doorkeeper 1.3.1 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 1cf5353e6f59ed9314bed48b00fee6eef151e62e
-  data.tar.gz: e9fbdfa650708ab9e9fdea68e96ab2c712910308
+  metadata.gz: 2effc07ab96a92f6ce4bf22833e99079c1309b01
+  data.tar.gz: b2d4793140041f6a71b3eddc5ce74c61bca8de8e
 SHA512:
-  metadata.gz: 5492059f736ca023683d8b9227dbe61648501742ae4d3d1aa6b8ec302906d57764760814647e06105f1b20e2eb902c3c934ef7d216c5600dc470fa356e1572ca
-  data.tar.gz: 871bc1c1cd6a7adc602e1d929f4f546cf95a89ef454a767719ad2a559d156c9e34121268aa11fde46c02d080be5d08992f2c57a130cd0a87691cb9aee9d1e5aa
+  metadata.gz: 55e4089805323ebc56efff0306872bfea4b19b814131632c62885975aebe452338612ced9f3137e20500b9dfa298bec2f8b3de7b385d3e1be16df804a0c8ccb7
+  data.tar.gz: 50b4631d1e4f14557aba937edb12d225e2a704d80142b3e3e487d8f36a5c097a89bfdd871bda1012e690324c3833605ca51c23820aa47a5b7baba242bf782287

data/.hound.yml

@@ -1,3 +1,6 @@
 LineLength:
   Exclude:
-    - app/spec/**/*
+    - spec/**/*
+
+StringLiterals:
+  Enabled: false

data/CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## master
+
+## 1.4.0
+
+- internals
+  - [#427] Adds specs expectations.
+  - [#428] Error response refactor.
+  - [#417] Moves token validation into Access Token class.
+  - [#439] Removes redundant module includes.
+  - [#443] TokensController and TokenInfoController inherit from ActionController::Metal
+- bug
+  - [#418] fixes #243, requests with insufficient scope now respond 403 instead
+    of 401. (API change)
+  - [#438] fixes #398, native redirect for implicit token grant bug.
+  - [#440] namespace fixes
+- enhancements
+  - [#432] Keeps query parameters
+
 ## 1.3.1
 
 - enhancements

data/README.md

@@ -20,7 +20,8 @@ Doorkeeper is a gem that makes it easy to introduce OAuth 2 provider functionali
     - [Routes](#routes)
     - [Authenticating](#authenticating)
 - [Protecting resources with OAuth (a.k.a your API endpoint)](#protecting-resources-with-oauth-aka-your-api-endpoint)
-    - [ActionController::Metal integration and other integrations](#actioncontrollermetal-integration-and-other-integrations)
+    - [ActionController::Metal integration](#actioncontrollermetal-integration)
+    - [Route Constraints and other integrations](#route-constraints-and-other-integrations)
     - [Access Token Scopes](#access-token-scopes)
     - [Authenticated resource owner](#authenticated-resource-owner)
     - [Applications list](#applications-list)

data/app/controllers/doorkeeper/application_metal_controller.rb

@@ -0,0 +1,16 @@
+module Doorkeeper
+  class ApplicationMetalController < ActionController::Metal
+    MODULES = [
+      ActionController::RackDelegation,
+      ActionController::Instrumentation,
+      AbstractController::Rendering,
+      ActionController::Rendering,
+      ActionController::Renderers::All,
+      Helpers::Controller
+    ]
+
+    MODULES.each do |mod|
+      include mod
+    end
+  end
+end

data/app/controllers/doorkeeper/applications_controller.rb

@@ -24,12 +24,6 @@ module Doorkeeper
       end
     end
 
-    def show
-    end
-
-    def edit
-    end
-
     def update
       if @application.update_attributes(application_params)
         flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :update])

data/app/controllers/doorkeeper/authorizations_controller.rb

@@ -1,10 +1,10 @@
 module Doorkeeper
-  class AuthorizationsController < ::Doorkeeper::ApplicationController
+  class AuthorizationsController < Doorkeeper::ApplicationController
     before_filter :authenticate_resource_owner!
 
