sorcery 0.8.5 → 0.9.0

data/lib/sorcery/test_helpers/internal/rails.rb

@@ -2,9 +2,9 @@ module Sorcery
   module TestHelpers
     module Internal
       module Rails
-        include ::Sorcery::TestHelpers::Rails
+        include ::Sorcery::TestHelpers::Rails::Controller
 
-        SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS = [
+        SUBMODULES_AUTO_ADDED_CONTROLLER_FILTERS = [
           :register_last_activity_time_to_db,
           :deny_banned_user,
           :validate_session
@@ -20,7 +20,13 @@ module Sorcery
           # remove all plugin before_filters so they won't fail other tests.
           # I don't like this way, but I didn't find another.
           # hopefully it won't break until Rails 4.
-          SorceryController._process_action_callbacks.delete_if {|c| SUBMODUELS_AUTO_ADDED_CONTROLLER_FILTERS.include?(c.filter) }
+          chain = if Gem::Version.new(::Rails::VERSION::STRING) >= Gem::Version.new("4.1.0")
+                    SorceryController._process_action_callbacks.send :chain
+                  else
+                    SorceryController._process_action_callbacks
+                  end
+
+          chain.delete_if {|c| SUBMODULES_AUTO_ADDED_CONTROLLER_FILTERS.include?(c.filter) }
 
           # configure
           ::Sorcery::Controller::Config.submodules = submodules
@@ -34,6 +40,11 @@ module Sorcery
             end
           end
           User.authenticates_with_sorcery!
+          if defined?(DataMapper) and User.ancestors.include?(DataMapper::Resource)
+            DataMapper.auto_migrate!
+            User.finalize
+            Authentication.finalize
+          end
         end
 
         def sorcery_controller_property_set(property, value)

data/lib/sorcery/test_helpers/internal.rb

@@ -30,14 +30,14 @@ module Sorcery
 
       def create_new_user(attributes_hash = nil)
         @user = build_new_user(attributes_hash)
-        @user.save!
+        @user.sorcery_adapter.save(:raise_on_failure => true)
         @user
       end
 
       def create_new_external_user(provider, attributes_hash = nil)
         user_attributes_hash = attributes_hash || {:username => 'gizmo'}
         @user = User.new(user_attributes_hash)
-        @user.save!
+        @user.sorcery_adapter.save(:raise_on_failure => true)
         @user.authentications.create!({:provider => provider, :uid => 123})
         @user
       end
@@ -47,7 +47,7 @@ module Sorcery
 
         user_attributes_hash = attributes_hash || {:username => 'gizmo'}
         @user = User.new(user_attributes_hash)
-        @user.save!
+        @user.sorcery_adapter.save(:raise_on_failure => true)
         @user.send(authentication_association).create!({:provider => provider, :uid => 123})
         @user
       end
@@ -58,6 +58,10 @@ module Sorcery
         end
       end
 
+      def update_model(&block)
+        User.class_exec(&block)
+      end
+
       private
 
       # reload user class between specs

data/lib/sorcery/test_helpers/rails/controller.rb

@@ -0,0 +1,21 @@
+module Sorcery
+  module TestHelpers
+    module Rails
+      module Controller
+        def login_user(user = nil, test_context = {})
+          user ||= @user
+          @controller.send(:auto_login, user)
+          @controller.send(:after_login!, user, [user.send(user.sorcery_config.username_attribute_names.first), 'secret'])
+        end
+
+        def logout_user
+          @controller.send(:logout)
+        end
+
+        def logged_in?
+          @controller.send(:logged_in?)
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/test_helpers/rails/integration.rb

