sorcery 0.7.0 → 0.8.0

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -1,31 +1,40 @@
 module Sorcery
   module Controller
     module Submodules
-      # The Remember Me submodule takes care of setting the user's cookie so that he will 
+      # The Remember Me submodule takes care of setting the user's cookie so that he will
       # be automatically logged in to the site on every visit,
       # until the cookie expires.
       # See Sorcery::Model::Submodules::RememberMe for configuration options.
       module RememberMe
         def self.included(base)
           base.send(:include, InstanceMethods)
+          Config.module_eval do
+            class << self
+              attr_accessor :remember_me_httponly
+              def merge_remember_me_defaults!
+                @defaults.merge!(:@remember_me_httponly => true)
+              end
+            end
+            merge_remember_me_defaults!
+          end
           Config.login_sources << :login_from_cookie
           Config.after_login << :remember_me_if_asked_to
           Config.after_logout << :forget_me!
         end
-        
+
         module InstanceMethods
           # This method sets the cookie and calls the user to save the token and the expiration to db.
           def remember_me!
             current_user.remember_me!
-            set_remember_me_cookie!(current_user)      
+            set_remember_me_cookie!(current_user)
           end
 
           # Clears the cookie and clears the token from the db.
           def forget_me!
-            current_user.forget_me!
-            cookies[:remember_me_token] = nil
+            @current_user.forget_me!
+            cookies.delete(:remember_me_token, :domain => Config.cookie_domain)
           end
-          
+
           # Override.
           # logins a user instance, and optionally remembers him.
           def auto_login(user, should_remember = false)
@@ -33,33 +42,35 @@ module Sorcery
             @current_user = user
             remember_me! if should_remember
           end
-          
+
           protected
-          
+
           # calls remember_me! if a third credential was passed to the login method.
           # Runs as a hook after login.
           def remember_me_if_asked_to(user, credentials)
             remember_me! if ( credentials.size == 3 && credentials[2] && credentials[2] != "0" )
           end
-          
-          # Checks the cookie for a remember me token, tried to find a user with that token 
+
+          # Checks the cookie for a remember me token, tried to find a user with that token
           # and logs the user in if found.
           # Runs as a login source. See 'current_user' method for how it is used.
           def login_from_cookie
             user = cookies.signed[:remember_me_token] && user_class.find_by_remember_me_token(cookies.signed[:remember_me_token])
             if user && user.remember_me_token?
               set_remember_me_cookie!(user)
+              session[:user_id] = user.id
               @current_user = user
             else
               @current_user = false
             end
           end
-          
+
           def set_remember_me_cookie!(user)
-            cookies.signed[:remember_me_token] = { 
-              :value => user.send(user.sorcery_config.remember_me_token_attribute_name), 
+            cookies.signed[:remember_me_token] = {
+              :value => user.send(user.sorcery_config.remember_me_token_attribute_name),
               :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name),
-              :httponly => true
+              :httponly => Config.remember_me_httponly,
+              :domain => Config.cookie_domain
             }
           end
         end
@@ -67,4 +78,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -30,18 +30,18 @@ module Sorcery
           # Registers last login to be used as the timeout starting point.
           # Runs as a hook after a successful login.
           def register_login_time(user, credentials)
-            session[:login_time] = session[:last_action_time] = Time.now.utc
+            session[:login_time] = session[:last_action_time] = Time.now.in_time_zone
           end
           
           # Checks if session timeout was reached and expires the current session if so.
           # To be used as a before_filter, before require_login
           def validate_session
             session_to_use = Config.session_timeout_from_last_action ? session[:last_action_time] : session[:login_time]
-            if session_to_use && (Time.now.utc - session_to_use > Config.session_timeout)
+            if session_to_use && (Time.now.in_time_zone - session_to_use > Config.session_timeout)
               reset_session
               @current_user = nil
             else
-              session[:last_action_time] = Time.now.utc
+              session[:last_action_time] = Time.now.in_time_zone
             end
           end
 

