sorcery 0.7.6 → 0.8.0

data/lib/sorcery/controller/submodules/external/providers/github.rb

@@ -34,6 +34,7 @@ module Sorcery
                               :auth_path,
                               :token_path,
                               :site,
+                              :scope,
                               :user_info_path,
                               :user_info_mapping
                 attr_reader   :access_token
@@ -43,6 +44,7 @@ module Sorcery
                 def init
                   @site           = "https://github.com/"
                   @user_info_path = "https://api.github.com/user"
+                  @scope          = nil
                   @auth_path      = "/login/oauth/authorize"
                   @token_path     = "/login/oauth/access_token"
                   @user_info_mapping = {}
@@ -51,7 +53,7 @@ module Sorcery
                 def get_user_hash
                   user_hash = {}
                   response = @access_token.get(@user_info_path)
-                  user_hash[:user_info] = JSON.parse(response)
+                  user_hash[:user_info] = JSON.parse(response.body)
                   user_hash[:uid] = user_hash[:user_info]['id']
                   user_hash
                 end
@@ -63,7 +65,7 @@ module Sorcery
                 # calculates and returns the url to which the user should be redirected,
                 # to get authenticated at the external provider's site.
                 def login_url(params,session)
-                  self.authorize_url({:authorize_path => @auth_path})
+                  self.authorize_url({:authorize_url => @auth_path})
                 end
 
                 # tries to login the user from access token
@@ -71,8 +73,8 @@ module Sorcery
                   args = {}
                   args.merge!({:code => params[:code]}) if params[:code]
                   options = {
-                    :access_token_path => @token_path,
-                    :access_token_method => :post
+                    :token_url    => @token_path,
+                    :token_method => :post
                   }
                   @access_token = self.get_access_token(args, options)
                 end

data/lib/sorcery/controller/submodules/external/providers/google.rb

@@ -44,7 +44,7 @@ module Sorcery
                 def init
                   @site              = "https://accounts.google.com"
                   @auth_url          = "/o/oauth2/auth"
-                  @token_path        = "/o/oauth2/token"
+                  @token_url         = "/o/oauth2/token"
                   @user_info_url     = "https://www.googleapis.com/oauth2/v1/userinfo"
                   @scope             = "https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile"
                   @user_info_mapping = {}
@@ -53,7 +53,7 @@ module Sorcery
                 def get_user_hash
                   user_hash = {}
                   response = @access_token.get(@user_info_url)
-                  user_hash[:user_info] = JSON.parse(response)
+                  user_hash[:user_info] = JSON.parse(response.body)
                   user_hash[:uid] = user_hash[:user_info]['id']
                   user_hash
                 end
@@ -73,8 +73,8 @@ module Sorcery
                   args = {}
                   args.merge!({:code => params[:code]}) if params[:code]
                   options = {
-                    :access_token_path => @token_path,
-                    :access_token_method => :post
+                    :token_url => @token_url,
+                    :token_method => :post
                   }
                   @access_token = self.get_access_token(args, options)
                 end

