sorcery 0.7.6 → 0.8.0

data/lib/generators/sorcery/templates/initializer.rb

@@ -7,61 +7,118 @@ Rails.application.config.sorcery.submodules = []
 # Here you can configure each submodule's features.
 Rails.application.config.sorcery.configure do |config|
   # -- core --
-  # config.not_authenticated_action = :not_authenticated              # what controller action to call for
-                                                                      # non-authenticated users.
-                                                                      # You can also override 'not_authenticated'
-                                                                      # instead.
+  # What controller action to call for non-authenticated users. You can also
+  # override the 'not_authenticated' method of course.
+  # Default: `:not_authenticated`
+  #
+  # config.not_authenticated_action =
+
+
+  # When a non logged in user tries to enter a page that requires login, save
+  # the URL he wanted to reach, and send him there after login, using 'redirect_back_or_to'.
+  # Default: `true`
+  #
+  # config.save_return_to_url =
+
 
-  # config.save_return_to_url = true                                  # when a non logged in user tries to enter
-                                                                      # a page that requires login,
-                                                                      # save the URL he wanted to reach,
-                                                                      # and send him there after login, using
-                                                                      # 'redirect_back_or_to'.
+  # Set domain option for cookies; Useful for remember_me submodule.
+  # Default: `nil`
+  #
+  # config.cookie_domain =
 
-  # config.cookie_domain = nil                                        # set domain option for cookies
-                                                                      # Useful for remember_me submodule
+  
+  # -- remember_me --
+  # allow the remember_me cookie to settable through AJAX
+  # Default: `true`
+  #
+  # user.remember_me_httponly =
+  
 
   # -- session timeout --
-  # config.session_timeout = 3600                                     # how long in seconds to keep the session alive.
-  # config.session_timeout_from_last_action = false                   # use the last action as the beginning of
-                                                                      # session timeout.
+  # How long in seconds to keep the session alive.
+  # Default: `3600`
+  #
+  # config.session_timeout =
+
+
+  # Use the last action as the beginning of session timeout.
+  # Default: `false`
+  #
+  # config.session_timeout_from_last_action =
+
 
   # -- http_basic_auth --
-  # config.controller_to_realm_map = {"application" => "Application"} # What realm to display for which controller name.
-                                                                      # For example {"My App" => "Application"}
+  # What realm to display for which controller name. For example {"My App" => "Application"}
+  # Default: `{"application" => "Application"}`
+  #
+  # config.controller_to_realm_map =
+
 
   # -- activity logging --
-  # config.register_login_time = true                                 # will register the time of last user login, every login.
-  # config.register_logout_time = true                                # will register the time of last user logout, every logout.
-  # config.register_last_activity_time = true                         # will register the time of last user action, every action.
+  # will register the time of last user login, every login.
+  # Default: `true`
+  #
+  # config.register_login_time =
+
+
+  # will register the time of last user logout, every logout.
+  # Default: `true`
+  #
+  # config.register_logout_time =
+
+
+  # will register the time of last user action, every action.
+  # Default: `true`
+  #
+  # config.register_last_activity_time =
+
 
   # -- external --
-  # config.external_providers = []                                    # What providers are supported by this app,
-                                                                      # i.e. [:twitter, :facebook, :github, :google, :liveid] .
-  # config.ca_file = 'path/to/ca_file'                                # Path to ca_file. By default use a internal ca-bundle.crt.
-                                                                      # You can change it by your local ca_file.
-                                                                      # i.e. '/etc/pki/tls/certs/ca-bundle.crt'
+  # What providers are supported by this app, i.e. [:twitter, :facebook, :github, :google, :liveid] .
+  # Default: `[]`
+  #
+  # config.external_providers =
+
+
+  # You can change it by your local ca_file. i.e. '/etc/pki/tls/certs/ca-bundle.crt'
+  # Path to ca_file. By default use a internal ca-bundle.crt.
+  # Default: `'path/to/ca_file'`
+  #
+  # config.ca_file =
+
 
