sorcery 0.8.5 → 0.9.0

data/lib/sorcery/controller/submodules/external/providers/xing.rb

@@ -1,98 +0,0 @@
-module Sorcery
-  module Controller
-    module Submodules
-      module External
-        module Providers
-          # This module adds support for OAuth with xing.com.
-          # When included in the 'config.providers' option, it adds a new option, 'config.xing'.
-          # Via this new option you can configure Xing specific settings like your app's key and secret.
-          #
-          #   config.xing.key = <key>
-          #   config.xing.secret = <secret>
-          #   ...
-          #
-          module Xing
-            def self.included(base)
-              base.module_eval do
-                class << self
-                  attr_reader :xing
-
-                  def merge_xing_defaults!
-                    @defaults.merge!(:@xing => XingClient)
-                  end
-                end
-                merge_xing_defaults!
-                update!
-              end
-            end
-
-            module XingClient
-              include Base::BaseClient
-              class << self
-                attr_accessor :key,
-                              :secret,
-                              :callback_url,
-                              :site,
-                              :authorize_path,
-                              :request_token_path,
-                              :access_token_path,
-                              :user_info_path,
-                              :user_info_mapping,
-                              :state
-                attr_reader   :access_token
-
-                include Protocols::Oauth1
-
-                # Override included get_consumer method to provide authorize_path
-                def get_consumer
-                  ::OAuth::Consumer.new(@key, @secret, @configuration)
-                end
-
-                def init
-                  @configuration = {
-                      site: "https://api.xing.com/v1",
-                      authorize_path: '/authorize',
-                      request_token_path: '/request_token',
-                      access_token_path: '/access_token'
-                  }
-                  @user_info_path = "/users/me"
-                end
-
-                def get_user_hash(access_token)
-                  user_hash = {}
-                  response = access_token.get(@user_info_path)
-                  user_hash[:user_info] = JSON.parse(response.body)['users'].first
-                  user_hash[:uid] = user_hash[:user_info]['id'].to_s
-                  user_hash
-                end
-
-                def has_callback?
-                  true
-                end
-
-                # calculates and returns the url to which the user should be redirected,
-                # to get authenticated at the external provider's site.
-                def login_url(params,session)
-                  req_token = self.get_request_token
-                  session[:request_token]         = req_token.token
-                  session[:request_token_secret]  = req_token.secret
-                  self.authorize_url({:request_token => req_token.token, :request_token_secret => req_token.secret})
-                end
-
-                # tries to login the user from access token
-                def process_callback(params, session)
-                  args = {}
-                  args.merge!({:oauth_verifier => params[:oauth_verifier], :request_token => session[:request_token], :request_token_secret => session[:request_token_secret]})
-                  args.merge!({:code => params[:code]}) if params[:code]
-                  return self.get_access_token(args)
-                end
-
-              end
-              init
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/sorcery/model/adapters/active_record.rb

@@ -1,49 +0,0 @@
-module Sorcery
-  module Model
-    module Adapters
-      module ActiveRecord
-        def self.included(klass)
-          klass.extend ClassMethods
-          klass.send(:include, InstanceMethods)
-        end
-
-        module InstanceMethods
-          def update_many_attributes(attrs)
-            attrs.each do |name, value|
-              self.send(:"#{name}=", value)
-            end
-            primary_key = self.class.primary_key
-            self.class.where(:"#{primary_key}" => self.send(:"#{primary_key}")).update_all(attrs)
-          end
-
-          def update_single_attribute(name, value)
-            update_many_attributes(name => value)
-          end
-        end
-        
-        module ClassMethods
-          def column_name(attribute)
-            return "LOWER(#{attribute})" if (@sorcery_config.downcase_username_before_authenticating)
-            return "#{attribute}"
-          end
-
-          def find_by_credentials(credentials)
-             sql = @sorcery_config.username_attribute_names.map{|attribute| column_name(attribute) + " = :login"}
-             where(sql.join(' OR '), :login => credentials[0]).first
-          end
-
-          def find_by_sorcery_token(token_attr_name, token)
-            where("#{token_attr_name} = ?", token).first
-          end
-
-          def get_current_users
-            config = sorcery_config
-            where("#{config.last_activity_at_attribute_name} IS NOT NULL") \
-            .where("#{config.last_logout_at_attribute_name} IS NULL OR #{config.last_activity_at_attribute_name} > #{config.last_logout_at_attribute_name}") \
-            .where("#{config.last_activity_at_attribute_name} > ? ", config.activity_timeout.seconds.ago.utc.to_s(:db))
-          end
-        end
-      end
-    end
-  end
-end

