doorkeeper 0.4.2 → 0.5.0

data/lib/doorkeeper/config.rb

@@ -1,37 +1,30 @@
 module Doorkeeper
   def self.configure(&block)
     @config = Config::Builder.new(&block).build
+    enable_orm
+    setup_application_owner if @config.enable_application_owner?
   end
 
   def self.configuration
     @config
   end
 
-  class Config
-    class Builder
-      # Helper class to migrate scopes using authorization_scopes block
-      # It will be removed in v0.5.x
-      class ScopesMigrator
-        attr_accessor :default_scopes, :optional_scopes, :translations
-
-        def initialize
-          @default_scopes, @optional_scopes, @translations = [], [], {}
-        end
-
-        def scope(scope, options = {})
-          if options[:default]
-            @optional_scopes << scope
-          else
-            @default_scopes << scope
-          end
-          @translations[scope] = options[:description]
-        end
+  def self.enable_orm
+    require "doorkeeper/models/#{@config.orm}/access_grant"
+    require "doorkeeper/models/#{@config.orm}/access_token"
+    require "doorkeeper/models/#{@config.orm}/application"
+    require 'doorkeeper/models/access_grant'
+    require 'doorkeeper/models/access_token'
+    require 'doorkeeper/models/application'
+  end
 
-        def migrate(&block)
-          self.instance_eval(&block)
-        end
-      end
+  def self.setup_application_owner
+    require File.join(File.dirname(__FILE__), 'models', 'ownership')
+    Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
+  end
 
+  class Config
+    class Builder
       def initialize(&block)
         @config = Config.new
         instance_eval(&block)
@@ -41,6 +34,15 @@ module Doorkeeper
         @config
       end
 
+      def enable_application_owner(opts={})
+        @config.instance_variable_set("@enable_application_owner", true)
+        confirm_application_owner if opts[:confirmation].present? && opts[:confirmation]
+      end
+
+      def confirm_application_owner
+        @config.instance_variable_set("@confirm_application_owner", true)
+      end
+
       def default_scopes(*scopes)
         @config.instance_variable_set("@default_scopes", Doorkeeper::OAuth::Scopes.from_array(scopes))
       end
@@ -53,17 +55,12 @@ module Doorkeeper
         @config.instance_variable_set("@client_credentials", methods)
       end
 
-      def use_refresh_token
-        @config.instance_variable_set("@refresh_token_enabled", true)
+      def access_token_methods(*methods)
+        @config.instance_variable_set("@access_token_methods", methods)
       end
 
-      # DEPRECATED: use default/optional scopes
-      def authorization_scopes(&block)
-        migrator = ScopesMigrator.new
-        migrator.migrate(&block)
-        self.default_scopes *migrator.default_scopes
-        self.optional_scopes *migrator.optional_scopes
-        @config.instance_variable_set("@authorization_scopes", migrator)
+      def use_refresh_token
+        @config.instance_variable_set("@refresh_token_enabled", true)
       end
     end
 
@@ -102,6 +99,7 @@ module Doorkeeper
 
         Builder.instance_eval do
           define_method name do |*args, &block|
+            # TODO: is builder_class option being used?
             value = unless attribute_builder
               block ? block : args.first
             else
@@ -130,15 +128,36 @@ module Doorkeeper
 
     extend Option
 
-    option :resource_owner_authenticator, :as => :authenticate_resource_owner
-    option :admin_authenticator,          :as => :authenticate_admin
-    option :resource_owner_from_credentials
+    option :resource_owner_authenticator,
+           :as => :authenticate_resource_owner,
+           :default => lambda{|routes|
+             logger.warn(I18n.translate('doorkeeper.errors.messages.resource_owner_authenticator_not_configured'))
+             nil
+           }
+    option :admin_authenticator,
+           :as => :authenticate_admin,
+           :default => lambda{|routes| }
+    option :resource_owner_from_credentials,
+           :default => lambda{|routes|
+             logger.warn(I18n.translate('doorkeeper.errors.messages.credential_flow_not_configured'))
+             nil
+           }
     option :access_token_expires_in,      :default => 7200
+    option :authorization_code_expires_in,:default => 600
+    option :orm, :default => :active_record
 
     def refresh_token_enabled?
       !!@refresh_token_enabled
     end
 
+    def enable_application_owner?
+      !!@enable_application_owner
+    end
+
+    def confirm_application_owner?
+      !!@confirm_application_owner
+    end
+
     def default_scopes
       @default_scopes ||= Doorkeeper::OAuth::Scopes.new
     end
@@ -155,9 +174,8 @@ module Doorkeeper
       @client_credentials ||= [:from_basic, :from_params]
     end
 
