sorcery 0.7.8 → 0.7.9

data/README.rdoc

@@ -29,7 +29,7 @@ Railscast: http://railscasts.com/episodes/283-authentication-with-sorcery
 
 Example Rails 3 app using sorcery: https://github.com/NoamB/sorcery-example-app
 
-Documentation: http://rubydoc.info/gems/sorcery/0.7.8/frames
+Documentation: http://rubydoc.info/gems/sorcery/0.7.9/frames
 
 Check out the tutorials in the github wiki!
 

data/Rakefile

@@ -51,6 +51,7 @@ task :all_sorcery_specs do
     directory_name = File.dirname(rakefile)
     sh <<-CMD
       cd #{directory_name}
+      bundle
       bundle exec rake
     CMD
   end

data/VERSION

@@ -1 +1 @@
-0.7.8
+0.7.9

data/lib/generators/sorcery/templates/initializer.rb

@@ -329,6 +329,26 @@ Rails.application.config.sorcery.configure do |config|
     #
     # user.login_lock_time_period =
 
+    # Unlock token attribute name
+    # Default: `:unlock_token`
+    #
+    # user.unlock_token_attribute_name =
+
+    # Unlock token mailer method
+    # Default: `:send_unlock_token_email`
+    #
+    # user.unlock_token_email_method_name =
+
+    # when true sorcery will not automatically
+    # send email with unlock token
+    # Default: `false`
+    #
+    # user.unlock_token_mailer_disabled = true
+
+    # Unlock token mailer class
+    # Default: `nil`
+    # 
+    # user.unlock_token_mailer = UserMailer
 
     # -- activity logging --
     # Last login attribute name.

data/lib/generators/sorcery/templates/migration/brute_force_protection.rb

@@ -2,10 +2,12 @@ class SorceryBruteForceProtection < ActiveRecord::Migration
   def self.up
     add_column :<%= model_class_name.tableize %>, :failed_logins_count, :integer, :default => 0
     add_column :<%= model_class_name.tableize %>, :lock_expires_at, :datetime, :default => nil
+    add_column :<%= model_class_name.tableize %>, :unlock_token, :string, :default => nil
   end
 
   def self.down
     remove_column :<%= model_class_name.tableize %>, :lock_expires_at
     remove_column :<%= model_class_name.tableize %>, :failed_logins_count
+    remove_column :<%= model_class_name.tableize %>, :unlock_token
   end
 end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -72,8 +72,8 @@ module Sorcery
           def get_current_users
             config = sorcery_config
             where(config.last_activity_at_attribute_name.ne => nil) \
-            .and("this.#{config.last_logout_at_attribute_name} == null || this.#{config.last_activity_at_attribute_name} > this.#{config.last_logout_at_attribute_name}") \
-            .and(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc).order_by([:_id,:asc])
+            .where("this.#{config.last_logout_at_attribute_name} == null || this.#{config.last_activity_at_attribute_name} > this.#{config.last_logout_at_attribute_name}") \
+            .where(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc).order_by([:_id,:asc])
           end
         end
       end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -12,15 +12,25 @@ module Sorcery
                           :lock_expires_at_attribute_name,            # this field indicates whether user 
                                                                       # is banned and when it will be active again.
                           :consecutive_login_retries_amount_limit,    # how many failed logins allowed.
-                          :login_lock_time_period                     # how long the user should be banned. 
+                          :login_lock_time_period,                    # how long the user should be banned. 
                                                                       # in seconds. 0 for permanent.
+
+                          :unlock_token_attribute_name,               # Unlock token attribute name
+                          :unlock_token_email_method_name,            # Mailer method name
+                          :unlock_token_mailer_disabled,              # When true, dont send unlock token via email
+                          :unlock_token_mailer                        # Mailer class
           end
           
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@failed_logins_count_attribute_name              => :failed_logins_count,
                              :@lock_expires_at_attribute_name                  => :lock_expires_at,
                              :@consecutive_login_retries_amount_limit          => 50,
-                             :@login_lock_time_period                          => 60 * 60)
+                             :@login_lock_time_period                          => 60 * 60,
+
+                             :@unlock_token_attribute_name                     => :unlock_token,
+                             :@unlock_token_email_method_name                  => :send_unlock_token_email,
+                             :@unlock_token_mailer_disabled                    => false,
+                             :@unlock_token_mailer                             => nil)
             reset!
           end
           