data/lib/sorcery/model/adapters/mongo_mapper.rb

@@ -1,56 +0,0 @@
-module Sorcery
-  module Model
-    module Adapters
-      module MongoMapper
-        extend ActiveSupport::Concern
-
-        included do
-          include Sorcery::Model
-        end
-
-        def increment(attr)
-          self.class.increment(id, attr => 1)
-        end
-
-        def save!(options = {})
-          save(options)
-        end
-
-        def update_many_attributes(attrs)
-          update_attributes(attrs)
-        end
-
-        module ClassMethods
-          def credential_regex(credential)
-            return { :$regex =>  /^#{credential}$/i  }  if (@sorcery_config.downcase_username_before_authenticating)
-            return credential
-          end
-
-          def find_by_credentials(credentials)
-            @sorcery_config.username_attribute_names.each do |attribute|
-              @user = where(attribute => credential_regex(credentials[0])).first
-              break if @user
-            end
-            @user
-          end
-
-          def find_by_id(id)
-            find(id)
-          end
-
-          def find_by_activation_token(token)
-            where(sorcery_config.activation_token_attribute_name => token).first
-          end
-
-          def transaction(&blk)
-            tap(&blk)
-          end
-
-          def find_by_sorcery_token(token_attr_name, token)
-            where(token_attr_name => token).first
-          end
-        end
-      end
-    end
-  end
-end

data/lib/sorcery/model/adapters/mongoid.rb

@@ -1,88 +0,0 @@
-module Sorcery
-  module Model
-    module Adapters
-      module Mongoid
-        def self.included(klass)
-          klass.extend ClassMethods
-          klass.send(:include, InstanceMethods)
-        end
-
-        module InstanceMethods
-          def increment(attr)
-            self.inc(attr, 1)
-          end
-
-          def update_many_attributes(attrs)
-            attrs.each do |name, value|
-              attrs[name] = value.utc if value.is_a?(ActiveSupport::TimeWithZone)
-              self.send(:"#{name}=", value)
-            end
-            self.class.where(:_id => self.id).update_all(attrs)
-          end
-
-          def update_single_attribute(name, value)
-            update_many_attributes(name => value)
-          end
-        end
-
-        module ClassMethods
-          def credential_regex(credential)
-            return { :$regex =>  /^#{credential}$/i  } if (@sorcery_config.downcase_username_before_authenticating)
-            credential
-          end
-
-          def find_by_credentials(credentials)
-            @sorcery_config.username_attribute_names.each do |attribute|
-              @user = where(attribute => credential_regex(credentials[0])).first
-              break if @user
-            end
-            @user
-          end
-
-          def find_by_provider_and_uid(provider, uid)
-            @user_klass ||= ::Sorcery::Controller::Config.user_class.to_s.constantize
-            where(@user_klass.sorcery_config.provider_attribute_name => provider, @user_klass.sorcery_config.provider_uid_attribute_name => uid).first
-          end
-
-          def find_by_id(id)
-            find(id)
-          rescue ::Mongoid::Errors::DocumentNotFound
-            nil
-          end
-
-          def find_by_activation_token(token)
-            where(sorcery_config.activation_token_attribute_name => token).first
-          end
-
-          def find_by_remember_me_token(token)
-            where(sorcery_config.remember_me_token_attribute_name => token).first
-          end
-
-          def find_by_username(username)
-            query = sorcery_config.username_attribute_names.map {|name| {name => username}}
-            any_of(*query).first
-          end
-
-          def transaction(&blk)
-            tap(&blk)
-          end
-
-          def find_by_sorcery_token(token_attr_name, token)
-            where(token_attr_name => token).first
-          end
-
-          def find_by_email(email)
-            where(sorcery_config.email_attribute_name => email).first
-          end
-
-          def get_current_users
-            config = sorcery_config
-            where(config.last_activity_at_attribute_name.ne => nil) \
-            .where("this.#{config.last_logout_at_attribute_name} == null || this.#{config.last_activity_at_attribute_name} > this.#{config.last_logout_at_attribute_name}") \
-            .where(config.last_activity_at_attribute_name.gt => config.activity_timeout.seconds.ago.utc).order_by([:_id,:asc])
-          end
-        end
-      end
-    end
-  end
-end

