devise_oauth2_providable 1.0.5 → 1.1.0

data/lib/devise/oauth2_providable/expirable_token.rb

@@ -20,10 +20,9 @@ module Devise
           validates :client, :presence => true
           validates :token, :presence => true, :uniqueness => true
 
-          scope :not_expired, lambda {
+          default_scope lambda {
             where(self.arel_table[:expires_at].gteq(Time.now.utc))
           }
-          default_scope not_expired
 
           include LocalInstanceMethods
         end
@@ -55,3 +54,4 @@ module Devise
 end
 
 ActiveRecord::Base.send :include, Devise::Oauth2Providable::ExpirableToken
+

data/lib/devise/oauth2_providable/strategies/oauth2_authorization_code_grant_type_strategy.rb

@@ -7,8 +7,8 @@ module Devise
         'authorization_code'
       end
 
-      def authenticate!
-        if client && code = client.authorization_codes.find_by_token(params[:code])
+      def authenticate_grant_type(client)
+        if code = client.authorization_codes.find_by_token(params[:code])
           success! code.user
         elsif !halted?
           oauth_error! :invalid_grant, 'invalid authorization code request'

data/lib/devise/oauth2_providable/strategies/oauth2_grant_type_strategy.rb

@@ -11,12 +11,21 @@ module Devise
       def grant_type
       end
 
-      def client
-        return @client if @client
-        @client = Devise::Oauth2Providable::Client.find_by_identifier params[:client_id]
-        env[Devise::Oauth2Providable::CLIENT_ENV_REF] = @client
-        @client
+      # defined by subclass
+      def authenticate_grant_type(client)
+      end
+
+      def authenticate!
+        client_id, client_secret = request.authorization ? decode_credentials : [params[:client_id], params[:client_secret]]
+        client = Devise::Oauth2Providable::Client.find_by_identifier client_id
+        if client && client.secret == client_secret
+          env[Devise::Oauth2Providable::CLIENT_ENV_REF] = client
+          authenticate_grant_type(client)
+        else
+          oauth_error! :invalid_client, 'invalid client credentials'
+        end
       end
+
       # return custom error response in accordance with the oauth spec
       # see http://tools.ietf.org/html/draft-ietf-oauth-v2-16#section-4.3
       def oauth_error!(error_code = :invalid_request, description = nil)

data/lib/devise/oauth2_providable/strategies/oauth2_password_grant_type_strategy.rb

@@ -7,9 +7,9 @@ module Devise
         'password'
       end
 
-      def authenticate!
+      def authenticate_grant_type(client)
         resource = mapping.to.find_for_authentication(mapping.to.authentication_keys.first => params[:username])
-        if client && validate(resource) { resource.valid_password?(params[:password]) }
+        if validate(resource) { resource.valid_password?(params[:password]) }
           success! resource
         elsif !halted?
           oauth_error! :invalid_grant, 'invalid password authentication request'

data/lib/devise/oauth2_providable/strategies/oauth2_refresh_token_grant_type_strategy.rb

@@ -7,8 +7,8 @@ module Devise
         'refresh_token'
       end
 
-      def authenticate!
-        if client && refresh_token = client.refresh_tokens.find_by_token(params[:refresh_token])
+      def authenticate_grant_type(client)
+        if refresh_token = client.refresh_tokens.find_by_token(params[:refresh_token])
           env[Devise::Oauth2Providable::REFRESH_TOKEN_ENV_REF] = refresh_token
           success! refresh_token.user
         elsif !halted?

data/lib/devise/oauth2_providable/version.rb

@@ -1,5 +1,5 @@
 module Devise
   module Oauth2Providable
-    VERSION = "1.0.5"
+    VERSION = "1.1.0"
   end
 end

data/spec/integration/oauth2_authorization_token_grant_type_strategy_spec.rb

@@ -31,6 +31,33 @@ describe Devise::Strategies::Oauth2AuthorizationCodeGrantTypeStrategy do
           response.body.should match_json(expected)
         end
       end
+      context 'with expired authorization_code' do
+        with :client
+        with :user
+        before do
+          timenow = 2.days.from_now
+          Time.stub!(:now).and_return(timenow)
+          @authorization_code = user.authorization_codes.create(:client_id => client, :redirect_uri => client.redirect_uri)
+          params = {
+            :grant_type => 'authorization_code',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :code => @authorization_code.token
+          }
+          Time.stub!(:now).and_return(timenow + 10.minutes)
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_grant',
+            :error_description => 'invalid authorization code request'
+          }
+          response.body.should match_json(expected)
+        end
+      end
       context 'with invalid authorization_code' do
         with :client
         with :user
@@ -40,7 +67,7 @@ describe Devise::Strategies::Oauth2AuthorizationCodeGrantTypeStrategy do
             :grant_type => 'authorization_code',
             :client_id => client.identifier,
             :client_secret => client.secret,
-            :refresh_token => 'invalid'
+            :code => 'invalid'
           }
 
