sorcery 0.9.1 → 0.16.3

Sign up to get free protection for your applications and to get access to all the features.
Files changed (199) hide show
  1. checksums.yaml +5 -5
  2. data/.github/FUNDING.yml +1 -0
  3. data/.github/ISSUE_TEMPLATE.md +24 -0
  4. data/.github/PULL_REQUEST_TEMPLATE.md +7 -0
  5. data/.github/workflows/ruby.yml +70 -0
  6. data/.gitignore +3 -0
  7. data/.rubocop.yml +55 -0
  8. data/.rubocop_todo.yml +163 -0
  9. data/CHANGELOG.md +132 -34
  10. data/CODE_OF_CONDUCT.md +14 -0
  11. data/Gemfile +3 -17
  12. data/{LICENSE.txt → LICENSE.md} +1 -1
  13. data/MAINTAINING.md +64 -0
  14. data/README.md +146 -269
  15. data/Rakefile +4 -2
  16. data/SECURITY.md +19 -0
  17. data/gemfiles/rails_52.gemfile +7 -0
  18. data/gemfiles/rails_60.gemfile +7 -0
  19. data/gemfiles/rails_61.gemfile +7 -0
  20. data/gemfiles/rails_70.gemfile +7 -0
  21. data/lib/generators/sorcery/USAGE +1 -1
  22. data/lib/generators/sorcery/helpers.rb +8 -4
  23. data/lib/generators/sorcery/install_generator.rb +41 -35
  24. data/lib/generators/sorcery/templates/initializer.rb +216 -112
  25. data/lib/generators/sorcery/templates/migration/activity_logging.rb +7 -7
  26. data/lib/generators/sorcery/templates/migration/brute_force_protection.rb +5 -5
  27. data/lib/generators/sorcery/templates/migration/core.rb +5 -7
  28. data/lib/generators/sorcery/templates/migration/external.rb +4 -4
  29. data/lib/generators/sorcery/templates/migration/magic_login.rb +9 -0
  30. data/lib/generators/sorcery/templates/migration/remember_me.rb +5 -5
  31. data/lib/generators/sorcery/templates/migration/reset_password.rb +7 -6
  32. data/lib/generators/sorcery/templates/migration/user_activation.rb +6 -6
  33. data/lib/sorcery/adapters/active_record_adapter.rb +11 -21
  34. data/lib/sorcery/adapters/mongoid_adapter.rb +23 -11
  35. data/lib/sorcery/controller/config.rb +27 -23
  36. data/lib/sorcery/controller/submodules/activity_logging.rb +16 -18
  37. data/lib/sorcery/controller/submodules/brute_force_protection.rb +1 -2
  38. data/lib/sorcery/controller/submodules/external.rb +69 -44
  39. data/lib/sorcery/controller/submodules/http_basic_auth.rb +18 -19
  40. data/lib/sorcery/controller/submodules/remember_me.rb +16 -16
  41. data/lib/sorcery/controller/submodules/session_timeout.rb +33 -11
  42. data/lib/sorcery/controller.rb +50 -35
  43. data/lib/sorcery/crypto_providers/aes256.rb +17 -16
  44. data/lib/sorcery/crypto_providers/bcrypt.rb +26 -22
  45. data/lib/sorcery/crypto_providers/common.rb +1 -1
  46. data/lib/sorcery/crypto_providers/md5.rb +5 -5
  47. data/lib/sorcery/crypto_providers/sha1.rb +5 -5
  48. data/lib/sorcery/crypto_providers/sha256.rb +2 -2
  49. data/lib/sorcery/crypto_providers/sha512.rb +3 -3
  50. data/lib/sorcery/engine.rb +19 -11
  51. data/lib/sorcery/model/config.rb +73 -50
  52. data/lib/sorcery/model/submodules/activity_logging.rb +31 -12
  53. data/lib/sorcery/model/submodules/brute_force_protection.rb +38 -31
  54. data/lib/sorcery/model/submodules/external.rb +22 -10
  55. data/lib/sorcery/model/submodules/magic_login.rb +130 -0
  56. data/lib/sorcery/model/submodules/remember_me.rb +19 -7
  57. data/lib/sorcery/model/submodules/reset_password.rb +64 -42
  58. data/lib/sorcery/model/submodules/user_activation.rb +52 -54
  59. data/lib/sorcery/model/temporary_token.rb +30 -7
  60. data/lib/sorcery/model.rb +65 -40
  61. data/lib/sorcery/protocols/oauth.rb +4 -9
  62. data/lib/sorcery/protocols/oauth2.rb +0 -2
  63. data/lib/sorcery/providers/auth0.rb +46 -0
  64. data/lib/sorcery/providers/base.rb +4 -4
  65. data/lib/sorcery/providers/battlenet.rb +51 -0
  66. data/lib/sorcery/providers/discord.rb +52 -0
  67. data/lib/sorcery/providers/facebook.rb +8 -11
  68. data/lib/sorcery/providers/github.rb +5 -7
  69. data/lib/sorcery/providers/google.rb +3 -5
  70. data/lib/sorcery/providers/heroku.rb +7 -8
  71. data/lib/sorcery/providers/instagram.rb +73 -0
  72. data/lib/sorcery/providers/jira.rb +12 -17
  73. data/lib/sorcery/providers/line.rb +63 -0
  74. data/lib/sorcery/providers/linkedin.rb +44 -35