data/lib/sorcery/test_helpers/rails.rb

@@ -1,16 +0,0 @@
-module Sorcery
-  module TestHelpers
-    module Rails
-      # logins a user and calls all callbacks
-      def login_user(user = nil)
-        user ||= @user
-        @controller.send(:auto_login, user)
-        @controller.send(:after_login!, user, [user.send(user.sorcery_config.username_attribute_names.first), 'secret'])
-      end
-
-      def logout_user
-        @controller.send(:logout)
-      end
-    end
-  end
-end

data/lib/sorcery/test_helpers.rb

@@ -1,5 +0,0 @@
-module Sorcery
-  module TestHelpers
-
-  end
-end

data/spec/active_record/controller_activity_logging_spec.rb

@@ -1,140 +0,0 @@
-require 'spec_helper'
-
-describe SorceryController do
-  before(:all) do
-    ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/activity_logging")
-    User.reset_column_information
-  end
-
-  after(:all) do
-    ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activity_logging")
-
-    sorcery_controller_property_set(:register_login_time, true)
-    sorcery_controller_property_set(:register_logout_time, true)
-    sorcery_controller_property_set(:register_last_activity_time, true)
-    # sorcery_controller_property_set(:last_login_from_ip_address_name, true)
-  end
-
-  # ----------------- ACTIVITY LOGGING -----------------------
-  describe SorceryController, "with activity logging features" do
-    before(:all) do
-      sorcery_reload!([:activity_logging])
-    end
-
-    before(:each) do
-      create_new_user
-    end
-
-    after(:each) do
-      User.delete_all
-    end
-
-    specify { subject.should respond_to(:current_users) }
-
-    it "'current_users' should be empty when no users are logged in" do
-      subject.current_users.size.should == 0
-    end
-
-    it "should log login time on login" do
-      now = Time.now.in_time_zone
-      login_user
-      @user.last_login_at.should_not be_nil
-      @user.last_login_at.to_s(:db).should >= now.to_s(:db)
-      @user.last_login_at.to_s(:db).should <= (now+2).to_s(:db)
-    end
-
-    it "should log logout time on logout" do
-      login_user
-      now = Time.now.in_time_zone
-      logout_user
-
-      User.last.last_logout_at.should_not be_nil
-
-      User.last.last_logout_at.to_s(:db).should >= now.to_s(:db)
-      User.last.last_logout_at.to_s(:db).should <= (now+2).to_s(:db)
-    end
-
-    it "should log last activity time when logged in" do
-      sorcery_controller_property_set(:register_last_activity_time, true)
-
-      login_user
-      now = Time.now.in_time_zone
-      get :some_action
-
-      last_activity_at = User.last.last_activity_at
-
-      last_activity_at.should be_present
-      last_activity_at.to_s(:db).should >= now.to_s(:db)
-      last_activity_at.to_s(:db).should <= (now+2).to_s(:db)
-    end
-
-    it "should log last IP address when logged in" do
-      login_user
-      get :some_action
-      User.last.last_login_from_ip_address.should == "0.0.0.0"
-    end
-
-    it "should update nothing but activity fields" do
-      original_user_name = User.last.username
-      login_user
-      get :some_action_making_a_non_persisted_change_to_the_user
-      User.last.username.should == original_user_name
-    end
-
-    it "'current_users' should hold the user object when 1 user is logged in" do
-      login_user
-      get :some_action
-      subject.current_users.size.should == 1
-      subject.current_users[0].should == @user
-    end
-
-    it "'current_users' should show all current_users, whether they have logged out before or not." do
-      user1 = create_new_user({:username => 'gizmo1', :email => "bla1@bla.com", :password => 'secret1'})
-      login_user(user1)
-      get :some_action
-      clear_user_without_logout
-      user2 = create_new_user({:username => 'gizmo2', :email => "bla2@bla.com", :password => 'secret2'})
-      login_user(user2)
-      get :some_action
-      clear_user_without_logout
-      user3 = create_new_user({:username => 'gizmo3', :email => "bla3@bla.com", :password => 'secret3'})
-      login_user(user3)
-      get :some_action
-      subject.current_users.size.should == 3
-      subject.current_users[0].should == user1
-      subject.current_users[1].should == user2
-      subject.current_users[2].should == user3
-    end
-
-    it "should not register login time if configured so" do
-      sorcery_controller_property_set(:register_login_time, false)
-      now = Time.now.in_time_zone
-      login_user
-      @user.last_login_at.should be_nil
-    end
-
-    it "should not register logout time if configured so" do
-      sorcery_controller_property_set(:register_logout_time, false)
-      now = Time.now.in_time_zone
-      login_user
-      logout_user
-      @user.last_logout_at.should be_nil
-    end
-
-    it "should not register last activity time if configured so" do
-      sorcery_controller_property_set(:register_last_activity_time, false)
-      now = Time.now.in_time_zone
-      login_user
-      get :some_action
-      @user.last_activity_at.should be_nil
-    end
-
-    it "should not register last IP address if configured so" do
-      sorcery_controller_property_set(:register_last_ip_address, false)
-      ip_address = "127.0.0.1"
-      login_user
-      get :some_action
-      @user.last_activity_at.should be_nil
-    end
-  end
-end

