sorcery 0.8.5 → 0.9.0

data/lib/sorcery/model/submodules/user_activation.rb

@@ -10,16 +10,16 @@ module Sorcery
           base.sorcery_config.class_eval do
             attr_accessor :activation_state_attribute_name,               # the attribute name to hold activation state
                                                                           # (active/pending).
-                                                                          
+
                           :activation_token_attribute_name,               # the attribute name to hold activation code
                                                                           # (sent by email).
-                                                                          
+
                           :activation_token_expires_at_attribute_name,    # the attribute name to hold activation code
-                                                                          # expiration date. 
-                                                                          
+                                                                          # expiration date.
+
                           :activation_token_expiration_period,            # how many seconds before the activation code
                                                                           # expires. nil for never expires.
-                                                                          
+
                           :user_activation_mailer,                        # your mailer class. Required when
                                                                           # activation_mailer_disabled == false.
 
@@ -29,14 +29,14 @@ module Sorcery
 
                           :activation_needed_email_method_name,           # activation needed email method on your
                                                                           # mailer class.
-                                                                          
+
                           :activation_success_email_method_name,          # activation success email method on your
                                                                           # mailer class.
-                                                                          
+
                           :prevent_non_active_users_to_login              # do you want to prevent or allow users that
                                                                           # did not activate by email to login?
           end
-          
+
           base.sorcery_config.instance_eval do
             @defaults.merge!(:@activation_state_attribute_name             => :activation_state,
                              :@activation_token_attribute_name             => :activation_token,
@@ -49,27 +49,24 @@ module Sorcery
                              :@prevent_non_active_users_to_login           => true)
             reset!
           end
-          
+
           base.class_eval do
             # don't setup activation if no password supplied - this user is created automatically
-            before_create :setup_activation, :if => Proc.new { |user| user.send(sorcery_config.password_attribute_name).present? }
+            sorcery_adapter.define_callback :before, :create, :setup_activation, :if => Proc.new { |user| user.send(sorcery_config.password_attribute_name).present? }
             # don't send activation needed email if no crypted password created - this user is external (OAuth etc.)
-            after_create  :send_activation_needed_email!, :if => :send_activation_needed_email?
+            sorcery_adapter.define_callback :after, :create, :send_activation_needed_email!, :if => :send_activation_needed_email?
           end
-          
+
           base.sorcery_config.after_config << :validate_mailer_defined
-          base.sorcery_config.after_config << :define_user_activation_mongoid_fields if defined?(Mongoid) and base.ancestors.include?(Mongoid::Document)
-          if defined?(MongoMapper) and base.ancestors.include?(MongoMapper::Document)
-            base.sorcery_config.after_config << :define_user_activation_mongo_mapper_fields
-          end
+          base.sorcery_config.after_config << :define_user_activation_fields
           base.sorcery_config.before_authenticate << :prevent_non_active_login
-          
+
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
 
 
         end
-        
+
         module ClassMethods
           # Find user by token, also checks for expiration.
           # Returns the user if token found and is valid.
@@ -78,9 +75,9 @@ module Sorcery
             token_expiration_date_attr = @sorcery_config.activation_token_expires_at_attribute_name
             load_from_token(token, token_attr_name, token_expiration_date_attr)
           end
-          
+
           protected
-          
+
           # This submodule requires the developer to define his own mailer class to be used by it
           # when activation_mailer_disabled is false
           def validate_mailer_defined
@@ -88,42 +85,34 @@ module Sorcery
             raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil and @sorcery_config.activation_mailer_disabled == false
           end
 
