sorcery 0.9.0 → 0.10.0

data/lib/sorcery/model/submodules/user_activation.rb

@@ -8,33 +8,24 @@ module Sorcery
       module UserActivation
         def self.included(base)
           base.sorcery_config.class_eval do
-            attr_accessor :activation_state_attribute_name,               # the attribute name to hold activation state
-                                                                          # (active/pending).
-
-                          :activation_token_attribute_name,               # the attribute name to hold activation code
-                                                                          # (sent by email).
-
-                          :activation_token_expires_at_attribute_name,    # the attribute name to hold activation code
-                                                                          # expiration date.
-
-                          :activation_token_expiration_period,            # how many seconds before the activation code
-                                                                          # expires. nil for never expires.
-
-                          :user_activation_mailer,                        # your mailer class. Required when
-                                                                          # activation_mailer_disabled == false.
-
-                          :activation_mailer_disabled,                    # when true sorcery will not automatically
-                                                                          # email activation details and allow you to
-                                                                          # manually handle how and when email is sent
-
-                          :activation_needed_email_method_name,           # activation needed email method on your
-                                                                          # mailer class.
-
-                          :activation_success_email_method_name,          # activation success email method on your
-                                                                          # mailer class.
-
-                          :prevent_non_active_users_to_login              # do you want to prevent or allow users that
-                                                                          # did not activate by email to login?
+            # The attribute name to hold activation state (active/pending).
+            attr_accessor :activation_state_attribute_name
+            # The attribute name to hold activation code (sent by email).
+            attr_accessor :activation_token_attribute_name
+            # The attribute name to hold activation code expiration date.
+            attr_accessor :activation_token_expires_at_attribute_name
+            # How many seconds before the activation code expires. nil for never expires.
+            attr_accessor :activation_token_expiration_period
+            # Your mailer class. Required when activation_mailer_disabled == false.
+            attr_accessor :user_activation_mailer
+            # When true sorcery will not automatically email activation details and allow you to manually handle how and when email is sent
+            attr_accessor :activation_mailer_disabled
+            # Activation needed email method on your mailer class.
+            attr_accessor :activation_needed_email_method_name
+            # Activation success email method on your mailer class.
+            attr_accessor :activation_success_email_method_name
+            # Do you want to prevent or allow users that did not activate by email to login?
+            attr_accessor :prevent_non_active_users_to_login
           end
 
           base.sorcery_config.instance_eval do
@@ -52,9 +43,9 @@ module Sorcery
 
           base.class_eval do
             # don't setup activation if no password supplied - this user is created automatically
-            sorcery_adapter.define_callback :before, :create, :setup_activation, :if => Proc.new { |user| user.send(sorcery_config.password_attribute_name).present? }
+            sorcery_adapter.define_callback :before, :create, :setup_activation, if: proc { |user| user.send(sorcery_config.password_attribute_name).present? }
             # don't send activation needed email if no crypted password created - this user is external (OAuth etc.)
-            sorcery_adapter.define_callback :after, :create, :send_activation_needed_email!, :if => :send_activation_needed_email?
+            sorcery_adapter.define_callback :after, :create, :send_activation_needed_email!, if: :send_activation_needed_email?
           end
 
           base.sorcery_config.after_config << :validate_mailer_defined
@@ -63,8 +54,6 @@ module Sorcery
 
           base.extend(ClassMethods)
           base.send(:include, InstanceMethods)
-
-
         end
 
         module ClassMethods
@@ -81,12 +70,12 @@ module Sorcery
           # This submodule requires the developer to define his own mailer class to be used by it
           # when activation_mailer_disabled is false
           def validate_mailer_defined
-            msg = "To use user_activation submodule, you must define a mailer (config.user_activation_mailer = YourMailerClass)."
-            raise ArgumentError, msg if @sorcery_config.user_activation_mailer == nil and @sorcery_config.activation_mailer_disabled == false
+            message = 'To use user_activation submodule, you must define a mailer (config.user_activation_mailer = YourMailerClass).'
+            raise ArgumentError, message if @sorcery_config.user_activation_mailer.nil? && @sorcery_config.activation_mailer_disabled == false
           end
 
