sorcery 0.8.6 → 0.9.1

data/lib/sorcery/test_helpers/rails/controller.rb

@@ -1,7 +1,7 @@
 module Sorcery
   module TestHelpers
     module Rails
-      module Controller 
+      module Controller
         def login_user(user = nil, test_context = {})
           user ||= @user
           @controller.send(:auto_login, user)
@@ -11,6 +11,10 @@ module Sorcery
         def logout_user
           @controller.send(:logout)
         end
+
+        def logged_in?
+          @controller.send(:logged_in?)
+        end
       end
     end
   end

data/lib/sorcery/version.rb

@@ -0,0 +1,3 @@
+module Sorcery
+  VERSION = "0.9.1"
+end

data/lib/sorcery.rb

@@ -1,78 +1,110 @@
+require 'sorcery/version'
+
 module Sorcery
-  autoload :Model, 'sorcery/model'
+
+  require 'sorcery/model'
+
+  module Adapters
+    require 'sorcery/adapters/base_adapter'
+  end
+
   module Model
-    autoload :TemporaryToken, 'sorcery/model/temporary_token'
-    module Adapters
-      autoload :ActiveRecord, 'sorcery/model/adapters/active_record'
-      autoload :Mongoid, 'sorcery/model/adapters/mongoid'
-      autoload :MongoMapper, 'sorcery/model/adapters/mongo_mapper'
-      autoload :DataMapper, 'sorcery/model/adapters/datamapper'
-    end
+    require 'sorcery/model/temporary_token'
+    require 'sorcery/model/config'
+
+
     module Submodules
-      autoload :UserActivation, 'sorcery/model/submodules/user_activation'
-      autoload :ResetPassword, 'sorcery/model/submodules/reset_password'
-      autoload :RememberMe, 'sorcery/model/submodules/remember_me'
-      autoload :ActivityLogging, 'sorcery/model/submodules/activity_logging'
-      autoload :BruteForceProtection, 'sorcery/model/submodules/brute_force_protection'
-      autoload :External, 'sorcery/model/submodules/external'
+      require 'sorcery/model/submodules/user_activation'
+      require 'sorcery/model/submodules/reset_password'
+      require 'sorcery/model/submodules/remember_me'
+      require 'sorcery/model/submodules/activity_logging'
+      require 'sorcery/model/submodules/brute_force_protection'
+      require 'sorcery/model/submodules/external'
     end
   end
-  autoload :Controller, 'sorcery/controller'
+
+  require 'sorcery/controller'
+
   module Controller
+    autoload :Config, 'sorcery/controller/config'
     module Submodules
-      autoload :RememberMe, 'sorcery/controller/submodules/remember_me'
-      autoload :SessionTimeout, 'sorcery/controller/submodules/session_timeout'
-      autoload :BruteForceProtection, 'sorcery/controller/submodules/brute_force_protection'
-      autoload :HttpBasicAuth, 'sorcery/controller/submodules/http_basic_auth'
-      autoload :ActivityLogging, 'sorcery/controller/submodules/activity_logging'
-      autoload :External, 'sorcery/controller/submodules/external'
+      require 'sorcery/controller/submodules/remember_me'
+      require 'sorcery/controller/submodules/session_timeout'
+      require 'sorcery/controller/submodules/brute_force_protection'
+      require 'sorcery/controller/submodules/http_basic_auth'
+      require 'sorcery/controller/submodules/activity_logging'
+      require 'sorcery/controller/submodules/external'
     end
   end
+
   module Protocols
-    autoload :Oauth, 'sorcery/protocols/oauth'
-    autoload :Oauth2, 'sorcery/protocols/oauth2'
+    require 'sorcery/protocols/oauth'
+    require 'sorcery/protocols/oauth2'
   end
+
   module CryptoProviders
-    autoload :Common, 'sorcery/crypto_providers/common'
-    autoload :AES256, 'sorcery/crypto_providers/aes256'
-    autoload :BCrypt, 'sorcery/crypto_providers/bcrypt'
-    autoload :MD5,    'sorcery/crypto_providers/md5'
-    autoload :SHA1,   'sorcery/crypto_providers/sha1'
-    autoload :SHA256, 'sorcery/crypto_providers/sha256'
-    autoload :SHA512, 'sorcery/crypto_providers/sha512'
+    require 'sorcery/crypto_providers/common'
+    require 'sorcery/crypto_providers/aes256'
+    require 'sorcery/crypto_providers/bcrypt'
+    require 'sorcery/crypto_providers/md5'
+    require 'sorcery/crypto_providers/sha1'
+    require 'sorcery/crypto_providers/sha256'
+    require 'sorcery/crypto_providers/sha512'
   end
+
   module TestHelpers
-    autoload :Internal, 'sorcery/test_helpers/internal'
-    module Internal
-      autoload :Rails, 'sorcery/test_helpers/internal/rails'
-    end
-    autoload :Rails, 'sorcery/test_helpers/rails'
+    require 'sorcery/test_helpers/internal'
+
     module Rails
-      autoload :Controller, 'sorcery/test_helpers/rails/controller'
-      autoload :Integration, 'sorcery/test_helpers/rails/integration'
+      require 'sorcery/test_helpers/rails/controller'
+      require 'sorcery/test_helpers/rails/integration'
+    end
+
+    module Internal
+      require 'sorcery/test_helpers/internal/rails'
     end
 