data/spec/active_record/controller_brute_force_protection_spec.rb

@@ -1,136 +0,0 @@
-require 'spec_helper'
-
-describe SorceryController do
-  before(:all) do
-    ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/brute_force_protection")
-    User.reset_column_information
-  end
-
-  after(:all) do
-    ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/brute_force_protection")
-  end
-
-  # ----------------- SESSION TIMEOUT -----------------------
-  describe SorceryController, "with brute force protection features" do
-    before(:all) do
-      sorcery_reload!([:brute_force_protection])
-      create_new_user
-    end
-
-    after(:each) do
-      Sorcery::Controller::Config.reset!
-      sorcery_controller_property_set(:user_class, User)
-      Timecop.return
-    end
-
-    it "should count login retries" do
-      3.times {get :test_login, :email => 'bla@bla.com', :password => 'blabla'}
-      User.find_by_email('bla@bla.com').failed_logins_count.should == 3
-    end
-
-    it "should generate unlock token before mail is sent" do
-      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
-      sorcery_model_property_set(:login_lock_time_period, 0)
-      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
-      3.times {get :test_login, :email => "bla@bla.com", :password => "blabla"}
-      ActionMailer::Base.deliveries.last.body.to_s.match(User.find_by_email('bla@bla.com').unlock_token).should_not be_nil
-    end
-
-    it "should unlock after entering unlock token" do
-      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
-      sorcery_model_property_set(:login_lock_time_period, 0)
-      sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
-      3.times {get :test_login, :email => "bla@bla.com", :password => "blabla"}
-      User.find_by_email('bla@bla.com').unlock_token.should_not be_nil
-      token = User.find_by_email('bla@bla.com').unlock_token
-      user = User.load_from_unlock_token(token)
-      user.should_not be_nil
-      user.unlock!
-      User.load_from_unlock_token(token).should be_nil
-    end
-
-    it "should reset the counter on a good login" do
-      # dirty hack for rails 4
-      @controller.stub(:register_last_activity_time_to_db)
-
-      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 5)
-      3.times {get :test_login, :email => 'bla@bla.com', :password => 'blabla'}
-      get :test_login, :email => 'bla@bla.com', :password => 'secret'
-      User.find_by_email('bla@bla.com').failed_logins_count.should == 0
-    end
-
-    it "should lock user when number of retries reached the limit" do
-      User.find_by_email('bla@bla.com').lock_expires_at.should be_nil
-      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 1)
-      get :test_login, :email => 'bla@bla.com', :password => 'blabla'
-      User.find_by_email('bla@bla.com').lock_expires_at.should_not be_nil
-    end
-
-    it "should unlock after lock time period passes" do
-      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
-      sorcery_model_property_set(:login_lock_time_period, 0.2)
-      get :test_login, :email => 'bla@bla.com', :password => 'blabla'
-      get :test_login, :email => 'bla@bla.com', :password => 'blabla'
-      User.find_by_email('bla@bla.com').lock_expires_at.should_not be_nil
-      Timecop.travel(Time.now.in_time_zone + 0.3)
-      get :test_login, :email => 'bla@bla.com', :password => 'blabla'
-      User.find_by_email('bla@bla.com').lock_expires_at.should be_nil
-    end
-
-    it "should not unlock if time period is 0 (permanent lock)" do
-      sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
-      sorcery_model_property_set(:login_lock_time_period, 0)
-      get :test_login, :email => 'bla@bla.com', :password => 'blabla'
-      get :test_login, :email => 'bla@bla.com', :password => 'blabla'
-      unlock_date = User.find_by_email('bla@bla.com').lock_expires_at
-      Timecop.travel(Time.now.in_time_zone + 1)
-      get :test_login, :email => 'bla@bla.com', :password => 'blabla'
-      User.find_by_email('bla@bla.com').lock_expires_at.to_s.should == unlock_date.to_s
-    end
-
-    context "unlock_token_mailer_disabled is true" do
-
-      before(:each) do
-        sorcery_model_property_set(:unlock_token_mailer_disabled, true)
-        sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
-        sorcery_model_property_set(:login_lock_time_period, 0)
-        sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
-      end
-
-      it "should generate unlock token after user locked" do
-        3.times {get :test_login, :email => "bla@bla.com", :password => "blabla"}
-        User.find_by_email('bla@bla.com').unlock_token.should_not be_nil
-      end
-
-      it "should *not* automatically send unlock mail" do
-        old_size = ActionMailer::Base.deliveries.size
-        3.times {get :test_login, :email => "bla@bla.com", :password => "blabla"}
-        ActionMailer::Base.deliveries.size.should == old_size
-      end
-
-    end
-
-    context "unlock_token_mailer_disabled is false" do
-
-      before(:each) do
-        sorcery_model_property_set(:unlock_token_mailer_disabled, false)
-        sorcery_model_property_set(:consecutive_login_retries_amount_limit, 2)
-        sorcery_model_property_set(:login_lock_time_period, 0)
-        sorcery_model_property_set(:unlock_token_mailer, SorceryMailer)
-      end
-
-      it "should set the unlock token after user locked" do
-        3.times {get :test_login, :email => "bla@bla.com", :password => "blabla"}
-        User.find_by_email('bla@bla.com').unlock_token.should_not be_nil
-      end
-
-      it "should automatically send unlock mail" do
-        old_size = ActionMailer::Base.deliveries.size
-        3.times {get :test_login, :email => "bla@bla.com", :password => "blabla"}
-        ActionMailer::Base.deliveries.size.should == old_size + 1
-      end
-
-    end
-
-  end
-end