-    # DEPRECATED: use default/optional scopes
-    def authorization_scopes
-      @authorization_scopes
+    def access_token_methods
+      @access_token_methods ||= [:from_bearer_authorization, :from_access_token_param, :from_bearer_param]
     end
   end
 end

data/lib/doorkeeper/doorkeeper_for.rb

@@ -11,6 +11,7 @@ module Doorkeeper
       end
     end
 
+    # TODO: move this to Token class
     def validate_token(token)
       return false unless token
       token.accessible? and validate_token_scopes(token)
@@ -33,6 +34,7 @@ module Doorkeeper
       @filter_options[:unless] = unless_block
     end
 
+    # TODO: move this to Token class
     def validate_token_scopes(token)
       return true if @scopes.blank?
       token.scopes.any? { |scope| @scopes.include? scope}

data/lib/doorkeeper/engine.rb

@@ -1,37 +1,8 @@
 module Doorkeeper
   class Engine < Rails::Engine
-    isolate_namespace Doorkeeper
-
-    config.generators do |g|
-      g.test_framework :rspec, :view_specs => false
-    end
-
-    initializer "doorkeeper.deprecations" do
-      if Doorkeeper.installed?
-        if Doorkeeper.configuration.authorization_scopes.present?
-          warning = <<-WARN
-[DOORKEEPER]
-  Configuration for `authorization_scopes` will no longer be supported. Use default_scopes/optional_scopes instead.
-  ATTENTION: The :description option could not be migrated because doorkeeper now uses localization files.
-  Place this in your config/locales/en.yml
-en:
-  doorkeeper:
-    scopes:
-WARN
-          puts warning
-          Doorkeeper.configuration.authorization_scopes.translations.each do |scope, translation|
-            puts "      #{scope}: #{translation}"
-          end
-        end
-
-        if Doorkeeper::AccessToken.columns_hash["resource_owner_id"].null == false
-          warn <<-WARN
-[DOORKEEPER]
-  In order to use the Client Credentials flow, you have to migrate the oauth_access_tokens table:
-  change_column :oauth_access_tokens, :resource_owner_id, :integer, :null => true
-WARN
-        end
-      end
+    initializer "doorkeeper.routes" do
+      Doorkeeper::Rails::Routes.warn_if_using_mount_method!
+      Doorkeeper::Rails::Routes.install!
     end
 
     initializer "doorkeeper.helpers" do

data/lib/doorkeeper/helpers/controller.rb

@@ -0,0 +1,29 @@
+module Doorkeeper
+  module Helpers
+    module Controller
+      def self.included(base)
+        base.send :private,
+                  :authenticate_resource_owner!,
+                  :authenticate_admin!,
+                  :current_resource_owner,
+                  :resource_owner_from_credentials
+      end
+
+      def authenticate_resource_owner!
+        current_resource_owner
+      end
+
+      def current_resource_owner
+        instance_eval &Doorkeeper.configuration.authenticate_resource_owner
+      end
+
+      def resource_owner_from_credentials
+        instance_eval &Doorkeeper.configuration.resource_owner_from_credentials
+      end
+
+      def authenticate_admin!
+        instance_eval &Doorkeeper.configuration.authenticate_admin
+      end
+    end
+  end
+end

data/lib/doorkeeper/helpers/filter.rb

@@ -7,6 +7,7 @@ module Doorkeeper
 
           before_filter doorkeeper_for.filter_options do
             return if doorkeeper_for.validate_token(doorkeeper_token)
+            # TODO: use ErrorRespose class for this
             render_options = doorkeeper_unauthorized_render_options
             if render_options.nil? || render_options.empty?
               head :unauthorized
@@ -21,27 +22,12 @@ module Doorkeeper
 
