sorcery 0.8.4 → 0.8.6

data/lib/generators/sorcery/templates/migration/reset_password.rb

@@ -1,17 +1,9 @@
 class SorceryResetPassword < ActiveRecord::Migration
-  def self.up
+  def change
     add_column :<%= model_class_name.tableize %>, :reset_password_token, :string, :default => nil
     add_column :<%= model_class_name.tableize %>, :reset_password_token_expires_at, :datetime, :default => nil
     add_column :<%= model_class_name.tableize %>, :reset_password_email_sent_at, :datetime, :default => nil
-    
-    add_index :<%= model_class_name.tableize %>, :reset_password_token
-  end
 
-  def self.down
-    remove_index :<%= model_class_name.tableize %>, :reset_password_token
-    
-    remove_column :<%= model_class_name.tableize %>, :reset_password_email_sent_at
-    remove_column :<%= model_class_name.tableize %>, :reset_password_token_expires_at
-    remove_column :<%= model_class_name.tableize %>, :reset_password_token
+    add_index :<%= model_class_name.tableize %>, :reset_password_token
   end
 end

data/lib/generators/sorcery/templates/migration/user_activation.rb

@@ -1,17 +1,9 @@
 class SorceryUserActivation < ActiveRecord::Migration
-  def self.up
+  def change
     add_column :<%= model_class_name.tableize %>, :activation_state, :string, :default => nil
     add_column :<%= model_class_name.tableize %>, :activation_token, :string, :default => nil
     add_column :<%= model_class_name.tableize %>, :activation_token_expires_at, :datetime, :default => nil
-    
-    add_index :<%= model_class_name.tableize %>, :activation_token
-  end
 
-  def self.down
-    remove_index :<%= model_class_name.tableize %>, :activation_token
-    
-    remove_column :<%= model_class_name.tableize %>, :activation_token_expires_at
-    remove_column :<%= model_class_name.tableize %>, :activation_token
-    remove_column :<%= model_class_name.tableize %>, :activation_state
+    add_index :<%= model_class_name.tableize %>, :activation_token
   end
 end

data/lib/sorcery/controller/submodules/external.rb

@@ -6,21 +6,38 @@ module Sorcery
       module External
         def self.included(base)
           base.send(:include, InstanceMethods)
+
+          require 'sorcery/providers/base'
+          require 'sorcery/providers/facebook'
+          require 'sorcery/providers/twitter'
+          require 'sorcery/providers/vk'
+          require 'sorcery/providers/linkedin'
+          require 'sorcery/providers/liveid'
+          require 'sorcery/providers/xing'
+          require 'sorcery/providers/github'
+          require 'sorcery/providers/google'
+
           Config.module_eval do
             class << self
-              attr_reader :external_providers                           # external providers like twitter.
-              attr_accessor :ca_file                                    # path to ca_file. By default use a internal ca-bundle.crt.
-
-              def merge_external_defaults!
-                @defaults.merge!(:@external_providers => [],
-                                 :@ca_file => File.join(File.expand_path(File.dirname(__FILE__)), 'external/protocols/certs/ca-bundle.crt'))
-              end
+              attr_reader :external_providers
+              attr_accessor :ca_file
 
               def external_providers=(providers)
-                providers.each do |provider|
-                  include Providers.const_get(provider.to_s.split("_").map {|p| p.capitalize}.join(""))
+                @external_providers = providers
+
+                providers.each do |name|
+                  class_eval <<-E
+                    def self.#{name}
+                      @#{name} ||= Sorcery::Providers.const_get('#{name}'.to_s.capitalize).new
+                    end
+                  E
                 end
               end
+
+              def merge_external_defaults!
+                @defaults.merge!(:@external_providers => [],
+                                 :@ca_file => File.join(File.expand_path(File.dirname(__FILE__)), '../../protocols/certs/ca-bundle.crt'))
+              end
             end
             merge_external_defaults!
           end
@@ -31,18 +48,17 @@ module Sorcery
 