@@ -0,0 +1,26 @@
+module Sorcery
+  module TestHelpers
+    module Rails
+      module Integration
+        
+        #Accepts arguments for user to login, route to use and HTTP method
+        #Defaults - @user, 'sessions_url' and POST
+        def login_user(user = nil, route = nil, http_method = :post)
+          user ||= @user
+          route ||= sessions_url
+
+          username_attr = user.sorcery_config.username_attribute_names.first
+          username = user.send(username_attr)
+          page.driver.send(http_method, route, { :"#{username_attr}" => username, :password => 'secret' })
+        end
+
+        #Accepts route and HTTP method arguments
+        #Default - 'logout_url' and GET
+        def logout_user(route = nil, http_method = :get)
+          route ||= logout_url
+          page.driver.send(http_method, route)
+        end
+      end
+    end
+  end
+end

data/lib/sorcery/version.rb

@@ -0,0 +1,3 @@
+module Sorcery
+  VERSION = "0.9.0"
+end

data/lib/sorcery.rb

@@ -1,86 +1,110 @@
+require 'sorcery/version'
+
 module Sorcery
-  autoload :Model, 'sorcery/model'
+
+  require 'sorcery/model'
+
+  module Adapters
+    require 'sorcery/adapters/base_adapter'
+  end
+
   module Model
-    autoload :TemporaryToken, 'sorcery/model/temporary_token'
-    module Adapters
-      autoload :ActiveRecord, 'sorcery/model/adapters/active_record'
-      autoload :Mongoid, 'sorcery/model/adapters/mongoid'
-      autoload :MongoMapper, 'sorcery/model/adapters/mongo_mapper'
-    end
+    require 'sorcery/model/temporary_token'
+    require 'sorcery/model/config'
+
+
     module Submodules
-      autoload :UserActivation, 'sorcery/model/submodules/user_activation'
-      autoload :ResetPassword, 'sorcery/model/submodules/reset_password'
-      autoload :RememberMe, 'sorcery/model/submodules/remember_me'
-      autoload :ActivityLogging, 'sorcery/model/submodules/activity_logging'
-      autoload :BruteForceProtection, 'sorcery/model/submodules/brute_force_protection'
-      autoload :External, 'sorcery/model/submodules/external'
+      require 'sorcery/model/submodules/user_activation'
+      require 'sorcery/model/submodules/reset_password'
+      require 'sorcery/model/submodules/remember_me'
+      require 'sorcery/model/submodules/activity_logging'
+      require 'sorcery/model/submodules/brute_force_protection'
+      require 'sorcery/model/submodules/external'
     end
   end
-  autoload :Controller, 'sorcery/controller'
+
+  require 'sorcery/controller'
+
   module Controller
+    autoload :Config, 'sorcery/controller/config'
     module Submodules
-      autoload :RememberMe, 'sorcery/controller/submodules/remember_me'
-      autoload :SessionTimeout, 'sorcery/controller/submodules/session_timeout'
-      autoload :BruteForceProtection, 'sorcery/controller/submodules/brute_force_protection'
-      autoload :HttpBasicAuth, 'sorcery/controller/submodules/http_basic_auth'
-      autoload :ActivityLogging, 'sorcery/controller/submodules/activity_logging'
-      autoload :External, 'sorcery/controller/submodules/external'
-      module External
-        module Protocols
-          autoload :Oauth1, 'sorcery/controller/submodules/external/protocols/oauth1'
-          autoload :Oauth2, 'sorcery/controller/submodules/external/protocols/oauth2'
-        end
-        module Providers
-          autoload :Base, 'sorcery/controller/submodules/external/providers/base'
-          autoload :Twitter, 'sorcery/controller/submodules/external/providers/twitter'
-          autoload :Facebook, 'sorcery/controller/submodules/external/providers/facebook'
-          autoload :Github, 'sorcery/controller/submodules/external/providers/github'
-          autoload :Google, 'sorcery/controller/submodules/external/providers/google'
-          autoload :Liveid, 'sorcery/controller/submodules/external/providers/liveid'
-          autoload :Linkedin, 'sorcery/controller/submodules/external/providers/linkedin'
-          autoload :Vk, 'sorcery/controller/submodules/external/providers/vk'
-          autoload :Xing, 'sorcery/controller/submodules/external/providers/xing'
-        end
-      end
+      require 'sorcery/controller/submodules/remember_me'
+      require 'sorcery/controller/submodules/session_timeout'
+      require 'sorcery/controller/submodules/brute_force_protection'
+      require 'sorcery/controller/submodules/http_basic_auth'
+      require 'sorcery/controller/submodules/activity_logging'
+      require 'sorcery/controller/submodules/external'
     end
   end
+
+  module Protocols
+    require 'sorcery/protocols/oauth'
+    require 'sorcery/protocols/oauth2'
+  end
+
   module CryptoProviders
-    autoload :Common, 'sorcery/crypto_providers/common'
-    autoload :AES256, 'sorcery/crypto_providers/aes256'
-    autoload :BCrypt, 'sorcery/crypto_providers/bcrypt'
-    autoload :MD5,    'sorcery/crypto_providers/md5'
-    autoload :SHA1,   'sorcery/crypto_providers/sha1'
-    autoload :SHA256, 'sorcery/crypto_providers/sha256'
-    autoload :SHA512, 'sorcery/crypto_providers/sha512'
+    require 'sorcery/crypto_providers/common'
+    require 'sorcery/crypto_providers/aes256'
+    require 'sorcery/crypto_providers/bcrypt'
+    require 'sorcery/crypto_providers/md5'
+    require 'sorcery/crypto_providers/sha1'
+    require 'sorcery/crypto_providers/sha256'
+    require 'sorcery/crypto_providers/sha512'
   end
-  autoload :TestHelpers, 'sorcery/test_helpers'
+
   module TestHelpers
-    autoload :Rails, 'sorcery/test_helpers/rails'
-    autoload :Internal, 'sorcery/test_helpers/internal'
+    require 'sorcery/test_helpers/internal'
+
+    module Rails
+      require 'sorcery/test_helpers/rails/controller'
+      require 'sorcery/test_helpers/rails/integration'
+    end
+
     module Internal
-      autoload :Rails, 'sorcery/test_helpers/internal/rails'
+      require 'sorcery/test_helpers/internal/rails'
     end
 
