sorcery 0.7.0 → 0.8.0

data/spec/rails3/Gemfile.lock

@@ -1,10 +1,10 @@
 PATH
-  remote: ../../../
+  remote: ../../
   specs:
-    sorcery (0.6.1)
+    sorcery (0.7.13)
       bcrypt-ruby (~> 3.0.0)
       oauth (~> 0.4.4)
-      oauth2 (~> 0.5.0)
+      oauth2 (~> 0.8.0)
 
 GEM
   remote: http://rubygems.org/
@@ -36,53 +36,56 @@ GEM
       activemodel (= 3.0.3)
       activesupport (= 3.0.3)
     activesupport (3.0.3)
-    addressable (2.2.6)
+    addressable (2.2.7)
     archive-tar-minitar (0.5.2)
-    arel (2.0.6)
+    arel (2.0.10)
     bcrypt-ruby (3.0.1)
     builder (2.1.2)
-    capybara (1.1.1)
+    capybara (1.1.2)
       mime-types (>= 1.16)
       nokogiri (>= 1.3.3)
       rack (>= 1.0.0)
       rack-test (>= 0.5.4)
       selenium-webdriver (~> 2.0)
       xpath (~> 0.1.4)
-    childprocess (0.2.2)
+    childprocess (0.3.1)
       ffi (~> 1.0.6)
-    columnize (0.3.2)
-    diff-lcs (1.1.2)
+    columnize (0.3.6)
+    diff-lcs (1.1.3)
     erubis (2.6.6)
       abstract (>= 1.0.0)
-    faraday (0.7.4)
-      addressable (~> 2.2.6)
-      multipart-post (~> 1.1.0)
-      rack (< 2, >= 1.1.0)
-    ffi (1.0.9)
-    i18n (0.5.0)
-    json_pure (1.5.1)
+    faraday (0.8.4)
+      multipart-post (~> 1.1)
+    ffi (1.0.11)
+    httpauth (0.2.0)
+    i18n (0.6.0)
+    jwt (0.1.5)
+      multi_json (>= 1.0)
     launchy (2.0.5)
       addressable (~> 2.2.6)
-    linecache19 (0.5.11)
+    linecache19 (0.5.12)
       ruby_core_source (>= 0.1.4)
-    mail (2.2.13)
+    mail (2.2.19)
       activesupport (>= 2.3.6)
       i18n (>= 0.4.0)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
-    mime-types (1.16)
-    multi_json (1.0.3)
-    multipart-post (1.1.3)
-    nokogiri (1.4.4)
-    oauth (0.4.5)
-    oauth2 (0.5.1)
-      faraday (~> 0.7.4)
-      multi_json (~> 1.0.3)
-    polyglot (0.3.1)
-    rack (1.2.1)
-    rack-mount (0.6.13)
+    mime-types (1.17.2)
+    multi_json (1.1.0)
+    multipart-post (1.1.5)
+    nokogiri (1.5.0)
+    oauth (0.4.7)
+    oauth2 (0.8.0)
+      faraday (~> 0.8)
+      httpauth (~> 0.1)
+      jwt (~> 0.1.4)
+      multi_json (~> 1.0)
+      rack (~> 1.2)
+    polyglot (0.3.3)
+    rack (1.2.5)
+    rack-mount (0.6.14)
       rack (>= 1.0.0)
-    rack-test (0.5.6)
+    rack-test (0.5.7)
       rack (>= 1.0)
     rails (3.0.3)
       actionmailer (= 3.0.3)
@@ -97,21 +100,21 @@ GEM
       activesupport (= 3.0.3)
       rake (>= 0.8.7)
       thor (~> 0.14.4)
-    rake (0.8.7)
-    rspec (2.5.0)
-      rspec-core (~> 2.5.0)
-      rspec-expectations (~> 2.5.0)
-      rspec-mocks (~> 2.5.0)
-    rspec-core (2.5.1)
-    rspec-expectations (2.5.0)
+    rake (0.9.2.2)
+    rspec (2.7.0)
+      rspec-core (~> 2.7.0)
+      rspec-expectations (~> 2.7.0)
+      rspec-mocks (~> 2.7.0)
+    rspec-core (2.7.1)
+    rspec-expectations (2.7.0)
       diff-lcs (~> 1.1.2)
-    rspec-mocks (2.5.0)
-    rspec-rails (2.5.0)
+    rspec-mocks (2.7.0)
+    rspec-rails (2.7.0)
       actionpack (~> 3.0)
       activesupport (~> 3.0)
       railties (~> 3.0)
-      rspec (~> 2.5.0)
-    ruby-debug-base19 (0.11.24)
+      rspec (~> 2.7.0)
+    ruby-debug-base19 (0.11.25)
       columnize (>= 0.3.1)
       linecache19 (>= 0.5.11)
       ruby_core_source (>= 0.1.4)
@@ -119,23 +122,27 @@ GEM
       columnize (>= 0.3.1)
       linecache19 (>= 0.5.11)
       ruby-debug-base19 (>= 0.11.19)
-    ruby_core_source (0.1.4)
+    ruby_core_source (0.1.5)
       archive-tar-minitar (>= 0.5.2)
-    rubyzip (0.9.4)
-    selenium-webdriver (2.6.0)
-      childprocess (>= 0.2.1)
-      ffi (>= 1.0.7)
-      json_pure
+    rubyzip (0.9.6.1)
+    selenium-webdriver (2.20.0)
+      childprocess (>= 0.2.5)
+      ffi (~> 1.0)
+      multi_json (~> 1.0)
       rubyzip
-    simplecov (0.3.9)
-      simplecov-html (>= 0.3.7)
-    simplecov-html (0.3.9)
-    sqlite3-ruby (1.3.2)
+    simplecov (0.6.1)
+      multi_json (~> 1.0)
+      simplecov-html (~> 0.5.3)
+    simplecov-html (0.5.3)
+    sqlite3 (1.3.5)
+    sqlite3-ruby (1.3.3)
+      sqlite3 (>= 1.3.3)
     thor (0.14.6)
     timecop (0.3.5)
-    treetop (1.4.9)
+    treetop (1.4.10)
+      polyglot
       polyglot (>= 0.3.1)
-    tzinfo (0.3.23)
+    tzinfo (0.3.31)
     xpath (0.1.4)
       nokogiri (~> 1.3)
 