data/spec/active_record/controller_http_basic_auth_spec.rb

@@ -1,59 +0,0 @@
-require 'spec_helper'
-
-describe SorceryController do
-
-  # ----------------- HTTP BASIC AUTH -----------------------
-  describe SorceryController, "with http basic auth features" do
-    before(:all) do
-      sorcery_reload!([:http_basic_auth])
-
-      sorcery_controller_property_set(:controller_to_realm_map, {"sorcery" => "sorcery"})
-      create_new_user
-    end
-
-    after(:each) do
-      logout_user
-    end
-
-    it "requests basic authentication when before_filter is used" do
-      get :test_http_basic_auth
-      response.code.should == "401"
-    end
-
-    it "authenticates from http basic if credentials are sent" do
-      # dirty hack for rails 4
-      @controller.stub(:register_last_activity_time_to_db)
-
-      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{@user.email}:secret")
-      get :test_http_basic_auth, nil, :http_authentication_used => true
-      response.should be_a_success
-    end
-
-    it "fails authentication if credentials are wrong" do
-      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{@user.email}:wrong!")
-      get :test_http_basic_auth, nil, :http_authentication_used => true
-      response.code.should redirect_to root_url
-    end
-
-    it "should allow configuration option 'controller_to_realm_map'" do
-      sorcery_controller_property_set(:controller_to_realm_map, {"1" => "2"})
-      Sorcery::Controller::Config.controller_to_realm_map.should == {"1" => "2"}
-    end
-
-    it "should display the correct realm name configured for the controller" do
-      sorcery_controller_property_set(:controller_to_realm_map, {"sorcery" => "Salad"})
-
-      get :test_http_basic_auth
-      response.headers["WWW-Authenticate"].should == "Basic realm=\"Salad\""
-    end
-
-    it "should sign in the user's session on successful login" do
-      # dirty hack for rails 4
-      @controller.stub(:register_last_activity_time_to_db)
-
-      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{@user.email}:secret")
-      get :test_http_basic_auth, nil, :http_authentication_used => true
-      session[:user_id].should == User.find_by_email(@user.email).id
-    end
-  end
-end