user_plane 0.0.15

data/lib/user_plane/omniauth.rb

@@ -0,0 +1,50 @@
+require 'omniauth'
+
+module UserPlane
+  module OmniAuth
+
+    # Lets actiondispatch figure out the request path. Looks like request_path
+    # needs to return the callback path to generate the correct link
+    def self.request_path_criteria_for provider
+      lambda do |env|
+        path_parameters = env["action_dispatch.request.path_parameters"]
+        path_parameters[:action] == 'oauth_request' && UserPlane::OmniAuth.custom_path(env)        
+      end
+    end
+
+    def self.callback_path_criteria_for provider
+      lambda do |env|
+        path_parameters = env["action_dispatch.request.path_parameters"]
+        path_parameters[:action] == 'oauth_callback'
+      end
+    end
+
+    def self.custom_path env
+      path_parameters = env["action_dispatch.request.path_parameters"]
+      custom_callback_path = path_parameters.merge(action: 'oauth_callback',
+                                                   only_path: true)
+      env['action_dispatch.routes'].url_for custom_callback_path
+    end
+
+    # Configures the omniauth middleware for the application
+    def self.middleware &block
+      controllers = [User::SignInsController,
+                     User::SignUpsController,
+                     User::InvitesController]
+
+      controllers.each do |controller|
+        controller.middleware.use Builder, &block
+      end
+    end
+
+    # Wraps OmniAuth::Builder to provide custom callback urls driven by the routes
+    class Builder < ::OmniAuth::Builder
+      def provider(klass, *args, &block)
+        options = args.extract_options!
+        args << options.merge(request_path:  UserPlane::OmniAuth.request_path_criteria_for(klass),
+                              callback_path: UserPlane::OmniAuth.callback_path_criteria_for(klass))
+        super
+      end
+    end
+  end
+end

data/lib/user_plane/redirect_to_sign_in.rb

@@ -0,0 +1,22 @@
+module UserPlane
+  class RedirectToSignIn
+    def initialize route_options={}
+      default_route = {controller: 'user/sign_ins', action: :new}
+      @sign_in_route = default_route.merge(route_options)
+    end
+
+    def call env
+      session_manager = SessionManager.new(env['rack.session'])
+
+      if session_manager.signed_in?
+        raise ActionController::RoutingError.new('Not Found')
+      end
+
+      request_path = "#{env['PATH_INFO']}?#{env['QUERY_STRING']}"
+      session_manager.remember_page(request_path)
+
+      sign_in_path = env['action_dispatch.routes'].path_for(@sign_in_route)
+      [301, {'Location' => sign_in_path}, ['Redirecting to the sign in page']] 
+    end
+  end
+end

