sorcery 0.8.5 → 0.9.0

data/lib/sorcery/model/config.rb

@@ -0,0 +1,96 @@
+# Each class which calls 'activate_sorcery!' receives an instance of this class.
+# Every submodule which gets loaded may add accessors to this class so that all
+# options will be configured from a single place.
+module Sorcery
+  module Model
+    class Config
+
+      attr_accessor :username_attribute_names,           # change default username attribute, for example, to use :email
+                                                        # as the login.
+
+                    :password_attribute_name,           # change *virtual* password attribute, the one which is used
+                                                        # until an encrypted one is generated.
+
+                    :email_attribute_name,              # change default email attribute.
+
+                    :downcase_username_before_authenticating, # downcase the username before trying to authenticate, default is false
+
+                    :crypted_password_attribute_name,   # change default crypted_password attribute.
+                    :salt_join_token,                   # what pattern to use to join the password with the salt
+                    :salt_attribute_name,               # change default salt attribute.
+                    :stretches,                         # how many times to apply encryption to the password.
+                    :encryption_key,                    # encryption key used to encrypt reversible encryptions such as
+                                                        # AES256.
+
+                    :subclasses_inherit_config,         # make this configuration inheritable for subclasses. Useful for
+                                                        # ActiveRecord's STI.
+
+                    :submodules,                        # configured in config/application.rb
+                    :before_authenticate,               # an array of method names to call before authentication
+                                                        # completes. used internally.
+
+                    :after_config                       # an array of method names to call after configuration by user.
+                                                        # used internally.
+
+      attr_reader   :encryption_provider,               # change default encryption_provider.
+                    :custom_encryption_provider,        # use an external encryption class.
+                    :encryption_algorithm               # encryption algorithm name. See 'encryption_algorithm=' below
+                                                        # for available options.
+
+      def initialize
+        @defaults = {
+          :@submodules                           => [],
+          :@username_attribute_names              => [:email],
+          :@password_attribute_name              => :password,
+          :@downcase_username_before_authenticating => false,
+          :@email_attribute_name                 => :email,
+          :@crypted_password_attribute_name      => :crypted_password,
+          :@encryption_algorithm                 => :bcrypt,
+          :@encryption_provider                  => CryptoProviders::BCrypt,
+          :@custom_encryption_provider           => nil,
+          :@encryption_key                       => nil,
+          :@salt_join_token                      => "",
+          :@salt_attribute_name                  => :salt,
+          :@stretches                            => nil,
+          :@subclasses_inherit_config            => false,
+          :@before_authenticate                  => [],
+          :@after_config                         => []
+        }
+        reset!
+      end
+
+      # Resets all configuration options to their default values.
+      def reset!
+        @defaults.each do |k,v|
+          instance_variable_set(k,v)
+        end
+      end
+
+      def username_attribute_names=(fields)
+        @username_attribute_names = fields.kind_of?(Array) ? fields : [fields]
+      end
+
+      def custom_encryption_provider=(provider)
+        @custom_encryption_provider = @encryption_provider = provider
+      end
+
+      def encryption_algorithm=(algo)
+        @encryption_algorithm = algo
+        @encryption_provider = case @encryption_algorithm.to_sym
+        when :none   then nil
+        when :md5    then CryptoProviders::MD5
+        when :sha1   then CryptoProviders::SHA1
+        when :sha256 then CryptoProviders::SHA256
+        when :sha512 then CryptoProviders::SHA512
+        when :aes256 then CryptoProviders::AES256
+        when :bcrypt then CryptoProviders::BCrypt
+        when :custom then @custom_encryption_provider
+        else raise ArgumentError.new("Encryption algorithm supplied, #{algo}, is invalid")
+        end
+      end
+
+    end
+
+  end
+end
+

data/lib/sorcery/model/submodules/activity_logging.rb

@@ -3,22 +3,23 @@ module Sorcery
     module Submodules
       # This submodule keeps track of events such as login, logout, and last activity time, per user.
       # It helps in estimating which users are active now in the site.
-      # This cannot be determined absolutely because a user might be reading a page without clicking anything 
+      # This cannot be determined absolutely because a user might be reading a page without clicking anything
       # for a while.
       # This is the model part of the submodule, which provides configuration options.
       module ActivityLogging
         def self.included(base)
           base.extend(ClassMethods)
+          base.send(:include, InstanceMethods)
 
           base.sorcery_config.class_eval do
             attr_accessor :last_login_at_attribute_name,                  # last login attribute name.
                           :last_logout_at_attribute_name,                 # last logout attribute name.
                           :last_activity_at_attribute_name,               # last activity attribute name.
                           :last_login_from_ip_address_name,               # last activity login source
-                          :activity_timeout                               # how long since last activity is 
+                          :activity_timeout                               # how long since last activity is
                                                                           #the user defined logged out?
           end
-          
+
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@last_login_at_attribute_name                => :last_login_at,
                              :@last_logout_at_attribute_name               => :last_logout_at,
@@ -28,23 +29,39 @@ module Sorcery
             reset!
           end
 
