sorcery 0.7.6 → 0.8.0

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -12,15 +12,25 @@ module Sorcery
                           :lock_expires_at_attribute_name,            # this field indicates whether user 
                                                                       # is banned and when it will be active again.
                           :consecutive_login_retries_amount_limit,    # how many failed logins allowed.
-                          :login_lock_time_period                     # how long the user should be banned. 
+                          :login_lock_time_period,                    # how long the user should be banned. 
                                                                       # in seconds. 0 for permanent.
+
+                          :unlock_token_attribute_name,               # Unlock token attribute name
+                          :unlock_token_email_method_name,            # Mailer method name
+                          :unlock_token_mailer_disabled,              # When true, dont send unlock token via email
+                          :unlock_token_mailer                        # Mailer class
           end
           
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@failed_logins_count_attribute_name              => :failed_logins_count,
                              :@lock_expires_at_attribute_name                  => :lock_expires_at,
                              :@consecutive_login_retries_amount_limit          => 50,
-                             :@login_lock_time_period                          => 60 * 60)
+                             :@login_lock_time_period                          => 60 * 60,
+
+                             :@unlock_token_attribute_name                     => :unlock_token,
+                             :@unlock_token_email_method_name                  => :send_unlock_token_email,
+                             :@unlock_token_mailer_disabled                    => false,
+                             :@unlock_token_mailer                             => nil)
             reset!
           end
           
@@ -34,16 +44,24 @@ module Sorcery
         end
         
         module ClassMethods
+          def load_from_unlock_token(token)
+            return nil if token.blank?
+            user = find_by_sorcery_token(sorcery_config.unlock_token_attribute_name,token)
+            user
+          end
+
           protected
 
           def define_brute_force_protection_mongoid_fields
-            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer
+            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer, :default => 0
             field sorcery_config.lock_expires_at_attribute_name,      :type => Time
+            field sorcery_config.unlock_token_attribute_name,         :type => String
           end
 
           def define_brute_force_protection_mongo_mapper_fields
-            key sorcery_config.failed_logins_count_attribute_name, Integer
+            key sorcery_config.failed_logins_count_attribute_name, Integer, :default => 0
             key sorcery_config.lock_expires_at_attribute_name, Time
+            key sorcery_config.unlock_token_attribute_name, String
           end
         end
         
@@ -54,29 +72,42 @@ module Sorcery
             config = sorcery_config
             return if !unlocked?
             self.increment(config.failed_logins_count_attribute_name)
-            self.save!(:validate => false)
+            self.update_many_attributes(config.failed_logins_count_attribute_name => self.send(config.failed_logins_count_attribute_name))
             self.lock! if self.send(config.failed_logins_count_attribute_name) >= config.consecutive_login_retries_amount_limit
           end
           
+          # /!\
+          # Moved out of protected for use like activate! in controller
+          # /!\
+          def unlock!
+            config = sorcery_config
+            attributes = {config.lock_expires_at_attribute_name => nil,
+                          config.failed_logins_count_attribute_name => 0}
+            attributes[config.unlock_token_attribute_name] = nil unless config.unlock_token_mailer_disabled or config.unlock_token_mailer.nil?
+            self.update_many_attributes(attributes)
+          end
+
           protected
 
           def lock!
             config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.in_time_zone + config.login_lock_time_period)
-            self.save!(:validate => false)
-          end
+            attributes = {config.lock_expires_at_attribute_name => Time.now.in_time_zone + config.login_lock_time_period}
 
-          def unlock!
-            config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
-            self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
-            self.save!(:validate => false)
+            unless config.unlock_token_mailer_disabled || config.unlock_token_mailer.nil?
+              attributes[config.unlock_token_attribute_name] = TemporaryToken.generate_random_token
+              send_unlock_token_email!
+            end
+            self.update_many_attributes(attributes)
           end
           
           def unlocked?
             config = sorcery_config
             self.send(config.lock_expires_at_attribute_name).nil?
           end
+
+          def send_unlock_token_email!
+            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer) unless sorcery_config.unlock_token_email_method_name.nil? or sorcery_config.unlock_token_mailer_disabled == true
+          end
           