@@ -143,11 +150,11 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  bcrypt-ruby (~> 3.0.0)
   capybara (~> 1.1.1)
   launchy (~> 2.0.5)
   rails (= 3.0.3)
-  rspec (~> 2.5.0)
-  rspec-rails (~> 2.5.0)
+  rspec-rails (~> 2.7.0)
   ruby-debug19
   simplecov (>= 0.3.8)
   sorcery (>= 0.1.0)!

data/spec/rails3/app/controllers/application_controller.rb

@@ -9,16 +9,21 @@ class ApplicationController < ActionController::Base
 
   def index
   end
-  
+
   def some_action
     render :nothing => true
   end
 
+  def some_action_making_a_non_persisted_change_to_the_user
+    current_user.username = "to_be_ignored"
+    render :nothing => true
+  end
+  
   def test_login
     @user = login(params[:username], params[:password])
     render :text => ""
   end
-  
+
   def test_auto_login
     @user = User.find(:first)
     auto_login(@user)
@@ -84,6 +89,14 @@ class ApplicationController < ActionController::Base
     login_at(:github)
   end
 
+  def login_at_test4
+    login_at(:google)
+  end
+
+  def login_at_test5
+    login_at(:liveid)
+  end
+
   def test_login_from
     if @user = login_from(:twitter)
       redirect_to "bla", :notice => "Success!"
@@ -108,6 +121,62 @@ class ApplicationController < ActionController::Base
     end
   end
 
