spiderfw 0.5

data/apps/core/auth/controllers/login_controller.rb

@@ -0,0 +1,94 @@
+require 'apps/core/auth/lib/login_authenticator'
+
+module Spider; module Auth
+    
+    class LoginController < Spider::Controller
+        include HTTPMixin
+        include Visual
+        
+        def self.default_redirect
+            nil
+        end
+        
+        def self.users=(val)
+            @user_classes = val
+        end
+        
+        def self.users
+            @user_classes ||= [Spider::Auth::SuperUser]
+        end
+        
+        def default_redirect
+            self.class.default_redirect
+        end
+        
+        def before(action='')
+            super
+            @response.headers['Content-Type'] = 'text/html;charset=UTF-8'
+        end
+        
+        __.html
+        def index
+            exception = @request.session.flash[:unauthorized_exception]
+            @scene.redirect = @request.params['redirect'] if (@request.params['redirect'])
+            @scene.unauthorized_msg = exception.message if exception && exception.message != 'Spider::Auth::Unauthorized'
+            @scene.message = @request.session.flash[:login_message] if @request.session.flash[:login_message]
+            render('login')
+        end
+        
+        def authenticate
+            get_user
+        end
+        
+        def get_user
+            self.class.users.each do |user|
+                u = user.authenticate(:login, :username => @request.params['login'], :password => @request.params['password'])
+                return u if u
+            end
+            return nil
+        end
+        
+        __.html
+        def do_login
+            user = authenticate
+            if (user)
+                user.save_to_session(@request.session)
+                on_success(user)
+                unless success_redirect
+                    $out << "Loggato"
+                end
+            else
+                @scene.failed_login = true
+                @response.status = 401
+                @scene.login = @request.params['login']
+                index
+            end
+        end
+        
+        def on_success(user)
+        end
+        
+        def success_redirect
+            if (@request.params['redirect'] && !@request.params['redirect'].empty?)
+                redir_to = @request.params['redirect']
+                redirect(redir_to, Spider::HTTP::SEE_OTHER)
+                return true
+            elsif(self.default_redirect)
+                redirect(self.default_redirect)
+                return true
+            else
+                return false
+            end
+        end
+        
+        __.html
+        def logout
+            @request.session[:auth] = nil
+            @scene.did_logout = true
+            render('login')
+        end
+        
+    end
+    
+    
+end; end

data/apps/core/auth/controllers/mixins/auth_helper.rb

@@ -0,0 +1,114 @@
+module Spider; module Auth
+
+    module AuthHelper
+
+        def self.included(mod)
+            mod.extend(ClassMethods)
+            if mod.respond_to?(:define_annotation)
+                mod.define_annotation(:require_user) { |k, m, params| k.require_user(params, :only => m) }
+            end
+        end
+        
+        def before(action='', *arguments)
+            @request.extend(RequestMethods)
+            return super if action.index(Spider::Auth.route_url) == 0
+            self.class.auth_require_users.each do |req|
+                klasses, params = req
+                klasses = [klasses] unless klasses.is_a?(Array)
+                @current_require = params
+                unl = params[:unless]
+                action_match = true
+                if (unl)
+                    unl = [unl] unless unl.is_a?(Array)
+                    unl.each do |p|
+                        action_match = !check_action(action, p)
+                        break unless action_match
+                    end
+                end
+                only = params[:only]
+                if (only)
+                    only = [only] unless only.is_a?(Array)
+                    action_match = false
+                    only.each do |p|
+                        action_match = check_action(action, p)
+                        break if action_match
+                    end
+                end
+                next unless action_match
+                user = nil
+                unauthorized_exception = nil
+                requested_class = nil
+                klasses.each do |klass|
+                    requested_class = klass
+                    user = klass.restore_from_session(@request.session)
+                    if user
+                        @request.security[:users] << user
+                        if (params[:authentication])
+                            user = nil unless user.authenticated?(params[:authentication])
+                        elsif (params[:check])
+                            begin
+                                c = params[:check].call(user)
+                                user = nil unless c == true
+                                raise Unauthorized.new(c, requested_class) if c.is_a?(String)
+                            rescue => exc
+                                user = nil
+                                unauthorized_exception = exc
+                            end
+                        else
+                            break
+                        end
+                    end
+                end
+                unless user
+                    raise (unauthorized_exception ? unauthorized_exception : Unauthorized).new(_("Please login first"), requested_class)
+                end
+                @request.user = user
+            end
+            super
+        end
+        
+        def try_rescue(exc)
+            if (exc.is_a?(Unauthorized))
+                base = @current_require[:redirect] ? @current_require[:redirect] : '/'+Spider::Auth.route_url+'/login/'
+                base = request_path+'/'+base unless base[0].chr == '/'
+                base += '?'
+                redir_url = base + 'redirect='+URI.escape(@request.path)
+                @request.session.flash[:unauthorized_exception] = exc
+                redirect(redir_url, Spider::HTTP::TEMPORARY_REDIRECT)
+            else
+                super
+            end
+        end
+        
+        module RequestMethods
+            def security
+                @security ||= {:users => []}
+            end
+            def user
+                @user
+            end
+            def user=(val)
+                @user = val
+            end
+        end
+
+        module ClassMethods
+
+            def require_user(*args)
+                klass = args.shift if (args[0] && !args[0].is_a?(Hash))
+                params = args[0]
+                params ||= {}
+                @auth_require_users ||= []
+                @auth_require_users << [klass, params]
+            end
+            
+            def auth_require_users
+                @auth_require_users || []
+            end
+
+
+        end
+
+    end
+
+end; end