-          def define_user_activation_mongoid_fields
-            self.class_eval do
-              field sorcery_config.activation_state_attribute_name,            :type => String
-              field sorcery_config.activation_token_attribute_name,            :type => String
-              field sorcery_config.activation_token_expires_at_attribute_name, :type => Time
-            end
-          end
-
-          def define_user_activation_mongo_mapper_fields
+          def define_user_activation_fields
             self.class_eval do
-              key sorcery_config.activation_state_attribute_name, String
-              key sorcery_config.activation_token_attribute_name, String
-              key sorcery_config.activation_token_expires_at_attribute_name, Time
+              sorcery_adapter.define_field sorcery_config.activation_state_attribute_name, String
+              sorcery_adapter.define_field sorcery_config.activation_token_attribute_name, String
+              sorcery_adapter.define_field sorcery_config.activation_token_expires_at_attribute_name, Time
             end
           end
         end
-        
+
         module InstanceMethods
+          def setup_activation
+            config = sorcery_config
+            generated_activation_token = TemporaryToken.generate_random_token
+            self.send(:"#{config.activation_token_attribute_name}=", generated_activation_token)
+            self.send(:"#{config.activation_state_attribute_name}=", "pending")
+            self.send(:"#{config.activation_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.activation_token_expiration_period) if config.activation_token_expiration_period
+          end
+
           # clears activation code, sets the user as 'active' and optionaly sends a success email.
           def activate!
             config = sorcery_config
             self.send(:"#{config.activation_token_attribute_name}=", nil)
             self.send(:"#{config.activation_state_attribute_name}=", "active")
             send_activation_success_email! if send_activation_success_email?
-            save!(:validate => false) # don't run validations
+            sorcery_adapter.save(:validate => false, :raise_on_failure => true)
           end
-          
-          protected
 
-          def setup_activation
-            config = sorcery_config
-            generated_activation_token = TemporaryToken.generate_random_token
-            self.send(:"#{config.activation_token_attribute_name}=", generated_activation_token)
-            self.send(:"#{config.activation_state_attribute_name}=", "pending")
-            self.send(:"#{config.activation_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.activation_token_expiration_period) if config.activation_token_expiration_period
-          end
+          protected
 
           # called automatically after user initial creation.
           def send_activation_needed_email!
@@ -133,21 +122,21 @@ module Sorcery
           def send_activation_success_email!
             generic_send_email(:activation_success_email_method_name, :user_activation_mailer)
           end
-          
+
           def send_activation_success_email?
             !external? && (
               !(sorcery_config.activation_success_email_method_name.nil? ||
                 sorcery_config.activation_mailer_disabled == true)
             )
           end
-          
+
           def send_activation_needed_email?
             !external? && (
               !(sorcery_config.activation_needed_email_method_name.nil? ||
                 sorcery_config.activation_mailer_disabled == true)
             )
           end
-          
+
           def prevent_non_active_login
             config = sorcery_config
             config.prevent_non_active_users_to_login ? self.send(config.activation_state_attribute_name) == "active" : true
@@ -157,4 +146,4 @@ module Sorcery
       end
     end
   end
-end
+end

data/lib/sorcery/model/temporary_token.rb

@@ -3,22 +3,22 @@ require 'securerandom'
 module Sorcery
   module Model
     # This module encapsulates the logic for temporary token.
-    # A temporary token is created to identify a user in scenarios 
+    # A temporary token is created to identify a user in scenarios
     # such as reseting password and activating the user by email.
     module TemporaryToken
       def self.included(base)
         base.extend(ClassMethods)
       end
-      
+
       # Random code, used for salt and temporary tokens.
       def self.generate_random_token
         SecureRandom.base64(15).tr('+/=lIO0', 'pqrsxyz')
       end
-      
+
       module ClassMethods
         def load_from_token(token, token_attr_name, token_expiration_date_attr)
           return nil if token.blank?
-          user = find_by_sorcery_token(token_attr_name,token)
+          user = sorcery_adapter.find_by_token(token_attr_name,token)
           if !user.blank? && !user.send(token_expiration_date_attr).nil?
             return Time.now.in_time_zone < user.send(token_expiration_date_attr) ? user : nil
           end

data/lib/sorcery/model.rb

@@ -7,91 +7,70 @@ module Sorcery
   # which when called adds the other capabilities to the class.
   # This method is also the place to configure the plugin in the Model layer.
   module Model
-    def self.included(klass)
-      klass.class_eval do
-        class << self
-          def authenticates_with_sorcery!
-            @sorcery_config = Config.new
-            self.class_eval do
-              extend ClassMethods # included here, before submodules, so they can be overriden by them.
-              include InstanceMethods
-              include TemporaryToken
-            end
+    def authenticates_with_sorcery!
+      @sorcery_config = Config.new
 
