doorkeeper 0.3.0 → 0.4.0

data/gemfiles/gemfile.rails-3.2.x

@@ -0,0 +1,7 @@
+source 'http://rubygems.org'
+
+gem 'rails', '~> 3.2.0'
+gem 'jquery-rails'
+gem 'doorkeeper', :path => '../'
+
+gemspec :path => '../'

data/lib/doorkeeper/config.rb

@@ -1,7 +1,3 @@
-require 'doorkeeper/config/scopes'
-require 'doorkeeper/config/scope'
-require 'doorkeeper/config/scopes_builder'
-
 module Doorkeeper
   def self.configure(&block)
     @config = Config::Builder.new(&block).build
@@ -12,11 +8,30 @@ module Doorkeeper
   end
 
   class Config
-    def default_scope_string
-      @scopes.try(:default_scope_string) || ""
-    end
-
     class Builder
+      # Helper class to migrate scopes using authorization_scopes block
+      # It will be removed in v0.5.x
+      class ScopesMigrator
+        attr_accessor :default_scopes, :optional_scopes, :translations
+
+        def initialize
+          @default_scopes, @optional_scopes, @translations = [], [], {}
+        end
+
+        def scope(scope, options = {})
+          if options[:default]
+            @optional_scopes << scope
+          else
+            @default_scopes << scope
+          end
+          @translations[scope] = options[:description]
+        end
+
+        def migrate(&block)
+          self.instance_eval(&block)
+        end
+      end
+
       def initialize(&block)
         @config = Config.new
         instance_eval(&block)
@@ -26,9 +41,30 @@ module Doorkeeper
         @config
       end
 
+      def default_scopes(*scopes)
+        @config.instance_variable_set("@default_scopes", Doorkeeper::OAuth::Scopes.from_array(scopes))
+      end
+
+      def optional_scopes(*scopes)
+        @config.instance_variable_set("@optional_scopes", Doorkeeper::OAuth::Scopes.from_array(scopes))
+      end
+
+      def client_credentials(*methods)
+        @config.instance_variable_set("@client_credentials", methods)
+      end
+
       def use_refresh_token
         @config.instance_variable_set("@refresh_token_enabled", true)
       end
+
+      # DEPRECATED: use default/optional scopes
+      def authorization_scopes(&block)
+        migrator = ScopesMigrator.new
+        migrator.migrate(&block)
+        self.default_scopes *migrator.default_scopes
+        self.optional_scopes *migrator.optional_scopes
+        @config.instance_variable_set("@authorization_scopes", migrator)
+      end
     end
 
     module Option
@@ -77,7 +113,11 @@ module Doorkeeper
         end
 
         define_method attribute do |*args|
-          instance_variable_get(:"@#{attribute}") || options[:default]
+          if instance_variable_defined?(:"@#{attribute}")
+            instance_variable_get(:"@#{attribute}")
+          else
+            options[:default]
+          end
         end
 
         public attribute
@@ -90,13 +130,34 @@ module Doorkeeper
 
     extend Option
 
-    option :resource_owner_authenticator, :as      => :authenticate_resource_owner
-    option :admin_authenticator,          :as      => :authenticate_admin
+    option :resource_owner_authenticator, :as => :authenticate_resource_owner
+    option :admin_authenticator,          :as => :authenticate_admin
+    option :resource_owner_from_credentials
     option :access_token_expires_in,      :default => 7200
-    option :authorization_scopes,         :as      => :scopes, :builder_class => ScopesBuilder, :default => Scopes.new
 
     def refresh_token_enabled?
       !!@refresh_token_enabled
     end
+
+    def default_scopes
+      @default_scopes ||= Doorkeeper::OAuth::Scopes.new
+    end
+
+    def optional_scopes
+      @optional_scopes ||= Doorkeeper::OAuth::Scopes.new
+    end
+
+    def scopes
+      @scopes ||= default_scopes + optional_scopes
+    end
+
+    def client_credentials_methods
+      @client_credentials ||= [:from_basic, :from_params]
+    end
+
+    # DEPRECATED: use default/optional scopes
+    def authorization_scopes
+      @authorization_scopes
+    end
   end
 end

data/lib/doorkeeper/doorkeeper_for.rb

@@ -4,20 +4,20 @@ module Doorkeeper
     def initialize(options)
       options ||= {}
       raise InvalidSyntax unless options.is_a? Hash
+      @filter_options = {}
 
       options.each do |k, v|
         self.send(k, v)
       end
     end
 
-
     def validate_token(token)
       return false unless token
       token.accessible? and validate_token_scopes(token)
     end
 
