sorcery 0.8.1 → 0.9.1

data/lib/sorcery/model.rb

@@ -7,91 +7,70 @@ module Sorcery
   # which when called adds the other capabilities to the class.
   # This method is also the place to configure the plugin in the Model layer.
   module Model
-    def self.included(klass)
-      klass.class_eval do
-        class << self
-          def authenticates_with_sorcery!
-            @sorcery_config = Config.new
-            self.class_eval do
-              extend ClassMethods # included here, before submodules, so they can be overriden by them.
-              include InstanceMethods
-              include TemporaryToken
-            end
+    def authenticates_with_sorcery!
+      @sorcery_config = Config.new
 
-            include_required_submodules!
+      extend ClassMethods # included here, before submodules, so they can be overriden by them.
+      include InstanceMethods
+      include TemporaryToken
 
-            # This runs the options block set in the initializer on the model class.
-            ::Sorcery::Controller::Config.user_config.tap{|blk| blk.call(@sorcery_config) if blk}
+      include_required_submodules!
 
-            init_mongoid_support! if defined?(Mongoid) and self.ancestors.include?(Mongoid::Document)
-            init_mongo_mapper_support! if defined?(MongoMapper) and self.ancestors.include?(MongoMapper::Document)
+      # This runs the options block set in the initializer on the model class.
+      ::Sorcery::Controller::Config.user_config.tap{|blk| blk.call(@sorcery_config) if blk}
 
-            init_orm_hooks!
+      define_base_fields
+      init_orm_hooks!
 
-            @sorcery_config.after_config << :add_config_inheritance if @sorcery_config.subclasses_inherit_config
-            @sorcery_config.after_config.each { |c| send(c) }
-          end
+      @sorcery_config.after_config << :add_config_inheritance if @sorcery_config.subclasses_inherit_config
+      @sorcery_config.after_config.each { |c| send(c) }
+    end
 
-          protected
-
-          # includes required submodules into the model class,
-          # which usually is called User.
-          def include_required_submodules!
-            self.class_eval do
-              @sorcery_config.submodules = ::Sorcery::Controller::Config.submodules
-              @sorcery_config.submodules.each do |mod|
-                begin
-                  include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
-                rescue NameError
-                  # don't stop on a missing submodule. Needed because some submodules are only defined
-                  # in the controller side.
-                end
-              end
-            end
-          end
+    private
 
-          # defines mongoid fields on the model class,
-          # using 1.8.x hash syntax to perserve compatibility.
-          def init_mongoid_support!
-            self.class_eval do
-              sorcery_config.username_attribute_names.each do |username|
-                field username,         :type => String
-              end
-              field sorcery_config.email_attribute_name,            :type => String unless sorcery_config.username_attribute_names.include?(sorcery_config.email_attribute_name)
-              field sorcery_config.crypted_password_attribute_name, :type => String
-              field sorcery_config.salt_attribute_name,             :type => String
-            end
-          end
+    def define_base_fields
+      self.class_eval do
+        sorcery_config.username_attribute_names.each do |username|
+          sorcery_adapter.define_field username, String, length: 255
+        end
+        unless sorcery_config.username_attribute_names.include?(sorcery_config.email_attribute_name)
+          sorcery_adapter.define_field sorcery_config.email_attribute_name, String, length: 255
+        end
+        sorcery_adapter.define_field sorcery_config.crypted_password_attribute_name, String, length: 255
+        sorcery_adapter.define_field sorcery_config.salt_attribute_name, String, length: 255
+      end
 
-          # defines mongo_mapper fields on the model class,
-          def init_mongo_mapper_support!
-            self.class_eval do
-              sorcery_config.username_attribute_names.each do |username|
-                key username, String
-              end
-              key sorcery_config.email_attribute_name, String unless sorcery_config.username_attribute_names.include?(sorcery_config.email_attribute_name)
-              key sorcery_config.crypted_password_attribute_name, String
-              key sorcery_config.salt_attribute_name, String
-            end
-          end
+    end
 