data/apps/core/auth/controllers/mixins/http_basic_auth.rb

@@ -0,0 +1,24 @@
+module Spider; module Auth
+    
+    module HTTPBasicAuth
+        include HTTP
+        
+        def before(action='', *arguments)
+            if (uid = check_basic_auth(LoginAuthenticator.new))
+                @request.session['uid'] = uid
+                Spider::Auth.current_user = uid
+            end
+            super
+        end
+        
+        def try_rescue(exc)
+            if (exc.is_a?(Unauthorized))
+                challenge_basic_auth
+            else
+                super
+            end
+        end
+        
+    end
+    
+end; end

data/apps/core/auth/controllers/mixins/http_digest_auth.rb

@@ -0,0 +1,26 @@
+require 'apps/core/auth/lib/digest_authenticator'
+
+module Spider; module Auth
+    
+    module HTTPDigestAuth
+        include HTTP
+        
+        def before(action='', *arguments)
+            if (uid = check_digest_auth(Spider::Auth::DigestUser))
+                @request.session['uid'] = uid
+                Spider::Auth.current_user = uid
+            end
+            super
+        end
+        
+        def try_rescue(exc)
+            if (exc.is_a?(Unauthorized))
+                challenge_digest_auth
+            else
+                super
+            end
+        end
+        
+    end
+    
+end; end

data/apps/core/auth/lib/authenticable.rb

@@ -0,0 +1,86 @@
+module Spider; module Auth
+    
+    module Authenticable
+        
+        def self.included(klass)
+            klass.extend(ClassMethods)
+        end
+        
+        def authenticated(method)
+            @authentications ||= {}
+            @authentications[method] = true
+        end
+        
+        def authenticated?(method=nil)
+            return false unless @authentications
+            if (method)
+                @authentications[method]
+            else
+                return @authentications
+            end
+        end
+        
+        def save_to_session(session)
+            session[:auth] ||= {}
+            h = self.to_session_hash
+            h[:authentications] = @authentications
+            session[:auth][self.class.name] = h
+        end
+        
+        def to_session_hash
+            if (self.is_a?(Spider::Model::BaseModel))
+                h = {}
+                self.class.primary_keys.each{ |k| h[k.name] = self.get(k) }
+                return h
+            else
+                raise "Authenticable classes must implement to_session_hash and self.restore_session_hash"
+            end
+        end
+        
+        module ClassMethods
+        
+            def register_authentication(method)
+                @auth_methods ||= []
+                @auth_methods << method
+            end
+        
+            def authenticate(method, params)
+                methods = method ? method : @auth_methods
+                methods = method.is_a?(Array) ? method : [method]
+                res = nil
+                if (methods)
+                    methods.each do |method|
+                        res = self.send("authenticate_"+method.to_s, params)
+                        break if res
+                    end
+                end
+                res.authenticated(method) if res
+                return res
+            end
+        
+            def restore_from_session(session)
+                auth_name = self.name.to_s
+                return nil unless session[:auth] && session[:auth][auth_name]
+                h = session[:auth][auth_name]
+                authentications = h.delete(:authentications) || []
+                obj = restore_session_hash(session[:auth][auth_name])
+                authentications.each do |method|
+                    obj.authenticated(method)
+                end
+                return obj
+            end
+        
+            def restore_session_hash(saved)
+                if (self.subclass_of?(Spider::Model::BaseModel))
+                    return self.new(saved)
+                else
+                    raise "Authenticable classes must implement to_session_hash and self.restore_session_hash"
+                end
+            end
+            
+        end
+        
+    end
+    
+    
+end; end

