doorkeeper 0.3.4 → 0.4.0

data/lib/doorkeeper/doorkeeper_for.rb

@@ -109,7 +109,7 @@ module Doorkeeper
 
     def authorization_bearer_token
       header = request.env['HTTP_AUTHORIZATION']
-      header.gsub!(/^Bearer /, '') unless header.nil?
+      header.gsub(/^Bearer /, '') if header && header.match(/^Bearer /)
     end
 
     def doorkeeper_unauthorized_render_options

data/lib/doorkeeper/engine.rb

@@ -5,5 +5,33 @@ module Doorkeeper
     config.generators do |g|
       g.test_framework :rspec, :view_specs => false
     end
+
+    initializer "doorkeeper.deprecations" do
+      if Doorkeeper.installed?
+        if Doorkeeper.configuration.authorization_scopes.present?
+          warning = <<-WARN
+[DOORKEEPER]
+  Configuration for `authorization_scopes` will no longer be supported. Use default_scopes/optional_scopes instead.
+  ATTENTION: The :description option could not be migrated because doorkeeper now uses localization files.
+  Place this in your config/locales/en.yml
+en:
+  doorkeeper:
+    scopes:
+WARN
+          puts warning
+          Doorkeeper.configuration.authorization_scopes.translations.each do |scope, translation|
+            puts "      #{scope}: #{translation}"
+          end
+        end
+
+        if Doorkeeper::AccessToken.columns_hash["resource_owner_id"].null == false
+          warn <<-WARN
+[DOORKEEPER]
+  In order to use the Client Credentials flow, you have to migrate the oauth_access_tokens table:
+  change_column :oauth_access_tokens, :resource_owner_id, :integer, :null => true
+WARN
+        end
+      end
+    end
   end
 end

data/lib/doorkeeper/models/scopes.rb

@@ -0,0 +1,13 @@
+module Doorkeeper
+  module Models
+    module Scopes
+      def scopes
+        Doorkeeper::OAuth::Scopes.from_string(self[:scopes])
+      end
+
+      def scopes_string
+        Doorkeeper::OAuth::Scopes.from_string(self[:scopes]).to_s
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/access_token_request.rb

@@ -3,8 +3,6 @@ module Doorkeeper::OAuth
     include Doorkeeper::Validations
 
     ATTRIBUTES = [
-      :client_id,
-      :client_secret,
       :grant_type,
       :code,
       :redirect_uri,
@@ -18,9 +16,11 @@ module Doorkeeper::OAuth
     validate :redirect_uri, :error => :invalid_grant
 
     attr_accessor *ATTRIBUTES
+    attr_accessor :client
 
-    def initialize(attributes = {})
+    def initialize(client, attributes = {})
       ATTRIBUTES.each { |attr| instance_variable_set("@#{attr}", attributes[attr]) }
+      @client = client
       validate
     end
 
@@ -46,7 +46,7 @@ module Doorkeeper::OAuth
     end
 
     def access_token
-      @access_token ||= Doorkeeper::AccessToken.matching_token_for client, base_token.resource_owner_id, base_token.scopes_string
+      @access_token ||= Doorkeeper::AccessToken.matching_token_for client, base_token.resource_owner_id, base_token.scopes
     end
 
     def token_type
@@ -54,10 +54,7 @@ module Doorkeeper::OAuth
     end
 
     def error_response
-      {
-        'error' => error.to_s,
-        'error_description' => error_description
-      }
+      Doorkeeper::OAuth::ErrorResponse.from_request(self)
     end
 
     private
@@ -79,10 +76,6 @@ module Doorkeeper::OAuth
       base_token.revoke
     end
 
-    def client
-      @client ||= Doorkeeper::Application.find_by_uid_and_secret(@client_id, @client_secret)
-    end
-
     def base_token
       @base_token ||= refresh_token? ? token_via_refresh_token : token_via_authorization_code
     end
@@ -139,10 +132,6 @@ module Doorkeeper::OAuth
       %w(authorization_code refresh_token).include? grant_type
     end
 