     def new
       if pre_auth.authorizable?
-        if Doorkeeper::AccessToken.matching_token_for(pre_auth.client, current_resource_owner.id, pre_auth.scopes) || skip_authorization?
+        if matching_token? || skip_authorization?
           auth = authorization.authorize
           redirect_to auth.redirect_uri
         else
@@ -15,23 +15,24 @@ module Doorkeeper
       end
     end
 
-    def show
-    end
-
     # TODO: Handle raise invalid authorization
     def create
-      auth = authorization.authorize
-
-      if auth.redirectable?
-        redirect_to auth.redirect_uri
-      else
-        render json: auth.body, status: auth.status
-      end
+      redirect_or_render authorization.authorize
     end
 
     def destroy
-      auth = authorization.deny
+      redirect_or_render authorization.deny
+    end
+
+    private
 
+    def matching_token?
+      AccessToken.matching_token_for pre_auth.client,
+                                     current_resource_owner.id,
+                                     pre_auth.scopes
+    end
+
+    def redirect_or_render(auth)
       if auth.redirectable?
         redirect_to auth.redirect_uri
       else
@@ -39,8 +40,6 @@ module Doorkeeper
       end
     end
 
-    private
-
     def pre_auth
       @pre_auth ||= OAuth::PreAuthorization.new(Doorkeeper.configuration, server.client_via_uid, params)
     end

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -1,12 +1,14 @@
-class Doorkeeper::AuthorizedApplicationsController < Doorkeeper::ApplicationController
-  before_filter :authenticate_resource_owner!
+module Doorkeeper
+  class AuthorizedApplicationsController < Doorkeeper::ApplicationController
+    before_filter :authenticate_resource_owner!
 
-  def index
-    @applications = Doorkeeper::Application.authorized_for(current_resource_owner)
-  end
+    def index
+      @applications = Application.authorized_for(current_resource_owner)
+    end
 
-  def destroy
-    Doorkeeper::AccessToken.revoke_all_for params[:id], current_resource_owner
-    redirect_to oauth_authorized_applications_url, notice: I18n.t(:notice, scope: [:doorkeeper, :flash, :authorized_applications, :destroy])
+    def destroy
+      AccessToken.revoke_all_for params[:id], current_resource_owner
+      redirect_to oauth_authorized_applications_url, notice: I18n.t(:notice, scope: [:doorkeeper, :flash, :authorized_applications, :destroy])
+    end
   end
 end

data/app/controllers/doorkeeper/token_info_controller.rb

@@ -1,5 +1,5 @@
 module Doorkeeper
-  class TokenInfoController < ::Doorkeeper::ApplicationController
+  class TokenInfoController < Doorkeeper::ApplicationMetalController
     def show
       if doorkeeper_token && doorkeeper_token.accessible?
         render json: doorkeeper_token, status: :ok

data/app/controllers/doorkeeper/tokens_controller.rb

@@ -1,9 +1,5 @@
 module Doorkeeper
-  class TokensController < ::Doorkeeper::ApplicationController
-    include Helpers::Controller
-    include ActionController::RackDelegation
-    include ActionController::Instrumentation
-
+  class TokensController < Doorkeeper::ApplicationMetalController
     def create
       response = strategy.authorize
       self.headers.merge! response.headers
@@ -13,11 +9,7 @@ module Doorkeeper
       handle_token_exception e
     end
 
-    #############################################
-    #   RFC 7009 - OAuth 2.0 Token Revocation   #
-    #                                           #
-    #    http://tools.ietf.org/html/rfc7009     #
-    #############################################
+    # OAuth 2.0 Token Revocation - http://tools.ietf.org/html/rfc7009
     def revoke
       # The authorization server first validates the client credentials
       if doorkeeper_token && doorkeeper_token.accessible?
@@ -33,7 +25,7 @@ module Doorkeeper
     private
 
     def revoke_token(token)
-      token = Doorkeeper::AccessToken.authenticate(token) || Doorkeeper::AccessToken.by_refresh_token(token)
+      token = AccessToken.authenticate(token) || AccessToken.by_refresh_token(token)
       if token && doorkeeper_token.same_credential?(token)
         token.revoke
         true