+  # For information about LinkedIn API:
+  # - user info fields go to https://developer.linkedin.com/documents/profile-fields
+  # - access permissions go to https://developer.linkedin.com/documents/authentication#granting
+  #
+  # config.linkedin.key = ""
+  # config.linkedin.secret = ""
+  # config.linkedin.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=linkedin"
+  # config.linkedin.user_info_fields = ['first-name', 'last-name']
+  # config.linkedin.user_info_mapping = {first_name: "firstName", last_name: "lastName"}
+  # config.linkedin.access_permissions = ['r_basicprofile'] 
+  #
   # Twitter wil not accept any requests nor redirect uri containing localhost,
   # make sure you use 0.0.0.0:3000 to access your app in development
   #
-  # config.twitter.key = "eYVNBjBDi33aa9GkA3w"
-  # config.twitter.secret = "XpbeSdCoaKSmQGSeokz5qcUATClRW5u08QWNfv71N8"
+  # config.twitter.key = ""
+  # config.twitter.secret = ""
   # config.twitter.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=twitter"
   # config.twitter.user_info_mapping = {:email => "screen_name"}
   #
-  # config.facebook.key = "34cebc81c08a521bc66e212f947d73ec"
-  # config.facebook.secret = "5b458d179f61d4f036ee66a497ffbcd0"
+  # config.facebook.key = ""
+  # config.facebook.secret = ""
   # config.facebook.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=facebook"
   # config.facebook.user_info_mapping = {:email => "name"}
+  # config.facebook.access_permissions = ["email", "publish_stream"]
   #
   # config.github.key = ""
   # config.github.secret = ""
   # config.github.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=github"
   # config.github.user_info_mapping = {:email => "name"}
   #
-  # config.google.key = "491253340633.apps.googleusercontent.com"
-  # config.google.secret = "4oE6kXqbL_LN-VGcGcg7qgdL"
+  # config.google.key = ""
+  # config.google.secret = ""
   # config.google.callback_url = "http://0.0.0.0:3000/oauth/callback?provider=google"
   # config.google.user_info_mapping = {:email => "email", :username => "name"}
   #
@@ -74,147 +131,287 @@ Rails.application.config.sorcery.configure do |config|
   # config.liveid.callback_url = "http://mydomain.com:3000/oauth/callback?provider=liveid"
   # config.liveid.user_info_mapping = {:username => "name"}
 
+
   # --- user config ---
   config.user_config do |user|
     # -- core --
-    # user.username_attribute_names = [:username]                                     # specify username
-                                                                                      # attributes, for example:
-                                                                                      # [:username, :email].
+    # specify username attributes, for example: [:username, :email].
+    # Default: `[:username]`
+    #
+    # user.username_attribute_names =
+
+
+    # change *virtual* password attribute, the one which is used until an encrypted one is generated.
+    # Default: `:password`
+    #
+    # user.password_attribute_name =
+
+
+    # downcase the username before trying to authenticate, default is false
+    # Default: `false`
+    #
+    # user.downcase_username_before_authenticating =
+
+
+    # change default email attribute.
+    # Default: `:email`
+    #
+    # user.email_attribute_name =
+
+
+    # change default crypted_password attribute.
+    # Default: `:crypted_password`
+    #
+    # user.crypted_password_attribute_name =
+
 
-    # user.password_attribute_name = :password                                        # change *virtual* password
-                                                                                      # attribute, the one which is used
-                                                                                      # until an encrypted one is
-                                                                                      # generated.
+    # what pattern to use to join the password with the salt
+    # Default: `""`
+    #
+    # user.salt_join_token =
 
-    # user.downcase_username_before_authenticating = false                            # downcase the username before 
-                                                                                      # trying to authenticate, default
-                                                                                      # is false
 
-    # user.email_attribute_name = :email                                              # change default email attribute.
+    # change default salt attribute.
+    # Default: `:salt`
+    #
+    # user.salt_attribute_name =
 
-    # user.crypted_password_attribute_name =  :crypted_password                       # change default crypted_password
-                                                                                      # attribute.
 
-    # user.salt_join_token = ""                                                       # what pattern to use to join the
-                                                                                      # password with the salt
+    # how many times to apply encryption to the password.
+    # Default: `nil`
+    #
+    # user.stretches =
 
-    # user.salt_attribute_name = :salt                                                # change default salt attribute.
 
-    # user.stretches = nil                                                            # how many times to apply
-                                                                                      # encryption to the password.
+    # encryption key used to encrypt reversible encryptions such as AES256.
+    # WARNING: If used for users' passwords, changing this key will leave passwords undecryptable!
+    # Default: `nil`
+    #
+    # user.encryption_key =
 
-    # user.encryption_key = nil                                                       # encryption key used to encrypt
-                                                                                      # reversible encryptions such as
-                                                                                      # AES256.
-                                                                                      #
-                                                                                      # WARNING:
-                                                                                      #
-                                                                                      # If used for users' passwords, changing this key
-                                                                                      # will leave passwords undecryptable!
 