data/lib/sorcery/controller/submodules/external/providers/linkedin.rb

@@ -0,0 +1,101 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module External
+        module Providers
+          # This module adds support for OAuth with Linkedin.com.
+          # When included in the 'config.providers' option, it adds a new option, 'config.linkedin'.
+          # Via this new option you can configure Linkedin specific settings like your app's key and secret.
+          #
+          #   config.linkedin.key = <key>
+          #   config.linkedin.secret = <secret>
+          #   ...
+          #
+          module Linkedin
+            def self.included(base)
+              base.module_eval do
+                class << self
+                  attr_reader :linkedin                        
+
+                  def merge_linkedin_defaults!
+                    @defaults.merge!(:@linkedin => LinkedinClient)
+                  end
+                end
+                merge_linkedin_defaults!
+                update!
+              end
+            end
+            
+            module LinkedinClient
+              class << self
+                attr_accessor :key,
+                              :secret,
+                              :callback_url,
+                              :site,
+                              :authorize_path,
+                              :request_token_path,
+                              :access_token_path,
+                              :user_info_path,
+                              :user_info_mapping,
+                              :user_info_fields,
+                              :access_permissions
+                attr_reader   :access_token
+
+                include Protocols::Oauth1
+        
+                # Override included get_consumer method to provide authorize_path
+                def get_consumer
+                  # Add access permissions to request token path
+                  @configuration[:request_token_path] += "?scope=" + self.access_permissions.join('+') unless self.access_permissions.blank? or @configuration[:request_token_path].include? "?scope="
+                  ::OAuth::Consumer.new(@key, @secret, @configuration)
+                end
+                
+                def init
+                  @configuration = {
+                    site: "https://api.linkedin.com",
+                    authorize_path: '/uas/oauth/authenticate',
+                    request_token_path: '/uas/oauth/requestToken',
+                    access_token_path: '/uas/oauth/accessToken'
+                  }
+                  @user_info_path = "/v1/people/~"
+                end
+                
+                def get_user_hash
+                  user_hash = {}
+                  fields = self.user_info_fields.join(',')
+                  response = @access_token.get("#{@user_info_path}:(#{fields})", 'x-li-format' => 'json')
+                  user_hash[:user_info] = JSON.parse(response.body)
+                  user_hash[:uid] = user_hash[:user_info]['id'].to_s
+                  user_hash
+                end
+                
+                def has_callback?
+                  true
+                end
+                
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  req_token = self.get_request_token
+                  session[:request_token]         = req_token.token
+                  session[:request_token_secret]  = req_token.secret
+                  self.authorize_url({:request_token => req_token.token, :request_token_secret => req_token.secret})
+                end
+                
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:oauth_verifier => params[:oauth_verifier], :request_token => session[:request_token], :request_token_secret => session[:request_token_secret]})
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  @access_token = self.get_access_token(args)
+                end
+
+              end  
+              init
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/external/providers/liveid.rb

@@ -54,7 +54,7 @@ module Sorcery
                   user_hash = {}
                   @access_token.token_param = "access_token"
                   response = @access_token.get(@user_info_url)
-                  user_hash[:user_info] = JSON.parse(response)
+                  user_hash[:user_info] = JSON.parse(response.body)
                   user_hash[:uid] = user_hash[:user_info]['id']
                   user_hash
                 end

data/lib/sorcery/controller/submodules/external/providers/vkontakte.rb

@@ -0,0 +1,94 @@
+module Sorcery
+  module Controller
+    module Submodules
+      module External
+        module Providers
+          # This module adds support for OAuth with vkontakte.com.
+          # When included in the 'config.providers' option, it adds a new option, 'config.vkontakte'.
+          # Via this new option you can configure Vkontakte specific settings like your app's key and secret.
+          #
+          #   config.vkontakte.key = <key>
+          #   config.vkontakte.secret = <secret>
+          #   ...
+          #
+          module Vkontakte
+            def self.included(base)
+              base.module_eval do
+                class << self
+                  attr_reader :vkontakte                           # access to vkontakte_client.
+
+                  def merge_vkontakte_defaults!
+                    @defaults.merge!(:@vkontakte => VkontakteClient)
+                  end
+                end
+                merge_vkontakte_defaults!
+                update!
+              end
+            end
+
+            module VkontakteClient
+              class << self
+                attr_accessor :key,
+                              :secret,
+                              :callback_url,
+                              :auth_path,
+                              :token_path,
+                              :site,
+                              :scope,
+                              :user_info_path,
+                              :user_info_mapping
+                attr_reader   :access_token
+
+                include Protocols::Oauth2
+
+                def init
+                  @site           = "https://oauth.vk.com/"
+                  @user_info_url = "https://api.vk.com/method/getUserInfo"
+                  @scope          = nil
+                  @auth_path      = "/authorize"
+                  @token_path     = "/access_token"
+                  @user_info_mapping = {}
+                end
+
+                def get_user_hash
+                  user_hash = {}
+                  response = @access_token.get("#{@user_info_url}?access_token=#{@access_token.token}")
+                  user_hash[:user_info] = JSON.parse(response.body)
+                  if user_hash[:user_info]
+                    user_hash[:user_info] = user_hash[:user_info]["response"]
+                  end
+                  user_hash[:uid] = user_hash[:user_info]['user_id']
+                  user_hash
+                end
+
+                def has_callback?
+                  true
+                end
+
+                # calculates and returns the url to which the user should be redirected,
+                # to get authenticated at the external provider's site.
+                def login_url(params,session)
+                  self.authorize_url({:authorize_url => @auth_path})
+                end
+
+                # tries to login the user from access token
+                def process_callback(params,session)
+                  args = {}
+                  args.merge!({:code => params[:code]}) if params[:code]
+                  options = {
+                    :token_url    => @token_path,
+                    :token_method => :post
+                  }
+                  @access_token = self.get_access_token(args, options)
+                end
+
+              end
+              init
+            end
+
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/controller/submodules/external.rb