@@ -31,9 +41,19 @@ module Sorcery
           end
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
+
+          base.class_eval do
+            after_update :send_unlock_token_email!, :if => Proc.new { |user| user.send(sorcery_config.unlock_token_attribute_name).present? }
+          end
         end
         
         module ClassMethods
+          def load_from_unlock_token(token)
+            return nil if token.blank?
+            user = find_by_sorcery_token(sorcery_config.unlock_token_attribute_name,token)
+            user
+          end
+
           protected
 
           def define_brute_force_protection_mongoid_fields
@@ -58,18 +78,23 @@ module Sorcery
             self.lock! if self.send(config.failed_logins_count_attribute_name) >= config.consecutive_login_retries_amount_limit
           end
           
-          protected
-
-          def lock!
+          # /!\
+          # Moved out of protected for use like activate! in controller
+          # /!\
+          def unlock!
             config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.in_time_zone + config.login_lock_time_period)
+            self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
+            self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
+            self.send(:"#{config.unlock_token_attribute_name}=", nil) unless config.unlock_token_mailer_disabled or config.unlock_token_mailer.nil?
             self.save!(:validate => false)
           end
 
-          def unlock!
+          protected
+
+          def lock!
             config = sorcery_config
-            self.send(:"#{config.lock_expires_at_attribute_name}=", nil)
-            self.send(:"#{config.failed_logins_count_attribute_name}=", 0)
+            self.send(:"#{config.lock_expires_at_attribute_name}=", Time.now.in_time_zone + config.login_lock_time_period)
+            self.send(:"#{config.unlock_token_attribute_name}=", TemporaryToken.generate_random_token) unless config.unlock_token_mailer_disabled or config.unlock_token_mailer.nil?
             self.save!(:validate => false)
           end
           
@@ -77,6 +102,10 @@ module Sorcery
             config = sorcery_config
             self.send(config.lock_expires_at_attribute_name).nil?
           end
+
+          def send_unlock_token_email!
+            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer) unless sorcery_config.unlock_token_email_method_name.nil? or sorcery_config.unlock_token_mailer_disabled == true
+          end
           
           # Prevents a locked user from logging in, and unlocks users that expired their lock time.
           # Runs as a hook before authenticate.

data/sorcery.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "sorcery"
-  s.version = "0.7.8"
+  s.version = "0.7.9"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Noam Ben Ari"]
-  s.date = "2012-03-30"
+  s.date = "2012-04-17"
   s.description = "Provides common authentication needs such as signing in/out, activating by email and resetting password."
   s.email = "nbenari@gmail.com"
   s.extra_rdoc_files = [
@@ -100,6 +100,7 @@ Gem::Specification.new do |s|
     "spec/rails3/app/views/sorcery_mailer/activation_success_email.text.erb",
     "spec/rails3/app/views/sorcery_mailer/reset_password_email.html.erb",
     "spec/rails3/app/views/sorcery_mailer/reset_password_email.text.erb",
+    "spec/rails3/app/views/sorcery_mailer/send_unlock_token_email.text.erb",
     "spec/rails3/config.ru",
     "spec/rails3/config/application.rb",
     "spec/rails3/config/boot.rb",

data/spec/Gemfile.lock

@@ -6,7 +6,6 @@ PATH
       bundler (>= 1.1.0)
       oauth (~> 0.4.4)
       oauth2 (~> 0.5.1)
-      sorcery
 
 GEM
   remote: http://rubygems.org/

data/spec/rails3/Gemfile.lock

@@ -6,7 +6,6 @@ PATH
       bundler (>= 1.1.0)
       oauth (~> 0.4.4)
       oauth2 (~> 0.5.1)
-      sorcery
 