-    # user.custom_encryption_provider = nil                                           # use an external encryption
-                                                                                      # class.
+    # use an external encryption class.
+    # Default: `nil`
+    #
+    # user.custom_encryption_provider =
 
-    # user.encryption_algorithm = :bcrypt                                             # encryption algorithm name. See
-                                                                                      # 'encryption_algorithm=' for
-                                                                                      # available options.
 
-    # user.subclasses_inherit_config = false                                          # make this configuration
-                                                                                      # inheritable for subclasses.
-                                                                                      # Useful for ActiveRecord's STI.
+    # encryption algorithm name. See 'encryption_algorithm=' for available options.
+    # Default: `:bcrypt`
+    #
+    # user.encryption_algorithm =
+
+
+    # make this configuration inheritable for subclasses. Useful for ActiveRecord's STI.
+    # Default: `false`
+    #
+    # user.subclasses_inherit_config =
+
 
     # -- user_activation --
-    # user.activation_state_attribute_name = :activation_state                        # the attribute name to hold
-                                                                                      # activation state
-                                                                                      # (active/pending).
+    # the attribute name to hold activation state (active/pending).
+    # Default: `:activation_state`
+    #
+    # user.activation_state_attribute_name =
+
+
+    # the attribute name to hold activation code (sent by email).
+    # Default: `:activation_token`
+    #
+    # user.activation_token_attribute_name =
+
+
+    # the attribute name to hold activation code expiration date.
+    # Default: `:activation_token_expires_at`
+    #
+    # user.activation_token_expires_at_attribute_name =
+
+
+    # how many seconds before the activation code expires. nil for never expires.
+    # Default: `nil`
+    #
+    # user.activation_token_expiration_period =
+
 
-    # user.activation_token_attribute_name = :activation_token                        # the attribute name to hold
-                                                                                      # activation code (sent by email).
+    # your mailer class. Required.
+    # Default: `nil`
+    #
+    # user.user_activation_mailer =
 
-    # user.activation_token_expires_at_attribute_name = :activation_token_expires_at  # the attribute name to hold
-                                                                                      # activation code expiration date.
 
-    # user.activation_token_expiration_period =  nil                                  # how many seconds before the
-                                                                                      # activation code expires. nil for
-                                                                                      # never expires.
+    # when true sorcery will not automatically
+    # email activation details and allow you to
+    # manually handle how and when email is sent.
+    # Default: `false`
+    #
+    # user.activation_mailer_disabled =
 
-    # user.user_activation_mailer = nil                                               # your mailer class. Required.
 
-    # user.activation_needed_email_method_name = :activation_needed_email             # activation needed email method
-                                                                                      # on your mailer class.
+    # activation needed email method on your mailer class.
+    # Default: `:activation_needed_email`
+    #
+    # user.activation_needed_email_method_name =
 
-    # user.activation_success_email_method_name = :activation_success_email           # activation success email method
-                                                                                      # on your mailer class.
 
-    # user.prevent_non_active_users_to_login = true                                   # do you want to prevent or allow
-                                                                                      # users that did not activate by
-                                                                                      # email to login?
+    # activation success email method on your mailer class.
+    # Default: `:activation_success_email`
+    #
+    # user.activation_success_email_method_name =
+
+
+    # do you want to prevent or allow users that did not activate by email to login?
+    # Default: `true`
+    #
+    # user.prevent_non_active_users_to_login =
+
 
     # -- reset_password --
-    # user.reset_password_token_attribute_name = :reset_password_token                          # reset password code
-                                                                                                # attribute name.
+    # reset password code attribute name.
+    # Default: `:reset_password_token`
+    #
+    # user.reset_password_token_attribute_name =
+
+
+    # expires at attribute name.
+    # Default: `:reset_password_token_expires_at`
+    #
+    # user.reset_password_token_expires_at_attribute_name =
+
+
+    # when was email sent, used for hammering protection.
+    # Default: `:reset_password_email_sent_at`
+    #
+    # user.reset_password_email_sent_at_attribute_name =
+
+
+    # mailer class. Needed.
+    # Default: `nil`
+    #
+    # user.reset_password_mailer =
+
 
-    # user.reset_password_token_expires_at_attribute_name = :reset_password_token_expires_at    # expires at attribute
-                                                                                                # name.
+    # reset password email method on your mailer class.
+    # Default: `:reset_password_email`
+    #
+    # user.reset_password_email_method_name =
 
-    # user.reset_password_email_sent_at_attribute_name = :reset_password_email_sent_at          # when was email sent,
-                                                                                                # used for hammering
-                                                                                                # protection.
 