   end
 
+  require 'sorcery/adapters/base_adapter'
+
   if defined?(ActiveRecord)
+    require 'sorcery/adapters/active_record_adapter'
     ActiveRecord::Base.extend Sorcery::Model
-    ActiveRecord::Base.send :include, Sorcery::Model::Adapters::ActiveRecord
+
+    ActiveRecord::Base.send :define_method, :sorcery_adapter do
+      @sorcery_adapter ||= Sorcery::Adapters::ActiveRecordAdapter.new(self)
+    end
+
+    ActiveRecord::Base.send :define_singleton_method, :sorcery_adapter do
+      Sorcery::Adapters::ActiveRecordAdapter.from(self)
+    end
   end
 
   if defined?(Mongoid)
+    require 'sorcery/adapters/mongoid_adapter'
     Mongoid::Document::ClassMethods.send :include, Sorcery::Model
-    Mongoid::Document::ClassMethods.send :include, Sorcery::Model::Adapters::Mongoid::ClassMethods
-    Mongoid::Document.send :include, Sorcery::Model::Adapters::Mongoid::InstanceMethods
+
+    Mongoid::Document.send :define_method, :sorcery_adapter do
+      @sorcery_adapter ||= Sorcery::Adapters::MongoidAdapter.new(self)
+    end
+
+    Mongoid::Document::ClassMethods.send :define_method, :sorcery_adapter do
+      Sorcery::Adapters::MongoidAdapter.from(self)
+    end
   end
 
   if defined?(MongoMapper)
-    MongoMapper::Document.send(:plugin, Sorcery::Model::Adapters::MongoMapper)
+    require 'sorcery/adapters/mongo_mapper_adapter'
+    MongoMapper::Document.send(:plugin, Sorcery::Adapters::MongoMapperAdapter::Wrapper)
   end
 
   if defined?(DataMapper)
+    require 'sorcery/adapters/data_mapper_adapter'
     DataMapper::Model.append_extensions(Sorcery::Model)
-    DataMapper::Model.append_inclusions(Sorcery::Model::Adapters::DataMapper)
+
+    DataMapper::Model.append_inclusions(Sorcery::Adapters::DataMapperAdapter::Wrapper)
   end
 
-  require 'sorcery/engine' if defined?(Rails) && Rails::VERSION::MAJOR >= 3
+  require 'sorcery/engine' if defined?(Rails)
 end

data/sorcery.gemspec

@@ -1,6 +1,10 @@
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'sorcery/version'
+
 Gem::Specification.new do |s|
   s.name = "sorcery"
-  s.version = "0.8.6"
+  s.version = Sorcery::VERSION
   s.authors = ["Noam Ben Ari", "Kir Shatrov", "Grzegorz Witek"]
   s.email = "nbenari@gmail.com"
   s.description = "Provides common authentication needs such as signing in/out, activating by email and resetting password."
@@ -15,7 +19,7 @@ Gem::Specification.new do |s|
   s.required_ruby_version = '>= 1.9.3'
 
   s.add_dependency "oauth", "~> 0.4", ">= 0.4.4"
-  s.add_dependency "oauth2", ">= 0.8.0", "< 1.0.0"
+  s.add_dependency "oauth2", ">= 0.8.0"
   s.add_dependency "bcrypt", "~> 3.1"
 
   s.add_development_dependency "abstract", ">= 1.0.0"

