sorcery 0.7.4 → 0.8.0

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -8,6 +8,15 @@ module Sorcery
       module RememberMe
         def self.included(base)
           base.send(:include, InstanceMethods)
+          Config.module_eval do
+            class << self
+              attr_accessor :remember_me_httponly
+              def merge_remember_me_defaults!
+                @defaults.merge!(:@remember_me_httponly => true)
+              end
+            end
+            merge_remember_me_defaults!
+          end
           Config.login_sources << :login_from_cookie
           Config.after_login << :remember_me_if_asked_to
           Config.after_logout << :forget_me!
@@ -60,7 +69,7 @@ module Sorcery
             cookies.signed[:remember_me_token] = {
               :value => user.send(user.sorcery_config.remember_me_token_attribute_name),
               :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name),
-              :httponly => true,
+              :httponly => Config.remember_me_httponly,
               :domain => Config.cookie_domain
             }
           end
@@ -69,4 +78,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/controller.rb

@@ -21,19 +21,22 @@ module Sorcery
       # If all attempts to auto-login fail, the failure callback will be called.
       def require_login
         if !logged_in?
-          session[:return_to_url] = request.url if Config.save_return_to_url
+          session[:return_to_url] = request.url if Config.save_return_to_url && request.get?
           self.send(Config.not_authenticated_action)
         end
       end
 
       # Takes credentials and returns a user on successful authentication.
       # Runs hooks after login or failed login.
-      def login(*credentials)
+       def login(*credentials)
+        @current_user = nil
         user = user_class.authenticate(*credentials)
         if user
-          return_to_url = session[:return_to_url]
+          old_session = session.dup
           reset_session # protect from session fixation attacks
-          session[:return_to_url] = return_to_url
+          old_session.to_hash.each_pair do |k,v|
+            session[k.to_sym] = v
+          end
           auto_login(user)
           after_login!(user, credentials)
           current_user
@@ -71,6 +74,7 @@ module Sorcery
       # and we want to return him back to the page he originally wanted.
       def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
+        session[:return_to_url] = nil
       end
 
       # The default action for denying non-authenticated users.
@@ -108,10 +112,14 @@ module Sorcery
       end
 
       def login_from_session
-        @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
+        @current_user = (user_class.find(session[:user_id]) if session[:user_id]) || false
+      rescue => exception
+        return false if defined?(Mongoid) and exception.is_a?(Mongoid::Errors::DocumentNotFound)
+        return false if defined?(ActiveRecord) and exception.is_a?(ActiveRecord::RecordNotFound)
+        raise exception
       end
 
-      def after_login!(user, credentials)
+      def after_login!(user, credentials = [])
         Config.after_login.each {|c| self.send(c, user, credentials)}
       end
 

data/lib/sorcery/crypto_providers/bcrypt.rb

@@ -48,6 +48,7 @@ module Sorcery
           @cost ||= 10
         end
         attr_writer :cost
+        alias :stretches :cost
         alias :stretches= :cost=
         
         # Creates a BCrypt hash for the password passed.

data/lib/sorcery/model/adapters/active_record.rb

@@ -4,11 +4,31 @@ module Sorcery
       module ActiveRecord
         def self.included(klass)
           klass.extend ClassMethods
+          klass.send(:include, InstanceMethods)
         end
 
+        module InstanceMethods
+          def update_many_attributes(attrs)
+            attrs.each do |name, value|
+              self.send(:"#{name}=", value)
+            end
+            primary_key = self.class.primary_key
+            self.class.where(:"#{primary_key}" => self.send(:"#{primary_key}")).update_all(attrs)
+          end
+
+          def update_single_attribute(name, value)
+            update_many_attributes(name => value)
+          end
+        end
+        
         module ClassMethods
+          def column_name(attribute)
+            return "LOWER(#{attribute})" if (@sorcery_config.downcase_username_before_authenticating)
+            return "#{attribute}"
+          end
+
           def find_by_credentials(credentials)
-             sql = @sorcery_config.username_attribute_names.map{|attribute| "#{attribute} = :login"}
+             sql = @sorcery_config.username_attribute_names.map{|attribute| column_name(attribute) + " = :login"}
              where(sql.join(' OR '), :login => credentials[0]).first
           end
 