   end
 
+  require 'sorcery/adapters/base_adapter'
+
   if defined?(ActiveRecord)
-    ActiveRecord::Base.send(:include, Sorcery::Model)
-    ActiveRecord::Base.send(:include, Sorcery::Model::Adapters::ActiveRecord)
+    require 'sorcery/adapters/active_record_adapter'
+    ActiveRecord::Base.extend Sorcery::Model
+
+    ActiveRecord::Base.send :define_method, :sorcery_adapter do
+      @sorcery_adapter ||= Sorcery::Adapters::ActiveRecordAdapter.new(self)
+    end
+
+    ActiveRecord::Base.send :define_singleton_method, :sorcery_adapter do
+      Sorcery::Adapters::ActiveRecordAdapter.from(self)
+    end
   end
 
   if defined?(Mongoid)
-    Mongoid::Document.module_eval do
-      included do
-        attr_reader :new_record
-        include Sorcery::Model
-        include Sorcery::Model::Adapters::Mongoid
-      end
+    require 'sorcery/adapters/mongoid_adapter'
+    Mongoid::Document::ClassMethods.send :include, Sorcery::Model
+
+    Mongoid::Document.send :define_method, :sorcery_adapter do
+      @sorcery_adapter ||= Sorcery::Adapters::MongoidAdapter.new(self)
+    end
+
+    Mongoid::Document::ClassMethods.send :define_method, :sorcery_adapter do
+      Sorcery::Adapters::MongoidAdapter.from(self)
     end
   end
 
   if defined?(MongoMapper)
-    MongoMapper::Document.send(:plugin, Sorcery::Model::Adapters::MongoMapper)
+    require 'sorcery/adapters/mongo_mapper_adapter'
+    MongoMapper::Document.send(:plugin, Sorcery::Adapters::MongoMapperAdapter::Wrapper)
+  end
+
+  if defined?(DataMapper)
+    require 'sorcery/adapters/data_mapper_adapter'
+    DataMapper::Model.append_extensions(Sorcery::Model)
+
+    DataMapper::Model.append_inclusions(Sorcery::Adapters::DataMapperAdapter::Wrapper)
   end
 