data/spec/active_record/user_activity_logging_spec.rb

@@ -3,6 +3,15 @@ require 'shared_examples/user_activity_logging_shared_examples'
 
 describe User, "with activity logging submodule", :active_record => true do
 
+  before(:all) do
+    ActiveRecord::Migrator.migrate("#{Rails.root}/db/migrate/activity_logging")
+    User.reset_column_information
+  end
+
+  after(:all) do
+    ActiveRecord::Migrator.rollback("#{Rails.root}/db/migrate/activity_logging")
+  end
+
   it_behaves_like "rails_3_activity_logging_model"
 
 end

data/spec/controllers/controller_activity_logging_spec.rb

@@ -0,0 +1,124 @@
+require 'spec_helper'
+
+# require 'shared_examples/controller_activity_logging_shared_examples'
+
+describe SorceryController do
+  after(:all) do
+    sorcery_controller_property_set(:register_login_time, true)
+    sorcery_controller_property_set(:register_logout_time, true)
+    sorcery_controller_property_set(:register_last_activity_time, true)
+    # sorcery_controller_property_set(:last_login_from_ip_address_name, true)
+  end
+
+  # ----------------- ACTIVITY LOGGING -----------------------
+  context "with activity logging features" do
+
+    let(:adapter) { double('sorcery_adapter') }
+    let(:user) { double('user', id: 42, sorcery_adapter: adapter) }
+
+    before(:all) do
+      sorcery_reload!([:activity_logging])
+    end
+
+    specify { expect(subject).to respond_to(:current_users) }
+
+    before(:each) do
+      allow(user).to receive(:username)
+      allow(user).to receive_message_chain(:sorcery_config, :username_attribute_names, :first) { :username }
+      allow(User.sorcery_config).to receive(:last_login_at_attribute_name) { :last_login_at }
+      allow(User.sorcery_config).to receive(:last_login_from_ip_address_name) { :last_login_from_ip_address }
+
+      sorcery_controller_property_set(:register_login_time, false)
+      sorcery_controller_property_set(:register_last_ip_address, false)
+      sorcery_controller_property_set(:register_last_activity_time, false)
+    end
+
+    it "'current_users' should proxy to User.current_users" do
+      expect(User).to receive(:current_users).with(no_args)
+
+      subject.current_users
+    end
+
+
+    it "logs login time on login" do
+      now = Time.now.in_time_zone
+      Timecop.freeze(now)
+
+      sorcery_controller_property_set(:register_login_time, true)
+      expect(user).to receive(:set_last_login_at).with(be_within(0.1).of(now))
+      login_user(user)
+
+      Timecop.return
+    end
+
+    it "logs logout time on logout" do
+      login_user(user)
+      now = Time.now.in_time_zone
+      Timecop.freeze(now)
+      expect(user).to receive(:set_last_logout_at).with(be_within(0.1).of(now))
+
+      logout_user
+
+      Timecop.return
+    end
+
+    it "logs last activity time when logged in" do
+      sorcery_controller_property_set(:register_last_activity_time, true)
+
+      login_user(user)
+      now = Time.now.in_time_zone
+      Timecop.freeze(now)
+      expect(user).to receive(:set_last_activity_at).with(be_within(0.1).of(now))
+
+      get :some_action
+
+      Timecop.return
+    end
+
+    it "logs last IP address when logged in" do
+      sorcery_controller_property_set(:register_last_ip_address, true)
+      expect(user).to receive(:set_last_ip_addess).with('0.0.0.0')
+
+      login_user(user)
+    end
+
+    it "updates nothing but activity fields" do
+      pending 'Move to model'
+      original_user_name = User.last.username
+      login_user(user)
+      get :some_action_making_a_non_persisted_change_to_the_user
+
+      expect(User.last.username).to eq original_user_name
+    end
+
+    it "does not register login time if configured so" do
+      sorcery_controller_property_set(:register_login_time, false)
+
+      expect(user).to receive(:set_last_login_at).never
+      login_user(user)
+    end
+
+    it "does not register logout time if configured so" do
+      sorcery_controller_property_set(:register_logout_time, false)
+      login_user(user)
+
+      expect(user).to receive(:set_last_logout_at).never
+      logout_user
+    end
+
+    it "does not register last activity time if configured so" do
+      sorcery_controller_property_set(:register_last_activity_time, false)
+
+      expect(user).to receive(:set_last_activity_at).never
+      login_user(user)
+    end
+
+    it "does not register last IP address if configured so" do
+      sorcery_controller_property_set(:register_last_ip_address, false)
+      expect(user).to receive(:set_last_ip_addess).never
+
+      login_user(user)
+    end
+
+  end
+end