data/apps/core/auth/lib/authenticator.rb

@@ -0,0 +1,11 @@
+module Spider; module Auth
+    
+    class Authenticator
+        
+        def authenticate(*args)
+            raise NotImplementedError
+        end
+        
+    end
+    
+end; end

data/apps/core/auth/lib/digest_authenticator.rb

@@ -0,0 +1,44 @@
+require 'apps/core/auth/lib/authenticator'
+require 'digest/md5'
+
+module Spider; module Auth
+    
+    module DigestAuthenticator
+        include Authenticable
+        
+        def self.included(klass)
+            klass.extend(ClassMethods)
+            klass.extend(Authenticable::ClassMethods)
+            klass.register_authentication(:digest)
+        end
+        
+        module ClassMethods
+        
+            def authenticate_digest(params)
+                login = params[:login]
+                password = params[:password]
+                realm = password[:ha1]
+                ha1 = self.ha1(login, password, realm)
+                user = find(:username => login, :realm => realm, :ha1 => ha1)
+                if (user.length == 1)
+                    return user[0].uid
+                end
+                return nil
+            end
+        
+            def find_by_ha1
+                user = DigestUser.find(:ha1 => ha1)
+                return user[0] if (user.length == 1)
+                return nil
+            end
+        
+            def ha1(login, password, realm)
+                Digest::MD5::hexdigest("#{login}:#{password}:#{realm}")
+            end
+            
+            
+        end
+        
+    end
+    
+end; end

data/apps/core/auth/lib/login_authenticator.rb

@@ -0,0 +1,27 @@
+require 'apps/core/auth/lib/authenticable'
+
+module Spider; module Auth
+    
+    module LoginAuthenticator
+        include Authenticable
+        
+        def self.included(klass)
+            klass.extend(ClassMethods)
+            klass.extend(Authenticable::ClassMethods)
+            klass.register_authentication(:login)
+        end
+        
+        module ClassMethods
+            
+            def authenticate_login(params)
+                user = self.load(:username => params[:username])
+                return nil unless user
+                return nil unless user.password && Spider::DataTypes::Password.check_match(user.password, params[:password])
+                return user
+            end
+            
+        end
+                
+    end
+    
+end; end

data/apps/core/auth/models/digest_user.rb

@@ -0,0 +1,34 @@
+require 'digest/md5'
+
+module Spider; module Auth
+    
+    class DigestUser < LoginUser
+        include DigestAuthenticator
+        extend_model superclass, :add_polymorphic => true
+        element :realm, String, :hidden => true
+        element :ha1, String, :hidden => true
+        
+        module MapperMethods
+            def before_save(obj, mode)
+                if (mode == :insert) || (mode == :update && (obj.elements_modified?(:username, :password, :realm)))
+                    unless (obj.element_modified?(:password))
+                        cur = obj.get_new
+                        if (cur.username != obj.username || cur.realm != obj.realm)
+                            raise RuntimeError, _("You must always supply the password to a DigestUser when updating username or realm")
+                        end
+                    end
+                    pass_obj = obj.get(:password)
+                    pass = pass_obj.is_a?(String) ? pass_obj : pass_obj.get
+                    obj.set(:ha1, Digest::MD5::hexdigest("#{obj.get(:username)}:#{obj.get(:realm)}:#{pass}"))
+                    super
+                else
+                    super
+                end
+            end
+        end
+        mapper_include MapperMethods
+            
+        
+    end
+    
+end; end

data/apps/core/auth/models/group.rb

@@ -0,0 +1,22 @@
+require 'spiderfw/model/mixins/tree'
+require 'apps/core/auth/models/mixins/access_control'
+require 'uuid'
+
+module Spider; module Auth
+    
+    class Group < Spider::Model::BaseModel
+        include Spider::Model::Tree
+        tree :subgroups
+        element :gid, String, :primary_key => true
+        element :label, String, :required => true, :check => /[\w\d_]+/, :unique => true
+        element :name, String
+        
+        with_mapper_subclasses do
+            def assign_primary_keys(obj)
+                obj.set(:gid, UUID.new.generate)
+            end
+        end
+        
+    end
+    
+end; end

data/apps/core/auth/models/login_user.rb

@@ -0,0 +1,15 @@
+module Spider; module Auth
+    
+    class LoginUser < User
+        extend_model superclass, :add_polymorphic => true
+        include LoginAuthenticator
+        element :username, String, :required => true, :unique => true
+        element :password, Password
+
+        def identifier
+            username
+        end
+        
+    end
+    
+end; end