     def filter_options
-      {}
+      @filter_options
     end
 
     private
@@ -25,6 +25,14 @@ module Doorkeeper
       @scopes = scopes
     end
 
+    def if(if_block)
+      @filter_options[:if] = if_block
+    end
+
+    def unless(unless_block)
+      @filter_options[:unless] = unless_block
+    end
+
     def validate_token_scopes(token)
       return true if @scopes.blank?
       token.scopes.any? { |scope| @scopes.include? scope}
@@ -32,30 +40,22 @@ module Doorkeeper
   end
 
   class AllDoorkeeperFor < DoorkeeperFor
-    def filter_options
-      @except ? {:except => @except} : {}
-    end
-
     private
     def except(actions)
-      @except = actions
+      @filter_options[:except] = actions
     end
   end
 
   class SelectedDoorkeeperFor < DoorkeeperFor
     def initialize(*args)
       options = args.pop if args.last.is_a? Hash
-      only(args)
       super(options)
-    end
-
-    def filter_options
-      {:only => @only}
+      only(args)
     end
 
     private
     def only(actions)
-      @only = actions
+      @filter_options[:only] = actions
     end
   end
 
@@ -101,13 +101,17 @@ module Doorkeeper
     end
 
     def get_doorkeeper_token
-      token = params[:access_token] || params[:bearer_token] || request.env['HTTP_AUTHORIZATION']
+      token = params[:access_token] || params[:bearer_token] || authorization_bearer_token
       if token
-        token.gsub!(/Bearer /, '')
         AccessToken.find_by_token(token)
       end
     end
 
+    def authorization_bearer_token
+      header = request.env['HTTP_AUTHORIZATION']
+      header.gsub(/^Bearer /, '') if header && header.match(/^Bearer /)
+    end
+
     def doorkeeper_unauthorized_render_options
       nil
     end

data/lib/doorkeeper/engine.rb

@@ -5,5 +5,33 @@ module Doorkeeper
     config.generators do |g|
       g.test_framework :rspec, :view_specs => false
     end
+
+    initializer "doorkeeper.deprecations" do
+      if Doorkeeper.installed?
+        if Doorkeeper.configuration.authorization_scopes.present?
+          warning = <<-WARN
+[DOORKEEPER]
+  Configuration for `authorization_scopes` will no longer be supported. Use default_scopes/optional_scopes instead.
+  ATTENTION: The :description option could not be migrated because doorkeeper now uses localization files.
+  Place this in your config/locales/en.yml
+en:
+  doorkeeper:
+    scopes:
+WARN
+          puts warning
+          Doorkeeper.configuration.authorization_scopes.translations.each do |scope, translation|
+            puts "      #{scope}: #{translation}"
+          end
+        end
+
+        if Doorkeeper::AccessToken.columns_hash["resource_owner_id"].null == false
+          warn <<-WARN
+[DOORKEEPER]
+  In order to use the Client Credentials flow, you have to migrate the oauth_access_tokens table:
+  change_column :oauth_access_tokens, :resource_owner_id, :integer, :null => true
+WARN
+        end
+      end
+    end
   end
 end

data/lib/doorkeeper/models/scopes.rb

@@ -0,0 +1,13 @@
+module Doorkeeper
+  module Models
+    module Scopes
+      def scopes
+        Doorkeeper::OAuth::Scopes.from_string(self[:scopes])
+      end
+
+      def scopes_string
+        Doorkeeper::OAuth::Scopes.from_string(self[:scopes]).to_s
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/access_token_request.rb

@@ -3,12 +3,10 @@ module Doorkeeper::OAuth
     include Doorkeeper::Validations
 
     ATTRIBUTES = [
-      :client_id,
-      :client_secret,
       :grant_type,
       :code,
       :redirect_uri,
-      :refresh_token,
+      :refresh_token
     ]
 
     validate :attributes,   :error => :invalid_request
@@ -18,9 +16,11 @@ module Doorkeeper::OAuth
     validate :redirect_uri, :error => :invalid_grant
 
     attr_accessor *ATTRIBUTES
+    attr_accessor :client
 
-    def initialize(attributes = {})
+    def initialize(client, attributes = {})
       ATTRIBUTES.each { |attr| instance_variable_set("@#{attr}", attributes[attr]) }
+      @client = client
       validate
     end
 
@@ -46,7 +46,7 @@ module Doorkeeper::OAuth
     end
 
     def access_token
-      @access_token ||= AccessToken.matching_token_for client, base_token.resource_owner_id, base_token.scopes_string
+      @access_token ||= Doorkeeper::AccessToken.matching_token_for client, base_token.resource_owner_id, base_token.scopes
     end
 
     def token_type
@@ -54,10 +54,7 @@ module Doorkeeper::OAuth
     end
 
     def error_response
-      {
-        'error' => error.to_s,
-        'error_description' => error_description
-      }
+      Doorkeeper::OAuth::ErrorResponse.from_request(self)
     end
 
     private
@@ -79,24 +76,20 @@ module Doorkeeper::OAuth
       base_token.revoke
     end
 