data/spec/controllers/controller_brute_force_protection_spec.rb

@@ -0,0 +1,43 @@
+require 'spec_helper'
+
+describe SorceryController do
+
+  let(:user) { double('user', id: 42, email: 'bla@bla.com') }
+
+  def request_test_login
+    get :test_login, email: 'bla@bla.com', password: 'blabla'
+  end
+
+  # ----------------- SESSION TIMEOUT -----------------------
+  describe "brute force protection features" do
+
+    before(:all) do
+      sorcery_reload!([:brute_force_protection])
+    end
+
+    after(:each) do
+      Sorcery::Controller::Config.reset!
+      sorcery_controller_property_set(:user_class, User)
+      Timecop.return
+    end
+
+    it "counts login retries" do
+      allow(User).to receive(:authenticate)
+      allow(User.sorcery_adapter).to receive(:find_by_credentials).with(['bla@bla.com', 'blabla']).and_return(user)
+
+      expect(user).to receive(:register_failed_login!).exactly(3).times
+
+      3.times { request_test_login }
+    end
+
+    it "resets the counter on a good login" do
+      # dirty hack for rails 4
+      allow(@controller).to receive(:register_last_activity_time_to_db)
+
+      allow(User).to receive(:authenticate).and_return(user)
+      expect(user).to receive_message_chain(:sorcery_adapter, :update_attribute).with(:failed_logins_count, 0)
+
+      get :test_login, email: 'bla@bla.com', password: 'secret'
+    end
+  end
+end

data/spec/{active_record → controllers}/controller_http_basic_auth_spec.rb

@@ -1,10 +1,9 @@
 require 'spec_helper'
 
-describe SorceryController, :active_record => true do
+describe SorceryController do
 
-  let!(:user) { create_new_user }
+  let(:user) { double("user", id: 42, email: 'bla@bla.com') }
 
-  # ----------------- HTTP BASIC AUTH -----------------------
   describe  "with http basic auth features" do
     before(:all) do
       sorcery_reload!([:http_basic_auth])
@@ -19,22 +18,24 @@ describe SorceryController, :active_record => true do
     it "requests basic authentication when before_filter is used" do
       get :test_http_basic_auth
 
-      expect(response.code).to eq "401"
+      expect(response.status).to eq 401
     end
 
     it "authenticates from http basic if credentials are sent" do
       # dirty hack for rails 4
       allow(subject).to receive(:register_last_activity_time_to_db)
 
-      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{user.email}:secret")
-      get :test_http_basic_auth, nil, :http_authentication_used => true
+      @request.env["HTTP_AUTHORIZATION"] = "Basic #{Base64::encode64("#{user.email}:secret")}"
+      expect(User).to receive('authenticate').with('bla@bla.com', 'secret').and_return(user)
+      get :test_http_basic_auth, nil, http_authentication_used: true
 
       expect(response).to be_a_success
     end
 
     it "fails authentication if credentials are wrong" do
-      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{user.email}:wrong!")
-      get :test_http_basic_auth, nil, :http_authentication_used => true
+      @request.env["HTTP_AUTHORIZATION"] = "Basic #{Base64::encode64("#{user.email}:wrong!")}"
+      expect(User).to receive('authenticate').with('bla@bla.com', 'wrong!').and_return(nil)
+      get :test_http_basic_auth, nil, http_authentication_used: true
 
       expect(response).to redirect_to root_url
     end
@@ -56,10 +57,12 @@ describe SorceryController, :active_record => true do
       # dirty hack for rails 4
       allow(controller).to receive(:register_last_activity_time_to_db)
 
-      @request.env["HTTP_AUTHORIZATION"] = "Basic " + Base64::encode64("#{user.email}:secret")
-      get :test_http_basic_auth, nil, :http_authentication_used => true
+      @request.env["HTTP_AUTHORIZATION"] = "Basic #{Base64::encode64("#{user.email}:secret")}"
+      expect(User).to receive('authenticate').with('bla@bla.com', 'secret').and_return(user)
 
-      expect(session[:user_id]).to be User.find_by_email(user.email).id
+      get :test_http_basic_auth, nil, http_authentication_used: true
+
+      expect(session[:user_id]).to eq "42"
     end
   end
 end