data/lib/sorcery/controller.rb

@@ -5,7 +5,7 @@ module Sorcery
         include InstanceMethods
         Config.submodules.each do |mod|
           begin
-            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
+            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
           rescue NameError
             # don't stop on a missing submodule.
           end
@@ -14,26 +14,29 @@ module Sorcery
       Config.update!
       Config.configure!
     end
-    
+
     module InstanceMethods
       # To be used as before_filter.
       # Will trigger auto-login attempts via the call to logged_in?
       # If all attempts to auto-login fail, the failure callback will be called.
       def require_login
         if !logged_in?
-          session[:return_to_url] = request.url if Config.save_return_to_url
-          self.send(Config.not_authenticated_action) 
+          session[:return_to_url] = request.url if Config.save_return_to_url && request.get?
+          self.send(Config.not_authenticated_action)
         end
       end
-      
+
       # Takes credentials and returns a user on successful authentication.
       # Runs hooks after login or failed login.
-      def login(*credentials)
+       def login(*credentials)
+        @current_user = nil
         user = user_class.authenticate(*credentials)
         if user
-          return_to_url = session[:return_to_url]
+          old_session = session.dup
           reset_session # protect from session fixation attacks
-          session[:return_to_url] = return_to_url
+          old_session.to_hash.each_pair do |k,v|
+            session[k.to_sym] = v
+          end
           auto_login(user)
           after_login!(user, credentials)
           current_user
@@ -42,43 +45,45 @@ module Sorcery
           nil
         end
       end
-      
+
       # Resets the session and runs hooks before and after.
       def logout
         if logged_in?
           before_logout!(current_user)
           reset_session
           after_logout!
+          @current_user = nil
         end
       end
-      
+
       def logged_in?
         !!current_user
       end
-      
+
       # attempts to auto-login from the sources defined (session, basic_auth, cookie, etc.)
       # returns the logged in user if found, false if not (using old restful-authentication trick, nil != false).
       def current_user
         @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
       end
-      
+
       def current_user=(user)
         @current_user = user
       end
-      
-      # used when a user tries to access a page while logged out, is asked to login, 
+
+      # used when a user tries to access a page while logged out, is asked to login,
       # and we want to return him back to the page he originally wanted.
       def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
+        session[:return_to_url] = nil
       end
-      
+
       # The default action for denying non-authenticated users.
       # You can override this method in your controllers,
       # or provide a different method in the configuration.
       def not_authenticated
         redirect_to root_path
       end
-      
+
       # login a user instance
       #
       # @param [<User-Model>] user the user instance.
@@ -87,16 +92,16 @@ module Sorcery
         session[:user_id] = user.id
         @current_user = user
       end
-      
+
       # Overwrite Rails' handle unverified request
       def handle_unverified_request
         cookies[:remember_me_token] = nil
         @current_user = nil
         super # call the default behaviour which resets the session
       end
-      
+
       protected
-      
+
       # Tries all available sources (methods) until one doesn't return false.
       def login_from_other_sources
         result = nil
@@ -105,51 +110,55 @@ module Sorcery
         end
         result || false
       end
-      
+
       def login_from_session
-        @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
-      end
-      
-      def after_login!(user, credentials)
+        @current_user = (user_class.find(session[:user_id]) if session[:user_id]) || false
+      rescue => exception
+        return false if defined?(Mongoid) and exception.is_a?(Mongoid::Errors::DocumentNotFound)
+        return false if defined?(ActiveRecord) and exception.is_a?(ActiveRecord::RecordNotFound)
+        raise exception
+      end
+
+      def after_login!(user, credentials = [])
         Config.after_login.each {|c| self.send(c, user, credentials)}
       end
-      
+
       def after_failed_login!(credentials)
         Config.after_failed_login.each {|c| self.send(c, credentials)}
       end
-      
+
       def before_logout!(user)
         Config.before_logout.each {|c| self.send(c, user)}
       end
-      
+
       def after_logout!
         Config.after_logout.each {|c| self.send(c)}
       end
-      
+
       def user_class
         @user_class ||= Config.user_class.to_s.constantize
       end
-      
+
     end
-    
+
     module Config
       class << self
         attr_accessor :submodules,
-                      :user_class,                    # what class to use as the user class. 
+                      :user_class,                    # what class to use as the user class.
                       :not_authenticated_action,      # what controller action to call for non-authenticated users.
-                      
+
                       :save_return_to_url,            # when a non logged in user tries to enter a page that requires
-                                                      # login, save the URL he wanted to reach, 
+                                                      # login, save the URL he wanted to reach,
                                                       # and send him there after login.
-                                                      
-                      :sinatra_cookie_secret,         # used to sign cookies in Sinatra.
-                      
+
+                      :cookie_domain,                 # set domain option for cookies
+
                       :login_sources,
                       :after_login,
                       :after_failed_login,
                       :before_logout,
-                      :after_logout             
-        
+                      :after_logout
+
         def init!
           @defaults = {
             :@user_class                           => nil,
@@ -161,31 +170,31 @@ module Sorcery
             :@before_logout                        => [],
             :@after_logout                         => [],
             :@save_return_to_url                   => true,
-            :@sinatra_cookie_secret                => 'ch4ng3M3plz'
+            :@cookie_domain                        => nil
           }
         end
-        
+
         # Resets all configuration options to their default values.
         def reset!
           @defaults.each do |k,v|
             instance_variable_set(k,v)
-          end       
+          end
         end
-        
+
         def update!
           @defaults.each do |k,v|
             instance_variable_set(k,v) if !instance_variable_defined?(k)
           end
         end
-        
+
         def user_config(&blk)
           block_given? ? @user_config = blk : @user_config
         end
-        
+
         def configure(&blk)
           @configure_blk = blk
         end
-        
+
         def configure!
           @configure_blk.call(self) if @configure_blk
         end
@@ -194,4 +203,4 @@ module Sorcery
       reset!
     end
   end
-end
+end