  75. data/lib/sorcery/providers/liveid.rb +4 -7
  76. data/lib/sorcery/providers/microsoft.rb +59 -0
  77. data/lib/sorcery/providers/paypal.rb +60 -0
  78. data/lib/sorcery/providers/salesforce.rb +3 -5
  79. data/lib/sorcery/providers/slack.rb +45 -0
  80. data/lib/sorcery/providers/twitter.rb +4 -6
  81. data/lib/sorcery/providers/vk.rb +8 -9
  82. data/lib/sorcery/providers/wechat.rb +81 -0
  83. data/lib/sorcery/providers/xing.rb +7 -10
  84. data/lib/sorcery/test_helpers/internal/rails.rb +25 -17
  85. data/lib/sorcery/test_helpers/internal.rb +15 -14
  86. data/lib/sorcery/test_helpers/rails/controller.rb +1 -1
  87. data/lib/sorcery/test_helpers/rails/integration.rb +5 -6
  88. data/lib/sorcery/test_helpers/rails/request.rb +20 -0
  89. data/lib/sorcery/version.rb +1 -1
  90. data/lib/sorcery.rb +4 -17
  91. data/sorcery.gemspec +43 -28
  92. data/spec/active_record/user_activation_spec.rb +4 -5
  93. data/spec/active_record/user_activity_logging_spec.rb +4 -6
  94. data/spec/active_record/user_brute_force_protection_spec.rb +5 -6
  95. data/spec/active_record/user_magic_login_spec.rb +15 -0
  96. data/spec/active_record/user_oauth_spec.rb +5 -6
  97. data/spec/active_record/user_remember_me_spec.rb +5 -6
  98. data/spec/active_record/user_reset_password_spec.rb +4 -5
  99. data/spec/active_record/user_spec.rb +7 -17
  100. data/spec/controllers/controller_activity_logging_spec.rb +13 -24
  101. data/spec/controllers/controller_brute_force_protection_spec.rb +8 -10
  102. data/spec/controllers/controller_http_basic_auth_spec.rb +20 -21
  103. data/spec/controllers/controller_oauth2_spec.rb +297 -158
  104. data/spec/controllers/controller_oauth_spec.rb +97 -71
  105. data/spec/controllers/controller_remember_me_spec.rb +49 -36
  106. data/spec/controllers/controller_session_timeout_spec.rb +106 -20
  107. data/spec/controllers/controller_spec.rb +87 -111
  108. data/spec/orm/active_record.rb +3 -3
  109. data/spec/providers/example_provider_spec.rb +17 -0
  110. data/spec/providers/example_spec.rb +17 -0
  111. data/spec/providers/examples_spec.rb +17 -0
  112. data/spec/providers/vk_spec.rb +42 -0
  113. data/spec/rails_app/app/active_record/authentication.rb +1 -1
  114. data/spec/rails_app/app/active_record/user.rb +2 -2
  115. data/spec/rails_app/app/assets/config/manifest.js +1 -0
  116. data/spec/rails_app/app/controllers/application_controller.rb +2 -0
  117. data/spec/rails_app/app/controllers/sorcery_controller.rb +250 -46
  118. data/spec/rails_app/app/mailers/sorcery_mailer.rb +23 -17
  119. data/spec/rails_app/app/views/sorcery_mailer/magic_login_email.html.erb +13 -0
  120. data/spec/rails_app/app/views/sorcery_mailer/magic_login_email.text.erb +6 -0
  121. data/spec/rails_app/config/application.rb +14 -9
  122. data/spec/rails_app/config/boot.rb +2 -2
  123. data/spec/rails_app/config/environment.rb +1 -1
  124. data/spec/rails_app/config/environments/test.rb +1 -1
  125. data/spec/rails_app/config/initializers/compatible_legacy_migration.rb +11 -0
  126. data/spec/rails_app/config/initializers/session_store.rb +3 -3
  127. data/spec/rails_app/config/routes.rb +31 -1
  128. data/spec/rails_app/config/secrets.yml +4 -0
  129. data/spec/rails_app/config.ru +1 -1
  130. data/spec/rails_app/db/migrate/activation/20101224223622_add_activation_to_users.rb +4 -4
  131. data/spec/rails_app/db/migrate/activity_logging/20101224223624_add_activity_logging_to_users.rb +10 -10
  132. data/spec/rails_app/db/migrate/brute_force_protection/20101224223626_add_brute_force_protection_to_users.rb +5 -5
  133. data/spec/rails_app/db/migrate/core/20101224223620_create_users.rb +5 -5
  134. data/spec/rails_app/db/migrate/external/20101224223628_create_authentications_and_user_providers.rb +3 -3
  135. data/spec/rails_app/db/migrate/invalidate_active_sessions/20180221093235_add_invalidate_active_sessions_before_to_users.rb +9 -0
  136. data/spec/rails_app/db/migrate/magic_login/20170924151831_add_magic_login_to_users.rb +17 -0
  137. data/spec/rails_app/db/migrate/remember_me/20101224223623_add_remember_me_token_to_users.rb +6 -6