@@ -10,12 +10,12 @@ module Sorcery
             class << self
               attr_reader :external_providers                           # external providers like twitter.
               attr_accessor :ca_file                                    # path to ca_file. By default use a internal ca-bundle.crt.
-                                          
+
               def merge_external_defaults!
                 @defaults.merge!(:@external_providers => [],
                                  :@ca_file => File.join(File.expand_path(File.dirname(__FILE__)), 'external/protocols/certs/ca-bundle.crt'))
               end
-              
+
               def external_providers=(providers)
                 providers.each do |provider|
                   include Providers.const_get(provider.to_s.split("_").map {|p| p.capitalize}.join(""))
@@ -28,26 +28,37 @@ module Sorcery
 
         module InstanceMethods
           protected
-          
+
           # sends user to authenticate at the provider's website.
           # after authentication the user is redirected to the callback defined in the provider config
           def login_at(provider, args = {})
             @provider = Config.send(provider)
+            if @provider.callback_url.present? && @provider.callback_url[0] == '/'
+              uri = URI.parse(request.url.gsub(/\?.*$/,''))
+              uri.path = ''
+              uri.query = nil
+              uri.scheme = 'https' if(request.env['HTTP_X_FORWARDED_PROTO'] == 'https')
+              host = uri.to_s
+              @provider.callback_url = "#{host}#{@provider.callback_url}"
+            end
             if @provider.has_callback?
               redirect_to @provider.login_url(params,session)
             else
               #@provider.login(args)
             end
           end
-          
+
           # tries to login the user from provider's callback
           def login_from(provider)
             @provider = Config.send(provider)
             @provider.process_callback(params,session)
             @user_hash = @provider.get_user_hash
-            if user = user_class.load_from_provider(provider,@user_hash[:uid])
+            if user = user_class.load_from_provider(provider,@user_hash[:uid].to_s)
+              return_to_url = session[:return_to_url]
               reset_session
+              session[:return_to_url] = return_to_url
               auto_login(user)
+              after_login!(user)
               user
             end
           end
@@ -57,7 +68,48 @@ module Sorcery
             @provider = Config.send(provider)
             @provider.access_token
           end
-          
+
+          # If user is logged, he can add all available providers into his account
+          def add_provider_to_user(provider)
+            provider_name = provider.to_sym
+            @provider = Config.send(provider_name)
+            @provider.process_callback(params,session)
+            @user_hash = @provider.get_user_hash
+            config = user_class.sorcery_config
+
+            # first check to see if user has a particular authentication already
+            unless (current_user.send(config.authentications_class.to_s.downcase.pluralize).send("find_by_#{config.provider_attribute_name}_and_#{config.provider_uid_attribute_name}", provider, @user_hash[:uid].to_s))
+              user = current_user.send(config.authentications_class.to_s.downcase.pluralize).build(config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider_name.to_s)
+              user.save(:validate => false)
+            else
+              user = false
+            end
+
+            return user
+          end
+
+          # Initialize new user from provider informations.
+          # If a provider doesn't give required informations or username/email is already taken,
+          # we store provider/user infos into a session and can be rendered into registration form
+          def create_and_validate_from(provider)
+            provider = provider.to_sym
+            @provider = Config.send(provider)
+            @user_hash = @provider.get_user_hash
+            config = user_class.sorcery_config
+
+            attrs = user_attrs(@provider.user_info_mapping, @user_hash)
+
+            user = user_class.new(attrs)
+            user.send(config.authentications_class.to_s.downcase.pluralize).build(config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider)
+
+            session[:incomplete_user] = {
+              :provider => {config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider},
+              :user_hash => attrs
+            } unless user.save
+
+            return user
+          end
+
           # this method automatically creates a new user from the data in the external user hash.
           # The mappings from user hash fields to user db fields are set at controller config.
           # If the hash field you would like to map is nested, use slashes. For example, Given a hash like:
@@ -70,30 +122,46 @@ module Sorcery
           #
           # And this will cause 'moishe' to be set as the value of :username field.
           # Note: Be careful. This method skips validations model.
+          # Instead you can pass a block, if the block returns false the user will not be created
+          #
+          #   create_from(provider) {|user| user.some_check }
+          #
           def create_from(provider)
             provider = provider.to_sym
             @provider = Config.send(provider)
             @user_hash = @provider.get_user_hash
             config = user_class.sorcery_config
-            attrs = {}
-            @provider.user_info_mapping.each do |k,v|
-              if (varr = v.split("/")).size > 1
-                attribute_value = varr.inject(@user_hash[:user_info]) {|hsh,v| hsh[v] } rescue nil
-                attribute_value.nil? ? attrs : attrs.merge!(k => attribute_value)
-              else
-                attrs.merge!(k => @user_hash[:user_info][v])
-              end
-            end
+
+            attrs = user_attrs(@provider.user_info_mapping, @user_hash)
+
             user_class.transaction do
               @user = user_class.new()
               attrs.each do |k,v|
                 @user.send(:"#{k}=", v)
               end
+
+              if block_given?
+                return false unless yield @user
+              end
+
               @user.save(:validate => false)
               user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider, config.provider_uid_attribute_name => @user_hash[:uid]})
             end
             @user
           end
+
+          def user_attrs(user_info_mapping, user_hash)
+            attrs = {}
+            user_info_mapping.each do |k,v|
+              if (varr = v.split("/")).size > 1
+                attribute_value = varr.inject(user_hash[:user_info]) {|hash, value| hash[value]} rescue nil
+                attribute_value.nil? ? attrs : attrs.merge!(k => attribute_value)
+              else
+                attrs.merge!(k => user_hash[:user_info][v])
+              end
+            end
+            return attrs
+          end
         end
       end
     end