data/lib/user_plane/route_concerns.rb

@@ -0,0 +1,167 @@
+module UserPlane
+  module RouteConcerns
+
+    DEFAULTS = {namespace: 'user', on: :collection}
+
+    mattr_accessor :signed_in_constraint do
+        -> (request) {SessionManager.new(request.session).signed_in?}
+    end
+
+    class AbstractConcern
+      attr_accessor :concern_options
+      attr_accessor :mapper
+
+      def initialize(options = {})
+        defaults = RouteConcerns::DEFAULTS.merge(options)
+        @namespace = defaults[:namespace]
+        @defaults = defaults.except(:namespace)
+      end
+
+      # Returns true if a particular concern exists
+      def exists? concern 
+        mapper.instance_variable_get('@concerns').include?(concern)
+      end
+
+      # The abstract concern should be able to handle resources having a preferred
+      # collection/resource target.
+      def call(mapper, concern_options = {})
+        @mapper = mapper
+        @concern_options = concern_options
+
+        build
+      end
+
+      def options custom_route_options={}
+        resource_scope = mapper.send :resource_scope?
+
+        if resource_scope
+          @defaults.merge(@concern_options).merge(custom_route_options)
+        else
+          @defaults.merge(@concern_options).merge(custom_route_options).except(:on)
+        end
+      end
+    end
+
+    class AbstractNamespacedConcern < AbstractConcern
+      # The abstract concern should be able to handle resources having a preferred
+      # collection/resource target.
+      def call(mapper, concern_options = {})
+        @mapper = mapper
+        @concern_options = concern_options
+
+        mapper.namespace @namespace, path: '/' do
+          build
+        end
+      end
+    end
+
+    # Defines two resources:
+    # A session resource to sign a user in and out
+    # A details resource to let a user change the account's details
+    # It also defines an extra concern
+    # And a signed_in routing concern to ensure that child routes are accessible only
+    # to signed in users.
+    # It defines a route to edit the account details and one to sign in and sign out.
+    #
+    # To enforce being singed in to certain resources:
+    # resource :score, concern: :signed_in
+    #
+    # scope '/profile' concern: :signed_in do
+    #   resource :score
+    #   resource :buddies
+    # end
+    #
+    class Base < AbstractNamespacedConcern
+
+      attr_accessor :singed_in_constraint
+
+      def build
+        mapper.resource :sign_in, options(only: [:new, :create, :destroy]) do
+          if exists? :auth_endpoint
+            mapper.concerns :auth_endpoint, controller: :sign_ins
+          end
+        end
+
+        mapper.resource :details, options(only: [:edit, :update],
+                                          as: :update_details,
+                                          constraints: RouteConcerns.signed_in_constraint)
+      end
+    end
+
+    class SignUp < AbstractNamespacedConcern
+      def build
+        mapper.resource :sign_up, options(only: [:new, :create]) do
+          if exists? :auth_endpoint
+            mapper.concerns :auth_endpoint, controller: :sign_ups
+          end
+        end
+      end
+    end
+
+    # An alternative to the SignUp concern that provides routes to handle sign
+    # up via invites.
+    class Invites < AbstractNamespacedConcern
+
+      def initialize(defaults = {})
+        @users_can_send_invites = defaults.delete(:users_can_send_invites) || true
+        super
+      end
+
+      def build
+        sign_up_options = options(only: [:edit, :update],
+                                  path_names: {edit: 'redeem'},
+                                  as: :sign_up_with_invites,
+                                  param: :code)
+        
+        mapper.resources :invites,  sign_up_options do
+          if exists? :auth_endpoint
+            mapper.concerns :auth_endpoint, controller: :invites,
+                                            on: :member
+          end
+        end
+        
+        if @users_can_send_invites
+          mapper.resources :invites, options(only: [:new, :create],
+                                             as: :send_sign_up_invites,
+                                             constraints: RouteConcerns.signed_in_constraint)
+        end
+      end
+    end
+
+    # Provides extra routes to manage email identities: password resets and email
+    # confirmations
+    class EmailIdentity < AbstractNamespacedConcern
+      def build
+        mapper.scope controller: :reset_passwords do
+          mapper.resources :reset_passwords, options(only: [:new, :create],
+                                                     param: :code,
+                                                     as: :send_password_resets)
+
+          mapper.resources :reset_passwords, options(only: [:edit, :update],
+                                                     param: :code)
+        end
+
+        mapper.get '/confirm_email/:code', options(to: 'confirm_email_addresses#update',
+                                                   as: :confirm_email_address)
+      end
+    end
+
+    class OAuthEndpoint < AbstractConcern
+
+      def build
+        controller = concern_options.delete(:controller) || 'sessions'
+
+        mapper.resources :auth, options(as: :o_auth_endpoint,
+                                        only: :edit,
+                                        path_names: {edit: 'callback'},
+                                        param: :provider,
+                                        to: "#{controller}#oauth_callback")
+        mapper.resources :auth, options(as: :o_auth_endpoint,
+                                        only: :show,
+                                        param: :provider,
+                                        to: "#{controller}#oauth_request")
+      end
+    end
+
+  end
+end

data/lib/user_plane/session_manager_concern.rb

@@ -0,0 +1,9 @@
+module UserPlane
+  module SessionManagerConcern
+    extend ActiveSupport::Concern
+
+    def session_manager
+      @session_manager ||= SessionManager.new(session)
+    end
+  end
+end

data/lib/user_plane/signed_in_constraint.rb

@@ -0,0 +1,11 @@
+module UserPlane
+  # Prevents non signed in users to see specific routes
+  class SignedInConstraint
+
+    def matches?(request)
+      session = Session.new(request.session)
+      session.signed_in?
+    end
+    
+  end  
+end

data/lib/user_plane/token_segment.rb

@@ -0,0 +1,52 @@
+require 'active_support/concern'
+
+module TokenSegment
+  extend ActiveSupport::Concern
+
+  module ClassMethods
+    
+    def has_token(attribute, options={}, &block)
+      # Generates a random token on a given attirubte at creation time.
+      # optionally it can create it for every update of the record.
+
+      validates attribute, uniqueness: true
+
+      if life_span = options[:expires_in]
+        scope :stale, -> {unscoped.where('created_at <= ?', life_span.ago)}
+        scope :fresh, -> {where('created_at > ?', life_span.ago)}
+
+        define_method :stale? do
+          if new_record?
+            false
+          else
+            created_at <= life_span.ago
+          end
+        end
+      end
+
+      define_method :"regenerate_#{attribute}" do
+        if block_given?
+          make_token attribute, instance_eval(&block)
+        else
+          make_token attribute
+        end
+      end  
+
+      if regenerate_on = options[:regenerate_on]
+        before_validation :"regenerate_#{attribute}", on: regenerate_on
+      else
+        before_validation :"regenerate_#{attribute}" 
+      end
+    end
+
+  end
+
+private
+
+  def make_token(attribute, token_string = nil)
+    string_to_hash = token_string || "#{self.class.name}-#{Time.now}-#{rand}-#{self.id}"
+    new_attributes = {attribute => Digest::SHA1.hexdigest(string_to_hash)}
+    self.assign_attributes new_attributes
+  end
+
+end