data/lib/sorcery/model/adapters/mongo_mapper.rb

@@ -3,42 +3,49 @@ module Sorcery
     module Adapters
       module MongoMapper
         extend ActiveSupport::Concern
-        
+
         included do
           include Sorcery::Model
         end
-        
-        module InstanceMethods
-          def increment(attr)
-            self.inc(attr,1)
-          end
-          
-          def save!(options = {})
-            save(options)
-          end
+
+        def increment(attr)
+          self.class.increment(id, attr => 1)
+        end
+
+        def save!(options = {})
+          save(options)
+        end
+
+        def update_many_attributes(attrs)
+          update_attributes(attrs)
         end
 
         module ClassMethods
+          def credential_regex(credential)
+            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
+            return credential
+          end
+
           def find_by_credentials(credentials)
             @sorcery_config.username_attribute_names.each do |attribute|
-              @user = where(attribute => credentials[0]).first
+              @user = where(attribute => credential_regex(credentials[0])).first
               break if @user
             end
             @user
           end
-          
+
           def find_by_id(id)
             find(id)
           end
-          
+
           def find_by_activation_token(token)
             where(sorcery_config.activation_token_attribute_name => token).first
           end
-          
+
           def transaction(&blk)
             tap(&blk)
           end
-          
+
           def find_by_sorcery_token(token_attr_name, token)
             where(token_attr_name => token).first
           end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -11,12 +11,29 @@ module Sorcery
           def increment(attr)
             self.inc(attr,1)
           end
+
+          def update_many_attributes(attrs)
+            attrs.each do |name, value|
+              attrs[name] = value.utc if value.is_a?(ActiveSupport::TimeWithZone)
+              self.send(:"#{name}=", value)
+            end
+            self.class.where(:_id => self.id).update_all(attrs)
+          end
+
+          def update_single_attribute(name, value)
+            update_many_attributes(name => value)
+          end
         end
 
         module ClassMethods
+          def credential_regex(credential)
+            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
+            return credential
+          end
+
           def find_by_credentials(credentials)
             @sorcery_config.username_attribute_names.each do |attribute|
-              @user = where(attribute => credentials[0]).first
+              @user = where(attribute => credential_regex(credentials[0])).first
               break if @user
             end
             @user
@@ -61,8 +78,8 @@ module Sorcery
           def get_current_users
             config = sorcery_config
             where(config.last_activity_at_attribute_name.ne => nil) \
-            .any_of({config.last_logout_at_attribute_name => nil},{config.last_activity_at_attribute_name.gt => config.last_logout_at_attribute_name}) \
-            .and(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc.to_s(:db)).order_by([:_id,:asc])
+            .where("this.#{config.last_logout_at_attribute_name} == null || this.#{config.last_activity_at_attribute_name} > this.#{config.last_logout_at_attribute_name}") \
+            .where(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc).order_by([:_id,:asc])
           end
         end
       end

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -39,12 +39,12 @@ module Sorcery
           protected
 
           def define_activity_logging_mongoid_fields
-            field sorcery_config.last_login_at_attribute_name,    :type => DateTime
-            field sorcery_config.last_logout_at_attribute_name,   :type => DateTime
-            field sorcery_config.last_activity_at_attribute_name, :type => DateTime
+            field sorcery_config.last_login_at_attribute_name,    :type => Time
+            field sorcery_config.last_logout_at_attribute_name,   :type => Time
+            field sorcery_config.last_activity_at_attribute_name, :type => Time
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -12,15 +12,25 @@ module Sorcery
                           :lock_expires_at_attribute_name,            # this field indicates whether user 
                                                                       # is banned and when it will be active again.
                           :consecutive_login_retries_amount_limit,    # how many failed logins allowed.
-                          :login_lock_time_period                     # how long the user should be banned. 
+                          :login_lock_time_period,                    # how long the user should be banned. 
                                                                       # in seconds. 0 for permanent.
+
+                          :unlock_token_attribute_name,               # Unlock token attribute name
+                          :unlock_token_email_method_name,            # Mailer method name
+                          :unlock_token_mailer_disabled,              # When true, dont send unlock token via email
+                          :unlock_token_mailer                        # Mailer class
           end
           