           def define_user_activation_fields
-            self.class_eval do
+            class_eval do
               sorcery_adapter.define_field sorcery_config.activation_state_attribute_name, String
               sorcery_adapter.define_field sorcery_config.activation_token_attribute_name, String
               sorcery_adapter.define_field sorcery_config.activation_token_expires_at_attribute_name, Time
@@ -98,20 +87,22 @@ module Sorcery
           def setup_activation
             config = sorcery_config
             generated_activation_token = TemporaryToken.generate_random_token
-            self.send(:"#{config.activation_token_attribute_name}=", generated_activation_token)
-            self.send(:"#{config.activation_state_attribute_name}=", "pending")
-            self.send(:"#{config.activation_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.activation_token_expiration_period) if config.activation_token_expiration_period
+            send(:"#{config.activation_token_attribute_name}=", generated_activation_token)
+            send(:"#{config.activation_state_attribute_name}=", 'pending')
+            send(:"#{config.activation_token_expires_at_attribute_name}=", Time.now.in_time_zone + config.activation_token_expiration_period) if config.activation_token_expiration_period
           end
 
           # clears activation code, sets the user as 'active' and optionaly sends a success email.
           def activate!
             config = sorcery_config
-            self.send(:"#{config.activation_token_attribute_name}=", nil)
-            self.send(:"#{config.activation_state_attribute_name}=", "active")
+            send(:"#{config.activation_token_attribute_name}=", nil)
+            send(:"#{config.activation_state_attribute_name}=", 'active')
             send_activation_success_email! if send_activation_success_email?
-            sorcery_adapter.save(:validate => false, :raise_on_failure => true)
+            sorcery_adapter.save(validate: false, raise_on_failure: true)
           end
 
+          attr_accessor :skip_activation_needed_email, :skip_activation_success_email
+
           protected
 
           # called automatically after user initial creation.
@@ -124,24 +115,21 @@ module Sorcery
           end
 
           def send_activation_success_email?
-            !external? && (
-              !(sorcery_config.activation_success_email_method_name.nil? ||
-                sorcery_config.activation_mailer_disabled == true)
-            )
+            !external? &&
+              !(sorcery_config.activation_success_email_method_name.nil? || sorcery_config.activation_mailer_disabled == true) &&
+              !skip_activation_success_email
           end
 
           def send_activation_needed_email?
-            !external? && (
-              !(sorcery_config.activation_needed_email_method_name.nil? ||
-                sorcery_config.activation_mailer_disabled == true)
-            )
+            !external? &&
+              !(sorcery_config.activation_needed_email_method_name.nil? || sorcery_config.activation_mailer_disabled == true) &&
+              !skip_activation_needed_email
           end
 
           def prevent_non_active_login
             config = sorcery_config
-            config.prevent_non_active_users_to_login ? self.send(config.activation_state_attribute_name) == "active" : true
+            config.prevent_non_active_users_to_login ? send(config.activation_state_attribute_name) == 'active' : true
           end
-
         end
       end
     end

data/lib/sorcery/model/temporary_token.rb

@@ -12,13 +12,13 @@ module Sorcery
 
       # Random code, used for salt and temporary tokens.
       def self.generate_random_token
-        SecureRandom.base64(15).tr('+/=lIO0', 'pqrsxyz')
+        SecureRandom.urlsafe_base64(15).tr('lIO0', 'sxyz')
       end
 
       module ClassMethods
         def load_from_token(token, token_attr_name, token_expiration_date_attr)
           return nil if token.blank?
-          user = sorcery_adapter.find_by_token(token_attr_name,token)
+          user = sorcery_adapter.find_by_token(token_attr_name, token)
           if !user.blank? && !user.send(token_expiration_date_attr).nil?
             return Time.now.in_time_zone < user.send(token_expiration_date_attr) ? user : nil
           end

data/lib/sorcery/model.rb

@@ -17,7 +17,7 @@ module Sorcery
       include_required_submodules!
 