-          # add virtual password accessor and ORM callbacks.
-          def init_orm_hooks!
-            self.class_eval do
-              attr_accessor @sorcery_config.password_attribute_name
-              attr_protected @sorcery_config.crypted_password_attribute_name, @sorcery_config.salt_attribute_name
-              before_save :encrypt_password, :if => Proc.new { |record|
-                record.send(sorcery_config.password_attribute_name).present?
-              }
-              after_save :clear_virtual_password, :if => Proc.new { |record|
-                record.send(sorcery_config.password_attribute_name).present?
-              }
-            end
+    # includes required submodules into the model class,
+    # which usually is called User.
+    def include_required_submodules!
+      self.class_eval do
+        @sorcery_config.submodules = ::Sorcery::Controller::Config.submodules
+        @sorcery_config.submodules.each do |mod|
+          begin
+            include Submodules.const_get(mod.to_s.split('_').map {|p| p.capitalize}.join)
+          rescue NameError
+            # don't stop on a missing submodule. Needed because some submodules are only defined
+            # in the controller side.
           end
         end
       end
     end
 
+    # add virtual password accessor and ORM callbacks.
+    def init_orm_hooks!
+      sorcery_adapter.define_callback :before, :validation, :encrypt_password, if: Proc.new {|record|
+        record.send(sorcery_config.password_attribute_name).present?
+      }
+
+      sorcery_adapter.define_callback :after, :save, :clear_virtual_password, if: Proc.new {|record|
+        record.send(sorcery_config.password_attribute_name).present?
+      }
+
+      attr_accessor sorcery_config.password_attribute_name
+    end
+
     module ClassMethods
       # Returns the class instance variable for configuration, when called by the class itself.
       def sorcery_config
@@ -104,13 +83,22 @@ module Sorcery
       # returns the user if success, nil otherwise.
       def authenticate(*credentials)
         raise ArgumentError, "at least 2 arguments required" if credentials.size < 2
-        credentials[0].downcase! if @sorcery_config.downcase_username_before_authenticating
-        user = find_by_credentials(credentials)
 
-        set_encryption_attributes()
+        return false if credentials[0].blank?
+
+        if @sorcery_config.downcase_username_before_authenticating
+          credentials[0].downcase!
+        end
+
+        user = sorcery_adapter.find_by_credentials(credentials)
+
+        if user.respond_to?(:active_for_authentication?)
+          return nil if !user.active_for_authentication?
+        end
 
-        _salt = user.send(@sorcery_config.salt_attribute_name) if user && !@sorcery_config.salt_attribute_name.nil? && !@sorcery_config.encryption_provider.nil?
-        user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && credentials_match?(user.send(@sorcery_config.crypted_password_attribute_name),credentials[1],_salt)
+        set_encryption_attributes
+
+        user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && user.valid_password?(credentials[1])
       end
 
       # encrypt tokens using current encryption_provider.
@@ -129,13 +117,7 @@ module Sorcery
         @sorcery_config.encryption_provider.stretches = @sorcery_config.stretches if @sorcery_config.encryption_provider.respond_to?(:stretches) && @sorcery_config.stretches
         @sorcery_config.encryption_provider.join_token = @sorcery_config.salt_join_token if @sorcery_config.encryption_provider.respond_to?(:join_token) && @sorcery_config.salt_join_token
       end
-
-      # Calls the configured encryption provider to compare the supplied password with the encrypted one.
-      def credentials_match?(crypted, *tokens)
-        return crypted == tokens.join if @sorcery_config.encryption_provider.nil?
-        @sorcery_config.encryption_provider.matches?(crypted, *tokens)
-      end
-
+      
       def add_config_inheritance
         self.class_eval do
           def self.inherited(subclass)
@@ -164,6 +146,16 @@ module Sorcery
         send(sorcery_config.crypted_password_attribute_name).nil?
       end
 
+      # Calls the configured encryption provider to compare the supplied password with the encrypted one.
+      def valid_password?(pass)
+        _crypted = self.send(sorcery_config.crypted_password_attribute_name)  
+        return _crypted == pass if sorcery_config.encryption_provider.nil?
+
+        _salt = self.send(sorcery_config.salt_attribute_name) unless sorcery_config.salt_attribute_name.nil?
+
+        sorcery_config.encryption_provider.matches?(_crypted, pass, _salt)
+      end
+
       protected
 
       # creates new salt and saves it.
@@ -177,6 +169,10 @@ module Sorcery
       def clear_virtual_password
         config = sorcery_config
         self.send(:"#{config.password_attribute_name}=", nil)
+
+        if respond_to?(:"#{config.password_attribute_name}_confirmation=")
+          self.send(:"#{config.password_attribute_name}_confirmation=", nil)
+        end
       end
 
