sorcery 0.8.0 → 0.9.0

data/lib/sorcery/controller/submodules/external.rb

@@ -2,25 +2,45 @@ module Sorcery
   module Controller
     module Submodules
       # This submodule helps you login users from external auth providers such as Twitter.
-      # This is the controller part which handles the http requests and tokens passed between the app and the provider.
+      # This is the controller part which handles the http requests and tokens passed between the app and the @provider.
       module External
         def self.included(base)
           base.send(:include, InstanceMethods)
+
+          require 'sorcery/providers/base'
+          require 'sorcery/providers/facebook'
+          require 'sorcery/providers/twitter'
+          require 'sorcery/providers/vk'
+          require 'sorcery/providers/linkedin'
+          require 'sorcery/providers/liveid'
+          require 'sorcery/providers/xing'
+          require 'sorcery/providers/github'
+          require 'sorcery/providers/heroku'
+          require 'sorcery/providers/google'
+          require 'sorcery/providers/jira'
+          require 'sorcery/providers/salesforce'
+
           Config.module_eval do
             class << self
-              attr_reader :external_providers                           # external providers like twitter.
-              attr_accessor :ca_file                                    # path to ca_file. By default use a internal ca-bundle.crt.
-
-              def merge_external_defaults!
-                @defaults.merge!(:@external_providers => [],
-                                 :@ca_file => File.join(File.expand_path(File.dirname(__FILE__)), 'external/protocols/certs/ca-bundle.crt'))
-              end
+              attr_reader :external_providers
+              attr_accessor :ca_file
 
               def external_providers=(providers)
-                providers.each do |provider|
-                  include Providers.const_get(provider.to_s.split("_").map {|p| p.capitalize}.join(""))
+                @external_providers = providers
+
+                providers.each do |name|
+                  class_eval <<-E
+                    def self.#{name}
+                      @#{name} ||= Sorcery::Providers.const_get('#{name}'.to_s.capitalize).new
+                    end
+                  E
                 end
               end
+
+              def merge_external_defaults!
+                @defaults.merge!(:@external_providers => [],
+                                 :@ca_file => File.join(File.expand_path(File.dirname(__FILE__)), '../../protocols/certs/ca-bundle.crt'))
+              end
             end
             merge_external_defaults!
           end
@@ -29,83 +49,111 @@ module Sorcery
         module InstanceMethods
           protected
 
-          # sends user to authenticate at the provider's website.
-          # after authentication the user is redirected to the callback defined in the provider config
-          def login_at(provider, args = {})
-            @provider = Config.send(provider)
-            if @provider.callback_url.present? && @provider.callback_url[0] == '/'
+          # save the singleton ProviderClient instance into @provider
+          def sorcery_get_provider(provider_name)
+            return unless Config.external_providers.include?(provider_name.to_sym)
+            Config.send(provider_name.to_sym)
+          end
+
+          # get the login URL from the provider, if applicable.  Returns nil if the provider
+          # does not provide a login URL.  (as of v0.8.1 all providers provide a login URL)
+          def sorcery_login_url(provider_name, args = {})
+            @provider = sorcery_get_provider provider_name
+            sorcery_fixup_callback_url @provider
+            if @provider.respond_to?(:login_url) && @provider.has_callback?
+              @provider.state = args[:state] if args[:state]
+              return @provider.login_url(params, session)
+            else
+              return nil
+            end
+          end
+
+          # get the user hash from a provider using information from the params and session.
+          def sorcery_fetch_user_hash(provider_name)
+            # the application should never ask for user hashes from two different providers
+            # on the same request.  But if they do, we should be ready: on the second request,
+            # clear out the instance variables if the provider is different
+            provider = sorcery_get_provider provider_name
+            if @provider.nil? || @provider != provider
+              @provider = provider
+              @access_token = nil
+              @user_hash = nil
+            end
+
+            # delegate to the provider for the access token and the user hash.
+            # cache them in instance variables.
+            @access_token ||= @provider.process_callback(params, session) # sends request to oauth agent to get the token
+            @user_hash ||= @provider.get_user_hash(@access_token) # uses the token to send another request to the oauth agent requesting user info
+          end
+
+          # for backwards compatibility
+          def access_token(*args)
+            @access_token
+          end
+
+
+          # this method should be somewhere else.  It only does something once per application per provider.
+          def sorcery_fixup_callback_url(provider)
+            provider.original_callback_url ||= provider.callback_url
+            if provider.original_callback_url.present? && provider.original_callback_url[0] == '/'
               uri = URI.parse(request.url.gsub(/\?.*$/,''))
               uri.path = ''
               uri.query = nil
               uri.scheme = 'https' if(request.env['HTTP_X_FORWARDED_PROTO'] == 'https')
               host = uri.to_s
-              @provider.callback_url = "#{host}#{@provider.callback_url}"
-            end
-            if @provider.has_callback?
-              redirect_to @provider.login_url(params,session)
-            else
-              #@provider.login(args)
+              provider.callback_url = "#{host}#{@provider.original_callback_url}"
             end
           end
 