 GEM
   remote: http://rubygems.org/

data/spec/rails3/app/mailers/sorcery_mailer.rb

@@ -22,4 +22,11 @@ class SorceryMailer < ActionMailer::Base
     mail(:to => user.email,
          :subject => "Your password has been reset")
   end
+
+  def send_unlock_token_email(user)
+    @user = user
+    @url = "http://example.com/unlock/#{user.unlock_token}"
+    mail(:to => user.email,
+         :subject => "Your account has been locked due to many wrong logins")
+  end
 end

data/spec/rails3/app/views/sorcery_mailer/send_unlock_token_email.text.erb

@@ -0,0 +1 @@
+Please visit <% @url %> for unlock your account.

data/spec/rails3/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb

@@ -2,9 +2,11 @@ class AddBruteForceProtectionToUsers < ActiveRecord::Migration
   def self.up
     add_column :users, :failed_logins_count, :integer, :default => 0
     add_column :users, :lock_expires_at, :datetime, :default => nil
+    add_column :users, :unlock_token, :string, :default => nil
   end
 
   def self.down
+    remove_column :users, :unlock_token
     remove_column :users, :lock_expires_at
     remove_column :users, :failed_logins_count
   end

data/spec/rails3/spec/controller_brute_force_protection_spec.rb

@@ -21,12 +21,34 @@ describe ApplicationController do
       sorcery_controller_property_set(:user_class, User)
       Timecop.return
     end
-    
+
     it "should count login retries" do
       3.times {get :test_login, :username => 'gizmo', :password => 'blabla'}
       User.find_by_username('gizmo').failed_logins_count.should == 3
     end
     
+    it "should generate unlock token after user locked" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times {get :test_login, :username => "gizmo", :password => "blabla"}
+      User.find_by_username('gizmo').unlock_token.should_not be_nil
+    end
+
+    it "should unlock after entering unlock token" do
+      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
+      sorcery_model_property_set(:login_lock_time_period, 0)
+      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
+      3.times {get :test_login, :username => "gizmo", :password => "blabla"}
+      User.find_by_username('gizmo').unlock_token.should_not be_nil
+      token = User.find_by_username('gizmo').unlock_token
+      user = User.load_from_unlock_token(token)
+      user.should_not be_nil
+      user.unlock!
+      User.load_from_unlock_token(token).should be_nil
+    end
+
+    
     it "should reset the counter on a good login" do
       sorcery_model_property_set(:consecutive_login_retries_amount_limit, 5)
       3.times {get :test_login, :username => 'gizmo', :password => 'blabla'}

data/spec/rails3_mongo_mapper/Gemfile

@@ -3,7 +3,7 @@ source 'http://rubygems.org'
 gem 'bcrypt-ruby', '~> 3.0.0'
 gem 'rails', '3.0.3'
 gem "sorcery", '>= 0.1.0', :path => '../../'
-gem "mongo_mapper"
+gem "mongo_mapper", '~> 0.11.0'
 gem "bson_ext", "~> 1.3"
 
 group :development, :test do

data/spec/rails3_mongo_mapper/Gemfile.lock

@@ -6,7 +6,6 @@ PATH
       bundler (>= 1.1.0)
       oauth (~> 0.4.4)
       oauth2 (~> 0.5.1)
-      sorcery
 
 GEM
   remote: http://rubygems.org/
@@ -144,7 +143,7 @@ PLATFORMS
 DEPENDENCIES
   bcrypt-ruby (~> 3.0.0)
   bson_ext (~> 1.3)
-  mongo_mapper
+  mongo_mapper (~> 0.11.0)
   pry
   rails (= 3.0.3)
   rspec (~> 2.5.0)

data/spec/rails3_mongoid/Gemfile.lock

@@ -6,7 +6,6 @@ PATH
       bundler (>= 1.1.0)
       oauth (~> 0.4.4)
       oauth2 (~> 0.5.1)
-      sorcery
 