       # calls the requested email method on the configured mailer
@@ -185,100 +181,14 @@ module Sorcery
         config = sorcery_config
         mail = config.send(mailer).send(config.send(method),self)
         if defined?(ActionMailer) and config.send(mailer).kind_of?(Class) and config.send(mailer) < ActionMailer::Base
-          mail.deliver
-        end
-      end
-    end
-
-    # Each class which calls 'activate_sorcery!' receives an instance of this class.
-    # Every submodule which gets loaded may add accessors to this class so that all
-    # options will be configured from a single place.
-    class Config
-
-      attr_accessor :username_attribute_names,           # change default username attribute, for example, to use :email
-                                                        # as the login.
-
-                    :password_attribute_name,           # change *virtual* password attribute, the one which is used
-                                                        # until an encrypted one is generated.
-
-                    :email_attribute_name,              # change default email attribute.
-
-                    :downcase_username_before_authenticating, # downcase the username before trying to authenticate, default is false
-
-                    :crypted_password_attribute_name,   # change default crypted_password attribute.
-                    :salt_join_token,                   # what pattern to use to join the password with the salt
-                    :salt_attribute_name,               # change default salt attribute.
-                    :stretches,                         # how many times to apply encryption to the password.
-                    :encryption_key,                    # encryption key used to encrypt reversible encryptions such as
-                                                        # AES256.
-
-                    :subclasses_inherit_config,         # make this configuration inheritable for subclasses. Useful for
-                                                        # ActiveRecord's STI.
-
-                    :submodules,                        # configured in config/application.rb
-                    :before_authenticate,               # an array of method names to call before authentication
-                                                        # completes. used internally.
-
-                    :after_config                       # an array of method names to call after configuration by user.
-                                                        # used internally.
-
-      attr_reader   :encryption_provider,               # change default encryption_provider.
-                    :custom_encryption_provider,        # use an external encryption class.
-                    :encryption_algorithm               # encryption algorithm name. See 'encryption_algorithm=' below
-                                                        # for available options.
-
-      def initialize
-        @defaults = {
-          :@submodules                           => [],
-          :@username_attribute_names              => [:username],
-          :@password_attribute_name              => :password,
-          :@downcase_username_before_authenticating => false,
-          :@email_attribute_name                 => :email,
-          :@crypted_password_attribute_name      => :crypted_password,
-          :@encryption_algorithm                 => :bcrypt,
-          :@encryption_provider                  => CryptoProviders::BCrypt,
-          :@custom_encryption_provider           => nil,
-          :@encryption_key                       => nil,
-          :@salt_join_token                      => "",
-          :@salt_attribute_name                  => :salt,
-          :@stretches                            => nil,
-          :@subclasses_inherit_config            => false,
-          :@before_authenticate                  => [],
-          :@after_config                         => []
-        }
-        reset!
-      end
-
-      # Resets all configuration options to their default values.
-      def reset!
-        @defaults.each do |k,v|
-          instance_variable_set(k,v)
-        end
-      end
-
-      def username_attribute_names=(fields)
-        @username_attribute_names = fields.kind_of?(Array) ? fields : [fields]
-      end
-
-      def custom_encryption_provider=(provider)
-        @custom_encryption_provider = @encryption_provider = provider
-      end
-
-      def encryption_algorithm=(algo)
-        @encryption_algorithm = algo
-        @encryption_provider = case @encryption_algorithm.to_sym
-        when :none   then nil
-        when :md5    then CryptoProviders::MD5
-        when :sha1   then CryptoProviders::SHA1
-        when :sha256 then CryptoProviders::SHA256
-        when :sha512 then CryptoProviders::SHA512
-        when :aes256 then CryptoProviders::AES256
-        when :bcrypt then CryptoProviders::BCrypt
-        when :custom then @custom_encryption_provider
-        else raise ArgumentError.new("Encryption algorithm supplied, #{algo}, is invalid")
+          # Rails 4.2 deprecates #deliver
+          if mail.respond_to?(:deliver_now)
+            mail.deliver_now
+          else
+            mail.deliver
+          end
         end
       end
-
     end
 