  138. data/spec/rails_app/db/migrate/reset_password/20101224223622_add_reset_password_to_users.rb +7 -5
  139. data/spec/rails_app/db/schema.rb +7 -9
  140. data/spec/shared_examples/user_activation_shared_examples.rb +177 -58
  141. data/spec/shared_examples/user_activity_logging_shared_examples.rb +47 -41
  142. data/spec/shared_examples/user_brute_force_protection_shared_examples.rb +19 -24
  143. data/spec/shared_examples/user_magic_login_shared_examples.rb +150 -0
  144. data/spec/shared_examples/user_oauth_shared_examples.rb +7 -10
  145. data/spec/shared_examples/user_remember_me_shared_examples.rb +91 -22
  146. data/spec/shared_examples/user_reset_password_shared_examples.rb +153 -58
  147. data/spec/shared_examples/user_shared_examples.rb +328 -145
  148. data/spec/sorcery_crypto_providers_spec.rb +122 -75
  149. data/spec/sorcery_temporary_token_spec.rb +27 -0
  150. data/spec/spec.opts +1 -1
  151. data/spec/spec_helper.rb +19 -14
  152. data/spec/support/migration_helper.rb +29 -0
  153. data/spec/support/providers/example.rb +11 -0
  154. data/spec/support/providers/example_provider.rb +11 -0
  155. data/spec/support/providers/examples.rb +11 -0
  156. metadata +119 -89
  157. data/.travis.yml +0 -132
  158. data/gemfiles/active_record-rails40.gemfile +0 -7
  159. data/gemfiles/active_record-rails41.gemfile +0 -7
  160. data/gemfiles/mongo_mapper-rails40.gemfile +0 -9
  161. data/gemfiles/mongo_mapper-rails41.gemfile +0 -9
  162. data/gemfiles/mongoid-rails40.gemfile +0 -9
  163. data/gemfiles/mongoid-rails41.gemfile +0 -9
  164. data/gemfiles/mongoid3-rails32.gemfile +0 -9
  165. data/lib/sorcery/adapters/data_mapper_adapter.rb +0 -176
  166. data/lib/sorcery/adapters/mongo_mapper_adapter.rb +0 -110
  167. data/lib/sorcery/railties/tasks.rake +0 -6
  168. data/spec/data_mapper/user_activation_spec.rb +0 -10
  169. data/spec/data_mapper/user_activity_logging_spec.rb +0 -14
  170. data/spec/data_mapper/user_brute_force_protection_spec.rb +0 -9
  171. data/spec/data_mapper/user_oauth_spec.rb +0 -9
  172. data/spec/data_mapper/user_remember_me_spec.rb +0 -8
  173. data/spec/data_mapper/user_reset_password_spec.rb +0 -8
  174. data/spec/data_mapper/user_spec.rb +0 -27
  175. data/spec/mongo_mapper/user_activation_spec.rb +0 -9
  176. data/spec/mongo_mapper/user_activity_logging_spec.rb +0 -8
  177. data/spec/mongo_mapper/user_brute_force_protection_spec.rb +0 -8
  178. data/spec/mongo_mapper/user_oauth_spec.rb +0 -8
  179. data/spec/mongo_mapper/user_remember_me_spec.rb +0 -8
  180. data/spec/mongo_mapper/user_reset_password_spec.rb +0 -8
  181. data/spec/mongo_mapper/user_spec.rb +0 -37
  182. data/spec/mongoid/user_activation_spec.rb +0 -9
  183. data/spec/mongoid/user_activity_logging_spec.rb +0 -8
  184. data/spec/mongoid/user_brute_force_protection_spec.rb +0 -8
  185. data/spec/mongoid/user_oauth_spec.rb +0 -8
  186. data/spec/mongoid/user_remember_me_spec.rb +0 -8
  187. data/spec/mongoid/user_reset_password_spec.rb +0 -8
  188. data/spec/mongoid/user_spec.rb +0 -51
  189. data/spec/orm/data_mapper.rb +0 -48
  190. data/spec/orm/mongo_mapper.rb +0 -10
  191. data/spec/orm/mongoid.rb +0 -22
  192. data/spec/rails_app/app/data_mapper/authentication.rb +0 -8
  193. data/spec/rails_app/app/data_mapper/user.rb +0 -7
  194. data/spec/rails_app/app/mongo_mapper/authentication.rb +0 -6
  195. data/spec/rails_app/app/mongo_mapper/user.rb +0 -7
  196. data/spec/rails_app/app/mongoid/authentication.rb +0 -7
  197. data/spec/rails_app/app/mongoid/user.rb +0 -7
  198. data/spec/rails_app/config/initializers/secret_token.rb +0 -7
  199. data/spec/rails_app/log/development.log +0 -1791
data/README.md CHANGED
@@ -1,96 +1,113 @@
1
- [![Build Status](https://travis-ci.org/NoamB/sorcery.svg?branch=master)](https://travis-ci.org/NoamB/sorcery)
2
- [![Code Climate](https://codeclimate.com/github/NoamB/sorcery.png)](https://codeclimate.com/github/NoamB/sorcery)
3
- [![Inline docs](http://inch-ci.org/github/NoamB/sorcery.png?branch=master)](http://inch-ci.org/github/NoamB/sorcery)
1
+ # Sorcery: Magical Authentication
4
2
 