       def self.included(base)
         base.extend ClassMethods
-        base.send :private,
-                  :doorkeeper_token,
-                  :get_doorkeeper_token,
-                  :authorization_bearer_token,
-                  :doorkeeper_unauthorized_render_options
+        base.send :private, :doorkeeper_token, :doorkeeper_unauthorized_render_options
       end
 
       def doorkeeper_token
-        @token ||= get_doorkeeper_token
-      end
-
-      def get_doorkeeper_token
-        token = params[:access_token] || params[:bearer_token] || authorization_bearer_token
-        if token
-          AccessToken.find_by_token(token)
-        end
-      end
-
-      def authorization_bearer_token
-        header = request.env['HTTP_AUTHORIZATION']
-        header.gsub(/^Bearer /, '') if header && header.match(/^Bearer /)
+        methods = Doorkeeper.configuration.access_token_methods
+        @token ||= OAuth::Token.authenticate request, *methods
       end
 
       def doorkeeper_unauthorized_render_options

data/{app/models/doorkeeper → lib/doorkeeper/models}/access_grant.rb

@@ -1,28 +1,28 @@
 module Doorkeeper
-  class AccessGrant < ActiveRecord::Base
+  class AccessGrant
     include Doorkeeper::OAuth::Helpers
     include Doorkeeper::Models::Expirable
     include Doorkeeper::Models::Revocable
+    include Doorkeeper::Models::Accessible
     include Doorkeeper::Models::Scopes
 
-    self.table_name = :oauth_access_grants
-
-    belongs_to :application
+    belongs_to :application, :class_name => "Doorkeeper::Application"
 
     attr_accessible :resource_owner_id, :application_id, :expires_in, :redirect_uri, :scopes
 
     validates :resource_owner_id, :application_id, :token, :expires_in, :redirect_uri, :presence => true
+    validates :token, :uniqueness => true
 
     before_validation :generate_token, :on => :create
 
-    def accessible?
-      !expired? && !revoked?
+    def self.authenticate(token)
+      where(:token => token).first
     end
 
     private
 
     def generate_token
-      self.token = UniqueToken.generate_for :token, self.class
+      self.token = UniqueToken.generate
     end
   end
 end

data/{app/models/doorkeeper → lib/doorkeeper/models}/access_token.rb

@@ -1,17 +1,16 @@
 module Doorkeeper
-  class AccessToken < ActiveRecord::Base
+  class AccessToken
     include Doorkeeper::OAuth::Helpers
     include Doorkeeper::Models::Expirable
     include Doorkeeper::Models::Revocable
+    include Doorkeeper::Models::Accessible
     include Doorkeeper::Models::Scopes
 
-    self.table_name = :oauth_access_tokens
-
-    belongs_to :application
-
-    scope :accessible, where(:revoked_at => nil)
+    belongs_to :application, :class_name => "Doorkeeper::Application"
 
     validates :application_id, :token, :presence => true
+    validates :token, :uniqueness => true
+    validates :refresh_token, :uniqueness => true, :if => :use_refresh_token?
 
     attr_accessor :use_refresh_token
     attr_accessible :application_id, :resource_owner_id, :expires_in, :scopes, :use_refresh_token
@@ -19,47 +18,51 @@ module Doorkeeper
     before_validation :generate_token, :on => :create
     before_validation :generate_refresh_token, :on => :create, :if => :use_refresh_token?
 
+    def self.authenticate(token)
+      where(:token => token).first
+    end
+
+    def self.by_refresh_token(refresh_token)
+      where(:refresh_token => refresh_token).first
+    end
+
     def self.revoke_all_for(application_id, resource_owner)
       where(:application_id => application_id,
               :resource_owner_id => resource_owner.id).delete_all
     end
 
     def self.matching_token_for(application, resource_owner_or_id, scopes)
-      token = last_authorized_token_for(application, resource_owner_or_id)
+      resource_owner_id = resource_owner_or_id.respond_to?(:to_key) ? resource_owner_or_id.id : resource_owner_or_id
+      token = last_authorized_token_for(application, resource_owner_id)
       token if token && ScopeChecker.matches?(token.scopes, scopes)
     end
 
-    def self.last_authorized_token_for(application, resource_owner_or_id)
-      resource_owner_id = resource_owner_or_id.kind_of?(ActiveRecord::Base) ? resource_owner_or_id.id : resource_owner_or_id
-      accessible.
-        where(:application_id => application.id,
-              :resource_owner_id => resource_owner_id).
-        order("created_at desc").
-        limit(1).
-        first
-    end
-    private_class_method :last_authorized_token_for
-
     def token_type
       "bearer"
     end
 