           # Prevents a locked user from logging in, and unlocks users that expired their lock time.
           # Runs as a hook before authenticate.

data/lib/sorcery/model/submodules/remember_me.rb

@@ -49,17 +49,15 @@ module Sorcery
           # You shouldn't really use this one yourself - it's called by the controller's 'remember_me!' method.
           def remember_me!
             config = sorcery_config
-            self.send(:"#{config.remember_me_token_attribute_name}=", TemporaryToken.generate_random_token)
-            self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.remember_me_for)
-            self.save!(:validate => false)
+            self.update_many_attributes(config.remember_me_token_attribute_name => TemporaryToken.generate_random_token,
+                                        config.remember_me_token_expires_at_attribute_name => Time.now.in_time_zone + config.remember_me_for)
           end
           
           # You shouldn't really use this one yourself - it's called by the controller's 'forget_me!' method.
           def forget_me!
             config = sorcery_config
-            self.send(:"#{config.remember_me_token_attribute_name}=", nil)
-            self.send(:"#{config.remember_me_token_expires_at_attribute_name}=", nil)
-            self.save!(:validate => false)
+            self.update_many_attributes(config.remember_me_token_attribute_name => nil,
+                                        config.remember_me_token_expires_at_attribute_name => nil)
           end
         end
       end

data/lib/sorcery/model/submodules/reset_password.rb

@@ -18,6 +18,11 @@ module Sorcery
                                                                              # protection.
                                                                              
                           :reset_password_mailer,                            # mailer class. Needed.
+
+                          :reset_password_mailer_disabled,                   # when true sorcery will not automatically
+                                                                             # email password reset details and allow you to
+                                                                             # manually handle how and when email is sent
+
                           :reset_password_email_method_name,                 # reset password email method on your
                                                                              # mailer class.
                                                                              
@@ -34,6 +39,7 @@ module Sorcery
                              :@reset_password_token_expires_at_attribute_name => :reset_password_token_expires_at,
                              :@reset_password_email_sent_at_attribute_name    => :reset_password_email_sent_at,
                              :@reset_password_mailer                          => nil,
+                             :@reset_password_mailer_disabled                 => false,
                              :@reset_password_email_method_name               => :reset_password_email,
                              :@reset_password_expiration_period               => nil,
                              :@reset_password_time_between_emails             => 5 * 60 )
@@ -64,10 +70,11 @@ module Sorcery
           
           protected
           
-          # This submodule requires the developer to define his own mailer class to be used by it.
+          # This submodule requires the developer to define his own mailer class to be used by it
+          # when reset_password_mailer_disabled is false
           def validate_mailer_defined
             msg = "To use reset_password submodule, you must define a mailer (config.reset_password_mailer = YourMailerClass)."
-            raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil
+            raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil and @sorcery_config.reset_password_mailer_disabled == false
           end
 
           def define_reset_password_mongoid_fields
@@ -89,12 +96,12 @@ module Sorcery
             config = sorcery_config
             # hammering protection
             return false if config.reset_password_time_between_emails && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.ago.utc
-            self.send(:"#{config.reset_password_token_attribute_name}=", TemporaryToken.generate_random_token)
-            self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.reset_password_expiration_period) if config.reset_password_expiration_period
-            self.send(:"#{config.reset_password_email_sent_at_attribute_name}=", Time.now.in_time_zone)
+            attributes = {config.reset_password_token_attribute_name => TemporaryToken.generate_random_token,
+                          config.reset_password_email_sent_at_attribute_name => Time.now.in_time_zone}
+            attributes[config.reset_password_token_expires_at_attribute_name] = Time.now.in_time_zone + config.reset_password_expiration_period if config.reset_password_expiration_period
             self.class.transaction do
-              self.save!(:validate => false)
-              generic_send_email(:reset_password_email_method_name, :reset_password_mailer)
+              self.update_many_attributes(attributes)
+              generic_send_email(:reset_password_email_method_name, :reset_password_mailer) unless config.reset_password_mailer_disabled
             end
           end
           

data/lib/sorcery/model/submodules/user_activation.rb

@@ -20,7 +20,13 @@ module Sorcery
                           :activation_token_expiration_period,            # how many seconds before the activation code
                                                                           # expires. nil for never expires.
                                                                           