5
- # sorcery
6
- Magical Authentication for Rails 3 and 4. Supports ActiveRecord,
7
- DataMapper, Mongoid and MongoMapper.
3
+ [![Gem Version](https://badge.fury.io/rb/sorcery.svg)](https://rubygems.org/gems/sorcery)
4
+ [![Gem Downloads](https://img.shields.io/gem/dt/sorcery.svg)](https://rubygems.org/gems/sorcery)
5
+ [![Build Status](https://github.com/Sorcery/sorcery/actions/workflows/ruby.yml/badge.svg?branch=master)](https://github.com/Sorcery/sorcery/actions/workflows/ruby.yml)
8
6
 
9
- Inspired by restful_authentication, Authlogic and Devise. Crypto code taken
10
- almost unchanged from Authlogic. OAuth code inspired by OmniAuth and Ryan
11
- Bates's railscasts about it.
7
+ Magical Authentication for Rails. Supports ActiveRecord, DataMapper, Mongoid and MongoMapper.
12
8
 
13
- **What's happening now?** We are working on 1.0 version, which will include some API-breaking changes. It should be released about April 2015.
14
- Until then we'll continue releasing `0.9.x` version with bug fixed.
9
+ Inspired by Restful Authentication, Authlogic and Devise. Crypto code taken almost unchanged from Authlogic. OAuth code inspired by OmniAuth and Ryan Bates's Railscast about it.
15
10
 
16
- **Rails 4 status:** [Sorcery 0.9.0](http://rubygems.org/gems/sorcery/versions/0.9.0) is fully tested and ready for Rails 4.0, 4.1 and 4.2.
17
- **Mongoid status:** Version 0.9.0 works with Mongoid 4.
11
+ ### Philosophy
18
12
 
19
- https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication
13
+ Sorcery is a stripped-down, bare-bones authentication library, with which you can write your own authentication flow. It was built with a few goals in mind:
20
14
 
21
- ## Philosophy
15
+ - Less is more - less than 20 public methods to remember for the entire feature-set make the lib easy to 'get'.
16
+ - No built-in or generated code - use the library's methods inside *your own* MVC structures, and don't fight to fix someone else's.
17
+ - Magic yes, Voodoo no - the lib should be easy to hack for most developers.
18
+ - Configuration over Confusion - Centralized (1 file), Simple & short configuration as possible, not drowning in syntactic sugar.
19
+ - Keep MVC cleanly separated - DB is for models, sessions are for controllers. Models stay unaware of sessions.
22
20
 
23
- Sorcery is a stripped-down, bare-bones authentication library, with which you
24
- can write your own authentication flow. It was built with a few goals in mind:
21
+ ## Table of Contents
25
22
 
26
- * Less is more - less than 20 public methods to remember for the entire
27
- feature-set make the lib easy to 'get'.
28
- * No built-in or generated code - use the library's methods inside *your
29
- own* MVC structures, and don't fight to fix someone else's.
30
- * Magic yes, Voodoo no - the lib should be easy to hack for most developers.
31
- * Configuration over Confusion - Centralized (1 file), Simple & short
32
- configuration as possible, not drowning in syntactic sugar.
33
- * Keep MVC cleanly separated - DB is for models, sessions are for
34
- controllers. Models stay unaware of sessions.
35
-
36
-
37
- Hopefully, I've achieved this. If not, let me know.
23
+ 1. [Useful Links](#useful-links)
24
+ 2. [API Summary](#api-summary)
25
+ 3. [Installation](#installation)
26
+ 4. [Configuration](#configuration)
27
+ 5. [Full Features List by Module](#full-features-list-by-module)
28
+ 6. [Planned Features](#planned-features)
29
+ 7. [Contributing](#contributing)
30
+ 8. [Contact](#contact)
31
+ 9. [License](#license)
38
32
 
39
33
  ## Useful Links
40
34
 
41
- [Documentation](http://rubydoc.info/gems/sorcery) |
42
- [Railscast](http://railscasts.com/episodes/283-authentication-with-sorcery) | [Simple tutorial](https://github.com/NoamB/sorcery/wiki/Simple-Password-Authentication) | [Example Rails 3 app](https://github.com/NoamB/sorcery-example-app)
35
+ - [Documentation](http://rubydoc.info/gems/sorcery)
36
+ - [Railscast](http://railscasts.com/episodes/283-authentication-with-sorcery)
37
+ - [Simple tutorial](https://github.com/Sorcery/sorcery/wiki/Simple-Password-Authentication)
38
+ - [Example Rails app](https://github.com/Sorcery/sorcery-example-app)
43
39
 
44
- Check out the tutorials in the [Wiki](https://github.com/NoamB/sorcery/wiki) for more!
40
+ Check out the tutorials in the [wiki](https://github.com/Sorcery/sorcery/wiki) for more:
41
+
42
+ - [DataMapper Support](https://github.com/Sorcery/sorcery/wiki/DataMapper-Support)
43
+ - [DelayedJob Integration](https://github.com/Sorcery/sorcery/wiki/DelayedJob-Integration)
44
+ - [Simple Password Authentication](https://github.com/Sorcery/sorcery/wiki/Simple-Password-Authentication)
45
+ - [Single Table Inheritance Support](https://github.com/Sorcery/sorcery/wiki/Single-Table-Inheritance-Support)
46
+ - [Upgrading](https://github.com/Sorcery/sorcery/wiki/Upgrading)
45
47
 
46
48
  ## API Summary
47
49
 
48
50
  Below is a summary of the library methods. Most method names are self
49
51
  explaining and the rest are commented:
50
52
 
53
+ ### Core
51
54
 
52
- ### core
53
55
  ```ruby
54
- require_login # this is a before filter
56
+ require_login # This is a before action
55
57
  login(email, password, remember_me = false)
56
- auto_login(user)# login without credentials
58
+ auto_login(user) # Login without credentials
57
59
  logout
58
- logged_in? # available to view
59
- current_user # available to view
60
- redirect_back_or_to # used when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted.
61
- @user.external? # external users, such as facebook/twitter etc.
62
- @user.active_for_authentication? # add this method to define behaviour that will prevent selected users from signing in
60
+ logged_in? # Available in views
61
+ current_user # Available in views
62
+ redirect_back_or_to # Use when a user tries to access a page while logged out, is asked to login, and we want to return him back to the page he originally wanted
63
+ @user.external? # Users who signed up using Facebook, Twitter, etc.
64
+ @user.active_for_authentication? # Add this method to define behaviour that will prevent selected users from signing in
65
+ @user.valid_password?('secret') # Compares 'secret' with the actual user's password, returns true if they match
63
66
  User.authenticates_with_sorcery!
64
67
  ```
65
68
 