data/app/validators/redirect_uri_validator.rb

@@ -14,7 +14,6 @@ class RedirectUriValidator < ActiveModel::EachValidator
         return if native_redirect_uri?(uri)
         record.errors.add(attribute, :fragment_present) unless uri.fragment.nil?
         record.errors.add(attribute, :relative_uri) if uri.scheme.nil? || uri.host.nil?
-        record.errors.add(attribute, :has_query_parameter) unless uri.query.nil?
       end
     end
   rescue URI::InvalidURIError

data/config/locales/en.yml

@@ -6,7 +6,6 @@ en:
           attributes:
             redirect_uri:
               fragment_present: 'cannot contain a fragment.'
-              has_query_parameter: 'cannot contain a query parameter.'
               invalid_uri: 'must be a valid URI.'
               relative_uri: 'must be an absolute URI.'
   mongoid:
@@ -16,7 +15,6 @@ en:
           attributes:
             redirect_uri:
               fragment_present: 'cannot contain a fragment.'
-              has_query_parameter: 'cannot contain a query parameter.'
               invalid_uri: 'must be a valid URI.'
               relative_uri: 'must be an absolute URI.'
   mongo_mapper:
@@ -26,7 +24,6 @@ en:
           attributes:
             redirect_uri:
               fragment_present: 'cannot contain a fragment.'
-              has_query_parameter: 'cannot contain a query parameter.'
               invalid_uri: 'must be a valid URI.'
               relative_uri: 'must be an absolute URI.'
   doorkeeper:

data/doorkeeper.gemspec

@@ -27,4 +27,5 @@ Gem::Specification.new do |s|
   s.add_development_dependency "database_cleaner", "~> 1.3.0"
   s.add_development_dependency "rspec-activemodel-mocks", "~> 1.0.0"
   s.add_development_dependency "bcrypt-ruby", "~> 3.0.1"
+  s.add_development_dependency "pry", "~> 0.10.0"
 end

data/lib/doorkeeper.rb

@@ -31,6 +31,7 @@ require 'doorkeeper/oauth/token_request'
 require 'doorkeeper/oauth/client'
 require 'doorkeeper/oauth/token'
 require 'doorkeeper/oauth/invalid_token_response'
+require 'doorkeeper/oauth/forbidden_token_response'
 
 require 'doorkeeper/models/scopes'
 require 'doorkeeper/models/expirable'

data/lib/doorkeeper/config.rb

@@ -35,7 +35,7 @@ module Doorkeeper
 
   def self.setup_application_owner
     require File.join(File.dirname(__FILE__), 'models', 'ownership')
-    Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
+    Application.send :include, Models::Ownership
   end
 
   class Config
@@ -59,11 +59,11 @@ module Doorkeeper
       end
 
       def default_scopes(*scopes)
-        @config.instance_variable_set('@default_scopes', Doorkeeper::OAuth::Scopes.from_array(scopes))
+        @config.instance_variable_set('@default_scopes', OAuth::Scopes.from_array(scopes))
       end
 
       def optional_scopes(*scopes)
-        @config.instance_variable_set('@optional_scopes', Doorkeeper::OAuth::Scopes.from_array(scopes))
+        @config.instance_variable_set('@optional_scopes', OAuth::Scopes.from_array(scopes))
       end
 
       def client_credentials(*methods)
@@ -198,11 +198,11 @@ module Doorkeeper
     end
 
     def default_scopes
-      @default_scopes ||= Doorkeeper::OAuth::Scopes.new
+      @default_scopes ||= OAuth::Scopes.new
     end
 
     def optional_scopes
-      @optional_scopes ||= Doorkeeper::OAuth::Scopes.new
+      @optional_scopes ||= OAuth::Scopes.new
     end
 
     def scopes

data/lib/doorkeeper/doorkeeper_for.rb

@@ -1,51 +1,41 @@
 module Doorkeeper
   class InvalidSyntax < StandardError; end
   class DoorkeeperFor
+    attr_reader :scopes
+
     def initialize(options)
       options ||= {}
       fail InvalidSyntax unless options.is_a? Hash
       @filter_options = {}
 
       options.each do |k, v|
-        self.send(k, v)
+        send("#{k}=", v)
       end
     end
 