       # This runs the options block set in the initializer on the model class.
-      ::Sorcery::Controller::Config.user_config.tap{|blk| blk.call(@sorcery_config) if blk}
+      ::Sorcery::Controller::Config.user_config.tap { |blk| blk.call(@sorcery_config) if blk }
 
       define_base_fields
       init_orm_hooks!
@@ -29,7 +29,7 @@ module Sorcery
     private
 
     def define_base_fields
-      self.class_eval do
+      class_eval do
         sorcery_config.username_attribute_names.each do |username|
           sorcery_adapter.define_field username, String, length: 255
         end
@@ -39,17 +39,16 @@ module Sorcery
         sorcery_adapter.define_field sorcery_config.crypted_password_attribute_name, String, length: 255
         sorcery_adapter.define_field sorcery_config.salt_attribute_name, String, length: 255
       end
-
     end
 
     # includes required submodules into the model class,
     # which usually is called User.
     def include_required_submodules!
-      self.class_eval do
+      class_eval do
         @sorcery_config.submodules = ::Sorcery::Controller::Config.submodules
         @sorcery_config.submodules.each do |mod|
           begin
-            include Submodules.const_get(mod.to_s.split('_').map {|p| p.capitalize}.join)
+            include Submodules.const_get(mod.to_s.split('_').map(&:capitalize).join)
           rescue NameError
             # don't stop on a missing submodule. Needed because some submodules are only defined
             # in the controller side.
@@ -60,11 +59,11 @@ module Sorcery
 
     # add virtual password accessor and ORM callbacks.
     def init_orm_hooks!
-      sorcery_adapter.define_callback :before, :validation, :encrypt_password, if: Proc.new {|record|
+      sorcery_adapter.define_callback :before, :validation, :encrypt_password, if: proc { |record|
         record.send(sorcery_config.password_attribute_name).present?
       }
 
-      sorcery_adapter.define_callback :after, :save, :clear_virtual_password, if: Proc.new {|record|
+      sorcery_adapter.define_callback :after, :save, :clear_virtual_password, if: proc { |record|
         record.send(sorcery_config.password_attribute_name).present?
       }
 
@@ -82,7 +81,7 @@ module Sorcery
       # Finds the user by the username and compares the user's password to the one supplied to the method.
       # returns the user if success, nil otherwise.
       def authenticate(*credentials)
-        raise ArgumentError, "at least 2 arguments required" if credentials.size < 2
+        raise ArgumentError, 'at least 2 arguments required' if credentials.size < 2
 
         return false if credentials[0].blank?
 
@@ -92,16 +91,20 @@ module Sorcery
 
         user = sorcery_adapter.find_by_credentials(credentials)
 
+        if user.respond_to?(:active_for_authentication?)
+          return nil unless user.active_for_authentication?
+        end
+
         set_encryption_attributes
 
-        user if user && @sorcery_config.before_authenticate.all? {|c| user.send(c)} && user.valid_password?(credentials[1])
+        user if user && @sorcery_config.before_authenticate.all? { |c| user.send(c) } && user.valid_password?(credentials[1])
       end
 
       # encrypt tokens using current encryption_provider.
       def encrypt(*tokens)
         return tokens.first if @sorcery_config.encryption_provider.nil?
 