-    # user.reset_password_mailer = nil                                                          # mailer class. Needed.
+    # when true sorcery will not automatically
+    # email password reset details and allow you to
+    # manually handle how and when email is sent
+    # Default: `false`
+    #
+    # user.reset_password_mailer_disabled =
 
-    # user.reset_password_email_method_name = :reset_password_email                             # reset password email
-                                                                                                # method on your mailer
-                                                                                                # class.
 
-    # user.reset_password_expiration_period = nil                                               # how many seconds
-                                                                                                # before the reset
-                                                                                                # request expires. nil
-                                                                                                # for never expires.
+    # how many seconds before the reset request expires. nil for never expires.
+    # Default: `nil`
+    #
+    # user.reset_password_expiration_period =
+
+
+    # hammering protection, how long to wait before allowing another email to be sent.
+    # Default: `5 * 60`
+    #
+    # user.reset_password_time_between_emails =
 
-    # user.reset_password_time_between_emails = 5 * 60                                          # hammering protection,
-                                                                                                # how long to wait
-                                                                                                # before allowing
-                                                                                                # another email to be
-                                                                                                # sent.
 
     # -- brute_force_protection --
-    # user.failed_logins_count_attribute_name = :failed_logins_count                  # failed logins attribute name.
+    # Failed logins attribute name.
+    # Default: `:failed_logins_count`
+    #
+    # user.failed_logins_count_attribute_name =
+
+
+    # This field indicates whether user is banned and when it will be active again.
+    # Default: `:lock_expires_at`
+    #
+    # user.lock_expires_at_attribute_name =
+
 
-    # user.lock_expires_at_attribute_name = :lock_expires_at                          # this field indicates whether
-                                                                                      # user is banned and when it will
-                                                                                      # be active again.
+    # How many failed logins allowed.
+    # Default: `50`
+    #
+    # user.consecutive_login_retries_amount_limit =
 
-    # user.consecutive_login_retries_amount_limit = 50                                # how many failed logins allowed.
 
-    # user.login_lock_time_period = 60 * 60                                           # how long the user should be
-                                                                                      # banned. in seconds. 0 for
-                                                                                      # permanent.
+    # How long the user should be banned. in seconds. 0 for permanent.
+    # Default: `60 * 60`
+    #
+    # user.login_lock_time_period =
+
+    # Unlock token attribute name
+    # Default: `:unlock_token`
+    #
+    # user.unlock_token_attribute_name =
+
+    # Unlock token mailer method
+    # Default: `:send_unlock_token_email`
+    #
+    # user.unlock_token_email_method_name =
+
+    # when true sorcery will not automatically
+    # send email with unlock token
+    # Default: `false`
+    #
+    # user.unlock_token_mailer_disabled = true
+
+    # Unlock token mailer class
+    # Default: `nil`
+    #
+    # user.unlock_token_mailer = UserMailer
 
     # -- activity logging --
-    # user.last_login_at_attribute_name = :last_login_at                              # last login attribute name.
-    # user.last_logout_at_attribute_name = :last_logout_at                            # last logout attribute name.
-    # user.last_activity_at_attribute_name = :last_activity_at                        # last activity attribute name.
-    # user.activity_timeout = 10 * 60                                                 # how long since last activity is
-                                                                                      # the user defined logged out?
+    # Last login attribute name.
+    # Default: `:last_login_at`
+    #
+    # user.last_login_at_attribute_name =
+
+
+    # Last logout attribute name.
+    # Default: `:last_logout_at`
+    #
+    # user.last_logout_at_attribute_name =
+
+
+    # Last activity attribute name.
+    # Default: `:last_activity_at`
+    #
+    # user.last_activity_at_attribute_name =
+
+
+    # How long since last activity is he user defined logged out?
+    # Default: `10 * 60`
+    #
+    # user.activity_timeout =
+
 
     # -- external --
-    # user.authentications_class = nil                                                # class which holds the various
-                                                                                      # external provider data for this
-                                                                                      # user.
+    # Class which holds the various external provider data for this user.
+    # Default: `nil`
+    #
+    # user.authentications_class =
+
+
+    # User's identifier in authentications class.
+    # Default: `:user_id`
+    #
+    # user.authentications_user_id_attribute_name =
+
 
-    # user.authentications_user_id_attribute_name = :user_id                          # user's identifier in
-                                                                                      # authentications class.
+    # Provider's identifier in authentications class.
+    # Default: `:provider`
+    #
+    # user.provider_attribute_name =
 
-    # user.provider_attribute_name = :provider                                        # provider's identifier in
-                                                                                      # authentications class.
 