           # save the singleton ProviderClient instance into @provider
           def sorcery_get_provider(provider_name)
-            allowed = %w(facebook github google linkedin liveid twitter vk xing)
-            return unless allowed.include?(provider_name.to_s)
-
+            return unless Config.external_providers.include?(provider_name.to_sym)
             Config.send(provider_name.to_sym)
           end
 
           # get the login URL from the provider, if applicable.  Returns nil if the provider
           # does not provide a login URL.  (as of v0.8.1 all providers provide a login URL)
-          def sorcery_login_url(provider_name)
+          def sorcery_login_url(provider_name, args = {})
             @provider = sorcery_get_provider provider_name
             sorcery_fixup_callback_url @provider
             if @provider.respond_to?(:login_url) && @provider.has_callback?
+              @provider.state = args[:state] if args[:state]
               return @provider.login_url(params, session)
             else
               return nil
@@ -89,22 +105,22 @@ module Sorcery
           # sends user to authenticate at the provider's website.
           # after authentication the user is redirected to the callback defined in the provider config
           def login_at(provider_name, args = {})
-            redirect_to sorcery_login_url(provider_name)
+            redirect_to sorcery_login_url(provider_name, args)
           end
 
           # tries to login the user from provider's callback
-          def login_from(provider_name)
+          def login_from(provider_name, should_remember = false)
             sorcery_fetch_user_hash provider_name
-            
+
             if user = user_class.load_from_provider(provider_name, @user_hash[:uid].to_s)
               # we found the user.
               # clear the session
               return_to_url = session[:return_to_url]
-              reset_session
+              reset_sorcery_session
               session[:return_to_url] = return_to_url
 
               # sign in the user
-              auto_login(user)
+              auto_login(user, should_remember)
               after_login!(user)
 
               # return the user
@@ -118,9 +134,9 @@ module Sorcery
             config = user_class.sorcery_config
 
             # first check to see if user has a particular authentication already
-            unless (current_user.send(config.authentications_class.to_s.downcase.pluralize).send("find_by_#{config.provider_attribute_name}_and_#{config.provider_uid_attribute_name}", provider_name, @user_hash[:uid].to_s))
-              user = current_user.send(config.authentications_class.to_s.downcase.pluralize).build(config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider_name.to_s)
-              user.save(:validate => false)
+            unless (current_user.send(config.authentications_class.name.underscore.pluralize).send("find_by_#{config.provider_attribute_name}_and_#{config.provider_uid_attribute_name}", provider_name, @user_hash[:uid].to_s))
+              user = current_user.send(config.authentications_class.name.underscore.pluralize).build(config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider_name.to_s)
+              user.sorcery_save(:validate => false)
             else
               user = false
             end
@@ -143,7 +159,7 @@ module Sorcery
             session[:incomplete_user] = {
               :provider => {config.provider_uid_attribute_name => @user_hash[:uid], config.provider_attribute_name => provider_name},
               :user_hash => attrs
-            } unless user.save
+            } unless user.sorcery_save
 
             return user
           end
@@ -180,7 +196,7 @@ module Sorcery
                 return false unless yield @user
               end
 
-              @user.save(:validate => false)
+              @user.sorcery_save(:validate => false)
               user_class.sorcery_config.authentications_class.create!({config.authentications_user_id_attribute_name => @user.id, config.provider_attribute_name => provider_name, config.provider_uid_attribute_name => @user_hash[:uid]})
             end
             @user

data/lib/sorcery/controller/submodules/remember_me.rb

@@ -31,7 +31,7 @@ module Sorcery
 
           # Clears the cookie and clears the token from the db.
           def forget_me!
-            @current_user.forget_me!
+            current_user.forget_me!
             cookies.delete(:remember_me_token, :domain => Config.cookie_domain)
           end
 