-    def error_description
-      I18n.translate error, :scope => [:doorkeeper, :errors, :messages]
-    end
-
     def configuration
       Doorkeeper.configuration
     end

data/lib/doorkeeper/oauth/authorization/code.rb

@@ -18,7 +18,7 @@ module Doorkeeper
             :resource_owner_id => authorization.resource_owner.id,
             :expires_in        => DEFAULT_EXPIRATION_TIME,
             :redirect_uri      => authorization.redirect_uri,
-            :scopes            => authorization.scope
+            :scopes            => authorization.scopes.to_s
           )
         end
 

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -23,7 +23,7 @@ module Doorkeeper
           @access_token ||= AccessToken.create!({
             :application_id    => authorization.client.id,
             :resource_owner_id => authorization.resource_owner.id,
-            :scopes            => authorization.scope,
+            :scopes            => authorization.scopes.to_s,
             :expires_in        => configuration.access_token_expires_in,
             :use_refresh_token => false
           })

data/lib/doorkeeper/oauth/authorization_request.rb

@@ -6,7 +6,6 @@ module Doorkeeper::OAuth
 
     ATTRIBUTES = [
       :response_type,
-      :client_id,
       :redirect_uri,
       :scope,
       :state
@@ -19,12 +18,12 @@ module Doorkeeper::OAuth
     validate :scope,         :error => :invalid_scope
 
     attr_accessor *ATTRIBUTES
-    attr_accessor :resource_owner, :error
+    attr_accessor :resource_owner, :client, :error
 
-    def initialize(resource_owner, attributes)
+    def initialize(client, resource_owner, attributes)
       ATTRIBUTES.each { |attr| instance_variable_set("@#{attr}", attributes[attr]) }
       @resource_owner = resource_owner
-      @scope          ||= Doorkeeper.configuration.default_scope_string
+      @client         = client
       validate
     end
 
@@ -35,44 +34,44 @@ module Doorkeeper::OAuth
     end
 
     def access_token_exists?
-      Doorkeeper::AccessToken.matching_token_for(client, resource_owner, scope).present?
+      Doorkeeper::AccessToken.matching_token_for(client, resource_owner, scopes).present?
     end
 
     def deny
       self.error = :access_denied
     end
 
+    def error_response
+      Doorkeeper::OAuth::ErrorResponse.from_request(self)
+    end
+
     def success_redirect_uri
       @authorization.callback
     end
 
     def invalid_redirect_uri
       uri_builder = is_token_request? ? :uri_with_fragment : :uri_with_query
-      send(uri_builder, redirect_uri, {
-        :error => error,
-        :error_description => error_description,
-        :state => state
-      })
+      send(uri_builder, redirect_uri, error_response.attributes)
     end
 
     def redirect_on_error?
       (error != :invalid_redirect_uri) && (error != :invalid_client)
     end
 
-    def client
-      @client ||= Doorkeeper::Application.find_by_uid(client_id)
+    def scopes
+      @scopes ||= if scope.present?
+        Doorkeeper::OAuth::Scopes.from_string(scope)
+      else
+        Doorkeeper.configuration.default_scopes
+      end
     end
 
-    def scopes
-      Doorkeeper.configuration.scopes.with_names(*scope.split(" ")) if has_scope?
+    def client_id
+      client.uid
     end
 
     private
 
-    def has_scope?
-      Doorkeeper.configuration.scopes.all.present?
-    end
-
     def validate_attributes
       response_type.present?
     end
@@ -91,7 +90,7 @@ module Doorkeeper::OAuth
     end
 
     def validate_scope
-      return true unless has_scope?
+      return true unless scope.present?
       ScopeChecker.valid?(scope, configuration.scopes)
     end
 
@@ -103,10 +102,6 @@ module Doorkeeper::OAuth
       response_type == "token"
     end
 
