add_index :<%= model_class_name.tableize %>, :activation_token
+  end
+
+  def self.down
+    remove_index :<%= model_class_name.tableize %>, :activation_token
+    
+    remove_column :<%= model_class_name.tableize %>, :activation_token_expires_at
+    remove_column :<%= model_class_name.tableize %>, :activation_token
+    remove_column :<%= model_class_name.tableize %>, :activation_state
+  end
+end

data/lib/sorcery/controller/submodules/activity_logging.rb

@@ -21,15 +21,15 @@ module Sorcery
               attr_accessor :register_last_activity_time
             
               def merge_activity_logging_defaults!
-                @defaults.merge!(:@register_login_time  => true,
-                                 :@register_logout_time => true,
+                @defaults.merge!(:@register_login_time         => true,
+                                 :@register_logout_time        => true,
                                  :@register_last_activity_time => true)
               end
             end
             merge_activity_logging_defaults!
           end
-          Config.after_login << :register_login_time_to_db
-          Config.before_logout << :register_logout_time_to_db
+          Config.after_login    << :register_login_time_to_db
+          Config.before_logout  << :register_logout_time_to_db
           base.after_filter :register_last_activity_time_to_db
         end
         
@@ -52,16 +52,14 @@ module Sorcery
           # This runs as a hook just after a successful login.
           def register_login_time_to_db(user, credentials)
             return unless Config.register_login_time
-            user.send(:"#{user.sorcery_config.last_login_at_attribute_name}=", Time.now.utc.to_s(:db))
-            user.save!(:validate => false)
+            user.update_single_attribute(user.sorcery_config.last_login_at_attribute_name, Time.now.in_time_zone)
           end
           
           # registers last logout time on every logout.
           # This runs as a hook just before a logout.
           def register_logout_time_to_db(user)
             return unless Config.register_logout_time
-            user.send(:"#{user.sorcery_config.last_logout_at_attribute_name}=", Time.now.utc.to_s(:db))
-            user.save!(:validate => false)
+            user.update_single_attribute(user.sorcery_config.last_logout_at_attribute_name, Time.now.in_time_zone)
           end
           
           # Updates last activity time on every request.
@@ -69,11 +67,10 @@ module Sorcery
           def register_last_activity_time_to_db
             return unless Config.register_last_activity_time
             return unless logged_in?
-            current_user.send(:"#{current_user.sorcery_config.last_activity_at_attribute_name}=", Time.now.utc.to_s(:db))
-            current_user.save!(:validate => false)
+            current_user.update_single_attribute(current_user.sorcery_config.last_activity_at_attribute_name, Time.now.in_time_zone)
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -29,11 +29,10 @@ module Sorcery
           # Resets the failed logins counter.
           # Runs as a hook after a successful login.
           def reset_failed_logins_count!(user, credentials)
-            user.send(:"#{user_class.sorcery_config.failed_logins_count_attribute_name}=", 0)
-            user.save!
+            user.update_many_attributes(user_class.sorcery_config.failed_logins_count_attribute_name => 0)
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/controller/submodules/external/protocols/oauth2.rb

@@ -8,19 +8,34 @@ module Sorcery
             def oauth_version
               "2.0"
             end
-          
+
             def authorize_url(options = {})
+              client = build_client(options)
+              client.auth_code.authorize_url(
+                :redirect_uri => @callback_url,
+                :scope => @scope,
+                :display => @display
+              )
+            end
+
+            def get_access_token(args, options = {})
+              client = build_client(options)
+              client.auth_code.get_token(
+                args[:code],
+                { :redirect_uri => @callback_url, :parse => options.delete(:parse) }, options
+              )
+            end
+
+            def build_client(options = {})
               defaults = {
-                  :site => @site,
-                  :ssl => { :ca_file => Config.ca_file }
+                :site => @site,
+                :ssl => { :ca_file => Config.ca_file }
               }
-              client = ::OAuth2::Client.new(@key, @secret, defaults.merge!(options))
-              client.authorize_url(:redirect_uri => @callback_url, :scope => @scope)
-            end
-          
-            def get_access_token(args)
-              client = ::OAuth2::Client.new(@key, @secret, :site => @site, :ssl => { :ca_file => Config.ca_file })
-              client.get_token(args[:code], :redirect_uri => @callback_url)
+              ::OAuth2::Client.new(
+                @key,
+                @secret,
+                defaults.merge!(options)
+              )
             end
           end
         end