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@failed_logins_count_attribute_name              => :failed_logins_count,
                              :@lock_expires_at_attribute_name                  => :lock_expires_at,
                              :@consecutive_login_retries_amount_limit          => 50,
-                             :@login_lock_time_period                          => 60 * 60)
+                             :@login_lock_time_period                          => 60 * 60,
+
+                             :@unlock_token_attribute_name                     => :unlock_token,
+                             :@unlock_token_email_method_name                  => :send_unlock_token_email,
+                             :@unlock_token_mailer_disabled                    => false,
+                             :@unlock_token_mailer                             => nil)
             reset!
           end
           
@@ -34,16 +44,24 @@ module Sorcery
         end
         
         module ClassMethods
+          def load_from_unlock_token(token)
+            return nil if token.blank?
+            user = find_by_sorcery_token(sorcery_config.unlock_token_attribute_name,token)
+            user
+          end
+
           protected
 
           def define_brute_force_protection_mongoid_fields
-            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer
-            field sorcery_config.lock_expires_at_attribute_name,      :type => DateTime
+            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer, :default => 0
+            field sorcery_config.lock_expires_at_attribute_name,      :type => Time
+            field sorcery_config.unlock_token_attribute_name,         :type => String
           end
 
           def define_brute_force_protection_mongo_mapper_fields
-            key sorcery_config.failed_logins_count_attribute_name, Integer
-            key sorcery_config.lock_expires_at_attribute_name, DateTime
+            key sorcery_config.failed_logins_count_attribute_name, Integer, :default => 0
+            key sorcery_config.lock_expires_at_attribute_name, Time
+            key sorcery_config.unlock_token_attribute_name, String
           end
         end
         
@@ -54,29 +72,42 @@ module Sorcery
             config = sorcery_config
             return if !unlocked?
             self.increment(config.failed_logins_count_attribute_name)
-            save!(:validate => false)
+            self.update_many_attributes(config.failed_logins_count_attribute_name => self.send(config.failed_logins_count_attribute_name))
             self.lock! if self.send(config.failed_logins_count_attribute_name) >= config.consecutive_login_retries_amount_limit
           end
           
+          # /!\
+          # Moved out of protected for use like activate! in controller
+          # /!\
+          def unlock!
+            config = sorcery_config
+            attributes = {config.lock_expires_at_attribute_name => nil,
+                          config.failed_logins_count_attribute_name => 0}
+            attributes[config.unlock_token_attribute_name] = nil unless config.unlock_token_mailer_disabled or config.unlock_token_mailer.nil?
+            self.update_many_attributes(attributes)
+          end
+
           protected
 
           def lock!
             config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.in_time_zone + config.login_lock_time_period)
-            self.save!(validate: false)
-          end
+            attributes = {config.lock_expires_at_attribute_name => Time.now.in_time_zone + config.login_lock_time_period}
 
-          def unlock!
-            config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
-            self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
-            self.save!(validate: false)
+            unless config.unlock_token_mailer_disabled || config.unlock_token_mailer.nil?
+              attributes[config.unlock_token_attribute_name] = TemporaryToken.generate_random_token
+              send_unlock_token_email!
+            end
+            self.update_many_attributes(attributes)
           end
           
           def unlocked?
             config = sorcery_config
             self.send(config.lock_expires_at_attribute_name).nil?
           end
+
+          def send_unlock_token_email!
+            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer) unless sorcery_config.unlock_token_email_method_name.nil? or sorcery_config.unlock_token_mailer_disabled == true
+          end
           
           # Prevents a locked user from logging in, and unlocks users that expired their lock time.
           # Runs as a hook before authenticate.