-  require 'sorcery/engine' if defined?(Rails) && Rails::VERSION::MAJOR >= 3
+  require 'sorcery/engine' if defined?(Rails)
 end

data/sorcery.gemspec

@@ -1,10 +1,14 @@
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'sorcery/version'
+
 Gem::Specification.new do |s|
   s.name = "sorcery"
-  s.version = "0.8.5"
-  s.authors = ["Noam Ben Ari", "Kir Shatrov"]
+  s.version = Sorcery::VERSION
+  s.authors = ["Noam Ben Ari", "Kir Shatrov", "Grzegorz Witek"]
   s.email = "nbenari@gmail.com"
   s.description = "Provides common authentication needs such as signing in/out, activating by email and resetting password."
-  s.summary = "Magical authentication for Rails 3 applications"
+  s.summary = "Magical authentication for Rails 3 & 4 applications"
   s.homepage = "http://github.com/NoamB/sorcery"
 
   s.files         = `git ls-files`.split($/)
@@ -14,21 +18,17 @@ Gem::Specification.new do |s|
 
   s.required_ruby_version = '>= 1.9.3'
 
-  s.add_dependency("oauth", "~> 0.4.4")
-  s.add_dependency("oauth2", ">= 0.8.0", "< 1.0.0")
-  s.add_dependency("bcrypt-ruby", ">= 3.0")
-
-  s.add_development_dependency("abstract", ">= 1.0.0")
-  s.add_development_dependency("rails", ">= 3.2.15")
-  s.add_development_dependency("json", ">= 1.7.7")
-  s.add_development_dependency("rspec", "~> 2.5.0")
-  s.add_development_dependency("rspec-rails", "~> 2.5.0")
-  s.add_development_dependency("sqlite3", ">= 0")
-  s.add_development_dependency("yard", "~> 0.6.0")
-  s.add_development_dependency("bundler", ">= 1.1.0")
-  s.add_development_dependency("simplecov", ">= 0.3.8")
-  s.add_development_dependency("timecop", ">= 0")
-  s.add_development_dependency("mongo_mapper", ">= 0")
-  s.add_development_dependency("mongoid", "~> 2.4.4")
+  s.add_dependency "oauth", "~> 0.4", ">= 0.4.4"
+  s.add_dependency "oauth2", ">= 0.8.0"
+  s.add_dependency "bcrypt", "~> 3.1"
+
+  s.add_development_dependency "abstract", ">= 1.0.0"
+  s.add_development_dependency "json", ">= 1.7.7"
+  s.add_development_dependency "yard", "~> 0.6.0"
+
+  s.add_development_dependency "timecop"
+  s.add_development_dependency "simplecov", ">= 0.3.8"
+  s.add_development_dependency "rspec", "~> 3.0.0"
+  s.add_development_dependency "rspec-rails", "~> 3.0.0"
 end
 

data/spec/active_record/user_activation_spec.rb

@@ -3,7 +3,7 @@ require 'spec_helper'
 require 'rails_app/app/mailers/sorcery_mailer'
 require 'shared_examples/user_activation_shared_examples'
 
-describe "User with activation submodule" do
+describe User, "with activation submodule", :active_record => true do
   before(:all) do
     ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/activation")
     User.reset_column_information

data/spec/active_record/user_activity_logging_spec.rb

@@ -1,7 +1,16 @@
 require 'spec_helper'
 require 'shared_examples/user_activity_logging_shared_examples'
 
-describe "User with activity logging submodule" do
+describe User, "with activity logging submodule", :active_record => true do
+
+  before(:all) do
+    ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/activity_logging")
+    User.reset_column_information
+  end
+
+  after(:all) do
+    ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activity_logging")
+  end
 
   it_behaves_like "rails_3_activity_logging_model"
 

data/spec/active_record/user_brute_force_protection_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 require 'shared_examples/user_brute_force_protection_shared_examples'
 