data/lib/sorcery/crypto_providers/bcrypt.rb

@@ -48,6 +48,7 @@ module Sorcery
           @cost ||= 10
         end
         attr_writer :cost
+        alias :stretches :cost
         alias :stretches= :cost=
         
         # Creates a BCrypt hash for the password passed.

data/lib/sorcery/model/adapters/active_record.rb

@@ -4,11 +4,31 @@ module Sorcery
       module ActiveRecord
         def self.included(klass)
           klass.extend ClassMethods
+          klass.send(:include, InstanceMethods)
         end
 
+        module InstanceMethods
+          def update_many_attributes(attrs)
+            attrs.each do |name, value|
+              self.send(:"#{name}=", value)
+            end
+            primary_key = self.class.primary_key
+            self.class.where(:"#{primary_key}" => self.send(:"#{primary_key}")).update_all(attrs)
+          end
+
+          def update_single_attribute(name, value)
+            update_many_attributes(name => value)
+          end
+        end
+        
         module ClassMethods
+          def column_name(attribute)
+            return "LOWER(#{attribute})" if (@sorcery_config.downcase_username_before_authenticating)
+            return "#{attribute}"
+          end
+
           def find_by_credentials(credentials)
-             sql = @sorcery_config.username_attribute_names.map{|attribute| "#{attribute} = :login"}
+             sql = @sorcery_config.username_attribute_names.map{|attribute| column_name(attribute) + " = :login"}
              where(sql.join(' OR '), :login => credentials[0]).first
           end
 