-    def accessible?
-      !expired? && !revoked?
-    end
-
     def use_refresh_token?
       self.use_refresh_token
     end
 
+    def as_json(options={})
+      {
+        :resource_owner_id => self.resource_owner_id,
+        :scopes => self.scopes,
+        :expires_in_seconds => self.expires_in_seconds,
+        :application => { :uid => self.application.uid }
+      }
+    end
+
     private
 
     def generate_refresh_token
-      self.refresh_token = UniqueToken.generate_for :refresh_token, self.class
+      write_attribute :refresh_token, UniqueToken.generate
     end
 
     def generate_token
-      self.token = UniqueToken.generate_for :token, self.class
+      self.token = UniqueToken.generate
     end
+
   end
 end

data/lib/doorkeeper/models/accessible.rb

@@ -0,0 +1,9 @@
+module Doorkeeper
+  module Models
+    module Accessible
+      def accessible?
+        !expired? && !revoked?
+      end
+    end
+  end
+end

data/lib/doorkeeper/models/active_record/access_grant.rb

@@ -0,0 +1,5 @@
+module Doorkeeper
+  class AccessGrant < ActiveRecord::Base
+    self.table_name = :oauth_access_grants
+  end
+end

data/lib/doorkeeper/models/active_record/access_token.rb

@@ -0,0 +1,15 @@
+module Doorkeeper
+  class AccessToken < ActiveRecord::Base
+    self.table_name = :oauth_access_tokens
+
+    def self.last_authorized_token_for(application, resource_owner_id)
+      where(:application_id => application.id,
+            :resource_owner_id => resource_owner_id,
+            :revoked_at => nil).
+      order('created_at desc').
+      limit(1).
+      first
+    end
+    private_class_method :last_authorized_token_for
+  end
+end

data/lib/doorkeeper/models/active_record/application.rb

@@ -0,0 +1,18 @@
+module Doorkeeper
+  class Application < ActiveRecord::Base
+    self.table_name = :oauth_applications
+
+    has_many :authorized_tokens, :class_name => "AccessToken", :conditions => { :revoked_at => nil }
+    has_many :authorized_applications, :through => :authorized_tokens, :source => :application
+
+    def self.column_names_with_table
+      self.column_names.map { |c| "oauth_applications.#{c}" }
+    end
+
+    def self.authorized_for(resource_owner)
+      joins(:authorized_applications).
+        where(:oauth_access_tokens => { :resource_owner_id => resource_owner.id, :revoked_at => nil }).
+        group(column_names_with_table.join(','))
+    end
+  end
+end

data/lib/doorkeeper/models/application.rb

@@ -0,0 +1,38 @@
+module Doorkeeper
+  class Application
+    include Doorkeeper::OAuth::Helpers
+
+    has_many :access_grants, :dependent => :destroy, :class_name => "Doorkeeper::AccessGrant"
+    has_many :access_tokens, :dependent => :destroy, :class_name => "Doorkeeper::AccessToken"
+
+    validates :name, :secret, :uid, :redirect_uri, :presence => true
+    validates :uid, :uniqueness => true
+    validates :redirect_uri, :redirect_uri => true
+
+    before_validation :generate_uid, :generate_secret, :on => :create
+
+    attr_accessible :name, :redirect_uri
+
+    def self.model_name
+      ActiveModel::Name.new(self, Doorkeeper, 'Application')
+    end
+
+    def self.authenticate(uid, secret)
+      self.where(:uid => uid, :secret => secret).first
+    end
+
+    def self.by_uid(uid)
+      self.where(:uid => uid).first
+    end
+
+    private
+
+    def generate_uid
+      self.uid = UniqueToken.generate
+    end
+
+    def generate_secret
+      self.secret = UniqueToken.generate
+    end
+  end
+end

data/lib/doorkeeper/models/expirable.rb

@@ -5,13 +5,15 @@ module Doorkeeper
         expires_in && Time.now > expired_time
       end
 
