Finished the password machinery

app/models/user.rb

@@ -25,4 +25,37 @@ class User < ActiveRecord::Base
   validates :password, :presence => true,
                        :confirmation => true,
                        :length => { :within => 6..40 }
+
+  before_save :encrypt_password
+
+  def has_password?(submitted_password)
+    encrypted_password == encrypt(submitted_password)
+  end
+
+  class << self
+    def authenticate(email, submitted_password)
+      user = find_by_email(email)
+      return nil  if user.nil?
+      return user if user.has_password?(submitted_password)
+    end
+  end
+
+  private
+
+    def encrypt_password
+      self.salt = make_salt if new_record?
+      self.encrypted_password = encrypt(password)
+    end
+
+    def encrypt(string)
+      secure_hash("#{salt}--#{string}")
+    end
+
+    def make_salt
+      secure_hash("#{Time.now.utc}--#{password}")
+    end
+
+    def secure_hash(string)
+      Digest::SHA2.hexdigest(string)
+    end
 end

db/migrate/20100822233125_add_salt_to_users.rb

@@ -0,0 +1,9 @@
+class AddSaltToUsers < ActiveRecord::Migration
+  def self.up
+    add_column :users, :salt, :string
+  end
+
+  def self.down
+    remove_column :users, :salt
+  end
+end

db/schema.rb

@@ -10,14 +10,15 @@
 #
 # It's strongly recommended to check this file into your version control system.
 
-ActiveRecord::Schema.define(:version => 20100822204528) do
+ActiveRecord::Schema.define(:version => 20100822233125) do
 
   create_table "users", :force => true do |t|
     t.string   "name"
     t.string   "email"
     t.datetime "created_at"
     t.datetime "updated_at"
     t.string   "encrypted_password"
+    t.string   "salt"
   end
 
   add_index "users", ["email"], :name => "index_users_on_email", :unique => true

spec/models/user_spec.rb

@@ -109,5 +109,47 @@
     it "should have an encrypted password attribute" do
       @user.should respond_to(:encrypted_password)
     end
+
+    it "should set the encrypted password attribute" do
+      @user.encrypted_password.should_not be_blank
+    end
+
+    it "should have a salt" do
+      @user.should respond_to(:salt)
+    end
+
+    describe "has_password? method" do
+
+      it "should exist" do
+        @user.should respond_to(:has_password?)
+      end
+
+      it "should return true if the passwords match" do
+        @user.has_password?(@attr[:password]).should be_true
+      end
+
+      it "should return false if the passwords don't match" do
+        @user.has_password?("invalid").should be_false
+      end
+    end
+
+    describe "authenticate method" do
+
+      it "should exist" do
+        User.should respond_to(:authenticate)
+      end
+
+      it "should return nil on email/password mismatch" do
+        User.authenticate(@attr[:email], "wrongpass").should be_nil
+      end
+
+      it "should return nil for an email address with no user" do
+        User.authenticate("[email protected]", @attr[:password]).should be_nil
+      end
+
+      it "should return the user on email/password match" do
+        User.authenticate(@attr[:email], @attr[:password]).should == @user
+      end
+    end
   end
 end