-    # TODO: move this to Token class
-    def validate_token(token)
-      return false unless token
-      token.accessible? && validate_token_scopes(token)
-    end
-
     def filter_options
       @filter_options
     end
 
     private
 
-    def scopes(scopes)
+    def scopes=(scopes)
       @scopes = scopes.map(&:to_s)
     end
 
-    def if(if_block)
+    def if=(if_block)
       @filter_options[:if] = if_block
     end
 
-    def unless(unless_block)
+    def unless=(unless_block)
       @filter_options[:unless] = unless_block
     end
-
-    # TODO: move this to Token class
-    def validate_token_scopes(token)
-      return true if @scopes.blank?
-      token.scopes.any? { |scope| @scopes.include? scope }
-    end
   end
 
   class AllDoorkeeperFor < DoorkeeperFor
     private
 
-    def except(actions)
+    def except=(actions)
       @filter_options[:except] = actions
     end
   end

data/lib/doorkeeper/helpers/controller.rb

@@ -1,14 +1,9 @@
 module Doorkeeper
   module Helpers
     module Controller
-      def self.included(base)
-        base.send :private,
-                  :authenticate_resource_owner!,
-                  :authenticate_admin!,
-                  :current_resource_owner,
-                  :resource_owner_from_credentials,
-                  :skip_authorization?
-      end
+      extend ActiveSupport::Concern
+
+      private
 
       def authenticate_resource_owner!
         current_resource_owner
@@ -30,6 +25,14 @@ module Doorkeeper
         @server ||= Server.new(self)
       end
 
+      def doorkeeper_token
+        @token ||= OAuth::Token.authenticate request, *config_methods
+      end
+
+      def config_methods
+        @methods ||= Doorkeeper.configuration.access_token_methods
+      end
+
       def get_error_response_from_exception(exception)
         error_name = case exception
                      when Errors::InvalidTokenStrategy

data/lib/doorkeeper/helpers/filter.rb

@@ -6,18 +6,18 @@ module Doorkeeper
           doorkeeper_for = DoorkeeperForBuilder.create_doorkeeper_for(*args)
 
           before_filter doorkeeper_for.filter_options do
-            unless doorkeeper_for.validate_token(doorkeeper_token)
-              @error = OAuth::InvalidTokenResponse.from_access_token(doorkeeper_token)
-              headers.merge!(@error.headers.reject { |k, v| ['Content-Type'].include? k })
-              render_options = doorkeeper_unauthorized_render_options
-
-              if render_options.nil? || render_options.empty?
-                head :unauthorized
+            unless valid_token?(doorkeeper_for.scopes)
+              if !doorkeeper_token || !doorkeeper_token.accessible?
+                @error = OAuth::InvalidTokenResponse.from_access_token(doorkeeper_token)
+                error_status = :unauthorized
+                options = doorkeeper_unauthorized_render_options
               else
-                render_options[:status] = :unauthorized
-                render_options[:layout] = false if render_options[:layout].nil?
-                render render_options
+                @error = OAuth::ForbiddenTokenResponse.from_scopes(doorkeeper_for.scopes)
+                error_status = :forbidden
+                options = doorkeeper_forbidden_render_options
               end
+              headers.merge!(@error.headers.reject { |k, v| ['Content-Type'].include? k })
+              render_error(error_status, options)
             end
           end
         end
@@ -29,14 +29,36 @@ module Doorkeeper
       end
 
       def doorkeeper_token
-        return @token if instance_variable_defined?(:@token)
-        methods = Doorkeeper.configuration.access_token_methods
-        @token = OAuth::Token.authenticate request, *methods
+        @token ||= OAuth::Token.authenticate request, *config_methods
+      end
+
+      def config_methods
+        @methods ||= Doorkeeper.configuration.access_token_methods
       end
 
       def doorkeeper_unauthorized_render_options
         nil
       end
+
+      def doorkeeper_forbidden_render_options
+        nil
+      end
+
+      private
+
+      def valid_token?(scopes)
+        doorkeeper_token && doorkeeper_token.acceptable?(scopes)
+      end
+
+      def render_error(error, options)
+        if options.blank?
+          head error
+        else
+          options[:status] = error
+          options[:layout] = false if options[:layout].nil?
+          render options
+        end
+      end
     end
   end
 end