data/lib/sorcery/controller/submodules/session_timeout.rb

@@ -37,8 +37,8 @@ module Sorcery
           # To be used as a before_filter, before require_login
           def validate_session
             session_to_use = Config.session_timeout_from_last_action ? session[:last_action_time] : session[:login_time]
-            if session_to_use && (Time.now.in_time_zone - session_to_use > Config.session_timeout)
-              reset_session
+            if session_to_use && (Time.now.in_time_zone - session_to_use.to_time > Config.session_timeout)
+              reset_sorcery_session
               @current_user = nil
             else
               session[:last_action_time] = Time.now.in_time_zone

data/lib/sorcery/controller.rb

@@ -5,7 +5,7 @@ module Sorcery
         include InstanceMethods
         Config.submodules.each do |mod|
           begin
-            include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
+            include Submodules.const_get(mod.to_s.split('_').map { |p| p.capitalize }.join)
           rescue NameError
             # don't stop on a missing submodule.
           end
@@ -33,7 +33,7 @@ module Sorcery
         user = user_class.authenticate(*credentials)
         if user
           old_session = session.dup.to_hash
-          reset_session # protect from session fixation attacks
+          reset_sorcery_session
           old_session.each_pair do |k,v|
             session[k.to_sym] = v
           end
@@ -48,12 +48,20 @@ module Sorcery
         end
       end
 
+      # put this into the catch block to rescue undefined method `destroy_session'
+      # hotfix for https://github.com/NoamB/sorcery/issues/464
+      # can be removed when Rails 4.1 is out
+      def reset_sorcery_session
+        reset_session # protect from session fixation attacks
+      rescue NoMethodError
+      end
+
       # Resets the session and runs hooks before and after.
       def logout
         if logged_in?
           @current_user = current_user if @current_user.nil?
           before_logout!(@current_user)
-          reset_session
+          reset_sorcery_session
           after_logout!
           @current_user = nil
         end
@@ -64,9 +72,12 @@ module Sorcery
       end
 
       # attempts to auto-login from the sources defined (session, basic_auth, cookie, etc.)
-      # returns the logged in user if found, false if not (using old restful-authentication trick, nil != false).
+      # returns the logged in user if found, nil if not
       def current_user
-        @current_user ||= login_from_session || login_from_other_sources unless @current_user == false
+        unless defined?(@current_user)
+          @current_user = login_from_session || login_from_other_sources || nil
+        end
+        @current_user
       end
 
       def current_user=(user)
@@ -91,7 +102,7 @@ module Sorcery
       #
       # @param [<User-Model>] user the user instance.
       # @return - do not depend on the return value.
-      def auto_login(user)
+      def auto_login(user, should_remember = false)
         session[:user_id] = user.id
         @current_user = user
       end
@@ -115,11 +126,7 @@ module Sorcery
       end
 
       def login_from_session
-        @current_user = (user_class.find(session[:user_id]) if session[:user_id]) || false
-      rescue => exception
-        return false if defined?(Mongoid) and exception.is_a?(Mongoid::Errors::DocumentNotFound)
-        return false if defined?(ActiveRecord) and exception.is_a?(ActiveRecord::RecordNotFound)
-        raise exception
+        @current_user = (user_class.find_by_id(session[:user_id]) if session[:user_id]) || nil
       end
 
       def after_login!(user, credentials = [])

data/lib/sorcery/model/adapters/active_record.rb

@@ -19,12 +19,17 @@ module Sorcery
           def update_single_attribute(name, value)
             update_many_attributes(name => value)
           end
+
+          def sorcery_save(options = {})
+            mthd = options.delete(:raise_on_failure) ? :save! : :save
+            self.send(mthd, options)
+          end
         end
         
         module ClassMethods
           def column_name(attribute)
             return "LOWER(#{attribute})" if (@sorcery_config.downcase_username_before_authenticating)
-            return "#{attribute}"
+            attribute.to_s
           end
 
           def find_by_credentials(credentials)
@@ -37,7 +42,7 @@ module Sorcery
           end
 
