doorkeeper 0.3.4 → 0.4.0

data/lib/doorkeeper/oauth/client_credentials_request.rb

@@ -0,0 +1,46 @@
+require 'doorkeeper/oauth/error'
+require 'doorkeeper/oauth/error_response'
+require 'doorkeeper/oauth/scopes'
+require 'doorkeeper/oauth/client_credentials/creator'
+require 'doorkeeper/oauth/client_credentials/issuer'
+require 'doorkeeper/oauth/client_credentials/response'
+require 'doorkeeper/oauth/client_credentials/validation'
+
+module Doorkeeper
+  module OAuth
+    class ClientCredentialsRequest
+      attr_accessor :issuer, :server, :client, :original_scopes, :scopes
+      attr_reader   :response
+      alias         :authorization :response  # Remove this when API is consistent
+      alias         :error_response :response
+
+      delegate :error, :to => :issuer
+
+      def issuer
+        @issuer ||= Issuer.new(server, Validation.new(server, self))
+      end
+
+      def initialize(server, client, parameters = {})
+        @client, @server = client, server
+        @response        = nil
+        @original_scopes = parameters[:scope]
+      end
+
+      def authorize
+        @response = if issuer.create(client, scopes)
+          Response.new(issuer.token)
+        else
+          ErrorResponse.from_request(self)
+        end
+      end
+
+      def scopes
+        @scopes ||= if @original_scopes.present?
+          Doorkeeper::OAuth::Scopes.from_string(@original_scopes)
+        else
+          server.default_scopes
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/error.rb

@@ -0,0 +1,9 @@
+module Doorkeeper
+  module OAuth
+    class Error < Struct.new(:name, :state)
+      def description
+        I18n.translate name, :scope => [:doorkeeper, :errors, :messages]
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/error_response.rb

@@ -0,0 +1,30 @@
+module Doorkeeper
+  module OAuth
+    class ErrorResponse
+      include ActiveModel::Serializers::JSON
+
+      self.include_root_in_json = false
+
+      def self.from_request(request)
+        state = request.state if request.respond_to?(:state)
+        new(:name => request.error, :state => state)
+      end
+
+      delegate :name, :description, :state, :to => :@error
+      alias    :error :name
+      alias    :error_description :description
+
+      def initialize(attributes = {})
+        @error = Doorkeeper::OAuth::Error.new(*attributes.values_at(:name, :state))
+      end
+
+      def attributes
+        { 'error' => name, 'error_description' => description, 'state' => state }.reject { |k, v| v.blank? }
+      end
+
+      def status
+        :unauthorized
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -4,13 +4,13 @@ module Doorkeeper
       module ScopeChecker
         def self.matches?(current_scopes, scopes)
           return false if current_scopes.nil? || scopes.nil?
-          current_scopes.map(&:to_s).sort == scopes.split(" ").sort
+          current_scopes == scopes
         end
 
         def self.valid?(scope, server_scopes)
           scope.present? &&
           scope !~ /[\n|\r|\t]/ &&
-          server_scopes.all_included?(scope)
+          server_scopes.has_scopes?(Doorkeeper::OAuth::Scopes.from_string(scope))
         end
       end
     end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -0,0 +1,130 @@
+# coding: utf-8
+
+# TODO: refactor to DRY up, this is very similar to AccessTokenRequest
+module Doorkeeper::OAuth
+  class PasswordAccessTokenRequest
+    include Doorkeeper::Validations
+
+    ATTRIBUTES = [
+      :grant_type,
+      :username,
+      :password,
+      :scope,
+      :refresh_token
+    ]
+
+    validate :attributes,     :error => :invalid_request
+    validate :grant_type,     :error => :unsupported_grant_type
+    validate :client,         :error => :invalid_client
+    validate :resource_owner, :error => :invalid_resource_owner
+    validate :scope,          :error => :invalid_scope
+
+    attr_accessor *ATTRIBUTES
+    attr_accessor :resource_owner, :client
+
+    def initialize(client, owner, attributes = {})
+      ATTRIBUTES.each { |attr| instance_variable_set("@#{attr}", attributes[attr]) }
+      @resource_owner = owner
+      @client = client
+      validate
+    end
+
+    def authorize
+      if valid?
+        find_or_create_access_token
+      end
+    end
+
+    def authorization
+      auth = {
+        'access_token' => access_token.token,
+        'token_type'   => access_token.token_type,
+        'expires_in'   => access_token.expires_in,
+      }
+      auth.merge!({'refresh_token' => access_token.refresh_token}) if refresh_token_enabled?
+      auth
+    end
+
+    def valid?
+      self.error.nil?
+    end
+
+    def access_token
+      @access_token
+    end
+
+    def token_type
+      "bearer"
+    end
+
+    def error_response
+      Doorkeeper::OAuth::ErrorResponse.from_request(self)
+    end
+
+    def scopes
+      @scopes ||= if scope.present?
+        Doorkeeper::OAuth::Scopes.from_string(scope)
+      else
+        Doorkeeper.configuration.default_scopes
+      end
+    end
+
+    private
+
+    def find_or_create_access_token
+      if access_token
+        access_token.expired? ? revoke_and_create_access_token : access_token
+      else
+        create_access_token
+      end
+    end
+
+    def revoke_and_create_access_token
+      access_token.revoke
+      create_access_token
+    end
+
+    def revoke_base_token
+      base_token.revoke
+    end
+
+    def create_access_token
+      @access_token = Doorkeeper::AccessToken.create!({
+        :application_id     => client.id,
+        :resource_owner_id  => resource_owner.id,
+        :scopes             => scopes.to_s,
+        :expires_in         => configuration.access_token_expires_in,
+        :use_refresh_token  => refresh_token_enabled?
+      })
+    end
+
+    def validate_attributes
+      grant_type.present?
+    end
+
+    def refresh_token_enabled?
+      configuration.refresh_token_enabled?
+    end
+
+    def validate_client
+      !!client
+    end
+
+    def validate_scope
+      return true unless scope.present?
+      ScopeChecker.valid?(scope, configuration.scopes)
+    end
+
+    def validate_grant_type
+      grant_type == 'password'
+    end
+
+    def validate_resource_owner
+      !!resource_owner
+    end
+
+    def configuration
+      Doorkeeper.configuration
+    end
+  end
+end