-        set_encryption_attributes()
+        set_encryption_attributes
 
         CryptoProviders::AES256.key = @sorcery_config.encryption_key
         @sorcery_config.encryption_provider.encrypt(*tokens)
@@ -109,13 +112,13 @@ module Sorcery
 
       protected
 
-      def set_encryption_attributes()
+      def set_encryption_attributes
         @sorcery_config.encryption_provider.stretches = @sorcery_config.stretches if @sorcery_config.encryption_provider.respond_to?(:stretches) && @sorcery_config.stretches
         @sorcery_config.encryption_provider.join_token = @sorcery_config.salt_join_token if @sorcery_config.encryption_provider.respond_to?(:join_token) && @sorcery_config.salt_join_token
       end
-      
+
       def add_config_inheritance
-        self.class_eval do
+        class_eval do
           def self.inherited(subclass)
             subclass.class_eval do
               class << self
@@ -127,7 +130,6 @@ module Sorcery
           end
         end
       end
-
     end
 
     module InstanceMethods
@@ -144,12 +146,12 @@ module Sorcery
 
       # Calls the configured encryption provider to compare the supplied password with the encrypted one.
       def valid_password?(pass)
-        _crypted = self.send(sorcery_config.crypted_password_attribute_name)  
-        return _crypted == pass if sorcery_config.encryption_provider.nil?
+        crypted = send(sorcery_config.crypted_password_attribute_name)
+        return crypted == pass if sorcery_config.encryption_provider.nil?
 
-        _salt = self.send(sorcery_config.salt_attribute_name) unless sorcery_config.salt_attribute_name.nil?
+        salt = send(sorcery_config.salt_attribute_name) unless sorcery_config.salt_attribute_name.nil?
 
-        sorcery_config.encryption_provider.matches?(_crypted, pass, _salt)
+        sorcery_config.encryption_provider.matches?(crypted, pass, salt)
       end
 
       protected
@@ -158,16 +160,16 @@ module Sorcery
       # encrypts password with salt and saves it.
       def encrypt_password
         config = sorcery_config
-        self.send(:"#{config.salt_attribute_name}=", new_salt = TemporaryToken.generate_random_token) if !config.salt_attribute_name.nil?
-        self.send(:"#{config.crypted_password_attribute_name}=", self.class.encrypt(self.send(config.password_attribute_name),new_salt))
+        send(:"#{config.salt_attribute_name}=", new_salt = TemporaryToken.generate_random_token) unless config.salt_attribute_name.nil?
+        send(:"#{config.crypted_password_attribute_name}=", self.class.encrypt(send(config.password_attribute_name), new_salt))
       end
 
       def clear_virtual_password
         config = sorcery_config
-        self.send(:"#{config.password_attribute_name}=", nil)
+        send(:"#{config.password_attribute_name}=", nil)
 
         if respond_to?(:"#{config.password_attribute_name}_confirmation=")
-          self.send(:"#{config.password_attribute_name}_confirmation=", nil)
+          send(:"#{config.password_attribute_name}_confirmation=", nil)
         end
       end
 
@@ -175,17 +177,11 @@ module Sorcery
       # supports both the ActionMailer 3 way of calling, and the plain old Ruby object way.
       def generic_send_email(method, mailer)
         config = sorcery_config
-        mail = config.send(mailer).send(config.send(method),self)
-        if defined?(ActionMailer) and config.send(mailer).kind_of?(Class) and config.send(mailer) < ActionMailer::Base
-          # Rails 4.2 deprecates #deliver
-          if mail.respond_to?(:deliver_now)
-            mail.deliver_now
-          else
-            mail.deliver
-          end
+        mail = config.send(mailer).send(config.send(method), self)
+        if defined?(ActionMailer) && config.send(mailer).is_a?(Class) && config.send(mailer) < ActionMailer::Base
+          mail.send(config.email_delivery_method)
         end
       end
     end
-
   end
 end

data/lib/sorcery/protocols/oauth.rb

@@ -3,12 +3,11 @@ require 'oauth'
 module Sorcery
   module Protocols
     module Oauth
-
       def oauth_version
         '1.0'
       end
 