-            include_required_submodules!
+      extend ClassMethods # included here, before submodules, so they can be overriden by them.
+      include InstanceMethods
+      include TemporaryToken
 
-            # This runs the options block set in the initializer on the model class.
-            ::Sorcery::Controller::Config.user_config.tap{|blk| blk.call(@sorcery_config) if blk}
+      include_required_submodules!
 
-            init_mongoid_support! if defined?(Mongoid) and self.ancestors.include?(Mongoid::Document)
-            init_mongo_mapper_support! if defined?(MongoMapper) and self.ancestors.include?(MongoMapper::Document)
+      # This runs the options block set in the initializer on the model class.
+      ::Sorcery::Controller::Config.user_config.tap{|blk| blk.call(@sorcery_config) if blk}
 
-            init_orm_hooks!
+      define_base_fields
+      init_orm_hooks!
 
-            @sorcery_config.after_config << :add_config_inheritance if @sorcery_config.subclasses_inherit_config
-            @sorcery_config.after_config.each { |c| send(c) }
-          end
+      @sorcery_config.after_config << :add_config_inheritance if @sorcery_config.subclasses_inherit_config
+      @sorcery_config.after_config.each { |c| send(c) }
+    end
 
-          protected
-
-          # includes required submodules into the model class,
-          # which usually is called User.
-          def include_required_submodules!
-            self.class_eval do
-              @sorcery_config.submodules = ::Sorcery::Controller::Config.submodules
-              @sorcery_config.submodules.each do |mod|
-                begin
-                  include Submodules.const_get(mod.to_s.split("_").map {|p| p.capitalize}.join(""))
-                rescue NameError
-                  # don't stop on a missing submodule. Needed because some submodules are only defined
-                  # in the controller side.
-                end
-              end
-            end
-          end
+    private
 
-          # defines mongoid fields on the model class,
-          # using 1.8.x hash syntax to perserve compatibility.
-          def init_mongoid_support!
-            self.class_eval do
-              sorcery_config.username_attribute_names.each do |username|
-                field username,         :type => String
-              end
-              field sorcery_config.email_attribute_name,            :type => String unless sorcery_config.username_attribute_names.include?(sorcery_config.email_attribute_name)
-              field sorcery_config.crypted_password_attribute_name, :type => String
-              field sorcery_config.salt_attribute_name,             :type => String
-            end
-          end
+    def define_base_fields
+      self.class_eval do
+        sorcery_config.username_attribute_names.each do |username|
+          sorcery_adapter.define_field username, String, length: 255
+        end
+        unless sorcery_config.username_attribute_names.include?(sorcery_config.email_attribute_name)
+          sorcery_adapter.define_field sorcery_config.email_attribute_name, String, length: 255
+        end
+        sorcery_adapter.define_field sorcery_config.crypted_password_attribute_name, String, length: 255
+        sorcery_adapter.define_field sorcery_config.salt_attribute_name, String, length: 255
+      end
 
-          # defines mongo_mapper fields on the model class,
-          def init_mongo_mapper_support!
-            self.class_eval do
-              sorcery_config.username_attribute_names.each do |username|
-                key username, String
-              end
-              key sorcery_config.email_attribute_name, String unless sorcery_config.username_attribute_names.include?(sorcery_config.email_attribute_name)
-              key sorcery_config.crypted_password_attribute_name, String
-              key sorcery_config.salt_attribute_name, String
-            end
-          end
+    end
 