66
- ### http basic auth
69
+ ### HTTP Basic Auth
70
+
67
71
  ```ruby
68
- require_login_from_http_basic # this is a before filter
72
+ require_login_from_http_basic # This is a before action
69
73
  ```
70
74
 
71
- ### external
75
+ ### External
76
+
72
77
  ```ruby
73
- login_at(provider) # sends the user to an external service (twitter etc.) to authenticate.
74
- login_from(provider) # tries to login from the external provider's callback.
75
- create_from(provider) # create the user in the local app db.
78
+ login_at(provider) # Sends the user to an external service (Facebook, Twitter, etc.) to authenticate
79
+ login_from(provider) # Tries to login from the external provider's callback
80
+ create_from(provider) # Create the user in the local app database
81
+ build_from(provider) # Build user instance using user_info_mappings
76
82
  ```
77
83
 
78
- ### remember me
84
+ ### Remember Me
85
+
79
86
  ```ruby
80
- auto_login(user, should_remember=false) # login without credentials, optional remember_me
87
+ auto_login(user, should_remember = false) # Login without credentials, optional remember_me
81
88
  remember_me!
82
89
  forget_me!
90
+ force_forget_me! # Forgets all sessions by clearing the token, even if remember_me_token_persist_globally is set to true
83
91
  ```
84
92
 
85
- ### reset password
93
+ ### Reset Password
94
+
86
95
  ```ruby
87
96
  User.load_from_reset_password_token(token)
88
- @user.generate_reset_password_token! # if you want to send the email by youself
89
- @user.deliver_reset_password_instructions! # generates the token and sends the email
90
- @user.change_password!(new_password)
97
+ @user.generate_reset_password_token! # Use if you want to send the email by yourself
98
+ @user.deliver_reset_password_instructions! # Generates the token and sends the email
99
+ @user.change_password(new_password)
100
+ @user.change_password!(new_password) # Same as change_password but raises exception on save
91
101
  ```
92
102
 