data/lib/sorcery/controller/submodules/http_basic_auth.rb

@@ -58,7 +58,7 @@ module Sorcery
               while current_controller != ActionController::Base
                 result = Config.controller_to_realm_map[current_controller.controller_name]
                 return result if result
-                current_controller = self.class.superclass
+                current_controller = current_controller.superclass
               end
               nil
             else

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -8,6 +8,15 @@ module Sorcery
       module RememberMe
         def self.included(base)
           base.send(:include, InstanceMethods)
+          Config.module_eval do
+            class << self
+              attr_accessor :remember_me_httponly
+              def merge_remember_me_defaults!
+                @defaults.merge!(:@remember_me_httponly => true)
+              end
+            end
+            merge_remember_me_defaults!
+          end
           Config.login_sources << :login_from_cookie
           Config.after_login << :remember_me_if_asked_to
           Config.after_logout << :forget_me!
@@ -60,7 +69,7 @@ module Sorcery
             cookies.signed[:remember_me_token] = {
               :value => user.send(user.sorcery_config.remember_me_token_attribute_name),
               :expires => user.send(user.sorcery_config.remember_me_token_expires_at_attribute_name),
-              :httponly => true,
+              :httponly => Config.remember_me_httponly,
               :domain => Config.cookie_domain
             }
           end
@@ -69,4 +78,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/controller.rb

@@ -21,19 +21,22 @@ module Sorcery
       # If all attempts to auto-login fail, the failure callback will be called.
       def require_login
         if !logged_in?
-          session[:return_to_url] = request.url if Config.save_return_to_url
+          session[:return_to_url] = request.url if Config.save_return_to_url && request.get?
           self.send(Config.not_authenticated_action)
         end
       end
 
       # Takes credentials and returns a user on successful authentication.
       # Runs hooks after login or failed login.
-      def login(*credentials)
+       def login(*credentials)
+        @current_user = nil
         user = user_class.authenticate(*credentials)
         if user
-          return_to_url = session[:return_to_url]
+          old_session = session.dup
           reset_session # protect from session fixation attacks
-          session[:return_to_url] = return_to_url
+          old_session.to_hash.each_pair do |k,v|
+            session[k.to_sym] = v
+          end
           auto_login(user)
           after_login!(user, credentials)
           current_user
@@ -71,6 +74,7 @@ module Sorcery
       # and we want to return him back to the page he originally wanted.
       def redirect_back_or_to(url, flash_hash = {})
         redirect_to(session[:return_to_url] || url, :flash => flash_hash)
+        session[:return_to_url] = nil
       end
 