-                          :user_activation_mailer,                        # your mailer class. Required.
+                          :user_activation_mailer,                        # your mailer class. Required when
+                                                                          # activation_mailer_disabled == false.
+
+                          :activation_mailer_disabled,                    # when true sorcery will not automatically
+                                                                          # email activation details and allow you to
+                                                                          # manually handle how and when email is sent
+
                           :activation_needed_email_method_name,           # activation needed email method on your
                                                                           # mailer class.
                                                                           
@@ -37,6 +43,7 @@ module Sorcery
                              :@activation_token_expires_at_attribute_name  => :activation_token_expires_at,
                              :@activation_token_expiration_period          => nil,
                              :@user_activation_mailer                      => nil,
+                             :@activation_mailer_disabled                  => false,
                              :@activation_needed_email_method_name         => :activation_needed_email,
                              :@activation_success_email_method_name        => :activation_success_email,
                              :@prevent_non_active_users_to_login           => true)
@@ -47,7 +54,7 @@ module Sorcery
             # don't setup activation if no password supplied - this user is created automatically
             before_create :setup_activation, :if => Proc.new { |user| user.send(sorcery_config.password_attribute_name).present? }
             # don't send activation needed email if no crypted password created - this user is external (OAuth etc.)
-            after_create  :send_activation_needed_email!, :if => Proc.new { |user| !user.external?}
+            after_create  :send_activation_needed_email!, :if => Proc.new { |user| !user.external? }
           end
           
           base.sorcery_config.after_config << :validate_mailer_defined
@@ -74,10 +81,11 @@ module Sorcery
           
           protected
           
-          # This submodule requires the developer to define his own mailer class to be used by it.
+          # This submodule requires the developer to define his own mailer class to be used by it
+          # when activation_mailer_disabled is false
           def validate_mailer_defined
             msg = "To use user_activation submodule, you must define a mailer (config.user_activation_mailer = YourMailerClass)."
-            raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil
+            raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil and @sorcery_config.activation_mailer_disabled == false
           end
 
           def define_user_activation_mongoid_fields
@@ -119,11 +127,11 @@ module Sorcery
 
           # called automatically after user initial creation.
           def send_activation_needed_email!
-            generic_send_email(:activation_needed_email_method_name, :user_activation_mailer) unless sorcery_config.activation_needed_email_method_name.nil?
+            generic_send_email(:activation_needed_email_method_name, :user_activation_mailer) unless sorcery_config.activation_needed_email_method_name.nil? or sorcery_config.activation_mailer_disabled == true
           end
 
           def send_activation_success_email!
-            generic_send_email(:activation_success_email_method_name, :user_activation_mailer) unless sorcery_config.activation_success_email_method_name.nil?
+            generic_send_email(:activation_success_email_method_name, :user_activation_mailer) unless sorcery_config.activation_success_email_method_name.nil? or sorcery_config.activation_mailer_disabled == true
           end
           
           def prevent_non_active_login

data/lib/sorcery/model.rb

@@ -17,39 +17,39 @@ module Sorcery
               include InstanceMethods
               include TemporaryToken
             end
-            
+
             include_required_submodules!
 