93
- ### user activation
103
+ ### Session Timeout
104
+
105
+ ```ruby
106
+ invalidate_active_sessions! #Invalidate all sessions with a login_time or last_action_time before the current time. Must Opt-in
107
+ ```
108
+
109
+ ### User Activation
110
+
94
111
  ```ruby
95
112
  User.load_from_activation_token(token)
96
113
  @user.setup_activation
@@ -101,272 +118,132 @@ Please see the tutorials in the github wiki for detailed usage information.
101
118
 
102
119
  ## Installation
103
120
 
104
- If using bundler, first add 'sorcery' to your Gemfile:
121
+ Add this line to your application's Gemfile:
105
122
 
106
123
  ```ruby
107
- gem "sorcery"
124
+ gem 'sorcery'
108
125
  ```
109
126
 
110
- And run
127
+ And then execute:
111
128
 
112
- ```ruby
113
- bundle install
114
- ```
129
+ $ bundle
115
130
 
116
- Otherwise simply
131
+ Or install it yourself as:
117
132
 
118
- ```ruby
119
- gem install sorcery
120
- ```
133
+ $ gem install sorcery
121
134
 
122
- ## Rails configuration
135
+ ## Configuration
123
136
 
124
- ```bash
125
- rails generate sorcery:install
126
- ```
137
+ Run the following command to generate the core migration file, the initializer file and the
138
+ `User` model class.
127
139
 
128
- This will generate the core migration file, the initializer file and the
129
- 'User' model class.
140
+ $ rails generate sorcery:install
130
141
 
131
- ```bash
132
- rails generate sorcery:install remember_me reset_password
133
- ```
142
+ Run the following command generate the migrations files for remember_me and reset_password submodules and will create the initializer file (and add submodules to it), and create the `User` model class.
134
143
 
135
- This will generate the migrations files for remember_me and reset_password
136
- submodules and will create the initializer file (and add submodules to it),
137
- and create the 'User' model class.
144
+ $ rails generate sorcery:install remember_me reset_password
138
145
 
139
- ```bash
140
- rails generate sorcery:install --model Person
141
- ```
146
+ Run the following command to generate the core migration file, the initializer and change the model class (in the initializer and migration files) to the class `Person` (and its pluralized version, 'people')
142
147
 
143
- This will generate the core migration file, the initializer and change the
144
- model class (in the initializer and migration files) to the class 'Person'
145
- (and its pluralized version, 'people')
148
+ $ rails generate sorcery:install --model Person
146
149
 
147
- ```bash
148
- rails generate sorcery:install http_basic_auth external remember_me --only-submodules
149
- ```
150
+ Run the following command to generate only the migration files for the specified submodules and will add them to the initializer file.
150
151
 
151
- This will generate only the migration files for the specified submodules and
152
- will add them to the initializer file.
152
+ $ rails generate sorcery:install http_basic_auth external remember_me --only-submodules
153
153
 
154
154
  Inside the initializer, the comments will tell you what each setting does.
155
155
 
156
- ## DelayedJob Integration
157
-
158
- By default emails are sent synchronously. You can send them asynchronously by
159
- using the [delayed_job gem](https://github.com/collectiveidea/delayed_job).
160
-
161
- After implementing the `delayed_job` into your project add the code below at
162
- the end of the `config/initializers/sorcery.rb` file. After that all emails
163
- will be sent asynchronously.
164
-
165
- ```ruby
166
- module Sorcery
167
- module Model
168
- module InstanceMethods
169
- def generic_send_email(method, mailer)
170
- config = sorcery_config
171
- mail = config.send(mailer).delay.send(config.send(method), self)
172
- end
173
- end
174
- end
175
- end
176
- ```
177
-
178
- Sidekiq and Resque integrations are coming soon.
179
-
180
- ## Single Table Inheritance (STI) Support
181
- STI is supported via a single setting in config/initializers/sorcery.rb.
182
-
183
- ## Full Features List by module
184
-
185
- **Core** (see [lib/sorcery/model.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model.rb) and
186
- [lib/sorcery/controller.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller.rb)):
187
-
188
- * login/logout, optional return user to requested url on login, configurable
189
- redirect for non-logged-in users.
190
- * password encryption, algorithms: bcrypt(default), md5, sha1, sha256,
191
- sha512, aes256, custom(yours!), none. Configurable stretches and salt.
192
- * configurable attribute names for username, password and email.
193
- * allow multiple fields to serve as username.
156
+ ## Full Features List by Module
194
157
 
158
+ **Core** (see [lib/sorcery/model.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/model.rb) and [lib/sorcery/controller.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/controller.rb)):
195
159
 
196
- **User Activation** (see [lib/sorcery/model/submodules/user_activation.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/user_activation.rb)):
160
+ - Login / logout, optional return user to requested url on login, configurable redirect for non-logged-in users.
161
+ - Password encryption, algorithms: bcrypt (default), MD5, SHA-1, SHA-256, SHA-512, AES or custom. Configurable stretches and salt.
162
+ - Configurable attribute names for username, password and email.
163
+ - Allow multiple fields to serve as username.
197
164
 
198
- * User activation by email with optional success email.
199
- * configurable attribute names.
200
- * configurable mailer, method name, and attribute name.
201
- * configurable temporary token expiration.
202
- * Optionally prevent non-active users to login.
165
+ **User Activation** (see [lib/sorcery/model/submodules/user_activation.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/model/submodules/user_activation.rb)):
203
166
 
167
+ - User activation by email with optional success email
168
+ - Configurable attribute names
169
+ - Configurable mailer, method name, and attribute name
170
+ - Configurable temporary token expiration
171
+ - Optionally prevent non-active users to login
204
172
 
205
- **Reset Password** (see [lib/sorcery/model/submodules/reset_password.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/reset_password.rb)):
173
+ **Reset Password** (see [lib/sorcery/model/submodules/reset_password.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/model/submodules/reset_password.rb)):
206
174
 
207
- * Reset password with email verification.
208
- * configurable mailer, method name, and attribute name.
209
- * configurable temporary token expiration.
210
- * configurable time between emails (hammering protection).
175
+ - Reset password with email verification