-          base.sorcery_config.after_config << :define_activity_logging_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
+          base.sorcery_config.after_config << :define_activity_logging_fields
+        end
+
+        module InstanceMethods
+          def set_last_login_at(time)
+            sorcery_adapter.update_attribute(sorcery_config.last_login_at_attribute_name, time)
+          end
+
+          def set_last_logout_at(time)
+            sorcery_adapter.update_attribute(sorcery_config.last_logout_at_attribute_name, time)
+          end
+
+          def set_last_activity_at(time)
+            sorcery_adapter.update_attribute(sorcery_config.last_activity_at_attribute_name, time)
+          end
+
+          def set_last_ip_addess(ip_address)
+            sorcery_adapter.update_attribute(sorcery_config.last_login_from_ip_address_name, ip_address)
+          end
         end
-        
+
         module ClassMethods
           # get all users with last_activity within timeout
           def current_users
-            config = sorcery_config
-            get_current_users
+            sorcery_adapter.get_current_users
           end
 
           protected
-
-          def define_activity_logging_mongoid_fields
-            field sorcery_config.last_login_at_attribute_name,    :type => Time
-            field sorcery_config.last_logout_at_attribute_name,   :type => Time
-            field sorcery_config.last_activity_at_attribute_name, :type => Time
-            field sorcery_config.last_login_from_ip_address_name, :type => String
+          def define_activity_logging_fields
+            sorcery_adapter.define_field sorcery_config.last_login_at_attribute_name,    Time
+            sorcery_adapter.define_field sorcery_config.last_logout_at_attribute_name,   Time
+            sorcery_adapter.define_field sorcery_config.last_activity_at_attribute_name, Time
+            sorcery_adapter.define_field sorcery_config.last_login_from_ip_address_name, String
           end
         end
       end

data/lib/sorcery/model/submodules/brute_force_protection.rb

@@ -35,10 +35,7 @@ module Sorcery
           end
 
           base.sorcery_config.before_authenticate << :prevent_locked_user_login
-          base.sorcery_config.after_config << :define_brute_force_protection_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
-          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
-            base.sorcery_config.after_config << :define_brute_force_protection_mongo_mapper_fields
-          end
+          base.sorcery_config.after_config << :define_brute_force_protection_fields
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
         end
@@ -46,22 +43,16 @@ module Sorcery
         module ClassMethods
           def load_from_unlock_token(token)
             return nil if token.blank?
-            user = find_by_sorcery_token(sorcery_config.unlock_token_attribute_name,token)
+            user = sorcery_adapter.find_by_token(sorcery_config.unlock_token_attribute_name,token)
             user
           end
 
           protected
 
-          def define_brute_force_protection_mongoid_fields
-            field sorcery_config.failed_logins_count_attribute_name,  :type => Integer, :default => 0
-            field sorcery_config.lock_expires_at_attribute_name,      :type => Time
-            field sorcery_config.unlock_token_attribute_name,         :type => String
-          end
-
-          def define_brute_force_protection_mongo_mapper_fields
-            key sorcery_config.failed_logins_count_attribute_name, Integer, :default => 0
-            key sorcery_config.lock_expires_at_attribute_name, Time
-            key sorcery_config.unlock_token_attribute_name, String
+          def define_brute_force_protection_fields
+            sorcery_adapter.define_field sorcery_config.failed_logins_count_attribute_name, Integer, :default => 0
+            sorcery_adapter.define_field sorcery_config.lock_expires_at_attribute_name, Time
+            sorcery_adapter.define_field sorcery_config.unlock_token_attribute_name, String
           end
         end
 