       # The default action for denying non-authenticated users.
@@ -108,10 +112,14 @@ module Sorcery
       end
 
       def login_from_session
-        @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || false
+        @current_user = (user_class.find(session[:user_id]) if session[:user_id]) || false
+      rescue => exception
+        return false if defined?(Mongoid) and exception.is_a?(Mongoid::Errors::DocumentNotFound)
+        return false if defined?(ActiveRecord) and exception.is_a?(ActiveRecord::RecordNotFound)
+        raise exception
       end
 
-      def after_login!(user, credentials)
+      def after_login!(user, credentials = [])
         Config.after_login.each {|c| self.send(c, user, credentials)}
       end
 

data/lib/sorcery/crypto_providers/bcrypt.rb

@@ -48,6 +48,7 @@ module Sorcery
           @cost ||= 10
         end
         attr_writer :cost
+        alias :stretches :cost
         alias :stretches= :cost=
         
         # Creates a BCrypt hash for the password passed.

data/lib/sorcery/model/adapters/active_record.rb

@@ -8,11 +8,16 @@ module Sorcery
         end
 
         module InstanceMethods
-          def update_single_attribute(name, value)
-            self.send(:"#{name}=", value)
-            
+          def update_many_attributes(attrs)
+            attrs.each do |name, value|
+              self.send(:"#{name}=", value)
+            end
             primary_key = self.class.primary_key
-            self.class.where(:"#{primary_key}" => self.send(:"#{primary_key}")).update_all(name => value)
+            self.class.where(:"#{primary_key}" => self.send(:"#{primary_key}")).update_all(attrs)
+          end
+
+          def update_single_attribute(name, value)
+            update_many_attributes(name => value)
           end
         end
         

data/lib/sorcery/model/adapters/mongo_mapper.rb

@@ -3,19 +3,21 @@ module Sorcery
     module Adapters
       module MongoMapper
         extend ActiveSupport::Concern
-        
+
         included do
           include Sorcery::Model
         end
-        
-        module InstanceMethods
-          def increment(attr)
-            self.inc(attr,1)
-          end
-          
-          def save!(options = {})
-            save(options)
-          end
+
+        def increment(attr)
+          self.class.increment(id, attr => 1)
+        end
+
+        def save!(options = {})
+          save(options)
+        end
+
+        def update_many_attributes(attrs)
+          update_attributes(attrs)
         end
 
         module ClassMethods
@@ -31,19 +33,19 @@ module Sorcery
             end
             @user
           end
-          
+
           def find_by_id(id)
             find(id)
           end
-          
+
           def find_by_activation_token(token)
             where(sorcery_config.activation_token_attribute_name => token).first
           end
-          
+
           def transaction(&blk)
             tap(&blk)
           end
-          
+
           def find_by_sorcery_token(token_attr_name, token)
             where(token_attr_name => token).first
           end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -11,11 +11,17 @@ module Sorcery
           def increment(attr)
             self.inc(attr,1)
           end
-          
+
+          def update_many_attributes(attrs)
+            attrs.each do |name, value|
+              attrs[name] = value.utc if value.is_a?(ActiveSupport::TimeWithZone)
+              self.send(:"#{name}=", value)
+            end
+            self.class.where(:_id => self.id).update_all(attrs)
+          end
+
           def update_single_attribute(name, value)
-            value = value.utc if value.is_a?(ActiveSupport::TimeWithZone)
-            self.send(:"#{name}=", value)
-            self.class.where(:_id => self.id).update_all(name => value)
+            update_many_attributes(name => value)
           end
         end
 
@@ -72,8 +78,8 @@ module Sorcery
           def get_current_users
             config = sorcery_config
             where(config.last_activity_at_attribute_name.ne => nil) \
-            .any_of({config.last_logout_at_attribute_name => nil},{config.last_activity_at_attribute_name.gt => config.last_logout_at_attribute_name}) \
-            .and(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc.to_s(:db)).order_by([:_id,:asc])
+            .where("this.#{config.last_logout_at_attribute_name} == null || this.#{config.last_activity_at_attribute_name} > this.#{config.last_logout_at_attribute_name}") \
+            .where(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc).order_by([:_id,:asc])
           end
         end
       end