Pieces of Web

class CreateLoginAttempts < ActiveRecord::Migration
  def self.up
    create_table :login_attempts do |t|
      t.integer :user_id, :null => false
      t.string :remote_ip, :user_agent
      t.timestamps
    end
    add_column :users, :locked_out_at, :datetime
  end
 
  def self.down
    drop_table :login_attempts
    remove_column :users, :locked_out_at
  end
end

require 'digest/sha1'
class User < ActiveRecord::Base
  include Authentication
  include Authentication::ByPassword
  include Authentication::ByCookieToken
  include Authorization::AasmRoles
 
  # here is how I setup the lockout options 
  LOCKOUT_OPTIONS = {
    :lockout_period => 1, # in minutes
    :login_attempts => 3, # number of tries
    :attempt_window => 4 # can have x number of login_attempts in this many minutes
  }
 
  has_many :login_attempts
 
  named_scope :with_allowed_states, :conditions => { :state => [ 'suspended', 'locked_out', 'active' ] }
 
  # A locked out account is different from a suspended account, so these are necessary
  aasm_state :locked_out, :enter => :set_locked_out_at
  aasm_event :lock_out do
    transitions :from => :active, :to => :locked_out
  end
  aasm_event :end_lock_out do
    transitions :from => :locked_out, :to => :active
  end
 
  # HACK HACK HACK -- how to do attr_accessible from here?
  # prevents a user from submitting a crafted form that bypasses activation
  # anything else you want your user to change should be added here.
  attr_accessible :login, :email, :name, :password, :password_confirmation
 
  def max_login_attempts?
    self.login_attempts.by_attempt_window(LOCKOUT_OPTIONS[:attempt_window]).all.size > LOCKOUT_OPTIONS[:login_attempts]
  end
 
  def lock_out_ended?
    self.locked_out_at < (Time.now - LOCKOUT_OPTIONS[:lockout_period].minutes)
  end
 
  def login=(value)
    write_attribute :login, (value ? value.downcase : nil)
  end
 
  def email=(value)
    write_attribute :email, (value ? value.downcase : nil)
  end
 
  def admin?
    self.role == 'admin'
  end
 
protected
 
  def set_locked_out_at
    self.locked_out_at = Time.now
  end
 
  def make_activation_code
    self.deleted_at = nil
    self.activation_code = self.class.make_token
  end
end

# This controller handles the login/logout function of the site.  
class SessionsController < ApplicationController
  # render new.rhtml
  def new
  end
 
  def create
    logout_keeping_session!
    @login       = params[:login]
    @remember_me = params[:remember_me]
    @user = User.with_allowed_states.find_by_login(@login)
    if @user
      case @user.aasm_current_state
      when :suspended
        flash_and_render(:error, "Your account is suspended")
      when :locked_out
        if @user.lock_out_ended?
          LoginAttempt.delete(@user.login_attempts)
          @user.end_lock_out!
          proceed_to_login
        else
          flash_and_render(:error, "Your account is locked out")
        end
      else # is active
        proceed_to_login
      end
    else
      flash_and_render
    end
  end
 
  def destroy
    logout_killing_session!
    flash[:notice] = "You have been logged out."
    redirect_back_or_default('/')
  end
 
protected
 
  def proceed_to_login
    if @user.authenticated?(params[:password])
      self.current_user = @user
      LoginAttempt.delete(@user.login_attempts)
      new_cookie_flag = (params[:remember_me] == "1")
      handle_remember_cookie! new_cookie_flag
      flash[:success] = "Logged in successfully"
      redirect_back_or_default(root_path)
    else
      @user.login_attempts.create(:remote_ip => request.remote_ip, :user_agent => request.user_agent)
      if @user.max_login_attempts?
        @user.lock_out!
        flash_and_render(:error, "Your account is locked out")
      else
        flash_and_render
      end
    end
  end
 
  def flash_and_render(type = :notice, message = "Incorrect username or password")
    flash[type] = message
    # done to clear out unneeded flash values since this isn't a redirect...know a better way to do this?
    flash.delete_if {|key, value| key != type }
    render :action => 'new'
  end
end