data/lib/sorcery/model/adapters/mongo_mapper.rb

@@ -0,0 +1,56 @@
+module Sorcery
+  module Model
+    module Adapters
+      module MongoMapper
+        extend ActiveSupport::Concern
+
+        included do
+          include Sorcery::Model
+        end
+
+        def increment(attr)
+          self.class.increment(id, attr => 1)
+        end
+
+        def save!(options = {})
+          save(options)
+        end
+
+        def update_many_attributes(attrs)
+          update_attributes(attrs)
+        end
+
+        module ClassMethods
+          def credential_regex(credential)
+            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
+            return credential
+          end
+
+          def find_by_credentials(credentials)
+            @sorcery_config.username_attribute_names.each do |attribute|
+              @user = where(attribute => credential_regex(credentials[0])).first
+              break if @user
+            end
+            @user
+          end
+
+          def find_by_id(id)
+            find(id)
+          end
+
+          def find_by_activation_token(token)
+            where(sorcery_config.activation_token_attribute_name => token).first
+          end
+
+          def transaction(&blk)
+            tap(&blk)
+          end
+
+          def find_by_sorcery_token(token_attr_name, token)
+            where(token_attr_name => token).first
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -11,12 +11,29 @@ module Sorcery
           def increment(attr)
             self.inc(attr,1)
           end
+
+          def update_many_attributes(attrs)
+            attrs.each do |name, value|
+              attrs[name] = value.utc if value.is_a?(ActiveSupport::TimeWithZone)
+              self.send(:"#{name}=", value)
+            end
+            self.class.where(:_id => self.id).update_all(attrs)
+          end
+
+          def update_single_attribute(name, value)
+            update_many_attributes(name => value)
+          end
         end
 
         module ClassMethods
+          def credential_regex(credential)
+            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
+            return credential
+          end
+
           def find_by_credentials(credentials)
             @sorcery_config.username_attribute_names.each do |attribute|
-              @user = where(attribute => credentials[0]).first
+              @user = where(attribute => credential_regex(credentials[0])).first
               break if @user
             end
             @user
@@ -29,6 +46,8 @@ module Sorcery
 
           def find_by_id(id)
             find(id)
+          rescue ::Mongoid::Errors::DocumentNotFound
+            nil
           end
 
           def find_by_activation_token(token)
@@ -41,7 +60,7 @@ module Sorcery
 
           def find_by_username(username)
             query = sorcery_config.username_attribute_names.map {|name| {name => username}}
-            where(query).first
+            any_of(*query).first
           end
 
           def transaction(&blk)
@@ -59,8 +78,8 @@ module Sorcery
           def get_current_users
             config = sorcery_config
             where(config.last_activity_at_attribute_name.ne => nil) \
-            .any_of({config.last_logout_at_attribute_name => nil},{config.last_activity_at_attribute_name.gt => config.last_logout_at_attribute_name}) \
-            .and(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc.to_s(:db)).order_by([:_id,:asc])
+            .where("this.#{config.last_logout_at_attribute_name} == null || this.#{config.last_activity_at_attribute_name} > this.#{config.last_logout_at_attribute_name}") \
+            .where(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc).order_by([:_id,:asc])
           end
         end
       end

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -39,12 +39,12 @@ module Sorcery
           protected
 
           def define_activity_logging_mongoid_fields
-            field sorcery_config.last_login_at_attribute_name,    :type => DateTime
-            field sorcery_config.last_logout_at_attribute_name,   :type => DateTime
-            field sorcery_config.last_activity_at_attribute_name, :type => DateTime
+            field sorcery_config.last_login_at_attribute_name,    :type => Time
+            field sorcery_config.last_logout_at_attribute_name,   :type => Time
+            field sorcery_config.last_activity_at_attribute_name, :type => Time
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -12,30 +12,56 @@ module Sorcery
                           :lock_expires_at_attribute_name,            # this field indicates whether user 
                                                                       # is banned and when it will be active again.
                           :consecutive_login_retries_amount_limit,    # how many failed logins allowed.
-                          :login_lock_time_period                     # how long the user should be banned. 
+                          :login_lock_time_period,                    # how long the user should be banned. 
                                                                       # in seconds. 0 for permanent.
+
+                          :unlock_token_attribute_name,               # Unlock token attribute name
+                          :unlock_token_email_method_name,            # Mailer method name
+                          :unlock_token_mailer_disabled,              # When true, dont send unlock token via email
+                          :unlock_token_mailer                        # Mailer class
           end
           