+          # sends user to authenticate at the provider's website.
+          # after authentication the user is redirected to the callback defined in the provider config
+          def login_at(provider_name, args = {})
+            redirect_to sorcery_login_url(provider_name, args)
+          end
+
           # tries to login the user from provider's callback
-          def login_from(provider)
-            @provider = Config.send(provider)
-            @provider.process_callback(params,session)
-            @user_hash = @provider.get_user_hash
-            if user = user_class.load_from_provider(provider,@user_hash[:uid].to_s)
+          def login_from(provider_name, should_remember = false)
+            sorcery_fetch_user_hash provider_name
+
+            if user = user_class.load_from_provider(provider_name, @user_hash[:uid].to_s)
+              # we found the user.
+              # clear the session
               return_to_url = session[:return_to_url]
-              reset_session
+              reset_sorcery_session
               session[:return_to_url] = return_to_url
-              auto_login(user)
+
+              # sign in the user
+              auto_login(user, should_remember)
               after_login!(user)
+
+              # return the user
               user
             end
           end
 
-          # get provider access account
-          def access_token(provider)
-            @provider = Config.send(provider)
-            @provider.access_token
-          end
-
           # If user is logged, he can add all available providers into his account
-          def add_provider_to_user(provider)
-            provider_name = provider.to_sym
-            @provider = Config.send(provider_name)
-            @provider.process_callback(params,session)
-            @user_hash = @provider.get_user_hash
+          def add_provider_to_user(provider_name)
+            sorcery_fetch_user_hash provider_name
             config = user_class.sorcery_config
 
-            # first check to see if user has a particular authentication already
-            unless (current_user.send(config.authentications_class.to_s.downcase.pluralize).send("find_by_#{config.provider_attribute_name}_and_#{config.provider_uid_attribute_name}", provider, @user_hash[:uid].to_s))
-              user = current_user.send(config.authentications_class.to_s.downcase.pluralize).build(config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider_name.to_s)
-              user.save(:validate => false)
-            else
-              user = false
-            end
-
-            return user
+            current_user.add_provider_to_user(provider_name.to_s, @user_hash[:uid].to_s)
           end
 
           # Initialize new user from provider informations.
           # If a provider doesn't give required informations or username/email is already taken,
           # we store provider/user infos into a session and can be rendered into registration form
-          def create_and_validate_from(provider)
-            provider = provider.to_sym
-            @provider = Config.send(provider)
-            @user_hash = @provider.get_user_hash
+          def create_and_validate_from(provider_name)
+            sorcery_fetch_user_hash provider_name
             config = user_class.sorcery_config
 
             attrs = user_attrs(@provider.user_info_mapping, @user_hash)
 