   end

data/lib/sorcery/protocols/oauth.rb

@@ -0,0 +1,42 @@
+require 'oauth'
+
+module Sorcery
+  module Protocols
+    module Oauth
+
+      def oauth_version
+        '1.0'
+      end
+
+      def get_request_token(token=nil,secret=nil)
+        return ::OAuth::RequestToken.new(get_consumer, token, secret) if token && secret
+        get_consumer.get_request_token(oauth_callback: @callback_url)
+      end
+
+      def authorize_url(args)
+        get_request_token(
+          args[:request_token],
+          args[:request_token_secret]
+        ).authorize_url({
+          oauth_callback: @callback_url
+        })
+      end
+
+      def get_access_token(args)
+        get_request_token(
+          args[:request_token],
+          args[:request_token_secret]
+        ).get_access_token({
+          oauth_verifier: args[:oauth_verifier]
+        })
+      end
+
+      protected
+
+      def get_consumer
+        ::OAuth::Consumer.new(@key, @secret, site: @site)
+      end
+
+    end
+  end
+end

data/lib/sorcery/protocols/oauth2.rb

@@ -0,0 +1,47 @@
+require 'oauth2'
+
+module Sorcery
+  module Protocols
+    module Oauth2
+
+      def oauth_version
+        '2.0'
+      end
+
+      def authorize_url(options = {})
+        client = build_client(options)
+        client.auth_code.authorize_url(
+          redirect_uri: @callback_url,
+          scope: @scope,
+          display: @display,
+          state: @state
+        )
+      end
+
+      def get_access_token(args, options = {})
+        client = build_client(options)
+        client.auth_code.get_token(
+          args[:code],
+          {
+            redirect_uri: @callback_url,
+            parse: options.delete(:parse)
+          },
+          options
+        )
+      end
+
+      def build_client(options = {})
+        defaults = {
+          site: @site,
+          ssl: { ca_file: Sorcery::Controller::Config.ca_file }
+        }
+        ::OAuth2::Client.new(
+          @key,
+          @secret,
+          defaults.merge!(options)
+        )
+      end
+
+    end
+  end
+end

data/lib/sorcery/providers/base.rb

@@ -0,0 +1,38 @@
+module Sorcery
+  module Providers
+    class Base
+
+      attr_reader   :access_token
+
+      attr_accessor :callback_url, :key, :original_callback_url, :secret,
+                    :site, :state, :user_info_mapping
+
+      def has_callback?; true; end
+
+      def initialize
+        @user_info_mapping = {}
+      end
+
+      def auth_hash(access_token, hash={})
+        return hash if access_token.nil?
+
+        token_hash = hash.dup
+        token_hash[:token] = access_token.token if access_token.respond_to?(:token)
+        token_hash[:refresh_token] = access_token.refresh_token if access_token.respond_to?(:refresh_token)
+        token_hash[:expires_at] = access_token.expires_at if access_token.respond_to?(:expires_at)
+        token_hash[:expires_in] = access_token.expires_at if access_token.respond_to?(:expires_in)
+        token_hash
+      end
+
+      def self.name
+        super.gsub(/Sorcery::Providers::/, '').downcase
+      end
+
+      # Ensure that all descendant classes are loaded before run this
+      def self.descendants
+        ObjectSpace.each_object(Class).select { |klass| klass < self }
+      end
+
+    end
+  end
+end

data/lib/sorcery/providers/facebook.rb

@@ -0,0 +1,74 @@
+module Sorcery
+  module Providers
+    # This class adds support for OAuth with facebook.com.
+    #
+    #   config.facebook.key = <key>
+    #   config.facebook.secret = <secret>
+    #   ...
+    #
+    class Facebook < Base
+
+      include Protocols::Oauth2
+
+      attr_reader   :mode, :param_name, :parse
+      attr_accessor :access_permissions, :display, :scope, :token_url,
+                    :user_info_path, :auth_path, :api_version
+
+      def initialize
+        super
+
+        @site           = 'https://graph.facebook.com'
+        @auth_site      = 'https://www.facebook.com'
+        @user_info_path = 'me'
+        @scope          = 'email'
+        @display        = 'page'
+        @token_url      = 'oauth/access_token'
+        @auth_path      = 'dialog/oauth'
+        @mode           = :query
+        @parse          = :query
+        @param_name     = 'access_token'
+      end
+
+      def get_user_hash(access_token)
+        response = access_token.get(user_info_path)
+
+        auth_hash(access_token).tap do |h|
+          h[:user_info] = JSON.parse(response.body)
+          h[:uid] = h[:user_info]['id']
+        end
+      end
+
+      # calculates and returns the url to which the user should be redirected,
+      # to get authenticated at the external provider's site.
+      def login_url(params, session)
+        authorize_url
+      end
+
+      # overrides oauth2#authorize_url to allow customized scope.
+      def authorize_url
+
+        # Fix: replace default oauth2 options, specially to prevent the Faraday gem which
+        # concatenates with "/", removing the Facebook api version
+        options = {
+          site:          File::join(@site, api_version.to_s),
+          authorize_url: File::join(@auth_site, api_version.to_s, auth_path),
+          token_url:     token_url
+        }
+
+        @scope = access_permissions.present? ? access_permissions.join(',') : scope
+        super(options)
+      end
+
+      # tries to login the user from access token
+      def process_callback(params, session)
+        args = {}.tap do |a|
+          a[:code] = params[:code] if params[:code]
+        end
+
+        get_access_token(args, token_url: token_url, mode: mode,
+          param_name: param_name, parse: parse)
+      end
+
+    end
+  end
+end