-    def error_description
-      I18n.translate error, :scope => [:doorkeeper, :errors, :messages]
-    end
-
     def configuration
       Doorkeeper.configuration
     end

data/lib/doorkeeper/oauth/client.rb

@@ -0,0 +1,27 @@
+require 'doorkeeper/oauth/client/methods'
+require 'doorkeeper/oauth/client/credentials'
+
+module Doorkeeper
+  module OAuth
+    class Client
+      def self.find(uid)
+        if application = Doorkeeper::Application.find_by_uid(uid)
+          new(application)
+        end
+      end
+
+      def self.authenticate(credentials, method = Doorkeeper::Application.method(:authenticate))
+        return false if credentials.blank?
+        if application = method.call(credentials.uid, credentials.secret)
+          new(application)
+        end
+      end
+
+      delegate :id, :name, :uid, :redirect_uri, :to => :@application
+
+      def initialize(application)
+        @application = application
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -0,0 +1,21 @@
+module Doorkeeper
+  module OAuth
+    class Client
+      class Credentials < Struct.new(:uid, :secret)
+        extend Methods
+
+        def self.from_request(request, *credentials_methods)
+          credentials_methods.inject(nil) do |credentials, method|
+            method = self.method(method) if method.is_a?(Symbol)
+            credentials = Credentials.new *method.call(request)
+            break credentials unless credentials.blank?
+          end
+        end
+
+        def blank?
+          uid.blank? || secret.blank?
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client/methods.rb

@@ -0,0 +1,18 @@
+module Doorkeeper
+  module OAuth
+    class Client
+      module Methods
+        def from_params(request)
+          request.parameters.values_at(:client_id, :client_secret)
+        end
+
+        def from_basic(request)
+          authorization = request.authorization
+          if authorization.present? && authorization =~ /^Basic (.*)/m
+            Base64.decode64($1).split(/:/, 2)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -0,0 +1,29 @@
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Creator
+        def call(client, scopes, attributes = {})
+          existing_token = existing_token_for(client, scopes)
+          if existing_token
+            return existing_token if existing_token.accessible?
+            existing_token.revoke
+          end
+          create(client, scopes, attributes)
+        end
+
+      private
+
+        def existing_token_for(client, scopes)
+          Doorkeeper::AccessToken.matching_token_for client, nil, scopes
+        end
+
+        def create(client, scopes, attributes = {})
+          Doorkeeper::AccessToken.create(attributes.merge({
+            :application_id => client.id,
+            :scopes         => scopes.to_s
+          }))
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/issuer.rb

@@ -0,0 +1,35 @@
+require 'doorkeeper/oauth/client_credentials/validation'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Issuer
+        attr_accessor :token, :validation, :error
+
+        def initialize(server, validation)
+          @server, @validation = server, validation
+        end
+
+        def create(client, scopes, creator = Creator.new)
+          if validation.valid?
+            @token = create_token(client, scopes, creator)
+            @error = :server_error unless @token
+          else
+            @token = false
+            @error = validation.error
+          end
+          @token
+        end
+
+        private
+
+        def create_token(client, scopes, creator)
+          creator.call(client, scopes, {
+            :use_refresh_token => false,
+            :expires_in        => @server.access_token_expires_in
+          })
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/response.rb

@@ -0,0 +1,42 @@
+require 'active_model'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Response
+        include ActiveModel::Serializers::JSON
+
+        self.include_root_in_json = false
+
+        delegate :token, :expires_in, :scopes_string, :to => :@token
+        alias    :access_token :token
+        alias    :scope :scopes_string
+
+        def initialize(token)
+          @token = token
+        end
+
+        def attributes
+          {
+            'access_token' => token,
+            'token_type'   => token_type,
+            'expires_in'   => expires_in,
+            'scope'        => scopes_string
+          }
+        end
+
+        def status
+          :success
+        end
+
+        def token_type
+          'bearer'
+        end
+
+        def headers
+          { 'Cache-Control' => 'no-store', 'Pragma' => 'no-cache' }
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/validation.rb

@@ -0,0 +1,33 @@
+require 'doorkeeper/validations'
+require 'doorkeeper/oauth/scopes'
+require 'doorkeeper/oauth/helpers/scope_checker'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      class Validation
+        include Doorkeeper::Validations
+        include Doorkeeper::OAuth::Helpers
+
+        validate :client, :error => :invalid_client
+        validate :scopes, :error => :invalid_scope
+
+        def initialize(server, request)
+          @server, @request = server, request
+          validate
+        end
+
+        private
+
+        def validate_client
+          @request.client.present?
+        end
+
+        def validate_scopes
+          return true unless @request.original_scopes.present?
+          ScopeChecker.valid?(@request.original_scopes, @server.scopes)
+        end
+      end
+    end
+  end
+end