@@ -71,9 +62,12 @@ module Sorcery
           def register_failed_login!
             config = sorcery_config
             return if !unlocked?
-            self.increment(config.failed_logins_count_attribute_name)
-            self.update_many_attributes(config.failed_logins_count_attribute_name => self.send(config.failed_logins_count_attribute_name))
-            self.lock! if self.send(config.failed_logins_count_attribute_name) >= config.consecutive_login_retries_amount_limit
+
+            sorcery_adapter.increment(config.failed_logins_count_attribute_name)
+
+            if self.send(config.failed_logins_count_attribute_name) >= config.consecutive_login_retries_amount_limit
+              lock!
+            end
           end
 
           # /!\
@@ -84,7 +78,11 @@ module Sorcery
             attributes = {config.lock_expires_at_attribute_name => nil,
                           config.failed_logins_count_attribute_name => 0,
                           config.unlock_token_attribute_name => nil}
-            self.update_many_attributes(attributes)
+            sorcery_adapter.update_attributes(attributes)
+          end
+
+          def locked?
+            !unlocked?
           end
 
           protected
@@ -93,7 +91,7 @@ module Sorcery
             config = sorcery_config
             attributes = {config.lock_expires_at_attribute_name => Time.now.in_time_zone + config.login_lock_time_period,
                           config.unlock_token_attribute_name => TemporaryToken.generate_random_token}
-            self.update_many_attributes(attributes)
+            sorcery_adapter.update_attributes(attributes)
 
             unless config.unlock_token_mailer_disabled || config.unlock_token_mailer.nil?
               send_unlock_token_email!
@@ -106,7 +104,9 @@ module Sorcery
           end
 
           def send_unlock_token_email!
-            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer) unless sorcery_config.unlock_token_email_method_name.nil?
+            return if sorcery_config.unlock_token_email_method_name.nil?
+
+            generic_send_email(:unlock_token_email_method_name, :unlock_token_mailer)
           end
 
           # Prevents a locked user from logging in, and unlocks users that expired their lock time.

data/lib/sorcery/model/submodules/external.rb

@@ -8,7 +8,7 @@ module Sorcery
       # Socery assumes (read: requires) you will create external users in the same table where
       # you keep your regular users,
       # but that you will have a separate table for keeping their external authentication data,
-      # and that that separate table has a few rows for each user, facebook and twitter 
+      # and that that separate table has a few rows for each user, facebook and twitter
       # for example (a one-to-many relationship).
       #
       # External users will have a null crypted_password field, since we do not hold their password.
@@ -22,7 +22,7 @@ module Sorcery
                           :provider_uid_attribute_name
 
           end
-          
+
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@authentications_class                  => nil,
                              :@authentications_user_id_attribute_name => :user_id,
@@ -31,26 +31,70 @@ module Sorcery
 
             reset!
           end
-          
+
           base.send(:include, InstanceMethods)
           base.extend(ClassMethods)
 
         end
-        
+
         module ClassMethods
           # takes a provider and uid and finds a user by them.
           def load_from_provider(provider,uid)
             config = sorcery_config
-            authentication = config.authentications_class.find_by_provider_and_uid(provider, uid)
-            user = find(authentication.send(config.authentications_user_id_attribute_name)) if authentication
+            authentication = config.authentications_class.sorcery_adapter.find_by_oauth_credentials(provider, uid)
+            user = sorcery_adapter.find_by_id(authentication.send(config.authentications_user_id_attribute_name)) if authentication
+          end
+
+          def create_and_validate_from_provider(provider, uid, attrs)
+            user = new(attrs)
+            user.send(sorcery_config.authentications_class.to_s.downcase.pluralize).build(
+              sorcery_config.provider_uid_attribute_name => uid,
+              sorcery_config.provider_attribute_name => provider
+            )
+            saved = user.sorcery_adapter.save
+            [user, saved]
+          end
+
+          def create_from_provider(provider, uid, attrs)
+            user = new
+            attrs.each do |k,v|
+              user.send(:"#{k}=", v)
+            end
+
+            if block_given?
+              return false unless yield user
+            end
+
+            sorcery_adapter.transaction do
+              user.sorcery_adapter.save(:validate => false)
+              sorcery_config.authentications_class.create!(
+                sorcery_config.authentications_user_id_attribute_name => user.id,
+                sorcery_config.provider_attribute_name => provider,
+                sorcery_config.provider_uid_attribute_name => uid
+              )
+            end
+            user
           end
         end
-        
+
         module InstanceMethods
+          def add_provider_to_user(provider, uid)
+            authentications = sorcery_config.authentications_class.name.underscore.pluralize
+            # first check to see if user has a particular authentication already
+            if sorcery_adapter.find_authentication_by_oauth_credentials(authentications, provider, uid).nil?
+              user = send(authentications).build(sorcery_config.provider_uid_attribute_name => uid,
+                                                 sorcery_config.provider_attribute_name => provider)
+              user.sorcery_adapter.save(validate: false)
+            else
+              user = false
+            end
+
+            user
+          end
 
         end
-      
+
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/remember_me.rb