           def get_current_users
-            config = sorcery_config
+            config = @sorcery_config
             where("#{config.last_activity_at_attribute_name} IS NOT NULL") \
             .where("#{config.last_logout_at_attribute_name} IS NULL OR #{config.last_activity_at_attribute_name} > #{config.last_logout_at_attribute_name}") \
             .where("#{config.last_activity_at_attribute_name} > ? ", config.activity_timeout.seconds.ago.utc.to_s(:db))

data/lib/sorcery/model/adapters/datamapper.rb

@@ -0,0 +1,123 @@
+module Sorcery
+  module Model
+    module Adapters
+      module DataMapper
+        def self.included(klass)
+          klass.extend ClassMethods
+          klass.send(:include, InstanceMethods)
+        end
+
+        module InstanceMethods
+          def increment(attr)
+            self[attr] ||= 0
+            self[attr] += 1
+            self
+          end
+
+          def update_many_attributes(attrs)
+            attrs.each do |name, value|
+              value = value.utc if value.is_a?(ActiveSupport::TimeWithZone)
+              self.send(:"#{name}=", value)
+            end
+            self.class.get(self.id).update(attrs)
+          end
+
+          def update_single_attribute(name, value)
+            update_many_attributes(name => value)
+          end
+
+          def sorcery_save(options = {})
+            if options.key?(:validate) && ! options[:validate]
+              save!
+            else
+              save
+            end
+          end
+        end
+
+        module ClassMethods
+          def find(id)
+            get(id)
+          end
+
+          def delete_all
+            destroy
+          end
+
+          # NOTE
+          # DM Adapter dependent
+          # DM creates MySQL tables case insensitive by default
+          # http://datamapper.lighthouseapp.com/projects/20609-datamapper/tickets/1105
+          def find_by_credentials(credentials)
+            credential = credentials[0].dup
+            credential.downcase! if @sorcery_config.downcase_username_before_authenticating
+            @sorcery_config.username_attribute_names.each do |name|
+              @user = first(name => credential)
+              break if @user
+            end
+            !!@user ? get(@user.id) : nil
+          end
+
+          def find_by_provider_and_uid(provider, uid)
+            @user_klass ||= ::Sorcery::Controller::Config.user_class.to_s.constantize
+            user = first(@user_klass.sorcery_config.provider_attribute_name => provider, @user_klass.sorcery_config.provider_uid_attribute_name => uid)
+            !!user ? get(user.id) : nil
+          end
+
+          def find_by_id(id)
+            find(id)
+          rescue ::DataMapper::ObjectNotFoundError
+            nil
+          end
+
+          def find_by_activation_token(token)
+            user = first(sorcery_config.activation_token_attribute_name => token)
+            !!user ? get(user.id) : nil
+          end
+
+          def find_by_remember_me_token(token)
+            user = first(sorcery_config.remember_me_token_attribute_name => token)
+            !!user ? get(user.id) : nil
+          end
+
+          def find_by_username(username)
+            user = nil
+            sorcery_config.username_attribute_names.each do |name|
+              user = first(name => username)
+              break if user
+            end
+            !!user ? get(user.id) : nil
+          end
+
+          def transaction(&blk)
+            tap(&blk)
+          end
+
+          def find_by_sorcery_token(token_attr_name, token)
+            user = first(token_attr_name => token)
+            !!user ? get(user.id) : nil
+          end
+
+          def find_by_email(email)
+            user = first(sorcery_config.email_attribute_name => email)
+            !!user ? get(user.id) : nil
+          end
+
+          # NOTE
+          # DM Adapter dependent
+          def get_current_users
+            unless self.repository.adapter.is_a?(::DataMapper::Adapters::MysqlAdapter)
+              raise 'Unsupported DataMapper Adapter'
+            end
+            config = sorcery_config
+            ret = all(config.last_logout_at_attribute_name => nil) |
+                  all(config.last_activity_at_attribute_name.gt => config.last_logout_at_attribute_name)
+            ret = ret.all(config.last_activity_at_attribute_name.not => nil)
+            ret = ret.all(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc)
+            ret
+          end
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/model/adapters/mongo_mapper.rb