data/lib/sorcery/providers/github.rb

@@ -0,0 +1,60 @@
+module Sorcery
+  module Providers
+    # This class adds support for OAuth with github.com.
+    #
+    #   config.github.key = <key>
+    #   config.github.secret = <secret>
+    #   ...
+    #
+    class Github < Base
+
+      include Protocols::Oauth2
+
+      attr_accessor :auth_path, :scope, :token_url, :user_info_path
+
+      def initialize
+        super
+
+        @scope          = nil
+        @site           = 'https://github.com/'
+        @user_info_path = 'https://api.github.com/user'
+        @auth_path      = '/login/oauth/authorize'
+        @token_url      = '/login/oauth/access_token'
+      end
+
+      def get_user_hash(access_token)
+        response = access_token.get(user_info_path)
+
+        auth_hash(access_token).tap do |h|
+          h[:user_info] = JSON.parse(response.body).tap do |uih|
+            uih['email'] = primary_email(access_token) if scope =~ /user/
+          end
+          h[:uid] = h[:user_info]['id']
+        end
+      end
+
+      # calculates and returns the url to which the user should be redirected,
+      # to get authenticated at the external provider's site.
+      def login_url(params, session)
+        authorize_url({ authorize_url: auth_path })
+      end
+
+      # tries to login the user from access token
+      def process_callback(params, session)
+        args = {}.tap do |a|
+          a[:code] = params[:code] if params[:code]
+        end
+
+        get_access_token(args, token_url: token_url, token_method: :post)
+      end
+
+      def primary_email(access_token)
+        response = access_token.get(user_info_path + "/emails")
+        emails = JSON.parse(response.body)
+        primary = emails.find{|i| i['primary'] }
+        primary && primary['email'] || emails.first && emails.first['email']
+      end
+
+    end
+  end
+end

data/lib/sorcery/providers/google.rb

@@ -0,0 +1,51 @@
+module Sorcery
+  module Providers
+    # This class adds support for OAuth with google.com.
+    #
+    #   config.google.key = <key>
+    #   config.google.secret = <secret>
+    #   ...
+    #
+    class Google < Base
+
+      include Protocols::Oauth2
+
+      attr_accessor :auth_url, :scope, :token_url, :user_info_url
+
+      def initialize
+        super
+
+        @site          = 'https://accounts.google.com'
+        @auth_url      = '/o/oauth2/auth'
+        @token_url     = '/o/oauth2/token'
+        @user_info_url = 'https://www.googleapis.com/oauth2/v1/userinfo'
+        @scope         = 'https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/userinfo.profile'
+      end
+
+      def get_user_hash(access_token)
+        response = access_token.get(user_info_url)
+
+        auth_hash(access_token).tap do |h|
+          h[:user_info] = JSON.parse(response.body)
+          h[:uid] = h[:user_info]['id']
+        end
+      end
+
+      # calculates and returns the url to which the user should be redirected,
+      # to get authenticated at the external provider's site.
+      def login_url(params, session)
+        authorize_url({ authorize_url: auth_url })
+      end
+
+      # tries to login the user from access token
+      def process_callback(params, session)
+        args = {}.tap do |a|
+          a[:code] = params[:code] if params[:code]
+        end
+
+        get_access_token(args, token_url: token_url, token_method: :post)
+      end
+
+    end
+  end
+end