data/apps/core/auth/models/mixins/access_control.rb

@@ -0,0 +1,71 @@
+module Spider; module Auth
+
+    module AccessControl
+        
+        def self.included(model)
+            model.extend(ClassMethods)
+            model.element(:creation_user, Spider::Auth::User)
+            model.element(:modification_user, Spider::Auth::User)
+            model.element(:creation_date, DateTime)
+            model.element(:modification_date, DateTime)
+            model.mapper_include MapperMethods
+        end
+        
+        module MapperMethods
+            def insert(obj)
+                obj.creation_user = Spider::Auth.current_user
+                obj.modification_user = Spider::Auth.current_user
+                obj.creation_date = DateTime.now
+                obj.modification_date = DateTime.now
+                super(obj)
+            end
+            
+            def update(obj)
+                if (@model.elements_array.select{ |el| obj.element_modified?(el) }.length > 0)
+                    obj.modification_user = Spider::Auth.current_user
+                    obj.modification_date = DateTime.now
+                end
+                super(obj)
+            end
+        end
+        
+        module ClassMethods
+
+            def check_user(op, &proc)
+
+                with_mapper do
+                    def check_auth(op, proc, obj, mode)
+                        if (op == :all || op == mode)
+                            if (!proc && !Spider::Auth.current_user) || (proc && !proc.call(obj, mode))
+                                raise UnauthorizedAction, "You are not allowed to #{mode} #{@model}"
+                            end
+                        end
+                    end
+                    
+                    def before_save(obj, mode)
+                        check_auth(op, proc, obj, mode)
+                        super
+                    end
+                    
+                    def delete(obj)
+                        check_auth(op, proc, obj, :delete)
+                        super
+                    end
+                    
+                    def delete_all!(obj)
+                        check_auth(op, proc, obj, :delete_all)
+                        super
+                    end
+                    
+                end
+                
+            end 
+
+        end
+        
+    end
+    
+end; end
+        
+        
+        

data/apps/core/auth/models/mixins/authentication_tracking.rb

@@ -0,0 +1,19 @@
+module Spider; module Auth
+    
+    module AuthenticationTracking
+        
+        def self.included(mod)
+            mod.element :last_login, DateTime, :label => _('Last login'), :read_only => true
+            mod.element :login_count, Fixnum, :label => _('Login count'), :read_only => true
+        end
+        
+        def authenticated(method)
+            self.login_count ||= 0
+            self.login_count += 1
+            self.last_login = DateTime.now
+            save
+        end
+        
+    end
+    
+end; end

data/apps/core/auth/models/super_user.rb

@@ -0,0 +1,8 @@
+module Spider; module Auth
+    
+    class SuperUser < LoginUser
+        extend_model superclass, :add_polymorphic => true
+        include LoginAuthenticator
+    end
+    
+end; end

data/apps/core/auth/models/user.rb

@@ -0,0 +1,15 @@
+module Spider; module Auth
+    
+    class User < Spider::Model::Managed
+        
+        def identifier
+            raise "Unimplemented"
+        end
+        
+        def user_attributes(dest=nil)
+            {}
+        end
+        
+    end
+    
+end; end

data/apps/core/auth/po/it/spider_auth.po

@@ -0,0 +1,33 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: Spider::Auth 0.1\n"
+"POT-Creation-Date: 2009-10-27 14:38+0100\n"
+"PO-Revision-Date: 2009-06-30 16:58+0200\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=INTEGER; plural=EXPRESSION;\n"
+
+#: models/digest_user.rb:17
+msgid ""
+"You must always supply the password to a DigestUser when updating username "
+"or realm"
+msgstr ""
+"È necessario sempre specificare la password di un DigestUser quando si "
+"modifica lo username o il realm"
+
+#: models/mixins/authentication_tracking.rb:6
+msgid "Last login"
+msgstr "Ultima login"
+
+#: models/mixins/authentication_tracking.rb:7
+msgid "Login count"
+msgstr "Numero login"

data/apps/core/auth/po/spider_auth.pot

@@ -0,0 +1,31 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: Spider::Auth 0.1\n"
+"POT-Creation-Date: 2009-10-27 14:38+0100\n"
+"PO-Revision-Date: 2009-06-30 16:58+0200\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=INTEGER; plural=EXPRESSION;\n"
+
+#: models/digest_user.rb:17
+msgid ""
+"You must always supply the password to a DigestUser when updating username "
+"or realm"
+msgstr ""
+
+#: models/mixins/authentication_tracking.rb:6
+msgid "Last login"
+msgstr ""
+
+#: models/mixins/authentication_tracking.rb:7
+msgid "Login count"
+msgstr ""