 GEM
   remote: http://rubygems.org/

data/spec/rails3_mongoid/config/mongoid.yml

@@ -4,4 +4,4 @@ development:
 
 test:
   host: localhost
-  database: app_root_test
+  database: app_root_test

data/spec/rails3_mongoid/spec/controller_activity_logging_spec.rb

@@ -23,28 +23,28 @@ describe ApplicationController do
     end
 
     it "should log login time on login" do
-      now = Time.now
+      now = Time.now.utc
       login_user
       @user.last_login_at.should_not be_nil
-      @user.last_login_at.to_s(:db).should >= now.to_s(:db)
-      @user.last_login_at.to_s(:db).should <= (now+2).to_s(:db)
+      @user.last_login_at.utc.to_s.should >= now.utc.to_s
+      @user.last_login_at.utc.to_s.should <= (now.utc+2).to_s
     end
 
     it "should log logout time on logout" do
       login_user
-      now = Time.now
+      now = Time.now.utc
       logout_user
-      User.first.last_logout_at.should_not be_nil
-      User.first.last_logout_at.to_s(:db).should >= now.to_s(:db)
-      User.first.last_logout_at.to_s(:db).should <= (now+2).to_s(:db)
+      User.first.last_logout_at.utc.should_not be_nil
+      User.first.last_logout_at.utc.to_s.should >= now.utc.to_s
+      User.first.last_logout_at.utc.to_s.should <= (now.utc+2).to_s
     end
 
     it "should log last activity time when logged in" do
       login_user
-      now = Time.now
+      now = Time.now.utc
       get :some_action
-      User.first.last_activity_at.to_s(:db).should >= now.to_s(:db)
-      User.first.last_activity_at.to_s(:db).should <= (now+2).to_s(:db)
+      User.first.last_activity_at.utc.should >= now.utc
+      User.first.last_activity_at.utc.should <= (now.utc+2)
     end
 