-          # add virtual password accessor and ORM callbacks.
-          def init_orm_hooks!
-            self.class_eval do
-              attr_accessor @sorcery_config.password_attribute_name
-              #attr_protected @sorcery_config.crypted_password_attribute_name, @sorcery_config.salt_attribute_name
-              before_save :encrypt_password, :if => Proc.new { |record|
-                record.send(sorcery_config.password_attribute_name).present?
-              }
-              after_save :clear_virtual_password, :if => Proc.new { |record|
-                record.send(sorcery_config.password_attribute_name).present?
-              }
-            end
+    # includes required submodules into the model class,
+    # which usually is called User.
+    def include_required_submodules!
+      self.class_eval do
+        @sorcery_config.submodules = ::Sorcery::Controller::Config.submodules
+        @sorcery_config.submodules.each do |mod|
+          begin
+            include Submodules.const_get(mod.to_s.split('_').map {|p| p.capitalize}.join)
+          rescue NameError
+            # don't stop on a missing submodule. Needed because some submodules are only defined
+            # in the controller side.
           end
         end
       end
     end
 
+    # add virtual password accessor and ORM callbacks.
+    def init_orm_hooks!
+      sorcery_adapter.define_callback :before, :validation, :encrypt_password, if: Proc.new {|record|
+        record.send(sorcery_config.password_attribute_name).present?
+      }
+
+      sorcery_adapter.define_callback :after, :save, :clear_virtual_password, if: Proc.new {|record|
+        record.send(sorcery_config.password_attribute_name).present?
+      }
+
+      attr_accessor sorcery_config.password_attribute_name
+    end
+
     module ClassMethods
       # Returns the class instance variable for configuration, when called by the class itself.
       def sorcery_config
@@ -111,12 +90,11 @@ module Sorcery
           credentials[0].downcase!
         end
 
-        user = find_by_credentials(credentials)
+        user = sorcery_adapter.find_by_credentials(credentials)
 
         set_encryption_attributes
 
-        _salt = user.send(@sorcery_config.salt_attribute_name) if user && !@sorcery_config.salt_attribute_name.nil? && !@sorcery_config.encryption_provider.nil?
-        user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && credentials_match?(user.send(@sorcery_config.crypted_password_attribute_name),credentials[1],_salt)
+        user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && user.valid_password?(credentials[1])
       end
 
       # encrypt tokens using current encryption_provider.
@@ -135,13 +113,7 @@ module Sorcery
         @sorcery_config.encryption_provider.stretches = @sorcery_config.stretches if @sorcery_config.encryption_provider.respond_to?(:stretches) && @sorcery_config.stretches
         @sorcery_config.encryption_provider.join_token = @sorcery_config.salt_join_token if @sorcery_config.encryption_provider.respond_to?(:join_token) && @sorcery_config.salt_join_token
       end
-
-      # Calls the configured encryption provider to compare the supplied password with the encrypted one.
-      def credentials_match?(crypted, *tokens)
-        return crypted == tokens.join if @sorcery_config.encryption_provider.nil?
-        @sorcery_config.encryption_provider.matches?(crypted, *tokens)
-      end
-
+      
       def add_config_inheritance
         self.class_eval do
           def self.inherited(subclass)
@@ -170,6 +142,16 @@ module Sorcery
         send(sorcery_config.crypted_password_attribute_name).nil?
       end
 
+      # Calls the configured encryption provider to compare the supplied password with the encrypted one.
+      def valid_password?(pass)
+        _crypted = self.send(sorcery_config.crypted_password_attribute_name)  
+        return _crypted == pass if sorcery_config.encryption_provider.nil?
+
+        _salt = self.send(sorcery_config.salt_attribute_name) unless sorcery_config.salt_attribute_name.nil?
+
+        sorcery_config.encryption_provider.matches?(_crypted, pass, _salt)
+      end
+
       protected
 