176
+ - Configurable mailer, method name, and attribute name
177
+ - Configurable temporary token expiration
178
+ - Configurable time between emails (hammering protection)
211
179
 
180
+ **Remember Me** (see [lib/sorcery/model/submodules/remember_me.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/model/submodules/remember_me.rb)):
212
181
 
213
- **Remember Me** (see [lib/sorcery/model/submodules/remember_me.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/remember_me.rb)):
182
+ - Remember me with configurable expiration
183
+ - Configurable attribute names
184
+ - Configurable to persist globally (supporting multiple browsers at the same time), or starting anew after each login
214
185
 
215
- * Remember me with configurable expiration.
216
- * configurable attribute names.
186
+ **Session Timeout** (see [lib/sorcery/controller/submodules/session_timeout.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/controller/submodules/session_timeout.rb)):
217
187
 
188
+ - Configurable session timeout
189
+ - Optionally session timeout will be calculated from last user action
190
+ - Optionally enable a method to clear all active sessions, expects an `invalidate_sessions_before` datetime attribute.
218
191
 
219
- **Session Timeout** (see [lib/sorcery/controller/submodules/session_timeout.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/session_timeout.rb)):
192
+ **Brute Force Protection** (see [lib/sorcery/model/submodules/brute_force_protection.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/model/submodules/brute_force_protection.rb)):
220
193
 
221
- * Configurable session timeout.
222
- * Optionally session timeout will be calculated from last user action.
194
+ - Brute force login hammering protection
195
+ - configurable logins before lock and lock duration
223
196
 
197
+ **Basic HTTP Authentication** (see [lib/sorcery/controller/submodules/http_basic_auth.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/controller/submodules/http_basic_auth.rb)):
224
198
 
225
- **Brute Force Protection** (see [lib/sorcery/model/submodules/brute_force_protection.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/brute_force_protection.rb)):
199
+ - A before action for requesting authentication with HTTP Basic
200
+ - Automatic login from HTTP Basic
201
+ - Automatic login is disabled if session key changed
226
202
 
227
- * Brute force login hammering protection.
228
- * configurable logins before lock and lock duration.
203
+ **Activity Logging** (see [lib/sorcery/model/submodules/activity_logging.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/model/submodules/activity_logging.rb)):
229
204
 
205
+ - Automatic logging of last login, last logout, last activity time and IP address for last login
206
+ - Configurable timeout by which to decide whether to include a user in the list of logged in users
230
207
 
231
- **Basic HTTP Authentication** (see [lib/sorcery/controller/submodules/http_basic_auth.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/http_basic_auth.rb)):
208
+ **External** (see [lib/sorcery/controller/submodules/external.rb](https://github.com/Sorcery/sorcery/blob/master/lib/sorcery/controller/submodules/external.rb)):
232
209
 
233
- * A before filter for requesting authentication with HTTP Basic.
234
- * automatic login from HTTP Basic.
235
- * automatic login is disabled if session key changed.
210
+ - OAuth1 and OAuth2 support (currently: Twitter, Facebook, Github, Google, Heroku, LinkedIn, VK, LiveID, Xing, Salesforce)
211
+ - Configurable database column names
212
+ - Authentications table
236
213
 
214
+ ## Planned Features
237
215
 
238
- **Activity Logging** (see [lib/sorcery/model/submodules/activity_logging.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/model/submodules/activity_logging.rb)):
216
+ - Passing a block to encrypt, allowing the developer to define his own mix of salting and encrypting
217
+ - Forgot username, maybe as part of the reset_password module
218
+ - Scoping logins (to a subdomain or another arbitrary field)
219
+ - Allowing storing the salt and encrypted password in the same DB field for extra security
220
+ - Other reset password strategies (security questions?)
221
+ - Other brute force protection strategies (captcha)
239
222
 
240
- * automatic logging of last login, last logout, last activity time and IP
241
- address for last login.
242
- * an easy method of collecting the list of currently logged in users.
243
- * configurable timeout by which to decide whether to include a user in the
244
- list of logged in users.
223
+ Have an idea? Let us know, and it might get into the gem!
245
224
 
225
+ ## Contributing
246
226
 
247
- **External** (see [lib/sorcery/controller/submodules/external.rb](https://github.com/NoamB/sorcery/blob/master/lib/sorcery/controller/submodules/external.rb)):
227
+ Bug reports and pull requests are welcome on GitHub at https://github.com/Sorcery/sorcery.
248
228
 
249
- * OAuth1 and OAuth2 support (currently: Twitter, Facebook, Github, Google, Heroku,
250
- LinkedIn, VK, LiveID, Xing, and Salesforce)
251
- * configurable db field names and authentications table.
252
-
253
-
254
- ## Next Planned Features
255
-
256
- I've got some thoughts which include (unordered):
257
-
258
- * Passing a block to encrypt, allowing the developer to define his own mix
259
- of salting and encrypting
260
- * Forgot username, maybe as part of the reset_password module
261
- * Scoping logins (to a subdomain or another arbitrary field)
262
- * Allowing storing the salt and crypted password in the same DB field for
263
- extra security
264
- * Other reset password strategies (security questions?)
265
- * Other brute force protection strategies (captcha)
266
-
267
-
268
- Have an idea? Let me know, and it might get into the gem!
269
-
270
- ## Backward compatibility
271
-
272
- While the lib is young and evolving fast I'm breaking backward compatibility
273
- quite often. I'm constantly finding better ways to do things and throwing away
274
- old ways. To let you know when things are changing in a non-compatible way,
275
- I'm bumping the minor version of the gem. The patch version changes are
276
- backward compatible.
277
-
278
- In short, an app that works with x.3.1 should be able to upgrade to x.3.2 with
279
- no code changes. The same cannot be said about upgrading to x.4.0 and above,
280
- however.
281
-
282
- ## DataMapper Support
283
-
284
- Important notes:
285
-
286
- * Expected to work with DM adapters: dm-mysql-adapter,
287
- dm-redis-adapter.
288
- * Submodules DM adapter dependent: activity_logging (dm-mysql-adapter)
289
- * Usage: include DataMapper::Resource in user model, follow sorcery
290
- instructions (remember to add property id, validators and accessor