-            user = user_class.new(attrs)
-            user.send(config.authentications_class.to_s.downcase.pluralize).build(config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider)
+            user, saved = user_class.create_and_validate_from_provider(provider_name, @user_hash[:uid], attrs)
 
             session[:incomplete_user] = {
-              :provider => {config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider},
+              :provider => {config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider_name},
               :user_hash => attrs
-            } unless user.save
+            } unless saved
 
             return user
           end
@@ -126,28 +174,12 @@ module Sorcery
           #
           #   create_from(provider) {|user| user.some_check }
           #
-          def create_from(provider)
-            provider = provider.to_sym
-            @provider = Config.send(provider)
-            @user_hash = @provider.get_user_hash
+          def create_from(provider_name, &block)
+            sorcery_fetch_user_hash provider_name
             config = user_class.sorcery_config
 
             attrs = user_attrs(@provider.user_info_mapping, @user_hash)
-
-            user_class.transaction do
-              @user = user_class.new()
-              attrs.each do |k,v|
-                @user.send(:"#{k}=", v)
-              end
-
-              if block_given?
-                return false unless yield @user
-              end
-
-              @user.save(:validate => false)
-              user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider, config.provider_uid_attribute_name => @user_hash[:uid]})
-            end
-            @user
+            @user = user_class.create_from_provider(provider_name, @user_hash[:uid], attrs, &block)
           end
 
           def user_attrs(user_info_mapping, user_hash)

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -31,14 +31,14 @@ module Sorcery
 
           # Clears the cookie and clears the token from the db.
           def forget_me!
-            @current_user.forget_me!
+            current_user.forget_me!
             cookies.delete(:remember_me_token, :domain => Config.cookie_domain)
           end
 
           # Override.
           # logins a user instance, and optionally remembers him.
           def auto_login(user, should_remember = false)
-            session[:user_id] = user.id
+            session[:user_id] = user.id.to_s
             @current_user = user
             remember_me! if should_remember
           end
@@ -55,10 +55,10 @@ module Sorcery
           # and logs the user in if found.
           # Runs as a login source. See 'current_user' method for how it is used.
           def login_from_cookie
-            user = cookies.signed[:remember_me_token] && user_class.find_by_remember_me_token(cookies.signed[:remember_me_token])
-            if user && user.remember_me_token?
+            user = cookies.signed[:remember_me_token] && user_class.sorcery_adapter.find_by_remember_me_token(cookies.signed[:remember_me_token])
+            if user && user.has_remember_me_token?
               set_remember_me_cookie!(user)
-              session[:user_id] = user.id
+              session[:user_id] = user.id.to_s
               @current_user = user
             else
               @current_user = false

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -9,10 +9,10 @@ module Sorcery
           Config.module_eval do
             class << self
               attr_accessor :session_timeout,                     # how long in seconds to keep the session alive.
-              
+
                             :session_timeout_from_last_action     # use the last action as the beginning of session
                                                                   # timeout.
-                            
+
               def merge_session_timeout_defaults!
                 @defaults.merge!(:@session_timeout                      => 3600, # 1.hour
                                  :@session_timeout_from_last_action     => false)
@@ -23,28 +23,32 @@ module Sorcery
           Config.after_login << :register_login_time
           base.prepend_before_filter :validate_session
         end
-        
+
         module InstanceMethods
           protected
-          
+
           # Registers last login to be used as the timeout starting point.
           # Runs as a hook after a successful login.
           def register_login_time(user, credentials)
             session[:login_time] = session[:last_action_time] = Time.now.in_time_zone
           end
-          
+
           # Checks if session timeout was reached and expires the current session if so.
           # To be used as a before_filter, before require_login
           def validate_session
             session_to_use = Config.session_timeout_from_last_action ? session[:last_action_time] : session[:login_time]
-            if session_to_use && (Time.now.in_time_zone - session_to_use > Config.session_timeout)
-              reset_session
+            if session_to_use && sorcery_session_expired?(session_to_use.to_time)
+              reset_sorcery_session
               @current_user = nil
             else
               session[:last_action_time] = Time.now.in_time_zone
             end
           end
 