+  def test_login_from4
+    if @user = login_from(:google)
+      redirect_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
+  def test_login_from5
+    if @user = login_from(:liveid)
+      redirect_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
+  def test_return_to_with_external
+    if @user = login_from(:twitter)
+      redirect_back_or_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
+  def test_return_to_with_external2
+    if @user = login_from(:facebook)
+      redirect_back_or_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
+  def test_return_to_with_external3
+    if @user = login_from(:github)
+      redirect_back_or_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
+  def test_return_to_with_external4
+    if @user = login_from(:google)
+      redirect_back_or_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
+  def test_return_to_with_external5
+    if @user = login_from(:liveid)
+      redirect_back_or_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
+
   def test_create_from_provider
     provider = params[:provider]
     login_from(provider)
@@ -117,6 +186,20 @@ class ApplicationController < ActionController::Base
       redirect_to "blu", :alert => "Failed!"
     end
   end
+  
+  def test_create_from_provider_with_block
+    provider = params[:provider]
+    login_from(provider)
+    @user = create_from(provider) do |user|
+      # check uniqueness of username
+      User.where(:username => user.username).empty?
+    end
+    if @user 
+      redirect_to "bla", :notice => "Success!"
+    else
+      redirect_to "blu", :alert => "Failed!"
+    end
+  end
 
   protected
 

data/spec/rails3/app/mailers/sorcery_mailer.rb

@@ -22,4 +22,11 @@ class SorceryMailer < ActionMailer::Base
     mail(:to => user.email,
          :subject => "Your password has been reset")
   end
+
+  def send_unlock_token_email(user)
+    @user = user
+    @url = "http://example.com/unlock/#{user.unlock_token}"
+    mail(:to => user.email,
+         :subject => "Your account has been locked due to many wrong logins")
+  end
 end

data/spec/rails3/app/views/sorcery_mailer/send_unlock_token_email.text.erb

@@ -0,0 +1 @@
+Please visit <% @url %> for unlock your account.

data/spec/rails3/config/environments/in_memory.rb

@@ -0,0 +1,35 @@
+AppRoot::Application.configure do
+  # Settings specified here will take precedence over those in config/application.rb
+
+  # The test environment is used exclusively to run your application's
+  # test suite.  You never need to work with it otherwise.  Remember that
+  # your test database is "scratch space" for the test suite and is wiped
+  # and recreated between test runs.  Don't rely on the data there!
+  config.cache_classes = true
+
+  # Log error messages when you accidentally call methods on nil.
+  config.whiny_nils = true
+
+  # Show full error reports and disable caching
+  config.consider_all_requests_local       = true
+  config.action_controller.perform_caching = false
+
+  # Raise exceptions instead of rendering exception templates
+  config.action_dispatch.show_exceptions = false
+
+  # Disable request forgery protection in test environment
+  config.action_controller.allow_forgery_protection = true
+
+  # Tell Action Mailer not to deliver emails to the real world.
+  # The :test delivery method accumulates sent emails in the
+  # ActionMailer::Base.deliveries array.
+  config.action_mailer.delivery_method = :test
+
+  # Use SQL instead of Active Record's schema dumper when creating the test database.
+  # This is necessary if your schema can't be completely dumped by the schema dumper,
+  # like if you have constraints or database-specific column types
+  # config.active_record.schema_format = :sql
+
+  # Print deprecation notices to the stderr
+  config.active_support.deprecation = :stderr
+end

data/spec/rails3/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb

@@ -2,9 +2,11 @@ class AddBruteForceProtectionToUsers < ActiveRecord::Migration
   def self.up
     add_column :users, :failed_logins_count, :integer, :default => 0
     add_column :users, :lock_expires_at, :datetime, :default => nil
+    add_column :users, :unlock_token, :string, :default => nil
   end
 
   def self.down
+    remove_column :users, :unlock_token
     remove_column :users, :lock_expires_at
     remove_column :users, :failed_logins_count
   end

data/spec/rails3/spec/controller_activity_logging_spec.rb

@@ -7,6 +7,9 @@ describe ApplicationController do
   
   after(:all) do
     ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activity_logging")
+    sorcery_controller_property_set(:register_login_time, true)
+    sorcery_controller_property_set(:register_logout_time, true)
+    sorcery_controller_property_set(:register_last_activity_time, true)
   end
   