@@ -5,15 +5,19 @@ module Sorcery
         extend ActiveSupport::Concern
 
         included do
-          include Sorcery::Model
+          extend Sorcery::Model
         end
 
         def increment(attr)
           self.class.increment(id, attr => 1)
         end
 
-        def save!(options = {})
-          save(options)
+        def sorcery_save(options = {})
+          if options.delete(:raise_on_failure) && options[:validate] != false
+            save! options
+          else
+            save options
+          end
         end
 
         def update_many_attributes(attrs)
@@ -22,7 +26,7 @@ module Sorcery
 
         module ClassMethods
           def credential_regex(credential)
-            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
+            return { :$regex =>  /^#{Regexp.escape(credential)}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
             return credential
           end
 

data/lib/sorcery/model/adapters/mongoid.rb

@@ -2,14 +2,9 @@ module Sorcery
   module Model
     module Adapters
       module Mongoid
-        def self.included(klass)
-          klass.extend ClassMethods
-          klass.send(:include, InstanceMethods)
-        end
-
         module InstanceMethods
           def increment(attr)
-            self.inc(attr,1)
+            self.inc(attr, 1)
           end
 
           def update_many_attributes(attrs)
@@ -23,12 +18,17 @@ module Sorcery
           def update_single_attribute(name, value)
             update_many_attributes(name => value)
           end
+
+          def sorcery_save(options = {})
+            mthd = options.delete(:raise_on_failure) ? :save! : :save
+            self.send(mthd, options)
+          end
         end
 
         module ClassMethods
           def credential_regex(credential)
-            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
-            return credential
+            return { :$regex =>  /^#{Regexp.escape(credential)}$/i  } if (@sorcery_config.downcase_username_before_authenticating)
+            credential
           end
 
           def find_by_credentials(credentials)

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -29,6 +29,13 @@ module Sorcery
           end
 
           base.sorcery_config.after_config << :define_activity_logging_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          if defined?(DataMapper) and base.ancestors.include?(DataMapper::Resource)
+            # NOTE raise exception if data-store is not supported
+            unless base.repository.adapter.is_a?(DataMapper::Adapters::MysqlAdapter)
+              raise 'Unsupported DataMapper Adapter'
+            end
+            base.sorcery_config.after_config << :define_activity_logging_datamapper_fields
+          end
         end
         
         module ClassMethods
@@ -46,6 +53,23 @@ module Sorcery
             field sorcery_config.last_activity_at_attribute_name, :type => Time
             field sorcery_config.last_login_from_ip_address_name, :type => String
           end
+
+          def define_activity_logging_datamapper_fields
+            property sorcery_config.last_login_at_attribute_name,    Time
+            property sorcery_config.last_logout_at_attribute_name,   Time
+            property sorcery_config.last_activity_at_attribute_name, Time
+            property sorcery_config.last_login_from_ip_address_name, String
+            # Workaround local timezone retrieval problem NOTE dm-core issue #193
+            [sorcery_config.last_login_at_attribute_name,
+             sorcery_config.last_logout_at_attribute_name,
+             sorcery_config.last_activity_at_attribute_name].each do |sym|
+               alias_method "orig_#{sym}", sym
+               define_method(sym) do
+                 t = send("orig_#{sym}")
+                 t && Time.new(t.year, t.month, t.day, t.hour, t.min, t.sec, 0)
+               end
+             end
+          end
         end
       end
     end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -39,6 +39,9 @@ module Sorcery
           if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
             base.sorcery_config.after_config << :define_brute_force_protection_mongo_mapper_fields
           end
+          if defined?(DataMapper) and base.ancestors.include?(DataMapper::Resource)
+            base.sorcery_config.after_config << :define_brute_force_protection_datamapper_fields
+          end
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
         end
@@ -63,6 +66,19 @@ module Sorcery
             key sorcery_config.lock_expires_at_attribute_name, Time
             key sorcery_config.unlock_token_attribute_name, String
           end
+
+          def define_brute_force_protection_datamapper_fields
+            property sorcery_config.failed_logins_count_attribute_name, Integer, :default => 0
+            property sorcery_config.lock_expires_at_attribute_name,     Time
+            property sorcery_config.unlock_token_attribute_name,        String
+            [sorcery_config.lock_expires_at_attribute_name].each do |sym|
+              alias_method "orig_#{sym}", sym
+              define_method(sym) do
+                t = send("orig_#{sym}")
+                t && Time.new(t.year, t.month, t.day, t.hour, t.min, t.sec, 0)
+              end
+            end
+          end
         end
 