-      def time_left
-        expired? ? 0 : expired_time - Time.now
-      end
-
       def expired_time
         created_at + expires_in.seconds
       end
+
+      def expires_in_seconds
+        expires = (created_at + expires_in.seconds) - Time.now
+        expires_sec = expires.seconds.round(0)
+        expires_sec > 0 ? expires_sec : 0  
+      end
       private :expired_time
     end
   end

data/lib/doorkeeper/models/mongoid/access_grant.rb

@@ -0,0 +1,22 @@
+require 'doorkeeper/models/mongoid/revocable'
+require 'doorkeeper/models/mongoid/scopes'
+
+module Doorkeeper
+  class AccessGrant
+    include Mongoid::Document
+    include Mongoid::Timestamps
+    include Doorkeeper::Models::Mongoid::Revocable
+    include Doorkeeper::Models::Mongoid::Scopes
+
+    self.store_in :oauth_access_grants
+
+    field :resource_owner_id, :type => Hash
+    field :application_id, :type => Hash
+    field :token, :type => String
+    field :expires_in, :type => Integer
+    field :redirect_uri, :type => String
+    field :revoked_at, :type => DateTime
+
+    index :token, :unique => true
+  end
+end

data/lib/doorkeeper/models/mongoid/access_token.rb

@@ -0,0 +1,35 @@
+require 'doorkeeper/models/mongoid/revocable'
+require 'doorkeeper/models/mongoid/scopes'
+
+module Doorkeeper
+  class AccessToken
+    include Mongoid::Document
+    include Mongoid::Timestamps
+    include Doorkeeper::Models::Mongoid::Revocable
+    include Doorkeeper::Models::Mongoid::Scopes
+
+    self.store_in :oauth_access_tokens
+
+    field :resource_owner_id, :type => Integer
+    field :token, :type => String
+    field :expires_in, :type => Integer
+    field :revoked_at, :type => DateTime
+
+    index :token, :unique => true
+    index :refresh_token, :unique => true, :sparse => true
+
+    def self.last_authorized_token_for(application, resource_owner_id)
+      where(:application_id => application.id,
+            :resource_owner_id => resource_owner_id,
+            :revoked_at => nil).
+      order_by([:created_at, :desc]).
+      limit(1).
+      first
+    end
+    private_class_method :last_authorized_token_for
+
+    def refresh_token
+      self[:refresh_token]
+    end
+  end
+end

data/lib/doorkeeper/models/mongoid/application.rb

@@ -0,0 +1,22 @@
+module Doorkeeper
+  class Application
+    include Mongoid::Document
+    include Mongoid::Timestamps
+
+    self.store_in :oauth_applications
+
+    has_many :authorized_tokens, :class_name => "Doorkeeper::AccessToken"
+
+    field :name, :type => String
+    field :uid, :type => String
+    field :secret, :type => String
+    field :redirect_uri, :type => String
+
+    index :uid, :unique => true
+
+    def self.authorized_for(resource_owner)
+      ids = AccessToken.where(:resource_owner_id => resource_owner.id, :revoked_at => nil).map(&:application_id)
+      find(ids)
+    end
+  end
+end

data/lib/doorkeeper/models/mongoid/revocable.rb

@@ -0,0 +1,15 @@
+module Doorkeeper
+  module Models
+    module Mongoid
+      module Revocable
+        def self.included(base)
+          base.class_eval do
+            def update_column(attr, val)
+              update_attribute attr, val
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/models/mongoid/scopes.rb

@@ -0,0 +1,15 @@
+module Doorkeeper
+  module Models
+    module Mongoid
+      module Scopes
+        def self.included(base)
+          base.class_eval do
+            def scopes=(value)
+              write_attribute :scopes, value if value.present?
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/models/ownership.rb

@@ -0,0 +1,16 @@
+module Doorkeeper
+  module Models
+    module Ownership
+      def validate_owner?
+        Doorkeeper.configuration.confirm_application_owner?
+      end    
+  
+      def self.included(base)
+        base.class_eval do
+          belongs_to :owner, :polymorphic => true
+          validates :owner, :presence => true, :if => :validate_owner?      
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/models/revocable.rb

@@ -2,7 +2,7 @@ module Doorkeeper
   module Models
     module Revocable
       def revoke(clock = DateTime)
-        update_attribute :revoked_at, clock.now
+        update_column :revoked_at, clock.now
       end
 
       def revoked?