           post '/oauth2/token', params
@@ -48,8 +75,6 @@ describe Devise::Strategies::Oauth2AuthorizationCodeGrantTypeStrategy do
         it { response.code.to_i.should == 400 }
         it { response.content_type.should == 'application/json' }
         it 'returns json' do
-          token = Devise::Oauth2Providable::AccessToken.last
-          refresh_token = @refresh_token
           expected = {
             :error => 'invalid_grant',
             :error_description => 'invalid authorization code request'
@@ -57,6 +82,55 @@ describe Devise::Strategies::Oauth2AuthorizationCodeGrantTypeStrategy do
           response.body.should match_json(expected)
         end
       end
+      context 'with invalid client_secret' do
+        with :user
+        with :client
+        before do
+          @authorization_code = user.authorization_codes.create(:client_id => client, :redirect_uri => client.redirect_uri)
+          params = {
+            :grant_type => 'authorization_code',
+            :client_id => client.identifier,
+            :client_secret => 'invalid',
+            :code => @authorization_code.token
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_client',
+            :error_description => 'invalid client credentials'
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client_id' do
+        with :user
+        with :client
+        before do
+          @authorization_code = user.authorization_codes.create(:client_id => client, :redirect_uri => client.redirect_uri)
+          params = {
+            :grant_type => 'authorization_code',
+            :client_id => 'invalid',
+            :client_secret => client.secret,
+            :code => @authorization_code.token
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_client',
+            :error_description => 'invalid client credentials'
+          }
+          response.body.should match_json(expected)
+        end
+      end
     end
   end
 end
+

data/spec/integration/oauth2_password_grant_type_strategy_spec.rb

@@ -26,7 +26,74 @@ describe Devise::Strategies::Oauth2PasswordGrantTypeStrategy do
           response.body.should match_json(expected)
         end
       end
-      context 'with invalid params' do
+      context 'with valid params and client id/secret in basic auth header' do
+        with :client
+        before do
+          @user = User.create! :email => 'ryan@socialcast.com', :password => 'test'
+
+          params = {
+            :grant_type => 'password',
+            :username => @user.email,
+            :password => 'test'
+          }
+
+          auth_header = ActionController::HttpAuthentication::Basic.encode_credentials client.identifier, client.secret
+          post '/oauth2/token', params, 'HTTP_AUTHORIZATION' => auth_header
+        end
+        it { response.code.to_i.should == 200 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          puts response.body
+          token = Devise::Oauth2Providable::AccessToken.last
+          expected = token.token_response
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client id in basic auth header' do
+        with :client
+        before do
+          @user = User.create! :email => 'ryan@socialcast.com', :password => 'test'
+          params = {
+            :grant_type => 'password',
+            :username => @user.email,
+            :password => 'test'
+          }
+          auth_header = ActionController::HttpAuthentication::Basic.encode_credentials 'invalid client id', client.secret
+          post '/oauth2/token', params, 'HTTP_AUTHORIZATION' => auth_header
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid client credentials",
+            :error => "invalid_client"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client secret in basic auth header' do
+        with :client
+        before do
+          @user = User.create! :email => 'ryan@socialcast.com', :password => 'test'
+          params = {
+            :grant_type => 'password',
+            :username => @user.email,
+            :password => 'test'
+          }
+          auth_header = ActionController::HttpAuthentication::Basic.encode_credentials client.identifier, 'invalid secret'
+          post '/oauth2/token', params, 'HTTP_AUTHORIZATION' => auth_header
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid client credentials",
+            :error => "invalid_client"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid password' do
         with :client
         before do
           @user = User.create! :email => 'ryan@socialcast.com', :password => 'test'
@@ -51,13 +118,39 @@ describe Devise::Strategies::Oauth2PasswordGrantTypeStrategy do
           response.body.should match_json(expected)
         end
       end
-      context 'with invalid client' do
+      context 'with invalid client_id' do
+        with :client
         before do
           @user = User.create! :email => 'ryan@socialcast.com', :password => 'test'
 