data/lib/sorcery/model/submodules/remember_me.rb

@@ -49,17 +49,15 @@ module Sorcery
           # You shouldn't really use this one yourself - it's called by the controller's 'remember_me!' method.
           def remember_me!
             config = sorcery_config
-            self.send(:"#{config.remember_me_token_attribute_name}=", TemporaryToken.generate_random_token)
-            self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.remember_me_for)
-            self.save!(:validate => false)
+            self.update_many_attributes(config.remember_me_token_attribute_name => TemporaryToken.generate_random_token,
+                                        config.remember_me_token_expires_at_attribute_name => Time.now.in_time_zone + config.remember_me_for)
           end
           
           # You shouldn't really use this one yourself - it's called by the controller's 'forget_me!' method.
           def forget_me!
             config = sorcery_config
-            self.send(:"#{config.remember_me_token_attribute_name}=", nil)
-            self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", nil)
-            self.save!(:validate => false)
+            self.update_many_attributes(config.remember_me_token_attribute_name => nil,
+                                        config.remember_me_token_expires_at_attribute_name => nil)
           end
         end
       end

data/lib/sorcery/model/submodules/reset_password.rb

@@ -18,6 +18,11 @@ module Sorcery
                                                                              # protection.
                                                                              
                           :reset_password_mailer,                            # mailer class. Needed.
+
+                          :reset_password_mailer_disabled,                   # when true sorcery will not automatically
+                                                                             # email password reset details and allow you to
+                                                                             # manually handle how and when email is sent
+
                           :reset_password_email_method_name,                 # reset password email method on your
                                                                              # mailer class.
                                                                              
@@ -34,6 +39,7 @@ module Sorcery
                              :@reset_password_token_expires_at_attribute_name => :reset_password_token_expires_at,
                              :@reset_password_email_sent_at_attribute_name    => :reset_password_email_sent_at,
                              :@reset_password_mailer                          => nil,
+                             :@reset_password_mailer_disabled                 => false,
                              :@reset_password_email_method_name               => :reset_password_email,
                              :@reset_password_expiration_period               => nil,
                              :@reset_password_time_between_emails             => 5 * 60 )
@@ -64,21 +70,21 @@ module Sorcery
           
           protected
           
-          # This submodule requires the developer to define his own mailer class to be used by it.
+          # This submodule requires the developer to define his own mailer class to be used by it
+          # when reset_password_mailer_disabled is false
           def validate_mailer_defined
             msg = "To use reset_password submodule, you must define a mailer (config.reset_password_mailer = YourMailerClass)."
-            raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil
+            raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil and @sorcery_config.reset_password_mailer_disabled == false
           end
 
           def define_reset_password_mongoid_fields
             field sorcery_config.reset_password_token_attribute_name,             :type => String
-            field sorcery_config.reset_password_token_expires_at_attribute_name,  :type => DateTime
-            field sorcery_config.reset_password_email_sent_at_attribute_name,     :type => DateTime
+            field sorcery_config.reset_password_token_expires_at_attribute_name,  :type => Time
+            field sorcery_config.reset_password_email_sent_at_attribute_name,     :type => Time
           end
           
           def define_reset_password_mongo_mapper_fields
             key sorcery_config.reset_password_token_attribute_name, String
-            # no DateTime in MM
             key sorcery_config.reset_password_token_expires_at_attribute_name, Time
             key sorcery_config.reset_password_email_sent_at_attribute_name, Time
           end
@@ -89,13 +95,13 @@ module Sorcery
           def deliver_reset_password_instructions!
             config = sorcery_config
             # hammering protection
-            return if config.reset_password_time_between_emails && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.ago.utc
-            self.send(:"#{config.reset_password_token_attribute_name}=", TemporaryToken.generate_random_token)
-            self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.reset_password_expiration_period) if config.reset_password_expiration_period
-            self.send(:"#{config.reset_password_email_sent_at_attribute_name}=", Time.now.in_time_zone)
+            return false if config.reset_password_time_between_emails && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.ago.utc
+            attributes = {config.reset_password_token_attribute_name => TemporaryToken.generate_random_token,
+                          config.reset_password_email_sent_at_attribute_name => Time.now.in_time_zone}
+            attributes[config.reset_password_token_expires_at_attribute_name] = Time.now.in_time_zone + config.reset_password_expiration_period if config.reset_password_expiration_period
             self.class.transaction do
-              self.save!(:validate => false)
-              generic_send_email(:reset_password_email_method_name, :reset_password_mailer)
+              self.update_many_attributes(attributes)
+              generic_send_email(:reset_password_email_method_name, :reset_password_mailer) unless config.reset_password_mailer_disabled
             end
           end
           