291
- attributes such as password and password_confirmation)
292
- * Option downcase__username_before_authenticating and dm-mysql,
293
- http://datamapper.lighthouseapp.com/projects/20609/tickets/1105-add-support-for-definingchanging-default-collation
294
-
295
- ## Upgrading
296
-
297
- Important notes while upgrading:
298
-
299
- * If you are upgrading from <= **0.8.6** and you use Sorcery model methods in your app,
300
- you might need to change them from `user.method` to `user.sorcery_adapter.method` and from
301
- `User.method` to `User.sorcery_adapter_method`
302
-
303
- * If you are upgrading from <= **0.8.5** and you're using Sorcery test helpers,
304
- you need to change the way you include them to following code:
305
-
306
- ```ruby
307
- RSpec.configure do |config|
308
- config.include Sorcery::TestHelpers::Rails::Controller, type: :controller
309
- config.include Sorcery::TestHelpers::Rails::Integration, type: :feature
310
- end
311
- ```
312
-
313
- * If are upgrading to **0.8.2** and use activity_logging feature with
314
- ActiveRecord, you will have to add a new column
315
- `last_login_from_ip_address`
316
- [#465](https://github.com/NoamB/sorcery/issues/465)
317
- * Sinatra support existed until **v0.7.0** (including), but was dropped
318
- later due to being a maintenance nightmare.
319
- * If upgrading from <= **0.6.1 to >= **0.7.0** you need to change
320
- 'username
321
- _attribute_name' to 'username_attribute_names' in initializer.
322
- * If upgrading from <= **v0.5.1** to >= **v0.5.2** you need to explicitly
323
- set your user_class model in the initializer file.
324
-
325
- ```ruby
326
- # This line must come after the 'user config' block.
327
- config.user_class = User
328
- ```
329
-
330
-
331
- ## Contributing to sorcery
332
-
333
- Your feedback is very welcome and will make this gem much much better for you,
334
- me and everyone else. Besides feedback on code, features, suggestions and bug
335
- reports, you may want to actually make an impact on the code. For this:
336
-
337
- * Fork it.
338
- * Fix it.
339
- * Test it.
340
- * Commit it.
341
- * Send me a pull request so I'll... Pull it.
342
-
343
-
344
- If you feel sorcery has made your life easier, and you would like to express
345
- your thanks via a donation, my paypal email is in the contact details.
229
+ - [Git Workflow](https://github.com/Sorcery/sorcery/wiki/Git-Workflow)
230
+ - [Running the specs](https://github.com/Sorcery/sorcery/wiki/Running-the-specs)
346
231
 
347
232
  ## Contact
348
233
 
349
234
  Feel free to ask questions using these contact details:
350
235
 
351
- #### Noam Ben-Ari
352
-
353
- email: nbenari@gmail.com ( also for paypal )
354
-
355
- twitter: @nbenari
356
-
357
- #### Kir Shatrov
358
-
359
- email: shatrov@me.com
360
-
361
- twitter: @Kiiiir
236
+ **Current Maintainers:**
362
237
 
363
- #### Grzegorz Witek
238
+ - Josh Buker ([@athix](https://github.com/athix)) | [Email](mailto:crypto+sorcery@joshbuker.com?subject=Sorcery)
364
239
 
365
- email: arnvald.to@gmail.com
240
+ **Past Maintainers:**
366
241
 
367
- twitter: @arnvald
242
+ - Noam Ben-Ari ([@NoamB](https://github.com/NoamB)) | [Email](mailto:nbenari@gmail.com) | [Twitter](https://twitter.com/nbenari)
243
+ - Kir Shatrov ([@kirs](https://github.com/kirs)) | [Email](mailto:shatrov@me.com) | [Twitter](https://twitter.com/Kiiiir)
244
+ - Grzegorz Witek ([@arnvald](https://github.com/arnvald)) | [Email](mailto:arnvald.to@gmail.com) | [Twitter](https://twitter.com/arnvald)
245
+ - Chase Gilliam ([@Ch4s3](https://github.com/Ch4s3)) | [Email](mailto:chase.gilliam@gmail.com)
368
246
 
369
- ## Copyright
247
+ ## License
370
248
 
371
- Copyright (c) 2010-2014 Noam Ben Ari (nbenari@gmail.com). See LICENSE.txt for
372
- further details.
249
+ The gem is available as open source under the terms of the [MIT License](http://opensource.org/licenses/MIT).
data/Rakefile CHANGED
@@ -1,6 +1,8 @@
1
- require "bundler/gem_tasks"
1
+ require 'bundler/gem_tasks'
2
2
 
3
3
  require 'rspec/core/rake_task'
4
+ require 'rubocop/rake_task'
4
5
  RSpec::Core::RakeTask.new(:spec)
6
+ RuboCop::RakeTask.new
5
7
 
6
- task :default => :spec
8
+ task default: [:rubocop, :spec]
data/SECURITY.md ADDED
@@ -0,0 +1,19 @@
1
+ # Security Policy
2
+
3
+ ## Supported Versions
4
+
5
+ | Version | Supported |
6
+ | --------- | ------------------ |
7
+ | ~> 0.16.0 | :white_check_mark: |
8
+ | ~> 0.15.0 | :white_check_mark: |
9
+ | < 0.15.0 | :x: |
10
+
11
+ ## Reporting a Vulnerability
12
+
13
+ Email the current maintainer(s) with a description of the vulnerability. You
14
+ should expect a response within 48 hours. If the vulnerability is accepted, a
15
+ Github advisory will be created and eventually released with a CVE corresponding
16
+ to the issue found.
17
+
18
+ A list of the current maintainers can be found on the README under the contact
19
+ section. See: [README.md](https://github.com/Sorcery/sorcery#contact)
@@ -0,0 +1,7 @@
1
+ source 'https://rubygems.org'
2
+
3
+ gem 'rails', '~> 5.2.0'
4
+ gem 'rails-controller-testing'
5
+ gem 'sqlite3', '~> 1.3.6'
6
+
7
+ gemspec path: '..'
@@ -0,0 +1,7 @@
1
+ source 'https://rubygems.org'
2
+
3
+ gem 'rails', '~> 6.0.0'
4
+ gem 'rails-controller-testing'
5
+ gem 'sqlite3', '~> 1.4'
6
+
7
+ gemspec path: '..'
@@ -0,0 +1,7 @@
1
+ source 'https://rubygems.org'
2
+
3
+ gem 'rails', '~> 6.1.0'
4
+ gem 'rails-controller-testing'
5
+ gem 'sqlite3', '~> 1.4'
6
+
7
+ gemspec path: '..'
@@ -0,0 +1,7 @@
1
+ source 'https://rubygems.org'
2
+
3
+ gem 'rails', '~> 7.0.0'
4
+ gem 'rails-controller-testing'
5
+ gem 'sqlite3', '~> 1.4'
6
+
7
+ gemspec path: '..'
@@ -1,6 +1,6 @@
1
1
  Description:
2
2
  Generates the necessary files to get you up and running with Sorcery gem
3
-
3
+
4
4
  Examples:
5
5
  rails generate sorcery:install
6
6
 
@@ -4,16 +4,20 @@ module Sorcery
4
4
  private
5
5
 
6
6
  def sorcery_config_path
7
- "config/initializers/sorcery.rb"
7
+ 'config/initializers/sorcery.rb'
8
8
  end
9
9
 
10
10
  # Either return the model passed in a classified form or return the default "User".
11
11
  def model_class_name
12
- options[:model] ? options[:model].classify : "User"
12
+ options[:model] ? options[:model].classify : 'User'
13
+ end
14
+
15
+ def tableized_model_class
16
+ options[:model] ? options[:model].gsub(/::/, '').tableize : 'users'
13
17
  end
14
18
 
15
19
  def model_path
16
- @model_path ||= File.join("app", "models", "#{file_path}.rb")
20
+ @model_path ||= File.join('app', 'models', "#{file_path}.rb")
17
21
  end
18
22
 
19
23
  def file_path
@@ -33,7 +37,7 @@ module Sorcery
33
37
  [namespace.to_s] + [model_class_name]
34
38
  else
35
39
  [model_class_name]
36
- end.join("::")
40
+ end.join('::')
37
41
  end
38
42
  end
39
43
  end