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@failed_logins_count_attribute_name              => :failed_logins_count,
                              :@lock_expires_at_attribute_name                  => :lock_expires_at,
                              :@consecutive_login_retries_amount_limit          => 50,
-                             :@login_lock_time_period                          => 60 * 60)
+                             :@login_lock_time_period                          => 60 * 60,
+
+                             :@unlock_token_attribute_name                     => :unlock_token,
+                             :@unlock_token_email_method_name                  => :send_unlock_token_email,
+                             :@unlock_token_mailer_disabled                    => false,
+                             :@unlock_token_mailer                             => nil)
             reset!
           end
           
           base.sorcery_config.before_authenticate << :prevent_locked_user_login
           base.sorcery_config.after_config << :define_brute_force_protection_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
+            base.sorcery_config.after_config << :define_brute_force_protection_mongo_mapper_fields
+          end
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
         end
         
         module ClassMethods
+          def load_from_unlock_token(token)
+            return nil if token.blank?
+            user = find_by_sorcery_token(sorcery_config.unlock_token_attribute_name,token)
+            user
+          end
+
           protected
 
           def define_brute_force_protection_mongoid_fields
-            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer
-            field sorcery_config.lock_expires_at_attribute_name,      :type => DateTime
+            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer, :default => 0
+            field sorcery_config.lock_expires_at_attribute_name,      :type => Time
+            field sorcery_config.unlock_token_attribute_name,         :type => String
+          end
+
+          def define_brute_force_protection_mongo_mapper_fields
+            key sorcery_config.failed_logins_count_attribute_name, Integer, :default => 0
+            key sorcery_config.lock_expires_at_attribute_name, Time
+            key sorcery_config.unlock_token_attribute_name, String
           end
         end
         
@@ -46,36 +72,49 @@ module Sorcery
             config = sorcery_config
             return if !unlocked?
             self.increment(config.failed_logins_count_attribute_name)
-            save!
+            self.update_many_attributes(config.failed_logins_count_attribute_name => self.send(config.failed_logins_count_attribute_name))
             self.lock! if self.send(config.failed_logins_count_attribute_name) >= config.consecutive_login_retries_amount_limit
           end
           
+          # /!\
+          # Moved out of protected for use like activate! in controller
+          # /!\
+          def unlock!
+            config = sorcery_config
+            attributes = {config.lock_expires_at_attribute_name => nil,
+                          config.failed_logins_count_attribute_name => 0}
+            attributes[config.unlock_token_attribute_name] = nil unless config.unlock_token_mailer_disabled or config.unlock_token_mailer.nil?
+            self.update_many_attributes(attributes)
+          end
+
           protected
 
           def lock!
             config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.utc + config.login_lock_time_period)
-            self.save!
-          end
+            attributes = {config.lock_expires_at_attribute_name => Time.now.in_time_zone + config.login_lock_time_period}
 
-          def unlock!
-            config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
-            self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
-            self.save!
+            unless config.unlock_token_mailer_disabled || config.unlock_token_mailer.nil?
+              attributes[config.unlock_token_attribute_name] = TemporaryToken.generate_random_token
+              send_unlock_token_email!
+            end
+            self.update_many_attributes(attributes)
           end
           
           def unlocked?
             config = sorcery_config
             self.send(config.lock_expires_at_attribute_name).nil?
           end
+
+          def send_unlock_token_email!
+            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer) unless sorcery_config.unlock_token_email_method_name.nil? or sorcery_config.unlock_token_mailer_disabled == true
+          end
           
           # Prevents a locked user from logging in, and unlocks users that expired their lock time.
           # Runs as a hook before authenticate.
           def prevent_locked_user_login
             config = sorcery_config
             if !self.unlocked? && config.login_lock_time_period != 0
-              self.unlock! if self.send(config.lock_expires_at_attribute_name) <= Time.now.utc
+              self.unlock! if self.send(config.lock_expires_at_attribute_name) <= Time.now.in_time_zone
             end
             unlocked?
           end
@@ -83,4 +122,4 @@ module Sorcery
       end
     end
   end
-end
+end