       # creates new salt and saves it.
@@ -183,6 +165,10 @@ module Sorcery
       def clear_virtual_password
         config = sorcery_config
         self.send(:"#{config.password_attribute_name}=", nil)
+
+        if respond_to?(:"#{config.password_attribute_name}_confirmation=")
+          self.send(:"#{config.password_attribute_name}_confirmation=", nil)
+        end
       end
 
       # calls the requested email method on the configured mailer
@@ -191,100 +177,14 @@ module Sorcery
         config = sorcery_config
         mail = config.send(mailer).send(config.send(method),self)
         if defined?(ActionMailer) and config.send(mailer).kind_of?(Class) and config.send(mailer) < ActionMailer::Base
-          mail.deliver
-        end
-      end
-    end
-
-    # Each class which calls 'activate_sorcery!' receives an instance of this class.
-    # Every submodule which gets loaded may add accessors to this class so that all
-    # options will be configured from a single place.
-    class Config
-
-      attr_accessor :username_attribute_names,           # change default username attribute, for example, to use :email
-                                                        # as the login.
-
-                    :password_attribute_name,           # change *virtual* password attribute, the one which is used
-                                                        # until an encrypted one is generated.
-
-                    :email_attribute_name,              # change default email attribute.
-
-                    :downcase_username_before_authenticating, # downcase the username before trying to authenticate, default is false
-
-                    :crypted_password_attribute_name,   # change default crypted_password attribute.
-                    :salt_join_token,                   # what pattern to use to join the password with the salt
-                    :salt_attribute_name,               # change default salt attribute.
-                    :stretches,                         # how many times to apply encryption to the password.
-                    :encryption_key,                    # encryption key used to encrypt reversible encryptions such as
-                                                        # AES256.
-
-                    :subclasses_inherit_config,         # make this configuration inheritable for subclasses. Useful for
-                                                        # ActiveRecord's STI.
-
-                    :submodules,                        # configured in config/application.rb
-                    :before_authenticate,               # an array of method names to call before authentication
-                                                        # completes. used internally.
-
-                    :after_config                       # an array of method names to call after configuration by user.
-                                                        # used internally.
-
-      attr_reader   :encryption_provider,               # change default encryption_provider.
-                    :custom_encryption_provider,        # use an external encryption class.
-                    :encryption_algorithm               # encryption algorithm name. See 'encryption_algorithm=' below
-                                                        # for available options.
-
-      def initialize
-        @defaults = {
-          :@submodules                           => [],
-          :@username_attribute_names              => [:email],
-          :@password_attribute_name              => :password,
-          :@downcase_username_before_authenticating => false,
-          :@email_attribute_name                 => :email,
-          :@crypted_password_attribute_name      => :crypted_password,
-          :@encryption_algorithm                 => :bcrypt,
-          :@encryption_provider                  => CryptoProviders::BCrypt,
-          :@custom_encryption_provider           => nil,
-          :@encryption_key                       => nil,
-          :@salt_join_token                      => "",
-          :@salt_attribute_name                  => :salt,
-          :@stretches                            => nil,
-          :@subclasses_inherit_config            => false,
-          :@before_authenticate                  => [],
-          :@after_config                         => []
-        }
-        reset!
-      end
-
-      # Resets all configuration options to their default values.
-      def reset!
-        @defaults.each do |k,v|
-          instance_variable_set(k,v)
-        end
-      end
-
-      def username_attribute_names=(fields)
-        @username_attribute_names = fields.kind_of?(Array) ? fields : [fields]
-      end
-
-      def custom_encryption_provider=(provider)
-        @custom_encryption_provider = @encryption_provider = provider
-      end
-
-      def encryption_algorithm=(algo)
-        @encryption_algorithm = algo
-        @encryption_provider = case @encryption_algorithm.to_sym
-        when :none   then nil
-        when :md5    then CryptoProviders::MD5
-        when :sha1   then CryptoProviders::SHA1
-        when :sha256 then CryptoProviders::SHA256
-        when :sha512 then CryptoProviders::SHA512
-        when :aes256 then CryptoProviders::AES256
-        when :bcrypt then CryptoProviders::BCrypt
-        when :custom then @custom_encryption_provider
-        else raise ArgumentError.new("Encryption algorithm supplied, #{algo}, is invalid")
+          # Rails 4.2 deprecates #deliver
+          if mail.respond_to?(:deliver_now)
+            mail.deliver_now
+          else
+            mail.deliver
+          end
         end
       end
-
     end
 