     it "should update nothing but activity fields" do
@@ -102,4 +102,4 @@ describe ApplicationController do
       @user.last_activity_at.should be_nil
     end
   end
-end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: sorcery
 version: !ruby/object:Gem::Version
-  version: 0.7.8
+  version: 0.7.9
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-03-30 00:00:00.000000000 Z
+date: 2012-04-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sorcery
-  requirement: &2170248260 !ruby/object:Gem::Requirement
+  requirement: &2157607760 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: '0'
   type: :runtime
   prerelease: false
-  version_requirements: *2170248260
+  version_requirements: *2157607760
 - !ruby/object:Gem::Dependency
   name: bcrypt-ruby
-  requirement: &2170247380 !ruby/object:Gem::Requirement
+  requirement: &2157607080 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -32,10 +32,10 @@ dependencies:
         version: 3.0.0
   type: :development
   prerelease: false
-  version_requirements: *2170247380
+  version_requirements: *2157607080
 - !ruby/object:Gem::Dependency
   name: rails
-  requirement: &2170246660 !ruby/object:Gem::Requirement
+  requirement: &2157606380 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,10 +43,10 @@ dependencies:
         version: 3.0.0
   type: :development
   prerelease: false
-  version_requirements: *2170246660
+  version_requirements: *2157606380
 - !ruby/object:Gem::Dependency
   name: json
-  requirement: &2170245660 !ruby/object:Gem::Requirement
+  requirement: &2157605660 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -54,10 +54,10 @@ dependencies:
         version: 1.5.1
   type: :development
   prerelease: false
-  version_requirements: *2170245660
+  version_requirements: *2157605660
 - !ruby/object:Gem::Dependency
   name: rspec
-  requirement: &2170245120 !ruby/object:Gem::Requirement
+  requirement: &2157605020 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -65,10 +65,10 @@ dependencies:
         version: 2.5.0
   type: :development
   prerelease: false
-  version_requirements: *2170245120
+  version_requirements: *2157605020
 - !ruby/object:Gem::Dependency
   name: rspec-rails
-  requirement: &2170244560 !ruby/object:Gem::Requirement
+  requirement: &2157604120 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -76,10 +76,10 @@ dependencies:
         version: 2.5.0
   type: :development
   prerelease: false
-  version_requirements: *2170244560
+  version_requirements: *2157604120
 - !ruby/object:Gem::Dependency
   name: ruby-debug19
-  requirement: &2170243560 !ruby/object:Gem::Requirement
+  requirement: &2157618620 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -87,10 +87,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2170243560
+  version_requirements: *2157618620
 - !ruby/object:Gem::Dependency
   name: sqlite3-ruby
-  requirement: &2170242660 !ruby/object:Gem::Requirement
+  requirement: &2157617080 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -98,10 +98,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2170242660
+  version_requirements: *2157617080
 - !ruby/object:Gem::Dependency
   name: yard
-  requirement: &2170241560 !ruby/object:Gem::Requirement
+  requirement: &2157616260 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -109,10 +109,10 @@ dependencies:
         version: 0.6.0
   type: :development
   prerelease: false
-  version_requirements: *2170241560
+  version_requirements: *2157616260
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &2170240980 !ruby/object:Gem::Requirement
+  requirement: &2157615580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -120,10 +120,10 @@ dependencies:
         version: 1.1.0
   type: :development
   prerelease: false
-  version_requirements: *2170240980
+  version_requirements: *2157615580
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &2170240100 !ruby/object:Gem::Requirement
+  requirement: &2157614500 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -131,10 +131,10 @@ dependencies:
         version: 1.8.3
   type: :development
   prerelease: false
-  version_requirements: *2170240100
+  version_requirements: *2157614500
 - !ruby/object:Gem::Dependency
   name: simplecov
-  requirement: &2170239120 !ruby/object:Gem::Requirement
+  requirement: &2157613680 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -142,10 +142,10 @@ dependencies:
         version: 0.3.8
   type: :development
   prerelease: false
-  version_requirements: *2170239120
+  version_requirements: *2157613680
 - !ruby/object:Gem::Dependency
   name: capybara
-  requirement: &2170237960 !ruby/object:Gem::Requirement
+  requirement: &2157613040 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -153,10 +153,10 @@ dependencies:
         version: 1.1.2
   type: :development
   prerelease: false
-  version_requirements: *2170237960
+  version_requirements: *2157613040
 - !ruby/object:Gem::Dependency
   name: mongoid
-  requirement: &2170237000 !ruby/object:Gem::Requirement
+  requirement: &2157612240 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -164,10 +164,10 @@ dependencies:
         version: 2.4.4
   type: :development
   prerelease: false
-  version_requirements: *2170237000
+  version_requirements: *2157612240
 - !ruby/object:Gem::Dependency
   name: timecop
-  requirement: &2170235980 !ruby/object:Gem::Requirement
+  requirement: &2157627680 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -175,10 +175,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *2170235980
+  version_requirements: *2157627680
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &2170235380 !ruby/object:Gem::Requirement
+  requirement: &2157626820 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - =
@@ -186,10 +186,10 @@ dependencies:
         version: 1.1.0
   type: :runtime
   prerelease: false
-  version_requirements: *2170235380
+  version_requirements: *2157626820
 - !ruby/object:Gem::Dependency
   name: bcrypt-ruby
-  requirement: &2170234880 !ruby/object:Gem::Requirement
+  requirement: &2157625580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -197,10 +197,10 @@ dependencies:
         version: 3.0.0
   type: :runtime
   prerelease: false
-  version_requirements: *2170234880
+  version_requirements: *2157625580
 - !ruby/object:Gem::Dependency
   name: oauth
-  requirement: &2170234160 !ruby/object:Gem::Requirement
+  requirement: &2157624680 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -208,10 +208,10 @@ dependencies:
         version: 0.4.4
   type: :runtime
   prerelease: false
-  version_requirements: *2170234160
+  version_requirements: *2157624680
 - !ruby/object:Gem::Dependency
   name: oauth2
-  requirement: &2170233480 !ruby/object:Gem::Requirement
+  requirement: &2157623980 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -219,7 +219,7 @@ dependencies:
         version: 0.5.1
   type: :runtime
   prerelease: false
-  version_requirements: *2170233480
+  version_requirements: *2157623980
 description: Provides common authentication needs such as signing in/out, activating
   by email and resetting password.
 email: nbenari@gmail.com
@@ -312,6 +312,7 @@ files:
 - spec/rails3/app/views/sorcery_mailer/activation_success_email.text.erb
 - spec/rails3/app/views/sorcery_mailer/reset_password_email.html.erb
 - spec/rails3/app/views/sorcery_mailer/reset_password_email.text.erb
+- spec/rails3/app/views/sorcery_mailer/send_unlock_token_email.text.erb
 - spec/rails3/config.ru
 - spec/rails3/config/application.rb
 - spec/rails3/config/boot.rb