@@ -1,7 +1,7 @@
 module Sorcery
   module Model
     module Submodules
-      # The Remember Me submodule takes care of setting the user's cookie so that he will 
+      # The Remember Me submodule takes care of setting the user's cookie so that he will
       # be automatically logged in to the site on every visit,
       # until the cookie expires.
       module RememberMe
@@ -12,7 +12,7 @@ module Sorcery
                           :remember_me_for                                # how long in seconds to remember.
 
           end
-          
+
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@remember_me_token_attribute_name            => :remember_me_token,
                              :@remember_me_token_expires_at_attribute_name => :remember_me_token_expires_at,
@@ -20,47 +20,43 @@ module Sorcery
 
             reset!
           end
-          
+
           base.send(:include, InstanceMethods)
+          base.sorcery_config.after_config << :define_remember_me_fields
 
-          base.sorcery_config.after_config << :define_remember_me_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
-          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
-            base.sorcery_config.after_config << :define_remember_me_mongo_mapper_fields
-          end
-          
           base.extend(ClassMethods)
         end
 
         module ClassMethods
           protected
 
-          def define_remember_me_mongoid_fields
-            field sorcery_config.remember_me_token_attribute_name,            :type => String
-            field sorcery_config.remember_me_token_expires_at_attribute_name, :type => Time
+          def define_remember_me_fields
+            sorcery_adapter.define_field sorcery_config.remember_me_token_attribute_name, String
+            sorcery_adapter.define_field sorcery_config.remember_me_token_expires_at_attribute_name, Time
           end
 
-          def define_remember_me_mongo_mapper_fields
-            key sorcery_config.remember_me_token_attribute_name, String
-            key sorcery_config.remember_me_token_expires_at_attribute_name, Time
-          end
         end
 
         module InstanceMethods
           # You shouldn't really use this one yourself - it's called by the controller's 'remember_me!' method.
           def remember_me!
             config = sorcery_config
-            self.update_many_attributes(config.remember_me_token_attribute_name => TemporaryToken.generate_random_token,
+            self.sorcery_adapter.update_attributes(config.remember_me_token_attribute_name => TemporaryToken.generate_random_token,
                                         config.remember_me_token_expires_at_attribute_name => Time.now.in_time_zone + config.remember_me_for)
           end
-          
+
+          def has_remember_me_token?
+            self.send(sorcery_config.remember_me_token_attribute_name).present?
+          end
+
           # You shouldn't really use this one yourself - it's called by the controller's 'forget_me!' method.
           def forget_me!
             config = sorcery_config
-            self.update_many_attributes(config.remember_me_token_attribute_name => nil,
+            self.sorcery_adapter.update_attributes(config.remember_me_token_attribute_name => nil,
                                         config.remember_me_token_expires_at_attribute_name => nil)
           end
         end
       end
     end
   end
-end
+end

data/lib/sorcery/model/submodules/reset_password.rb

@@ -9,14 +9,14 @@ module Sorcery
       # he will be able to reset his password via a form.
       #
       # When using this submodule, supplying a mailer is mandatory.
-      module ResetPassword       
+      module ResetPassword
         def self.included(base)
           base.sorcery_config.class_eval do
             attr_accessor :reset_password_token_attribute_name,              # reset password code attribute name.
                           :reset_password_token_expires_at_attribute_name,   # expires at attribute name.
                           :reset_password_email_sent_at_attribute_name,      # when was email sent, used for hammering
                                                                              # protection.
-                                                                             
+
                           :reset_password_mailer,                            # mailer class. Needed.
 