   end

data/lib/sorcery/protocols/oauth.rb

@@ -0,0 +1,42 @@
+require 'oauth'
+
+module Sorcery
+  module Protocols
+    module Oauth
+
+      def oauth_version
+        '1.0'
+      end
+
+      def get_request_token(token=nil,secret=nil)
+        return ::OAuth::RequestToken.new(get_consumer, token, secret) if token && secret
+        get_consumer.get_request_token(oauth_callback: @callback_url)
+      end
+
+      def authorize_url(args)
+        get_request_token(
+          args[:request_token],
+          args[:request_token_secret]
+        ).authorize_url({
+          oauth_callback: @callback_url
+        })
+      end
+
+      def get_access_token(args)
+        get_request_token(
+          args[:request_token],
+          args[:request_token_secret]
+        ).get_access_token({
+          oauth_verifier: args[:oauth_verifier]
+        })
+      end
+
+      protected
+
+      def get_consumer
+        ::OAuth::Consumer.new(@key, @secret, site: @site)
+      end
+
+    end
+  end
+end

data/lib/sorcery/protocols/oauth2.rb

@@ -0,0 +1,47 @@
+require 'oauth2'
+
+module Sorcery
+  module Protocols
+    module Oauth2
+
+      def oauth_version
+        '2.0'
+      end
+
+      def authorize_url(options = {})
+        client = build_client(options)
+        client.auth_code.authorize_url(
+          redirect_uri: @callback_url,
+          scope: @scope,
+          display: @display,
+          state: @state
+        )
+      end
+
+      def get_access_token(args, options = {})
+        client = build_client(options)
+        client.auth_code.get_token(
+          args[:code],
+          {
+            redirect_uri: @callback_url,
+            parse: options.delete(:parse)
+          },
+          options
+        )
+      end
+
+      def build_client(options = {})
+        defaults = {
+          site: @site,
+          ssl: { ca_file: Sorcery::Controller::Config.ca_file }
+        }
+        ::OAuth2::Client.new(
+          @key,
+          @secret,
+          defaults.merge!(options)
+        )
+      end
+
+    end
+  end
+end

data/lib/sorcery/providers/base.rb

@@ -0,0 +1,38 @@
+module Sorcery
+  module Providers
+    class Base
+
+      attr_reader   :access_token
+
+      attr_accessor :callback_url, :key, :original_callback_url, :secret,
+                    :site, :state, :user_info_mapping
+
+      def has_callback?; true; end
+
+      def initialize
+        @user_info_mapping = {}
+      end
+
+      def auth_hash(access_token, hash={})
+        return hash if access_token.nil?
+
+        token_hash = hash.dup
+        token_hash[:token] = access_token.token if access_token.respond_to?(:token)
+        token_hash[:refresh_token] = access_token.refresh_token if access_token.respond_to?(:refresh_token)
+        token_hash[:expires_at] = access_token.expires_at if access_token.respond_to?(:expires_at)
+        token_hash[:expires_in] = access_token.expires_at if access_token.respond_to?(:expires_in)
+        token_hash
+      end
+
+      def self.name
+        super.gsub(/Sorcery::Providers::/, '').downcase
+      end
+
+      # Ensure that all descendant classes are loaded before run this
+      def self.descendants
+        ObjectSpace.each_object(Class).select { |klass| klass < self }
+      end
+
+    end
+  end
+end