doorkeeper 0.3.0 → 0.4.0

data/lib/doorkeeper/oauth/client_credentials/validation.rb

@@ -0,0 +1,33 @@
+require 'doorkeeper/validations'
+require 'doorkeeper/oauth/scopes'
+require 'doorkeeper/oauth/helpers/scope_checker'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Validation
+        include Doorkeeper::Validations
+        include Doorkeeper::OAuth::Helpers
+
+        validate :client, :error => :invalid_client
+        validate :scopes, :error => :invalid_scope
+
+        def initialize(server, request)
+          @server, @request = server, request
+          validate
+        end
+
+        private
+
+        def validate_client
+          @request.client.present?
+        end
+
+        def validate_scopes
+          return true unless @request.original_scopes.present?
+          ScopeChecker.valid?(@request.original_scopes, @server.scopes)
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials_request.rb

@@ -0,0 +1,46 @@
+require 'doorkeeper/oauth/error'
+require 'doorkeeper/oauth/error_response'
+require 'doorkeeper/oauth/scopes'
+require 'doorkeeper/oauth/client_credentials/creator'
+require 'doorkeeper/oauth/client_credentials/issuer'
+require 'doorkeeper/oauth/client_credentials/response'
+require 'doorkeeper/oauth/client_credentials/validation'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      attr_accessor :issuer, :server, :client, :original_scopes, :scopes
+      attr_reader   :response
+      alias         :authorization :response  # Remove this when API is consistent
+      alias         :error_response :response
+
+      delegate :error, :to => :issuer
+
+      def issuer
+        @issuer ||= Issuer.new(server, Validation.new(server, self))
+      end
+
+      def initialize(server, client, parameters = {})
+        @client, @server = client, server
+        @response        = nil
+        @original_scopes = parameters[:scope]
+      end
+
+      def authorize
+        @response = if issuer.create(client, scopes)
+          Response.new(issuer.token)
+        else
+          ErrorResponse.from_request(self)
+        end
+      end
+
+      def scopes
+        @scopes ||= if @original_scopes.present?
+          Doorkeeper::OAuth::Scopes.from_string(@original_scopes)
+        else
+          server.default_scopes
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/error.rb

@@ -0,0 +1,9 @@
+module Doorkeeper
+  module OAuth
+    class Error < Struct.new(:name, :state)
+      def description
+        I18n.translate name, :scope => [:doorkeeper, :errors, :messages]
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/error_response.rb

@@ -0,0 +1,30 @@
+module Doorkeeper
+  module OAuth
+    class ErrorResponse
+      include ActiveModel::Serializers::JSON
+
+      self.include_root_in_json = false
+
+      def self.from_request(request)
+        state = request.state if request.respond_to?(:state)
+        new(:name => request.error, :state => state)
+      end
+
+      delegate :name, :description, :state, :to => :@error
+      alias    :error :name
+      alias    :error_description :description
+
+      def initialize(attributes = {})
+        @error = Doorkeeper::OAuth::Error.new(*attributes.values_at(:name, :state))
+      end
+
+      def attributes
+        { 'error' => name, 'error_description' => description, 'state' => state }.reject { |k, v| v.blank? }
+      end
+
+      def status
+        :unauthorized
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -4,13 +4,13 @@ module Doorkeeper
       module ScopeChecker
         def self.matches?(current_scopes, scopes)
           return false if current_scopes.nil? || scopes.nil?
-          current_scopes.map(&:to_s).sort == scopes.split(" ").sort
+          current_scopes == scopes
         end
 