   # ----------------- ACTIVITY LOGGING -----------------------
@@ -30,7 +33,7 @@ describe ApplicationController do
     end
 
     it "should log login time on login" do
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       login_user
       @user.last_login_at.should_not be_nil
       @user.last_login_at.to_s(:db).should >= now.to_s(:db)
@@ -39,7 +42,7 @@ describe ApplicationController do
 
     it "should log logout time on logout" do
       login_user
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       logout_user
       User.first.last_logout_at.should_not be_nil
       User.first.last_logout_at.to_s(:db).should >= now.to_s(:db)
@@ -48,12 +51,19 @@ describe ApplicationController do
 
     it "should log last activity time when logged in" do
       login_user
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       get :some_action
       User.first.last_activity_at.to_s(:db).should >= now.to_s(:db)
       User.first.last_activity_at.to_s(:db).should <= (now+2).to_s(:db)
     end
 
+    it "should update nothing but activity fields" do
+      original_user_name = User.first.username
+      login_user
+      get :some_action_making_a_non_persisted_change_to_the_user
+      User.first.username.should == original_user_name
+    end
+    
     it "'current_users' should hold the user object when 1 user is logged in" do
       login_user
       get :some_action
@@ -81,14 +91,14 @@ describe ApplicationController do
     
     it "should not register login time if configured so" do
       sorcery_controller_property_set(:register_login_time, false)
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       login_user
       @user.last_login_at.should be_nil
     end
     
     it "should not register logout time if configured so" do
       sorcery_controller_property_set(:register_logout_time, false)
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       login_user
       logout_user
       @user.last_logout_at.should be_nil
@@ -96,7 +106,7 @@ describe ApplicationController do
     
     it "should not register last activity time if configured so" do
       sorcery_controller_property_set(:register_last_activity_time, false)
-      now = Time.now.utc
+      now = Time.now.in_time_zone
       login_user
       get :some_action
       @user.last_activity_at.should be_nil

data/spec/rails3/spec/controller_brute_force_protection_spec.rb

@@ -21,12 +21,34 @@ describe ApplicationController do
       sorcery_controller_property_set(:user_class, User)
       Timecop.return
     end
-    
+
     it "should count login retries" do
       3.times {get :test_login, :username => 'gizmo', :password => 'blabla'}
       User.find_by_username('gizmo').failed_logins_count.should == 3
     end
     
+    it "should generate unlock token after user locked" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times {get :test_login, :username => "gizmo", :password => "blabla"}
+      User.find_by_username('gizmo').unlock_token.should_not be_nil
+    end
+
+    it "should unlock after entering unlock token" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times {get :test_login, :username => "gizmo", :password => "blabla"}
+      User.find_by_username('gizmo').unlock_token.should_not be_nil
+      token = User.find_by_username('gizmo').unlock_token
+      user = User.load_from_unlock_token(token)
+      user.should_not be_nil
+      user.unlock!
+      User.load_from_unlock_token(token).should be_nil
+    end
+
+    
     it "should reset the counter on a good login" do
       sorcery_model_property_set(:consecutive_login_retries_amount_limit, 5)
       3.times {get :test_login, :username => 'gizmo', :password => 'blabla'}
@@ -47,7 +69,7 @@ describe ApplicationController do
       get :test_login, :username => 'gizmo', :password => 'blabla'
       get :test_login, :username => 'gizmo', :password => 'blabla'
       User.find_by_username('gizmo').lock_expires_at.should_not be_nil
-      Timecop.travel(Time.now + 0.3)
+      Timecop.travel(Time.now.in_time_zone + 0.3)
       get :test_login, :username => 'gizmo', :password => 'blabla'
       User.find_by_username('gizmo').lock_expires_at.should be_nil
     end
@@ -58,7 +80,7 @@ describe ApplicationController do
       get :test_login, :username => 'gizmo', :password => 'blabla'
       get :test_login, :username => 'gizmo', :password => 'blabla'
       unlock_date = User.find_by_username('gizmo').lock_expires_at
-      Timecop.travel(Time.now + 1)
+      Timecop.travel(Time.now.in_time_zone + 1)
       get :test_login, :username => 'gizmo', :password => 'blabla'
       User.find_by_username('gizmo').lock_expires_at.to_s.should == unlock_date.to_s
     end