+          def sorcery_session_expired?(time)
+            Time.now.in_time_zone - time > Config.session_timeout
+          end
+
         end
       end
     end

data/lib/sorcery/controller.rb

@@ -5,7 +5,7 @@ module Sorcery
         include InstanceMethods
         Config.submodules.each do |mod|
           begin
-            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
+            include Submodules.const_get(mod.to_s.split('_').map { |p| p.capitalize }.join)
           rescue NameError
             # don't stop on a missing submodule.
           end
@@ -28,15 +28,17 @@ module Sorcery
 
       # Takes credentials and returns a user on successful authentication.
       # Runs hooks after login or failed login.
-       def login(*credentials)
+      def login(*credentials)
         @current_user = nil
         user = user_class.authenticate(*credentials)
         if user
-          old_session = session.dup
-          reset_session # protect from session fixation attacks
-          old_session.to_hash.each_pair do |k,v|
+          old_session = session.dup.to_hash
+          reset_sorcery_session
+          old_session.each_pair do |k,v|
             session[k.to_sym] = v
           end
+          form_authenticity_token
+
           auto_login(user)
           after_login!(user, credentials)
           current_user
@@ -46,11 +48,20 @@ module Sorcery
         end
       end
 
+      # put this into the catch block to rescue undefined method `destroy_session'
+      # hotfix for https://github.com/NoamB/sorcery/issues/464
+      # can be removed when Rails 4.1 is out
+      def reset_sorcery_session
+        reset_session # protect from session fixation attacks
+      rescue NoMethodError
+      end
+
       # Resets the session and runs hooks before and after.
       def logout
         if logged_in?
-          before_logout!(current_user)
-          reset_session
+          @current_user = current_user if @current_user.nil?
+          before_logout!(@current_user)
+          reset_sorcery_session
           after_logout!
           @current_user = nil
         end
@@ -61,9 +72,12 @@ module Sorcery
       end
 
       # attempts to auto-login from the sources defined (session, basic_auth, cookie, etc.)
-      # returns the logged in user if found, false if not (using old restful-authentication trick, nil != false).
+      # returns the logged in user if found, nil if not
       def current_user
-        @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
+        unless defined?(@current_user)
+          @current_user = login_from_session || login_from_other_sources || nil
+        end
+        @current_user
       end
 
       def current_user=(user)
@@ -88,8 +102,8 @@ module Sorcery
       #
       # @param [<User-Model>] user the user instance.
       # @return - do not depend on the return value.
-      def auto_login(user)
-        session[:user_id] = user.id
+      def auto_login(user, should_remember = false)
+        session[:user_id] = user.id.to_s
         @current_user = user
       end
 
@@ -112,11 +126,9 @@ module Sorcery
       end
 
       def login_from_session
-        @current_user = (user_class.find(session[:user_id]) if session[:user_id]) || false
-      rescue => exception
-        return false if defined?(Mongoid) and exception.is_a?(Mongoid::Errors::DocumentNotFound)
-        return false if defined?(ActiveRecord) and exception.is_a?(ActiveRecord::RecordNotFound)
-        raise exception
+        @current_user = if session[:user_id]
+                          user_class.sorcery_adapter.find_by_id(session[:user_id])
+                        end
       end
 