         def self.valid?(scope, server_scopes)
           scope.present? &&
           scope !~ /[\n|\r|\t]/ &&
-          server_scopes.all_included?(scope)
+          server_scopes.has_scopes?(Doorkeeper::OAuth::Scopes.from_string(scope))
         end
       end
     end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -0,0 +1,130 @@
+# coding: utf-8
+
+# TODO: refactor to DRY up, this is very similar to AccessTokenRequest
+module Doorkeeper::OAuth
+  class PasswordAccessTokenRequest
+    include Doorkeeper::Validations
+
+    ATTRIBUTES = [
+      :grant_type,
+      :username,
+      :password,
+      :scope,
+      :refresh_token
+    ]
+
+    validate :attributes,     :error => :invalid_request
+    validate :grant_type,     :error => :unsupported_grant_type
+    validate :client,         :error => :invalid_client
+    validate :resource_owner, :error => :invalid_resource_owner
+    validate :scope,          :error => :invalid_scope
+
+    attr_accessor *ATTRIBUTES
+    attr_accessor :resource_owner, :client
+
+    def initialize(client, owner, attributes = {})
+      ATTRIBUTES.each { |attr| instance_variable_set("@#{attr}", attributes[attr]) }
+      @resource_owner = owner
+      @client = client
+      validate
+    end
+
+    def authorize
+      if valid?
+        find_or_create_access_token
+      end
+    end
+
+    def authorization
+      auth = {
+        'access_token' => access_token.token,
+        'token_type'   => access_token.token_type,
+        'expires_in'   => access_token.expires_in,
+      }
+      auth.merge!({'refresh_token' => access_token.refresh_token}) if refresh_token_enabled?
+      auth
+    end
+
+    def valid?
+      self.error.nil?
+    end
+
+    def access_token
+      @access_token
+    end
+
+    def token_type
+      "bearer"
+    end
+
+    def error_response
+      Doorkeeper::OAuth::ErrorResponse.from_request(self)
+    end
+
+    def scopes
+      @scopes ||= if scope.present?
+        Doorkeeper::OAuth::Scopes.from_string(scope)
+      else
+        Doorkeeper.configuration.default_scopes
+      end
+    end
+
+    private
+
+    def find_or_create_access_token
+      if access_token
+        access_token.expired? ? revoke_and_create_access_token : access_token
+      else
+        create_access_token
+      end
+    end
+
+    def revoke_and_create_access_token
+      access_token.revoke
+      create_access_token
+    end
+
+    def revoke_base_token
+      base_token.revoke
+    end
+
+    def create_access_token
+      @access_token = Doorkeeper::AccessToken.create!({
+        :application_id     => client.id,
+        :resource_owner_id  => resource_owner.id,
+        :scopes             => scopes.to_s,
+        :expires_in         => configuration.access_token_expires_in,
+        :use_refresh_token  => refresh_token_enabled?
+      })
+    end
+
+    def validate_attributes
+      grant_type.present?
+    end
+
+    def refresh_token_enabled?
+      configuration.refresh_token_enabled?
+    end
+
+    def validate_client
+      !!client
+    end
+
+    def validate_scope
+      return true unless scope.present?
+      ScopeChecker.valid?(scope, configuration.scopes)
+    end
+
+    def validate_grant_type
+      grant_type == 'password'
+    end
+
+    def validate_resource_owner
+      !!resource_owner
+    end
+
+    def configuration
+      Doorkeeper.configuration
+    end
+  end
+end

data/lib/doorkeeper/oauth/scopes.rb

@@ -0,0 +1,60 @@
+module Doorkeeper
+  module OAuth
+    class Scopes
+      include Enumerable
+      include Comparable
+
+      def self.from_string(string)
+        string ||= ""
+        new.tap do |scope|
+          scope.add *string.split
+        end
+      end
+
+      def self.from_array(array)
+        new.tap do |scope|
+          scope.add *array
+        end
+      end
+
+      delegate :each, :to => :@scopes
+
+      def initialize
+        @scopes = []
+      end
+
+      def exists?(scope)
+        @scopes.include? scope.to_sym
+      end
+
+      def add(*scopes)
+        @scopes.push *scopes.map(&:to_sym)
+        @scopes.uniq!
+      end
+
+      def all
+        @scopes
+      end
+
+      def to_s
+        @scopes.join(" ")
+      end
+
+      def has_scopes?(scopes)
+        scopes.all? { |s| exists?(s) }
+      end
+
+      def +(other)
+        if other.is_a? Scopes
+          self.class.from_array(self.all + other.all)
+        else
+          super(other)
+        end
+      end
+
+      def <=>(other)
+        self.map(&:to_s).sort <=> other.map(&:to_s).sort
+      end
+    end
+  end
+end

data/lib/doorkeeper/version.rb

@@ -1,3 +1,3 @@
 module Doorkeeper
-  VERSION = "0.3.0"
+  VERSION = "0.4.0"
 end

data/lib/doorkeeper.rb

@@ -1,3 +1,4 @@
+require "doorkeeper/version"
 require "doorkeeper/engine"
 require "doorkeeper/config"
 require "doorkeeper/doorkeeper_for"
@@ -6,9 +7,15 @@ module Doorkeeper
   autoload :Validations, "doorkeeper/validations"
 
   module OAuth
-    autoload :AuthorizationRequest, "doorkeeper/oauth/authorization_request"
-    autoload :AccessTokenRequest,   "doorkeeper/oauth/access_token_request"
-    autoload :Authorization,        "doorkeeper/oauth/authorization"
+    autoload :Scopes,                     "doorkeeper/oauth/scopes"
+    autoload :Error,                      "doorkeeper/oauth/error"
+    autoload :ErrorResponse,              "doorkeeper/oauth/error_response"
+    autoload :AuthorizationRequest,       "doorkeeper/oauth/authorization_request"
+    autoload :AccessTokenRequest,         "doorkeeper/oauth/access_token_request"
+    autoload :PasswordAccessTokenRequest, "doorkeeper/oauth/password_access_token_request"
+    autoload :ClientCredentialsRequest,   "doorkeeper/oauth/client_credentials_request"
+    autoload :Authorization,              "doorkeeper/oauth/authorization"
+    autoload :Client,                     "doorkeeper/oauth/client"
 