data/lib/user_plane/version.rb

@@ -0,0 +1,3 @@
+module UserPlane
+  VERSION = "0.0.15"
+end

data/spec/controllers/user/confirm_email_addresses_controller_spec.rb

@@ -0,0 +1,5 @@
+require 'spec_helper'
+
+describe User::ConfirmEmailAddressesController, type: :controller do
+
+end

data/spec/controllers/user/details_controller_spec.rb

@@ -0,0 +1,5 @@
+require 'spec_helper'
+
+describe User::DetailsController, type: :controller do
+
+end

data/spec/controllers/user/invites_controller_spec.rb

@@ -0,0 +1,19 @@
+require 'spec_helper'
+require 'shared_contexts/user'
+
+describe User::InvitesController, type: :controller do
+  include_context 'user'
+  render_views
+
+  # TODO: report this bug. You can't reproduce every route without use_route
+  # because all params are stringified, but constraints can be symbols
+
+  it 'does serve an invite page' do
+    session_manager = SessionManager.new(session)
+    session_manager.identity = a_user.email
+
+    get :new
+    expect(response).to have_http_status(:ok)
+  end
+
+end

data/spec/controllers/user/reset_passwords_controller_spec.rb

@@ -0,0 +1,5 @@
+require 'spec_helper'
+
+describe User::ResetPasswordsController, type: :controller do
+
+end

data/spec/controllers/user/sign_ins_controller_spec.rb

@@ -0,0 +1,34 @@
+require 'spec_helper'
+require 'shared_contexts/user'
+
+describe User::SignInsController, type: :controller do
+  include_context 'user'
+
+  let :session_manager do
+    double("session_manager")
+  end
+  before {allow(subject).to receive(:session_manager).and_return(session_manager)}
+
+  describe "signing in" do
+    it "updates the session with the correct credentials" do 
+      expect(session_manager).to receive(:identity=).with(a_user.email)
+      expect(session_manager).to receive(:remember_page).with(nil)
+      expect(session_manager).to receive(:previous_page)
+
+      post :create, user_sign_in: {email: a_user.email.address, password: a_user.email.password}
+    end
+
+    it "does not log in with bad credentials" do 
+      expect(session_manager).not_to receive(:identity=).with(a_user.email)
+      post :create, user_sign_in: {email: a_user.email.address, password: 'wrong password'}
+    end
+
+  end
+
+  describe "signing out" do
+    it "destroys the session" do
+      expect(session_manager).to receive(:sign_out)
+      get :destroy
+    end
+  end
+end

data/spec/controllers/user/sign_ups_controller_spec.rb

@@ -0,0 +1,5 @@
+require 'spec_helper'
+
+describe User::SignUpsController, type: :controller do
+
+end

data/spec/dummy/README.rdoc

@@ -0,0 +1,28 @@
+== README
+
+This README would normally document whatever steps are necessary to get the
+application up and running.
+
+Things you may want to cover:
+
+* Ruby version
+
+* System dependencies
+
+* Configuration
+
+* Database creation
+
+* Database initialization
+
+* How to run the test suite
+
+* Services (job queues, cache servers, search engines, etc.)
+
+* Deployment instructions
+
+* ...
+
+
+Please feel free to use a different markup language if you do not plan to run
+<tt>rake doc:app</tt>.

data/spec/dummy/Rakefile

@@ -0,0 +1,6 @@
+# Add your own tasks in files placed in lib/tasks ending in .rake,
+# for example lib/tasks/capistrano.rake, and they will automatically be available to Rake.
+
+require File.expand_path('../config/application', __FILE__)
+
+Rails.application.load_tasks

data/spec/dummy/app/assets/javascripts/application.js

@@ -0,0 +1,13 @@
+// This is a manifest file that'll be compiled into application.js, which will include all the files
+// listed below.
+//
+// Any JavaScript/Coffee file within this directory, lib/assets/javascripts, vendor/assets/javascripts,
+// or vendor/assets/javascripts of plugins, if any, can be referenced here using a relative path.
+//
+// It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
+// compiled file.
+//
+// Read Sprockets README (https://github.com/sstephenson/sprockets#sprockets-directives) for details
+// about supported directives.
+//
+//= require_tree .