data/lib/doorkeeper/oauth/scopes.rb

@@ -0,0 +1,60 @@
+module Doorkeeper
+  module OAuth
+    class Scopes
+      include Enumerable
+      include Comparable
+
+      def self.from_string(string)
+        string ||= ""
+        new.tap do |scope|
+          scope.add *string.split
+        end
+      end
+
+      def self.from_array(array)
+        new.tap do |scope|
+          scope.add *array
+        end
+      end
+
+      delegate :each, :to => :@scopes
+
+      def initialize
+        @scopes = []
+      end
+
+      def exists?(scope)
+        @scopes.include? scope.to_sym
+      end
+
+      def add(*scopes)
+        @scopes.push *scopes.map(&:to_sym)
+        @scopes.uniq!
+      end
+
+      def all
+        @scopes
+      end
+
+      def to_s
+        @scopes.join(" ")
+      end
+
+      def has_scopes?(scopes)
+        scopes.all? { |s| exists?(s) }
+      end
+
+      def +(other)
+        if other.is_a? Scopes
+          self.class.from_array(self.all + other.all)
+        else
+          super(other)
+        end
+      end
+
+      def <=>(other)
+        self.map(&:to_s).sort <=> other.map(&:to_s).sort
+      end
+    end
+  end
+end

data/lib/doorkeeper/version.rb

@@ -1,3 +1,3 @@
 module Doorkeeper
-  VERSION = "0.3.4"
+  VERSION = "0.4.0"
 end

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -21,7 +21,8 @@ Doorkeeper.configure do
   #   Admin.find_by_id(session[:admin_id]) || redirect_to(routes.new_admin_session_url)
   # end
 
-  # Access token expiration time (default 2 hours)
+  # Access token expiration time (default 2 hours).
+  # If you want to disable expiration, set this to nil.
   # access_token_expires_in 2.hours
 
   # Issue access tokens with refresh token (disabled by default)
@@ -29,8 +30,12 @@ Doorkeeper.configure do
 
   # Define access token scopes for your provider
   # For more information go to https://github.com/applicake/doorkeeper/wiki/Using-Scopes
-  # authorization_scopes do
-  #   scope :public, :default => true, :description => "The public one"
-  #   scope :write,  :description => "Updating information"
-  # end
+  # default_scopes  :public
+  # optional_scopes :write, :update
+
+  # Change the way client credentials are retrieved from the request object.
+  # By default it retrieves first from `HTTP_AUTHORIZATION` header and
+  # fallsback to `:client_id` and `:client_secret` from `params` object
+  # Check out the wiki for mor information on customization
+  # client_credentials :from_basic, :from_params
 end

data/lib/generators/doorkeeper/templates/migration.rb

@@ -24,7 +24,7 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
     add_index :oauth_access_grants, :token, :unique => true
 