     module Helpers
       autoload :ScopeChecker, "doorkeeper/oauth/helpers/scope_checker"
@@ -20,5 +27,18 @@ module Doorkeeper
   module Models
     autoload :Expirable, "doorkeeper/models/expirable"
     autoload :Revocable, "doorkeeper/models/revocable"
+    autoload :Scopes,    "doorkeeper/models/scopes"
+  end
+
+  def self.configured?
+    @config.present?
+  end
+
+  def self.database_installed?
+    [AccessToken, AccessGrant, Application].all? { |model| model.table_exists? }
+  end
+
+  def self.installed?
+    configured? && database_installed?
   end
 end

data/lib/generators/doorkeeper/install_generator.rb

@@ -3,6 +3,7 @@ require 'rails/generators/active_record'
 class Doorkeeper::InstallGenerator < Rails::Generators::Base
   include Rails::Generators::Migration
   source_root File.expand_path('../templates', __FILE__)
+  desc "Installs Doorkeeper."
 
   def install
     migration_template 'migration.rb', 'db/migrate/create_doorkeeper_tables.rb'

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -7,7 +7,7 @@ Doorkeeper.configure do
     # If you want to use named routes from your app you need
     # to call them on routes object eg.
     # routes.new_user_session_path
-    # e.g. User.find_by_id(session[:user_id]) || redirect_to routes.new_user_seesion_path
+    # e.g. User.find_by_id(session[:user_id]) || redirect_to(routes.new_user_session_url)
   end
 
   # If you want to restrict the access to the web interface for
@@ -18,10 +18,11 @@ Doorkeeper.configure do
   #   # If you want to use named routes from your app you need
   #   # to call them on routes object eg.
   #   # routes.new_admin_session_path
-  #   Admin.find_by_id(session[:admin_id]) || redirect_to routes.new_admin_session_path
+  #   Admin.find_by_id(session[:admin_id]) || redirect_to(routes.new_admin_session_url)
   # end
 
-  # Access token expiration time (default 2 hours)
+  # Access token expiration time (default 2 hours).
+  # If you want to disable expiration, set this to nil.
   # access_token_expires_in 2.hours
 
   # Issue access tokens with refresh token (disabled by default)
@@ -29,8 +30,12 @@ Doorkeeper.configure do
 
   # Define access token scopes for your provider
   # For more information go to https://github.com/applicake/doorkeeper/wiki/Using-Scopes
-  # authorization_scopes do
-  #   scope :public, :default => true, :description => "The public one"
-  #   scope :write,  :description => "Updating information"
-  # end
+  # default_scopes  :public
+  # optional_scopes :write, :update
+
+  # Change the way client credentials are retrieved from the request object.
+  # By default it retrieves first from `HTTP_AUTHORIZATION` header and
+  # fallsback to `:client_id` and `:client_secret` from `params` object
+  # Check out the wiki for mor information on customization
+  # client_credentials :from_basic, :from_params
 end

data/lib/generators/doorkeeper/templates/migration.rb

@@ -24,7 +24,7 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
     add_index :oauth_access_grants, :token, :unique => true
 
     create_table :oauth_access_tokens do |t|
-      t.integer  :resource_owner_id, :null => false
+      t.integer  :resource_owner_id
       t.integer  :application_id,    :null => false
       t.string   :token,             :null => false
       t.string   :refresh_token

data/lib/generators/doorkeeper/views_generator.rb

@@ -0,0 +1,15 @@
+module Doorkeeper
+  module Generators
+    class ViewsGenerator < Rails::Generators::Base
+      source_root File.expand_path('../../../../app/views/doorkeeper', __FILE__)
+
+      desc "Copies default Doorkeeper views to your application."
+
+      def manifest
+        directory 'applications', 'app/views/doorkeeper/applications'
+        directory 'authorizations', 'app/views/doorkeeper/authorizations'
+        directory 'authorized_applications', 'app/views/doorkeeper/authorized_applications'
+      end
+    end
+  end
+end

data/script/rails

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+#!/usr/bin/env ruby
+# This command will automatically be run when you run "rails" with Rails 3 gems installed from the root of your application.
+
+ENGINE_PATH = File.expand_path('../..',  __FILE__)
+load File.expand_path('../../spec/dummy/script/rails',  __FILE__)