@@ -119,4 +125,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/user_activation.rb

@@ -20,7 +20,13 @@ module Sorcery
                           :activation_token_expiration_period,            # how many seconds before the activation code
                                                                           # expires. nil for never expires.
                                                                           
-                          :user_activation_mailer,                        # your mailer class. Required.
+                          :user_activation_mailer,                        # your mailer class. Required when
+                                                                          # activation_mailer_disabled == false.
+
+                          :activation_mailer_disabled,                    # when true sorcery will not automatically
+                                                                          # email activation details and allow you to
+                                                                          # manually handle how and when email is sent
+
                           :activation_needed_email_method_name,           # activation needed email method on your
                                                                           # mailer class.
                                                                           
@@ -37,6 +43,7 @@ module Sorcery
                              :@activation_token_expires_at_attribute_name  => :activation_token_expires_at,
                              :@activation_token_expiration_period          => nil,
                              :@user_activation_mailer                      => nil,
+                             :@activation_mailer_disabled                  => false,
                              :@activation_needed_email_method_name         => :activation_needed_email,
                              :@activation_success_email_method_name        => :activation_success_email,
                              :@prevent_non_active_users_to_login           => true)
@@ -47,7 +54,7 @@ module Sorcery
             # don't setup activation if no password supplied - this user is created automatically
             before_create :setup_activation, :if => Proc.new { |user| user.send(sorcery_config.password_attribute_name).present? }
             # don't send activation needed email if no crypted password created - this user is external (OAuth etc.)
-            after_create  :send_activation_needed_email!, :if => Proc.new { |user| !user.external?}
+            after_create  :send_activation_needed_email!, :if => Proc.new { |user| !user.external? }
           end
           
           base.sorcery_config.after_config << :validate_mailer_defined
@@ -74,17 +81,18 @@ module Sorcery
           
           protected
           
-          # This submodule requires the developer to define his own mailer class to be used by it.
+          # This submodule requires the developer to define his own mailer class to be used by it
+          # when activation_mailer_disabled is false
           def validate_mailer_defined
             msg = "To use user_activation submodule, you must define a mailer (config.user_activation_mailer = YourMailerClass)."
-            raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil
+            raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil and @sorcery_config.activation_mailer_disabled == false
           end
 
           def define_user_activation_mongoid_fields
             self.class_eval do
               field sorcery_config.activation_state_attribute_name,            :type => String
               field sorcery_config.activation_token_attribute_name,            :type => String
-              field sorcery_config.activation_token_expires_at_attribute_name, :type => DateTime
+              field sorcery_config.activation_token_expires_at_attribute_name, :type => Time
             end
           end
 
@@ -92,7 +100,6 @@ module Sorcery
             self.class_eval do
               key sorcery_config.activation_state_attribute_name, String
               key sorcery_config.activation_token_attribute_name, String
-              # no DateTime in MM
               key sorcery_config.activation_token_expires_at_attribute_name, Time
             end
           end
@@ -120,11 +127,11 @@ module Sorcery
 
           # called automatically after user initial creation.
           def send_activation_needed_email!
-            generic_send_email(:activation_needed_email_method_name, :user_activation_mailer) unless sorcery_config.activation_needed_email_method_name.nil?
+            generic_send_email(:activation_needed_email_method_name, :user_activation_mailer) unless sorcery_config.activation_needed_email_method_name.nil? or sorcery_config.activation_mailer_disabled == true
           end
 
           def send_activation_success_email!
-            generic_send_email(:activation_success_email_method_name, :user_activation_mailer) unless sorcery_config.activation_success_email_method_name.nil?
+            generic_send_email(:activation_success_email_method_name, :user_activation_mailer) unless sorcery_config.activation_success_email_method_name.nil? or sorcery_config.activation_mailer_disabled == true
           end
           
           def prevent_non_active_login