-describe "User with brute_force_protection submodule" do
+describe User, "with brute_force_protection submodule", :active_record => true do
   before(:all) do
     ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/brute_force_protection")
     User.reset_column_information

data/spec/active_record/user_oauth_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 require 'shared_examples/user_oauth_shared_examples'
 
-describe "User with oauth submodule" do
+describe User, "with oauth submodule", :active_record => true do
   before(:all) do
     ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
     User.reset_column_information

data/spec/active_record/user_remember_me_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 require 'shared_examples/user_remember_me_shared_examples'
 
-describe "User with remember_me submodule" do
+describe User, "with remember_me submodule", :active_record => true do
   before(:all) do
     ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/remember_me")
     User.reset_column_information

data/spec/active_record/user_reset_password_spec.rb

@@ -1,7 +1,7 @@
 require 'spec_helper'
 require 'shared_examples/user_reset_password_shared_examples'
 
-describe "User with reset_password submodule" do
+describe User, "with reset_password submodule", :active_record => true do
   before(:all) do
     ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/reset_password")
     User.reset_column_information

data/spec/active_record/user_spec.rb

@@ -1,20 +1,19 @@
 require 'spec_helper'
-
 require 'rails_app/app/mailers/sorcery_mailer'
 require 'shared_examples/user_shared_examples'
 
-describe "User with no submodules (core)" do
+describe User, "with no submodules (core)", :active_record => true do
   before(:all) do
     sorcery_reload!
   end
 
-  describe User, "when app has plugin loaded" do
-    it "should respond to the plugin activation class method" do
-      ActiveRecord::Base.should respond_to(:authenticates_with_sorcery!)
+  context "when app has plugin loaded" do
+    it "responds to the plugin activation class method" do
+      expect(ActiveRecord::Base).to respond_to :authenticates_with_sorcery!
     end
 
-    it "User should respond_to .authenticates_with_sorcery!" do
-      User.should respond_to(:authenticates_with_sorcery!)
+    it "User responds to .authenticates_with_sorcery!" do
+      expect(User).to respond_to :authenticates_with_sorcery!
     end
   end
 
@@ -22,7 +21,7 @@ describe "User with no submodules (core)" do
 
   it_should_behave_like "rails_3_core_model"
 
-  describe User, "external users" do
+  describe "external users" do
     before(:all) do
       ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/external")
       User.reset_column_information