             # This runs the options block set in the initializer on the model class.
             ::Sorcery::Controller::Config.user_config.tap{|blk| blk.call(@sorcery_config) if blk}
-            
+
             init_mongoid_support! if defined?(Mongoid) and self.ancestors.include?(Mongoid::Document)
             init_mongo_mapper_support! if defined?(MongoMapper) and self.ancestors.include?(MongoMapper::Document)
 
             init_orm_hooks!
-            
+
             @sorcery_config.after_config << :add_config_inheritance if @sorcery_config.subclasses_inherit_config
             @sorcery_config.after_config.each { |c| send(c) }
           end
-          
+
           protected
-          
-          # includes required submodules into the model class, 
+
+          # includes required submodules into the model class,
           # which usually is called User.
           def include_required_submodules!
             self.class_eval do
               @sorcery_config.submodules = ::Sorcery::Controller::Config.submodules
               @sorcery_config.submodules.each do |mod|
                 begin
-                  include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join("")) 
+                  include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
                 rescue NameError
-                  # don't stop on a missing submodule. Needed because some submodules are only defined 
+                  # don't stop on a missing submodule. Needed because some submodules are only defined
                   # in the controller side.
                 end
               end
             end
           end
-          
+
           # defines mongoid fields on the model class,
           # using 1.8.x hash syntax to perserve compatibility.
           def init_mongoid_support!
@@ -62,7 +62,7 @@ module Sorcery
               field sorcery_config.salt_attribute_name,             :type => String
             end
           end
-          
+
           # defines mongo_mapper fields on the model class,
           def init_mongo_mapper_support!
             self.class_eval do
@@ -91,13 +91,13 @@ module Sorcery
         end
       end
     end
-    
+
     module ClassMethods
       # Returns the class instance variable for configuration, when called by the class itself.
       def sorcery_config
         @sorcery_config
       end
-      
+
       # The default authentication method.
       # Takes a username and password,
       # Finds the user by the username and compares the user's password to the one supplied to the method.
@@ -112,17 +112,17 @@ module Sorcery
         _salt = user.send(@sorcery_config.salt_attribute_name) if user && !@sorcery_config.salt_attribute_name.nil? && !@sorcery_config.encryption_provider.nil?
         user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && credentials_match?(user.send(@sorcery_config.crypted_password_attribute_name),credentials[1],_salt)
       end
-      
+
       # encrypt tokens using current encryption_provider.
       def encrypt(*tokens)
         return tokens.first if @sorcery_config.encryption_provider.nil?
-        
+
         set_encryption_attributes()
 
         CryptoProviders::AES256.key = @sorcery_config.encryption_key
         @sorcery_config.encryption_provider.encrypt(*tokens)
       end
-      
+
       protected
 
       def set_encryption_attributes()
@@ -135,7 +135,7 @@ module Sorcery
         return crypted == tokens.join if @sorcery_config.encryption_provider.nil?
         @sorcery_config.encryption_provider.matches?(crypted, *tokens)
       end
-      
+
       def add_config_inheritance
         self.class_eval do
           def self.inherited(subclass)
@@ -149,23 +149,23 @@ module Sorcery
           end
         end
       end
-      
+
     end
-    
+
     module InstanceMethods
       # Returns the class instance variable for configuration, when called by an instance.
       def sorcery_config
         self.class.sorcery_config
       end
-      
+
       # identifies whether this user is regular, i.e. we hold his credentials in our db,
       # or that he is external, and his credentials are saved elsewhere (twitter/facebook etc.).
       def external?
         send(sorcery_config.crypted_password_attribute_name).nil?
       end
-      
+
       protected
-      
+
       # creates new salt and saves it.
       # encrypts password with salt and saves it.
       def encrypt_password
@@ -178,29 +178,29 @@ module Sorcery
         config = sorcery_config
         self.send(:"#{config.password_attribute_name}=", nil)
       end
-      
+
       # calls the requested email method on the configured mailer
       # supports both the ActionMailer 3 way of calling, and the plain old Ruby object way.
       def generic_send_email(method, mailer)
         config = sorcery_config
         mail = config.send(mailer).send(config.send(method),self)
-        if defined?(ActionMailer) and config.send(mailer).superclass == ActionMailer::Base
+        if defined?(ActionMailer) and config.send(mailer).kind_of?(Class) and config.send(mailer) < ActionMailer::Base
           mail.deliver
         end
       end
     end
 
     # Each class which calls 'activate_sorcery!' receives an instance of this class.
-    # Every submodule which gets loaded may add accessors to this class so that all 
+    # Every submodule which gets loaded may add accessors to this class so that all
     # options will be configured from a single place.
     class Config
 
       attr_accessor :username_attribute_names,           # change default username attribute, for example, to use :email
                                                         # as the login.
-                                                        
+
                     :password_attribute_name,           # change *virtual* password attribute, the one which is used
                                                         # until an encrypted one is generated.
-                                                        
+
                     :email_attribute_name,              # change default email attribute.
 