       def after_login!(user, credentials = [])
@@ -141,66 +153,5 @@ module Sorcery
 
     end
 
-    module Config
-      class << self
-        attr_accessor :submodules,
-                      :user_class,                    # what class to use as the user class.
-                      :not_authenticated_action,      # what controller action to call for non-authenticated users.
-
-                      :save_return_to_url,            # when a non logged in user tries to enter a page that requires
-                                                      # login, save the URL he wanted to reach,
-                                                      # and send him there after login.
-
-                      :cookie_domain,                 # set domain option for cookies
-
-                      :login_sources,
-                      :after_login,
-                      :after_failed_login,
-                      :before_logout,
-                      :after_logout
-
-        def init!
-          @defaults = {
-            :@user_class                           => nil,
-            :@submodules                           => [],
-            :@not_authenticated_action             => :not_authenticated,
-            :@login_sources                        => [],
-            :@after_login                          => [],
-            :@after_failed_login                   => [],
-            :@before_logout                        => [],
-            :@after_logout                         => [],
-            :@save_return_to_url                   => true,
-            :@cookie_domain                        => nil
-          }
-        end
-
-        # Resets all configuration options to their default values.
-        def reset!
-          @defaults.each do |k,v|
-            instance_variable_set(k,v)
-          end
-        end
-
-        def update!
-          @defaults.each do |k,v|
-            instance_variable_set(k,v) if !instance_variable_defined?(k)
-          end
-        end
-
-        def user_config(&blk)
-          block_given? ? @user_config = blk : @user_config
-        end
-
-        def configure(&blk)
-          @configure_blk = blk
-        end
-
-        def configure!
-          @configure_blk.call(self) if @configure_blk
-        end
-      end
-      init!
-      reset!
-    end
-  end
+	end
 end

data/lib/sorcery/model/config.rb

@@ -0,0 +1,96 @@
+# Each class which calls 'activate_sorcery!' receives an instance of this class.
+# Every submodule which gets loaded may add accessors to this class so that all
+# options will be configured from a single place.
+module Sorcery
+  module Model
+    class Config
+
+      attr_accessor :username_attribute_names,           # change default username attribute, for example, to use :email
+                                                        # as the login.
+
+                    :password_attribute_name,           # change *virtual* password attribute, the one which is used
+                                                        # until an encrypted one is generated.
+
+                    :email_attribute_name,              # change default email attribute.
+
+                    :downcase_username_before_authenticating, # downcase the username before trying to authenticate, default is false
+
+                    :crypted_password_attribute_name,   # change default crypted_password attribute.
+                    :salt_join_token,                   # what pattern to use to join the password with the salt
+                    :salt_attribute_name,               # change default salt attribute.
+                    :stretches,                         # how many times to apply encryption to the password.
+                    :encryption_key,                    # encryption key used to encrypt reversible encryptions such as
+                                                        # AES256.
+
+                    :subclasses_inherit_config,         # make this configuration inheritable for subclasses. Useful for
+                                                        # ActiveRecord's STI.
+
+                    :submodules,                        # configured in config/application.rb
+                    :before_authenticate,               # an array of method names to call before authentication
+                                                        # completes. used internally.
+
+                    :after_config                       # an array of method names to call after configuration by user.
+                                                        # used internally.
+
+      attr_reader   :encryption_provider,               # change default encryption_provider.
+                    :custom_encryption_provider,        # use an external encryption class.
+                    :encryption_algorithm               # encryption algorithm name. See 'encryption_algorithm=' below
+                                                        # for available options.
+
+      def initialize
+        @defaults = {
+          :@submodules                           => [],
+          :@username_attribute_names              => [:email],
+          :@password_attribute_name              => :password,
+          :@downcase_username_before_authenticating => false,
+          :@email_attribute_name                 => :email,
+          :@crypted_password_attribute_name      => :crypted_password,
+          :@encryption_algorithm                 => :bcrypt,
+          :@encryption_provider                  => CryptoProviders::BCrypt,
+          :@custom_encryption_provider           => nil,
+          :@encryption_key                       => nil,
+          :@salt_join_token                      => "",
+          :@salt_attribute_name                  => :salt,
+          :@stretches                            => nil,
+          :@subclasses_inherit_config            => false,
+          :@before_authenticate                  => [],
+          :@after_config                         => []
+        }
+        reset!
+      end
+
+      # Resets all configuration options to their default values.
+      def reset!
+        @defaults.each do |k,v|
+          instance_variable_set(k,v)
+        end
+      end
+
+      def username_attribute_names=(fields)
+        @username_attribute_names = fields.kind_of?(Array) ? fields : [fields]
+      end
+
+      def custom_encryption_provider=(provider)
+        @custom_encryption_provider = @encryption_provider = provider
+      end
+
+      def encryption_algorithm=(algo)
+        @encryption_algorithm = algo
+        @encryption_provider = case @encryption_algorithm.to_sym
+        when :none   then nil
+        when :md5    then CryptoProviders::MD5
+        when :sha1   then CryptoProviders::SHA1
+        when :sha256 then CryptoProviders::SHA256
+        when :sha512 then CryptoProviders::SHA512
+        when :aes256 then CryptoProviders::AES256
+        when :bcrypt then CryptoProviders::BCrypt
+        when :custom then @custom_encryption_provider
+        else raise ArgumentError.new("Encryption algorithm supplied, #{algo}, is invalid")
+        end
+      end
+
+    end
+
+  end
+end
+