-      def get_request_token(token=nil,secret=nil)
+      def get_request_token(token = nil, secret = nil)
         return ::OAuth::RequestToken.new(get_consumer, token, secret) if token && secret
         get_consumer.get_request_token(oauth_callback: @callback_url)
       end
@@ -17,18 +16,14 @@ module Sorcery
         get_request_token(
           args[:request_token],
           args[:request_token_secret]
-        ).authorize_url({
-          oauth_callback: @callback_url
-        })
+        ).authorize_url(oauth_callback: @callback_url)
       end
 
       def get_access_token(args)
         get_request_token(
           args[:request_token],
           args[:request_token_secret]
-        ).get_access_token({
-          oauth_verifier: args[:oauth_verifier]
-        })
+        ).get_access_token(oauth_verifier: args[:oauth_verifier])
       end
 
       protected
@@ -36,7 +31,6 @@ module Sorcery
       def get_consumer
         ::OAuth::Consumer.new(@key, @secret, site: @site)
       end
-
     end
   end
 end

data/lib/sorcery/protocols/oauth2.rb

@@ -3,7 +3,6 @@ require 'oauth2'
 module Sorcery
   module Protocols
     module Oauth2
-
       def oauth_version
         '2.0'
       end
@@ -41,7 +40,6 @@ module Sorcery
           defaults.merge!(options)
         )
       end
-
     end
   end
 end

data/lib/sorcery/providers/base.rb

@@ -1,19 +1,20 @@
 module Sorcery
   module Providers
     class Base
-
       attr_reader   :access_token
 
       attr_accessor :callback_url, :key, :original_callback_url, :secret,
                     :site, :state, :user_info_mapping
 
-      def has_callback?; true; end
+      def has_callback?
+        true
+      end
 
       def initialize
         @user_info_mapping = {}
       end
 
-      def auth_hash(access_token, hash={})
+      def auth_hash(access_token, hash = {})
         return hash if access_token.nil?
 
         token_hash = hash.dup
@@ -32,7 +33,6 @@ module Sorcery
       def self.descendants
         ObjectSpace.each_object(Class).select { |klass| klass < self }
       end
-
     end
   end
 end

data/lib/sorcery/providers/facebook.rb

@@ -7,21 +7,22 @@ module Sorcery
     #   ...
     #
     class Facebook < Base
-
       include Protocols::Oauth2
 
       attr_reader   :mode, :param_name, :parse
       attr_accessor :access_permissions, :display, :scope, :token_url,
-                    :user_info_path
+                    :user_info_path, :auth_path, :api_version
 
       def initialize
         super
 
         @site           = 'https://graph.facebook.com'
-        @user_info_path = '/me'
-        @scope          = 'email,offline_access'
+        @auth_site      = 'https://www.facebook.com'
+        @user_info_path = 'me'
+        @scope          = 'email'
         @display        = 'page'
         @token_url      = 'oauth/access_token'
+        @auth_path      = 'dialog/oauth'
         @mode           = :query
         @parse          = :query
         @param_name     = 'access_token'
@@ -38,26 +39,33 @@ module Sorcery
 
       # calculates and returns the url to which the user should be redirected,
       # to get authenticated at the external provider's site.
-      def login_url(params, session)
+      def login_url(_params, _session)
         authorize_url
       end
 
       # overrides oauth2#authorize_url to allow customized scope.
       def authorize_url
+        # Fix: replace default oauth2 options, specially to prevent the Faraday gem which
+        # concatenates with "/", removing the Facebook api version
+        options = {
+          site:          File.join(@site, api_version.to_s),
+          authorize_url: File.join(@auth_site, api_version.to_s, auth_path),
+          token_url:     token_url
+        }
+
         @scope = access_permissions.present? ? access_permissions.join(',') : scope
-        super
+        super(options)
       end
 