data/spec/controllers/controller_activity_logging_spec.rb

@@ -0,0 +1,124 @@
+require 'spec_helper'
+
+# require 'shared_examples/controller_activity_logging_shared_examples'
+
+describe SorceryController do
+  after(:all) do
+    sorcery_controller_property_set(:register_login_time, true)
+    sorcery_controller_property_set(:register_logout_time, true)
+    sorcery_controller_property_set(:register_last_activity_time, true)
+    # sorcery_controller_property_set(:last_login_from_ip_address_name, true)
+  end
+
+  # ----------------- ACTIVITY LOGGING -----------------------
+  context "with activity logging features" do
+
+    let(:adapter) { double('sorcery_adapter') }
+    let(:user) { double('user', id: 42, sorcery_adapter: adapter) }
+
+    before(:all) do
+      sorcery_reload!([:activity_logging])
+    end
+
+    specify { expect(subject).to respond_to(:current_users) }
+
+    before(:each) do
+      allow(user).to receive(:username)
+      allow(user).to receive_message_chain(:sorcery_config, :username_attribute_names, :first) { :username }
+      allow(User.sorcery_config).to receive(:last_login_at_attribute_name) { :last_login_at }
+      allow(User.sorcery_config).to receive(:last_login_from_ip_address_name) { :last_login_from_ip_address }
+
+      sorcery_controller_property_set(:register_login_time, false)
+      sorcery_controller_property_set(:register_last_ip_address, false)
+      sorcery_controller_property_set(:register_last_activity_time, false)
+    end
+
+    it "'current_users' should proxy to User.current_users" do
+      expect(User).to receive(:current_users).with(no_args)
+
+      subject.current_users
+    end
+
+
+    it "logs login time on login" do
+      now = Time.now.in_time_zone
+      Timecop.freeze(now)
+
+      sorcery_controller_property_set(:register_login_time, true)
+      expect(user).to receive(:set_last_login_at).with(be_within(0.1).of(now))
+      login_user(user)
+
+      Timecop.return
+    end
+
+    it "logs logout time on logout" do
+      login_user(user)
+      now = Time.now.in_time_zone
+      Timecop.freeze(now)
+      expect(user).to receive(:set_last_logout_at).with(be_within(0.1).of(now))
+
+      logout_user
+
+      Timecop.return
+    end
+
+    it "logs last activity time when logged in" do
+      sorcery_controller_property_set(:register_last_activity_time, true)
+
+      login_user(user)
+      now = Time.now.in_time_zone
+      Timecop.freeze(now)
+      expect(user).to receive(:set_last_activity_at).with(be_within(0.1).of(now))
+
+      get :some_action
+
+      Timecop.return
+    end
+
+    it "logs last IP address when logged in" do
+      sorcery_controller_property_set(:register_last_ip_address, true)
+      expect(user).to receive(:set_last_ip_addess).with('0.0.0.0')
+
+      login_user(user)
+    end
+
+    it "updates nothing but activity fields" do
+      pending 'Move to model'
+      original_user_name = User.last.username
+      login_user(user)
+      get :some_action_making_a_non_persisted_change_to_the_user
+
+      expect(User.last.username).to eq original_user_name
+    end
+
+    it "does not register login time if configured so" do
+      sorcery_controller_property_set(:register_login_time, false)
+
+      expect(user).to receive(:set_last_login_at).never
+      login_user(user)
+    end
+
+    it "does not register logout time if configured so" do
+      sorcery_controller_property_set(:register_logout_time, false)
+      login_user(user)
+
+      expect(user).to receive(:set_last_logout_at).never
+      logout_user
+    end
+
+    it "does not register last activity time if configured so" do
+      sorcery_controller_property_set(:register_last_activity_time, false)
+
+      expect(user).to receive(:set_last_activity_at).never
+      login_user(user)
+    end
+
+    it "does not register last IP address if configured so" do
+      sorcery_controller_property_set(:register_last_ip_address, false)
+      expect(user).to receive(:set_last_ip_addess).never
+
+      login_user(user)
+    end
+
+  end
+end

data/spec/controllers/controller_brute_force_protection_spec.rb

@@ -0,0 +1,43 @@
+require 'spec_helper'
+
+describe SorceryController do
+
+  let(:user) { double('user', id: 42, email: 'bla@bla.com') }
+
+  def request_test_login
+    get :test_login, email: 'bla@bla.com', password: 'blabla'
+  end
+
+  # ----------------- SESSION TIMEOUT -----------------------
+  describe "brute force protection features" do
+
+    before(:all) do
+      sorcery_reload!([:brute_force_protection])
+    end
+
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      sorcery_controller_property_set(:user_class, User)
+      Timecop.return
+    end
+
+    it "counts login retries" do
+      allow(User).to receive(:authenticate)
+      allow(User.sorcery_adapter).to receive(:find_by_credentials).with(['bla@bla.com', 'blabla']).and_return(user)
+
+      expect(user).to receive(:register_failed_login!).exactly(3).times
+
+      3.times { request_test_login }
+    end
+
+    it "resets the counter on a good login" do
+      # dirty hack for rails 4
+      allow(@controller).to receive(:register_last_activity_time_to_db)
+
+      allow(User).to receive(:authenticate).and_return(user)
+      expect(user).to receive_message_chain(:sorcery_adapter, :update_attribute).with(:failed_logins_count, 0)
+
+      get :test_login, email: 'bla@bla.com', password: 'secret'
+    end
+  end
+end