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -3,45 +3,65 @@ module Sorcery
     module Submodules
       # This submodule keeps track of events such as login, logout, and last activity time, per user.
       # It helps in estimating which users are active now in the site.
-      # This cannot be determined absolutely because a user might be reading a page without clicking anything 
+      # This cannot be determined absolutely because a user might be reading a page without clicking anything
       # for a while.
       # This is the model part of the submodule, which provides configuration options.
       module ActivityLogging
         def self.included(base)
           base.extend(ClassMethods)
+          base.send(:include, InstanceMethods)
 
           base.sorcery_config.class_eval do
             attr_accessor :last_login_at_attribute_name,                  # last login attribute name.
                           :last_logout_at_attribute_name,                 # last logout attribute name.
                           :last_activity_at_attribute_name,               # last activity attribute name.
-                          :activity_timeout                               # how long since last activity is 
+                          :last_login_from_ip_address_name,               # last activity login source
+                          :activity_timeout                               # how long since last activity is
                                                                           #the user defined logged out?
           end
-          
+
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@last_login_at_attribute_name                => :last_login_at,
                              :@last_logout_at_attribute_name               => :last_logout_at,
                              :@last_activity_at_attribute_name             => :last_activity_at,
+                             :@last_login_from_ip_address_name             => :last_login_from_ip_address,
                              :@activity_timeout                            => 10 * 60)
             reset!
           end
 
-          base.sorcery_config.after_config << :define_activity_logging_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          base.sorcery_config.after_config << :define_activity_logging_fields
+        end
+
+        module InstanceMethods
+          def set_last_login_at(time)
+            sorcery_adapter.update_attribute(sorcery_config.last_login_at_attribute_name, time)
+          end
+
+          def set_last_logout_at(time)
+            sorcery_adapter.update_attribute(sorcery_config.last_logout_at_attribute_name, time)
+          end
+
+          def set_last_activity_at(time)
+            sorcery_adapter.update_attribute(sorcery_config.last_activity_at_attribute_name, time)
+          end
+
+          def set_last_ip_addess(ip_address)
+            sorcery_adapter.update_attribute(sorcery_config.last_login_from_ip_address_name, ip_address)
+          end
         end
-        
+
         module ClassMethods
           # get all users with last_activity within timeout
           def current_users
-            config = sorcery_config
-            get_current_users
+            sorcery_adapter.get_current_users
           end
 
           protected
-
-          def define_activity_logging_mongoid_fields
-            field sorcery_config.last_login_at_attribute_name,    :type => Time
-            field sorcery_config.last_logout_at_attribute_name,   :type => Time
-            field sorcery_config.last_activity_at_attribute_name, :type => Time
+          def define_activity_logging_fields
+            sorcery_adapter.define_field sorcery_config.last_login_at_attribute_name,    Time
+            sorcery_adapter.define_field sorcery_config.last_logout_at_attribute_name,   Time
+            sorcery_adapter.define_field sorcery_config.last_activity_at_attribute_name, Time
+            sorcery_adapter.define_field sorcery_config.last_login_from_ip_address_name, String
           end
         end
       end