       # tries to login the user from access token
-      def process_callback(params, session)
+      def process_callback(params, _session)
         args = {}.tap do |a|
           a[:code] = params[:code] if params[:code]
         end
 
         get_access_token(args, token_url: token_url, mode: mode,
-          param_name: param_name, parse: parse)
+                               param_name: param_name, parse: parse)
       end
-
     end
   end
 end

data/lib/sorcery/providers/github.rb

@@ -7,7 +7,6 @@ module Sorcery
     #   ...
     #
     class Github < Base
-
       include Protocols::Oauth2
 
       attr_accessor :auth_path, :scope, :token_url, :user_info_path
@@ -26,19 +25,21 @@ module Sorcery
         response = access_token.get(user_info_path)
 
         auth_hash(access_token).tap do |h|
-          h[:user_info] = JSON.parse(response.body)
+          h[:user_info] = JSON.parse(response.body).tap do |uih|
+            uih['email'] = primary_email(access_token) if scope =~ /user/
+          end
           h[:uid] = h[:user_info]['id']
         end
       end
 
       # calculates and returns the url to which the user should be redirected,
       # to get authenticated at the external provider's site.
-      def login_url(params, session)
-        authorize_url({ authorize_url: auth_path })
+      def login_url(_params, _session)
+        authorize_url(authorize_url: auth_path)
       end
 
       # tries to login the user from access token
-      def process_callback(params, session)
+      def process_callback(params, _session)
         args = {}.tap do |a|
           a[:code] = params[:code] if params[:code]
         end
@@ -46,6 +47,12 @@ module Sorcery
         get_access_token(args, token_url: token_url, token_method: :post)
       end
 
+      def primary_email(access_token)
+        response = access_token.get(user_info_path + '/emails')
+        emails = JSON.parse(response.body)
+        primary = emails.find { |i| i['primary'] }
+        primary && primary['email'] || emails.first && emails.first['email']
+      end
     end
   end
 end

data/lib/sorcery/providers/google.rb

@@ -7,7 +7,6 @@ module Sorcery
     #   ...
     #
     class Google < Base
-
       include Protocols::Oauth2
 
       attr_accessor :auth_url, :scope, :token_url, :user_info_url
@@ -33,19 +32,18 @@ module Sorcery
 
       # calculates and returns the url to which the user should be redirected,
       # to get authenticated at the external provider's site.
-      def login_url(params, session)
-        authorize_url({ authorize_url: auth_url })
+      def login_url(_params, _session)
+        authorize_url(authorize_url: auth_url)
       end
 
       # tries to login the user from access token
-      def process_callback(params, session)
+      def process_callback(params, _session)
         args = {}.tap do |a|
           a[:code] = params[:code] if params[:code]
         end
 
         get_access_token(args, token_url: token_url, token_method: :post)
       end
-
     end
   end
 end

data/lib/sorcery/providers/heroku.rb

@@ -1,6 +1,5 @@
 module Sorcery
   module Providers
-
     # This class adds support for OAuth with heroku.com.
 
     # config.heroku.key = <key>
@@ -13,7 +12,6 @@ module Sorcery
     # The full path must be set for OAuth Callback URL when configuring the API Client Information on Heroku.
 
     class Heroku < Base
-
       include Protocols::Oauth2
 
       attr_accessor :auth_path, :scope, :token_url, :user_info_path
@@ -40,18 +38,18 @@ module Sorcery
         end
       end
 
-      def login_url(params, session)
-        authorize_url({ authorize_url: auth_path })
+      def login_url(_params, _session)
+        authorize_url(authorize_url: auth_path)
       end
 
       # tries to login the user from access token
-      def process_callback(params, session)
-        raise "Invalid state. Potential Cross Site Forgery" if params[:state] != state
-        args = { }.tap do |a|
+      def process_callback(params, _session)
+        raise 'Invalid state. Potential Cross Site Forgery' if params[:state] != state
+        args = {}.tap do |a|
           a[:code] = params[:code] if params[:code]
         end
         get_access_token(args, token_url: token_url, token_method: :post)
       end
     end
   end
-end
+end