                           :reset_password_mailer_disabled,                   # when true sorcery will not automatically
@@ -25,15 +25,15 @@ module Sorcery
 
                           :reset_password_email_method_name,                 # reset password email method on your
                                                                              # mailer class.
-                                                                             
+
                           :reset_password_expiration_period,                 # how many seconds before the reset request
                                                                              # expires. nil for never expires.
-                                                                             
+
                           :reset_password_time_between_emails                # hammering protection, how long to wait
                                                                              # before allowing another email to be sent.
 
           end
-          
+
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@reset_password_token_attribute_name            => :reset_password_token,
                              :@reset_password_token_expires_at_attribute_name => :reset_password_token_expires_at,
@@ -50,15 +50,12 @@ module Sorcery
           base.extend(ClassMethods)
 
           base.sorcery_config.after_config << :validate_mailer_defined
-          base.sorcery_config.after_config << :define_reset_password_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
-          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
-            base.sorcery_config.after_config << :define_reset_password_mongo_mapper_fields
-          end
+          base.sorcery_config.after_config << :define_reset_password_fields
 
           base.send(:include, InstanceMethods)
 
         end
-        
+
         module ClassMethods
           # Find user by token, also checks for expiration.
           # Returns the user if token found and is valid.
@@ -67,9 +64,9 @@ module Sorcery
             token_expiration_date_attr = @sorcery_config.reset_password_token_expires_at_attribute_name
             load_from_token(token, token_attr_name, token_expiration_date_attr)
           end
-          
+
           protected
-          
+
           # This submodule requires the developer to define his own mailer class to be used by it
           # when reset_password_mailer_disabled is false
           def validate_mailer_defined
@@ -77,43 +74,45 @@ module Sorcery
             raise ArgumentError, msg if @sorcery_config.reset_password_mailer == nil and @sorcery_config.reset_password_mailer_disabled == false
           end
 
-          def define_reset_password_mongoid_fields
-            field sorcery_config.reset_password_token_attribute_name,             :type => String
-            field sorcery_config.reset_password_token_expires_at_attribute_name,  :type => Time
-            field sorcery_config.reset_password_email_sent_at_attribute_name,     :type => Time
-          end
-          
-          def define_reset_password_mongo_mapper_fields
-            key sorcery_config.reset_password_token_attribute_name, String
-            key sorcery_config.reset_password_token_expires_at_attribute_name, Time
-            key sorcery_config.reset_password_email_sent_at_attribute_name, Time
+          def define_reset_password_fields
+            sorcery_adapter.define_field sorcery_config.reset_password_token_attribute_name, String
+            sorcery_adapter.define_field sorcery_config.reset_password_token_expires_at_attribute_name, Time
+            sorcery_adapter.define_field sorcery_config.reset_password_email_sent_at_attribute_name, Time
           end
+
         end
-        
+
         module InstanceMethods
-          # generates a reset code with expiration and sends an email to the user.
-          def deliver_reset_password_instructions!
+          # generates a reset code with expiration
+          def generate_reset_password_token!
             config = sorcery_config
-            # hammering protection
-            return false if config.reset_password_time_between_emails && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.ago.utc
             attributes = {config.reset_password_token_attribute_name => TemporaryToken.generate_random_token,
                           config.reset_password_email_sent_at_attribute_name => Time.now.in_time_zone}
             attributes[config.reset_password_token_expires_at_attribute_name] = Time.now.in_time_zone + config.reset_password_expiration_period if config.reset_password_expiration_period
-            self.class.transaction do
-              self.update_many_attributes(attributes)
-              send_reset_password_email! unless sorcery_config.reset_password_mailer_disabled
+
+            self.sorcery_adapter.update_attributes(attributes)
+          end
+
+          # generates a reset code with expiration and sends an email to the user.
+          def deliver_reset_password_instructions!
+            config = sorcery_config
+            # hammering protection
+            return false if config.reset_password_time_between_emails.present? && self.send(config.reset_password_email_sent_at_attribute_name) && self.send(config.reset_password_email_sent_at_attribute_name) > config.reset_password_time_between_emails.seconds.ago.utc
+            self.class.sorcery_adapter.transaction do
+              generate_reset_password_token!
+              send_reset_password_email! unless config.reset_password_mailer_disabled
             end
           end
-          
+
           # Clears token and tries to update the new password for the user.
           def change_password!(new_password)
             clear_reset_password_token
             self.send(:"#{sorcery_config.password_attribute_name}=", new_password)
-            save
+            sorcery_adapter.save
           end
 
           protected
-          
+
           def send_reset_password_email!
             generic_send_email(:reset_password_email_method_name, :reset_password_mailer)
           end
@@ -125,7 +124,7 @@ module Sorcery
             self.send(:"#{config.reset_password_token_expires_at_attribute_name}=", nil) if config.reset_password_expiration_period
           end
         end
-        
+
       end
     end
   end