         module InstanceMethods
@@ -82,8 +98,8 @@ module Sorcery
           def unlock!
             config = sorcery_config
             attributes = {config.lock_expires_at_attribute_name => nil,
-                          config.failed_logins_count_attribute_name => 0}
-            attributes[config.unlock_token_attribute_name] = nil unless config.unlock_token_mailer_disabled or config.unlock_token_mailer.nil?
+                          config.failed_logins_count_attribute_name => 0,
+                          config.unlock_token_attribute_name => nil}
             self.update_many_attributes(attributes)
           end
 
@@ -91,14 +107,12 @@ module Sorcery
 
           def lock!
             config = sorcery_config
-            attributes = {config.lock_expires_at_attribute_name => Time.now.in_time_zone + config.login_lock_time_period}
+            attributes = {config.lock_expires_at_attribute_name => Time.now.in_time_zone + config.login_lock_time_period,
+                          config.unlock_token_attribute_name => TemporaryToken.generate_random_token}
+            self.update_many_attributes(attributes)
 
             unless config.unlock_token_mailer_disabled || config.unlock_token_mailer.nil?
-              attributes[config.unlock_token_attribute_name] = TemporaryToken.generate_random_token
-              self.update_many_attributes(attributes)
               send_unlock_token_email!
-            else
-              self.update_many_attributes(attributes)
             end
           end
 
@@ -108,7 +122,7 @@ module Sorcery
           end
 
           def send_unlock_token_email!
-            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer) unless sorcery_config.unlock_token_email_method_name.nil? or sorcery_config.unlock_token_mailer_disabled == true
+            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer) unless sorcery_config.unlock_token_email_method_name.nil?
           end
 
           # Prevents a locked user from logging in, and unlocks users that expired their lock time.

data/lib/sorcery/model/submodules/remember_me.rb

@@ -12,7 +12,7 @@ module Sorcery
                           :remember_me_for                                # how long in seconds to remember.
 
           end
-          
+
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@remember_me_token_attribute_name            => :remember_me_token,
                              :@remember_me_token_expires_at_attribute_name => :remember_me_token_expires_at,
@@ -20,14 +20,17 @@ module Sorcery
 
             reset!
           end
-          
+
           base.send(:include, InstanceMethods)
 
           base.sorcery_config.after_config << :define_remember_me_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
           if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
             base.sorcery_config.after_config << :define_remember_me_mongo_mapper_fields
           end
-          
+          if defined?(DataMapper) and base.ancestors.include?(DataMapper::Resource)
+            base.sorcery_config.after_config << :define_remember_me_datamapper_fields
+          end
+
           base.extend(ClassMethods)
         end
 
@@ -43,6 +46,18 @@ module Sorcery
             key sorcery_config.remember_me_token_attribute_name, String
             key sorcery_config.remember_me_token_expires_at_attribute_name, Time
           end
+
+          def define_remember_me_datamapper_fields
+            property sorcery_config.remember_me_token_attribute_name,            String
+            property sorcery_config.remember_me_token_expires_at_attribute_name, Time
+            [sorcery_config.remember_me_token_expires_at_attribute_name].each do |sym|
+              alias_method "orig_#{sym}", sym
+              define_method(sym) do
+                t = send("orig_#{sym}")
+                t && Time.new(t.year, t.month, t.day, t.hour, t.min, t.sec, 0)
+              end
+            end
+          end
         end
 
         module InstanceMethods
@@ -63,4 +78,4 @@ module Sorcery
       end
     end
   end
-end
+end