-    def client
-      @client ||= Application.find_by_uid_and_secret(@client_id, @client_secret)
-    end
-
     def base_token
       @base_token ||= refresh_token? ? token_via_refresh_token : token_via_authorization_code
     end
 
     def token_via_authorization_code
-      AccessGrant.find_by_token(code)
+      Doorkeeper::AccessGrant.find_by_token(code)
     end
 
     def token_via_refresh_token
-      AccessToken.find_by_refresh_token(refresh_token)
+      Doorkeeper::AccessToken.find_by_refresh_token(refresh_token)
     end
 
     def create_access_token
-      @access_token = AccessToken.create!({
+      @access_token = Doorkeeper::AccessToken.create!({
         :application_id    => client.id,
         :resource_owner_id => base_token.resource_owner_id,
         :scopes            => base_token.scopes_string,
@@ -139,10 +132,6 @@ module Doorkeeper::OAuth
       %w(authorization_code refresh_token).include? grant_type
     end
 
-    def error_description
-      I18n.translate error, :scope => [:doorkeeper, :errors, :messages]
-    end
-
     def configuration
       Doorkeeper.configuration
     end

data/lib/doorkeeper/oauth/authorization/code.rb

@@ -18,7 +18,7 @@ module Doorkeeper
             :resource_owner_id => authorization.resource_owner.id,
             :expires_in        => DEFAULT_EXPIRATION_TIME,
             :redirect_uri      => authorization.redirect_uri,
-            :scopes            => authorization.scope
+            :scopes            => authorization.scopes.to_s
           )
         end
 

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -14,7 +14,7 @@ module Doorkeeper
           uri_with_fragment(authorization.redirect_uri, {
             :access_token => access_token.token,
             :token_type   => access_token.token_type,
-            :expires_in   => access_token.time_left,
+            :expires_in   => access_token.expires_in,
             :state => authorization.state
           })
         end
@@ -23,7 +23,7 @@ module Doorkeeper
           @access_token ||= AccessToken.create!({
             :application_id    => authorization.client.id,
             :resource_owner_id => authorization.resource_owner.id,
-            :scopes            => authorization.scope,
+            :scopes            => authorization.scopes.to_s,
             :expires_in        => configuration.access_token_expires_in,
             :use_refresh_token => false
           })

data/lib/doorkeeper/oauth/authorization_request.rb

@@ -6,7 +6,6 @@ module Doorkeeper::OAuth
 
     ATTRIBUTES = [
       :response_type,
-      :client_id,
       :redirect_uri,
       :scope,
       :state
@@ -19,12 +18,12 @@ module Doorkeeper::OAuth
     validate :scope,         :error => :invalid_scope
 
     attr_accessor *ATTRIBUTES
-    attr_accessor :resource_owner, :error
+    attr_accessor :resource_owner, :client, :error
 
-    def initialize(resource_owner, attributes)
+    def initialize(client, resource_owner, attributes)
       ATTRIBUTES.each { |attr| instance_variable_set("@#{attr}", attributes[attr]) }
       @resource_owner = resource_owner
-      @scope          ||= Doorkeeper.configuration.default_scope_string
+      @client         = client
       validate
     end
 
@@ -35,44 +34,44 @@ module Doorkeeper::OAuth
     end
 
     def access_token_exists?
-      AccessToken.matching_token_for(client, resource_owner, scope).present?
+      Doorkeeper::AccessToken.matching_token_for(client, resource_owner, scopes).present?
     end
 
     def deny
       self.error = :access_denied
     end
 
+    def error_response
+      Doorkeeper::OAuth::ErrorResponse.from_request(self)
+    end
+
     def success_redirect_uri
       @authorization.callback
     end
 
     def invalid_redirect_uri
       uri_builder = is_token_request? ? :uri_with_fragment : :uri_with_query
-      send(uri_builder, redirect_uri, {
-        :error => error,
-        :error_description => error_description,
-        :state => state
-      })
+      send(uri_builder, redirect_uri, error_response.attributes)
     end
 
     def redirect_on_error?
       (error != :invalid_redirect_uri) && (error != :invalid_client)
     end
 
-    def client
-      @client ||= Application.find_by_uid(client_id)
+    def scopes
+      @scopes ||= if scope.present?
+        Doorkeeper::OAuth::Scopes.from_string(scope)
+      else
+        Doorkeeper.configuration.default_scopes
+      end
     end
 