           params = {
             :grant_type => 'password',
-            :client_id => '123',
+            :client_id => 'invalid',
+            :client_secret => client.secret,
+            :username => @user.email,
+            :password => 'test'
+          }
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json'  }
+        it 'returns json' do
+          expected = {
+            :error_description => "invalid client credentials",
+            :error => "invalid_client"
+          }
+          response.body.should match_json(expected)
+        end
+      end
+      context 'with invalid client_secret' do
+        with :client
+        before do
+          @user = User.create! :email => 'ryan@socialcast.com', :password => 'test'
+
+          params = {
+            :grant_type => 'password',
+            :client_id => client.identifier,
             :client_secret => 'invalid',
             :username => @user.email,
             :password => 'test'
@@ -69,8 +162,8 @@ describe Devise::Strategies::Oauth2PasswordGrantTypeStrategy do
         it { response.content_type.should == 'application/json'  }
         it 'returns json' do
           expected = {
-            :error_description => "invalid password authentication request",
-            :error => "invalid_grant"
+            :error_description => "invalid client credentials",
+            :error => "invalid_client"
           }
           response.body.should match_json(expected)
         end
@@ -78,3 +171,4 @@ describe Devise::Strategies::Oauth2PasswordGrantTypeStrategy do
     end
   end
 end
+

data/spec/integration/oauth2_refresh_token_grant_type_strategy_spec.rb

@@ -31,6 +31,33 @@ describe Devise::Strategies::Oauth2RefreshTokenGrantTypeStrategy do
           response.body.should match_json(expected)
         end
       end
+      context 'with expired refresh_token' do
+        with :user
+        with :client
+        before do
+          timenow = 2.days.from_now
+          Time.stub!(:now).and_return(timenow)
+          @refresh_token = client.refresh_tokens.create! :user => user
+          params = {
+            :grant_type => 'refresh_token',
+            :client_id => client.identifier,
+            :client_secret => client.secret,
+            :refresh_token => @refresh_token.token
+          }
+          Time.stub!(:now).and_return(timenow + 2.months)
+
+          post '/oauth2/token', params
+        end
+        it { response.code.to_i.should == 400 }
+        it { response.content_type.should == 'application/json' }
+        it 'returns json' do
+          expected = {
+            :error => 'invalid_grant',
+            :error_description => 'invalid refresh token'
+          }
+          response.body.should match_json(expected)
+        end
+      end
       context 'with invalid refresh_token' do
         with :user
         with :client
@@ -74,11 +101,9 @@ describe Devise::Strategies::Oauth2RefreshTokenGrantTypeStrategy do
         it { response.code.to_i.should == 400 }
         it { response.content_type.should == 'application/json' }
         it 'returns json' do
-          token = Devise::Oauth2Providable::AccessToken.last
-          refresh_token = @refresh_token
           expected = {
-            :error => 'invalid_grant',
-            :error_description => 'invalid refresh token'
+            :error => 'invalid_client',
+            :error_description => 'invalid client credentials'
           }
           response.body.should match_json(expected)
         end
@@ -91,7 +116,7 @@ describe Devise::Strategies::Oauth2RefreshTokenGrantTypeStrategy do
           params = {
             :grant_type => 'refresh_token',
             :client_id => client.identifier,
-            :client_secret => client.secret,
+            :client_secret => 'invalid',
             :refresh_token => @refresh_token.token
           }
 
@@ -100,11 +125,9 @@ describe Devise::Strategies::Oauth2RefreshTokenGrantTypeStrategy do
         it { response.code.to_i.should == 400 }
         it { response.content_type.should == 'application/json' }
         it 'returns json' do
-          token = Devise::Oauth2Providable::AccessToken.last
-          refresh_token = @refresh_token
           expected = {
-            :error => 'invalid_grant',
-            :error_description => 'invalid refresh token'
+            :error => 'invalid_client',
+            :error_description => 'invalid client credentials'
           }
           response.body.should match_json(expected)
         end
@@ -112,3 +135,4 @@ describe Devise::Strategies::Oauth2RefreshTokenGrantTypeStrategy do
     end
   end
 end
+

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: devise_oauth2_providable
 version: !ruby/object:Gem::Version 
-  hash: 29
+  hash: 19
   prerelease: 
   segments: 
   - 1
+  - 1
   - 0
-  - 5
-  version: 1.0.5
+  version: 1.1.0
 platform: ruby
 authors: 
 - Ryan Sonnek
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-01-20 00:00:00 Z
+date: 2012-02-18 00:00:00 Z
 dependencies: 
 - !ruby/object:Gem::Dependency 
   version_requirements: &id001 !ruby/object:Gem::Requirement