                     :downcase_username_before_authenticating, # downcase the username before trying to authenticate, default is false
@@ -211,17 +211,17 @@ module Sorcery
                     :stretches,                         # how many times to apply encryption to the password.
                     :encryption_key,                    # encryption key used to encrypt reversible encryptions such as
                                                         # AES256.
-                                                        
+
                     :subclasses_inherit_config,         # make this configuration inheritable for subclasses. Useful for
                                                         # ActiveRecord's STI.
-                    
+
                     :submodules,                        # configured in config/application.rb
                     :before_authenticate,               # an array of method names to call before authentication
                                                         # completes. used internally.
-                                                        
+
                     :after_config                       # an array of method names to call after configuration by user.
                                                         # used internally.
-                    
+
       attr_reader   :encryption_provider,               # change default encryption_provider.
                     :custom_encryption_provider,        # use an external encryption class.
                     :encryption_algorithm               # encryption algorithm name. See 'encryption_algorithm=' below
@@ -247,26 +247,26 @@ module Sorcery
           :@after_config                         => []
         }
         reset!
-      end     
-           
+      end
+
       # Resets all configuration options to their default values.
       def reset!
         @defaults.each do |k,v|
           instance_variable_set(k,v)
-        end       
+        end
       end
-      
+
       def username_attribute_names=(fields)
         @username_attribute_names = fields.kind_of?(Array) ? fields : [fields]
       end
-      
+
       def custom_encryption_provider=(provider)
         @custom_encryption_provider = @encryption_provider = provider
       end
-      
+
       def encryption_algorithm=(algo)
         @encryption_algorithm = algo
-        @encryption_provider = case @encryption_algorithm
+        @encryption_provider = case @encryption_algorithm.to_sym
         when :none   then nil
         when :md5    then CryptoProviders::MD5
         when :sha1   then CryptoProviders::SHA1
@@ -275,10 +275,11 @@ module Sorcery
         when :aes256 then CryptoProviders::AES256
         when :bcrypt then CryptoProviders::BCrypt
         when :custom then @custom_encryption_provider
+        else raise ArgumentError.new("Encryption algorithm supplied, #{algo}, is invalid")
         end
       end
-      
+
     end
-    
+
   end
 end

data/lib/sorcery/railties/tasks.rake

@@ -3,6 +3,8 @@ require 'fileutils'
 namespace :sorcery do
   desc "Adds sorcery's initializer file"
   task :bootstrap do
+    warn "This task is obsolete.\nUse \"rails g sorcery:install\" now.\nSee README for more information."
+
     src = File.join(File.dirname(__FILE__), '..', 'initializers', 'initializer.rb')
     target = File.join(Rails.root, "config", "initializers", "sorcery.rb")
     FileUtils.cp(src, target)

data/lib/sorcery.rb

@@ -36,6 +36,8 @@ module Sorcery
           autoload :Github, 'sorcery/controller/submodules/external/providers/github'
           autoload :Google, 'sorcery/controller/submodules/external/providers/google'
           autoload :Liveid, 'sorcery/controller/submodules/external/providers/liveid'
+          autoload :Linkedin, 'sorcery/controller/submodules/external/providers/linkedin'
+          autoload :Vkontakte, 'sorcery/controller/submodules/external/providers/vkontakte'
         end
       end
     end
@@ -78,5 +80,5 @@ module Sorcery
     MongoMapper::Document.send(:plugin, Sorcery::Model::Adapters::MongoMapper)
   end
 
-  require 'sorcery/engine' if defined?(Rails) && Rails::VERSION::MAJOR == 3
+  require 'sorcery/engine' if defined?(Rails) && Rails::VERSION::MAJOR >= 3
 end