-    # user.provider_uid_attribute_name = :uid                                         # user's external unique
-                                                                                      # identifier in authentications
-                                                                                      # class.
+    # User's external unique identifier in authentications class.
+    # Default: `:uid`
+    #
+    # user.provider_uid_attribute_name =
   end
 
   # This line must come after the 'user config' block.
-  config.user_class = "<%= model_class_name %>"                                       # define which model authenticates
-                                                                                      # with sorcery.
+  # Define which model authenticates with sorcery.
+  config.user_class = "<%= model_class_name %>"
 end

data/lib/generators/sorcery/templates/migration/brute_force_protection.rb

@@ -2,10 +2,12 @@ class SorceryBruteForceProtection < ActiveRecord::Migration
   def self.up
     add_column :<%= model_class_name.tableize %>, :failed_logins_count, :integer, :default => 0
     add_column :<%= model_class_name.tableize %>, :lock_expires_at, :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :unlock_token, :string, :default => nil
   end
 
   def self.down
     remove_column :<%= model_class_name.tableize %>, :lock_expires_at
     remove_column :<%= model_class_name.tableize %>, :failed_logins_count
+    remove_column :<%= model_class_name.tableize %>, :unlock_token
   end
 end

data/lib/sorcery/controller/submodules/brute_force_protection.rb

@@ -29,8 +29,7 @@ module Sorcery
           # Resets the failed logins counter.
           # Runs as a hook after a successful login.
           def reset_failed_logins_count!(user, credentials)
-            user.send(:"#{user_class.sorcery_config.failed_logins_count_attribute_name}=", 0)
-            user.save!(:validate => false)
+            user.update_many_attributes(user_class.sorcery_config.failed_logins_count_attribute_name => 0)
           end
         end
       end

data/lib/sorcery/controller/submodules/external/protocols/oauth2.rb

@@ -20,9 +20,9 @@ module Sorcery
 
             def get_access_token(args, options = {})
               client = build_client(options)
-              client.auth_code.get_access_token(
+              client.auth_code.get_token(
                 args[:code],
-                :redirect_uri => @callback_url
+                { :redirect_uri => @callback_url, :parse => options.delete(:parse) }, options
               )
             end
 

data/lib/sorcery/controller/submodules/external/providers/facebook.rb

@@ -35,7 +35,8 @@ module Sorcery
                               :user_info_path,
                               :scope,
                               :user_info_mapping,
-                              :display
+                              :display,
+                              :access_permissions
                 attr_reader   :access_token
 
                 include Protocols::Oauth2
@@ -46,12 +47,16 @@ module Sorcery
                   @scope          = "email,offline_access"
                   @user_info_mapping = {}
                   @display        = "page"
+                  @token_url      = "oauth/access_token"
+                  @mode           = :query
+                  @parse          = :query
+                  @param_name     = "access_token"
                 end
                 
                 def get_user_hash
                   user_hash = {}
                   response = @access_token.get(@user_info_path)
-                  user_hash[:user_info] = JSON.parse(response)
+                  user_hash[:user_info] = JSON.parse(response.body)
                   user_hash[:uid] = user_hash[:user_info]['id']
                   user_hash
                 end
@@ -65,12 +70,19 @@ module Sorcery
                 def login_url(params,session)
                   self.authorize_url
                 end
-                
+
+                # overrides oauth2#authorize_url to allow customized scope.
+                def authorize_url
+                  @scope = self.access_permissions.present? ? self.access_permissions.join(",") : @scope
+                  super
+                end
+
                 # tries to login the user from access token
                 def process_callback(params,session)
                   args = {}
+                  options = { :token_url => @token_url, :mode => @mode, :param_name => @param_name, :parse => @parse }
                   args.merge!({:code => params[:code]}) if params[:code]
-                  @access_token = self.get_access_token(args)
+                  @access_token = self.get_access_token(args, options)
                 end
                 
               end