data/script/run_all

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -e
+
+RBENV_VERSION=1.8.7-p352 bundle install --quiet
+RBENV_VERSION=1.8.7-p352 bundle exec rake
+
+RBENV_VERSION=1.9.2-p290 bundle install --quiet
+RBENV_VERSION=1.9.2-p290 bundle exec rake
+
+RBENV_VERSION=1.9.3-p0 bundle install --quiet
+RBENV_VERSION=1.9.3-p0 bundle exec rake

data/spec/controllers/applications_controller_spec.rb

@@ -0,0 +1,18 @@
+require 'spec_helper_integration'
+
+module Doorkeeper
+  describe ApplicationsController do
+    context "when admin is not authenticated" do
+      before(:each) do
+        Doorkeeper.configuration.stub(:authenticate_admin => proc do
+          redirect_to main_app.root_url
+        end)
+      end
+
+      it "redirects as set in Doorkeeper.authenticate_admin" do
+        get :index, :use_route => :doorkeeper
+        response.should redirect_to(controller.main_app.root_url)
+      end
+    end
+  end
+end

data/spec/controllers/authorizations_controller_spec.rb

@@ -0,0 +1,131 @@
+require 'spec_helper_integration'
+
+describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
+  include AuthorizationRequestHelper
+
+  def fragments(param)
+    fragment = URI.parse(response.location).fragment
+    Rack::Utils.parse_query(fragment)[param]
+  end
+
+  def translated_error_message(key)
+    I18n.translate key, :scope => [:doorkeeper, :errors, :messages]
+  end
+
+  let(:client) { FactoryGirl.create :application }
+  let(:user)   { User.create!(:name => "Joe", :password => "sekret") }
+
+  before do
+    controller.stub :current_resource_owner => user
+  end
+
+  describe "POST #create" do
+    before do
+      post :create, :client_id => client.uid, :response_type => "token", :redirect_uri => client.redirect_uri, :use_route => :doorkeeper
+    end
+
+    it "redirects after authorization" do
+      response.should be_redirect
+    end
+
+    it "redirects to client redirect uri" do
+      response.location.should =~ %r[^#{client.redirect_uri}]
+    end
+
+    it "includes access token in fragment" do
+      fragments("access_token").should == Doorkeeper::AccessToken.first.token
+    end
+
+    it "includes token type in fragment" do
+      fragments("token_type").should == "bearer"
+    end
+
+    it "includes token expiration in fragment" do
+      fragments("expires_in").to_i.should == 2.hours.to_i
+    end
+
+    it "issues the token for the current client" do
+      Doorkeeper::AccessToken.first.application_id.should == client.id
+    end
+
+    it "issues the token for the current resource owner" do
+      Doorkeeper::AccessToken.first.resource_owner_id.should == user.id
+    end
+  end
+
+  describe "POST #create with errors" do
+    before do
+      default_scopes_exist :public
+      post :create, :client_id => client.uid, :response_type => "token", :scope => "invalid", :redirect_uri => client.redirect_uri, :use_route => :doorkeeper
+    end
+
+    it "redirects after authorization" do
+      response.should be_redirect
+    end
+
+    it "redirects to client redirect uri" do
+      response.location.should =~ %r[^#{client.redirect_uri}]
+    end
+
+    it "does not include access token in fragment" do
+      fragments("access_token").should be_nil
+    end
+
+    it "includes error in fragment" do
+      fragments("error").should == "invalid_scope"
+    end
+
+    it "includes error description in fragment" do
+      fragments("error_description").should == translated_error_message(:invalid_scope)
+    end
+
+    it "does not issue any access token" do
+      Doorkeeper::AccessToken.all.should be_empty
+    end
+  end
+
+  describe "POST #create with application already authorized" do
+    it "returns the existing access token in a fragment"
+  end
+
+  describe "GET #new" do
+    before do
+      get :new, :client_id => client.uid, :response_type => "token", :redirect_uri => client.redirect_uri, :use_route => :doorkeeper
+    end
+
+    it 'renders new template' do
+      response.should render_template(:new)
+    end
+  end
+
+  describe "GET #new with errors" do
+    before do
+      default_scopes_exist :public
+      get :new, :client_id => client.uid, :response_type => "token", :scope => "invalid", :redirect_uri => client.redirect_uri, :use_route => :doorkeeper
+    end
+
+    it "redirects after authorization" do
+      response.should be_redirect
+    end
+
+    it "redirects to client redirect uri" do
+      response.location.should =~ %r[^#{client.redirect_uri}]
+    end
+
+    it "does not include access token in fragment" do
+      fragments("access_token").should be_nil
+    end
+
+    it "includes error in fragment" do
+      fragments("error").should == "invalid_scope"
+    end
+
+    it "includes error description in fragment" do
+      fragments("error_description").should == translated_error_message(:invalid_scope)
+    end
+
+    it "does not issue any access token" do
+      Doorkeeper::AccessToken.all.should be_empty
+    end
+  end
+end