     create_table :oauth_access_tokens do |t|
-      t.integer  :resource_owner_id, :null => false
+      t.integer  :resource_owner_id
       t.integer  :application_id,    :null => false
       t.string   :token,             :null => false
       t.string   :refresh_token

data/script/run_all

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -e
+
+RBENV_VERSION=1.8.7-p352 bundle install --quiet
+RBENV_VERSION=1.8.7-p352 bundle exec rake
+
+RBENV_VERSION=1.9.2-p290 bundle install --quiet
+RBENV_VERSION=1.9.2-p290 bundle exec rake
+
+RBENV_VERSION=1.9.3-p0 bundle install --quiet
+RBENV_VERSION=1.9.3-p0 bundle exec rake

data/spec/controllers/authorizations_controller_spec.rb

@@ -13,7 +13,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
   end
 
   let(:client) { FactoryGirl.create :application }
-  let(:user)   { User.create! }
+  let(:user)   { User.create!(:name => "Joe", :password => "sekret") }
 
   before do
     controller.stub :current_resource_owner => user
@@ -55,7 +55,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "POST #create with errors" do
     before do
-      scope_exists :public
+      default_scopes_exist :public
       post :create, :client_id => client.uid, :response_type => "token", :scope => "invalid", :redirect_uri => client.redirect_uri, :use_route => :doorkeeper
     end
 
@@ -100,7 +100,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "GET #new with errors" do
     before do
-      scope_exists :public
+      default_scopes_exist :public
       get :new, :client_id => client.uid, :response_type => "token", :scope => "invalid", :redirect_uri => client.redirect_uri, :use_route => :doorkeeper
     end
 

data/spec/controllers/protected_resources_controller_spec.rb

@@ -99,6 +99,13 @@ describe "Doorkeeper_for helper" do
       request.env["HTTP_AUTHORIZATION"] = "Basic #{Base64.encode64("foo:bar")}"
       get :index
     end
+
+    it "doesn't change Authorization header value" do
+      Doorkeeper::AccessToken.should_receive(:find_by_token).exactly(2).times
+      request.env["HTTP_AUTHORIZATION"] = "Bearer #{token_string}"
+      get :index
+      get :index
+    end
   end
 
   context "defined for all actions" do

data/spec/controllers/tokens_controller_spec.rb

@@ -26,7 +26,7 @@ describe Doorkeeper::TokensController do
     end
 
     it "returns the error response" do
-      token.should_receive(:error_response)
+      token.stub(:error_response => stub(:to_json => [], :status => :unauthorized))
       post :create, :use_route => :doorkeeper
       response.status.should == 401
     end

data/spec/dummy/app/controllers/home_controller.rb

@@ -4,7 +4,7 @@ class HomeController < ApplicationController
 
   def sign_in
     session[:user_id] = if Rails.env.development?
-      User.first || User.create!
+      User.first || User.create!(:name => "Joe", :password => "sekret")
     else
       User.first
     end

data/spec/dummy/app/models/user.rb

@@ -1,2 +1,11 @@
 class User < ActiveRecord::Base
+  has_secure_password
+  validates_presence_of :password, :on => :create
+
+  attr_accessible :name, :password
+
+  def self.authenticate!(name, password)
+    owner = User.find_by_name(name)
+    owner.authenticate(password) if owner
+  end
 end

data/spec/dummy/config/application.rb

@@ -27,6 +27,8 @@ module Dummy
     # Activate observers that should always be running.
     # config.active_record.observers = :cacher, :garbage_collector, :forum_observer
 
+    config.active_record.whitelist_attributes = true
+
     # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
     # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
     # config.time_zone = 'Central Time (US & Canada)'

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -21,14 +21,21 @@ Doorkeeper.configure do
   #   Admin.find_by_id(session[:admin_id]) || redirect_to(routes.new_admin_session_url)
   # end
 
-  authorization_scopes do
-    scope :public, :default => true, :description => "The public one"
-    scope :write, :description => "Updating information"
-  end
-
   # Access token expiration time (default 2 hours)
+  # If you want to disable expiration, set this to nil.
   # access_token_expires_in 2.hours
 
   # Issue access tokens with refresh token (disabled by default)
   use_refresh_token
+
+  # Define access token scopes for your provider
+  # For more information go to https://github.com/applicake/doorkeeper/wiki/Using-Scopes
+  default_scopes  :public
+  optional_scopes :write, :update
+
+  # Change the way client credentials are retrieved from the request object.
+  # By default it retrieves first from `HTTP_AUTHORIZATION` header and
+  # fallsback to `:client_id` and `:client_secret` from `params` object
+  # Check out the wiki for mor information on customization
+  # client_credentials :from_basic, :from_params
 end