-    def scopes
-      Doorkeeper.configuration.scopes.with_names(*scope.split(" ")) if has_scope?
+    def client_id
+      client.uid
     end
 
     private
 
-    def has_scope?
-      Doorkeeper.configuration.scopes.all.present?
-    end
-
     def validate_attributes
       response_type.present?
     end
@@ -91,7 +90,7 @@ module Doorkeeper::OAuth
     end
 
     def validate_scope
-      return true unless has_scope?
+      return true unless scope.present?
       ScopeChecker.valid?(scope, configuration.scopes)
     end
 
@@ -103,10 +102,6 @@ module Doorkeeper::OAuth
       response_type == "token"
     end
 
-    def error_description
-      I18n.translate error, :scope => [:doorkeeper, :errors, :messages]
-    end
-
     def configuration
       Doorkeeper.configuration
     end

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -0,0 +1,21 @@
+module Doorkeeper
+  module OAuth
+    class Client
+      class Credentials < Struct.new(:uid, :secret)
+        extend Methods
+
+        def self.from_request(request, *credentials_methods)
+          credentials_methods.inject(nil) do |credentials, method|
+            method = self.method(method) if method.is_a?(Symbol)
+            credentials = Credentials.new *method.call(request)
+            break credentials unless credentials.blank?
+          end
+        end
+
+        def blank?
+          uid.blank? || secret.blank?
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client/methods.rb

@@ -0,0 +1,18 @@
+module Doorkeeper
+  module OAuth
+    class Client
+      module Methods
+        def from_params(request)
+          request.parameters.values_at(:client_id, :client_secret)
+        end
+
+        def from_basic(request)
+          authorization = request.authorization
+          if authorization.present? && authorization =~ /^Basic (.*)/m
+            Base64.decode64($1).split(/:/, 2)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client.rb

@@ -0,0 +1,27 @@
+require 'doorkeeper/oauth/client/methods'
+require 'doorkeeper/oauth/client/credentials'
+
+module Doorkeeper
+  module OAuth
+    class Client
+      def self.find(uid)
+        if application = Doorkeeper::Application.find_by_uid(uid)
+          new(application)
+        end
+      end
+
+      def self.authenticate(credentials, method = Doorkeeper::Application.method(:authenticate))
+        return false if credentials.blank?
+        if application = method.call(credentials.uid, credentials.secret)
+          new(application)
+        end
+      end
+
+      delegate :id, :name, :uid, :redirect_uri, :to => :@application
+
+      def initialize(application)
+        @application = application
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -0,0 +1,29 @@
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Creator
+        def call(client, scopes, attributes = {})
+          existing_token = existing_token_for(client, scopes)
+          if existing_token
+            return existing_token if existing_token.accessible?
+            existing_token.revoke
+          end
+          create(client, scopes, attributes)
+        end
+
+      private
+
+        def existing_token_for(client, scopes)
+          Doorkeeper::AccessToken.matching_token_for client, nil, scopes
+        end
+
+        def create(client, scopes, attributes = {})
+          Doorkeeper::AccessToken.create(attributes.merge({
+            :application_id => client.id,
+            :scopes         => scopes.to_s
+          }))
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/issuer.rb

@@ -0,0 +1,35 @@
+require 'doorkeeper/oauth/client_credentials/validation'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Issuer
+        attr_accessor :token, :validation, :error
+
+        def initialize(server, validation)
+          @server, @validation = server, validation
+        end
+
+        def create(client, scopes, creator = Creator.new)
+          if validation.valid?
+            @token = create_token(client, scopes, creator)
+            @error = :server_error unless @token
+          else
+            @token = false
+            @error = validation.error
+          end
+          @token
+        end
+
+        private
+
+        def create_token(client, scopes, creator)
+          creator.call(client, scopes, {
+            :use_refresh_token => false,
+            :expires_in        => @server.access_token_expires_in
+          })
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/response.rb

@@ -0,0 +1,42 @@
+require 'active_model'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Response
+        include ActiveModel::Serializers::JSON
+
+        self.include_root_in_json = false
+
+        delegate :token, :expires_in, :scopes_string, :to => :@token
+        alias    :access_token :token
+        alias    :scope :scopes_string
+
+        def initialize(token)
+          @token = token
+        end
+
+        def attributes
+          {
+            'access_token' => token,
+            'token_type'   => token_type,
+            'expires_in'   => expires_in,
+            'scope'        => scopes_string
+          }
+        end
+
+        def status
+          :success
+        end
+
+        def token_type
+          'bearer'
+        end
+
+        def headers
+          { 'Cache-Control' => 'no-store', 'Pragma' => 'no-cache' }
+        end
+      end
+    end
+  end
+end