doorkeeper 1.3.1 → 1.4.0

data/lib/doorkeeper/models/access_grant.rb

@@ -1,10 +1,10 @@
 module Doorkeeper
   class AccessGrant
-    include Doorkeeper::OAuth::Helpers
-    include Doorkeeper::Models::Expirable
-    include Doorkeeper::Models::Revocable
-    include Doorkeeper::Models::Accessible
-    include Doorkeeper::Models::Scopes
+    include OAuth::Helpers
+    include Models::Expirable
+    include Models::Revocable
+    include Models::Accessible
+    include Models::Scopes
 
     belongs_to :application, class_name: 'Doorkeeper::Application', inverse_of: :access_grants
 

data/lib/doorkeeper/models/access_token.rb

@@ -1,10 +1,10 @@
 module Doorkeeper
   class AccessToken
-    include Doorkeeper::OAuth::Helpers
-    include Doorkeeper::Models::Expirable
-    include Doorkeeper::Models::Revocable
-    include Doorkeeper::Models::Accessible
-    include Doorkeeper::Models::Scopes
+    include OAuth::Helpers
+    include Models::Expirable
+    include Models::Revocable
+    include Models::Accessible
+    include Models::Scopes
 
     belongs_to :application,
                class_name: 'Doorkeeper::Application',
@@ -89,6 +89,10 @@ module Doorkeeper
         resource_owner_id == access_token.resource_owner_id
     end
 
+    def acceptable?(scopes)
+      accessible? && includes_scope?(scopes)
+    end
+
     private
 
     def generate_refresh_token

data/lib/doorkeeper/models/active_record/access_grant.rb

@@ -4,6 +4,6 @@ module Doorkeeper
       establish_connection Doorkeeper.configuration.active_record_options[:establish_connection]
     end
 
-    self.table_name = "#{self.table_name_prefix}oauth_access_grants#{self.table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}".to_sym
   end
 end

data/lib/doorkeeper/models/active_record/access_token.rb

@@ -4,7 +4,7 @@ module Doorkeeper
       establish_connection Doorkeeper.configuration.active_record_options[:establish_connection]
     end
 
-    self.table_name = "#{self.table_name_prefix}oauth_access_tokens#{self.table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}".to_sym
 
     def self.delete_all_for(application_id, resource_owner)
       where(application_id: application_id,

data/lib/doorkeeper/models/active_record/application.rb

@@ -4,7 +4,7 @@ module Doorkeeper
       establish_connection Doorkeeper.configuration.active_record_options[:establish_connection]
     end
 
-    self.table_name = "#{self.table_name_prefix}oauth_applications#{self.table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}".to_sym
 
     if ActiveRecord::VERSION::MAJOR >= 4
       has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: 'AccessToken'
@@ -14,12 +14,12 @@ module Doorkeeper
     has_many :authorized_applications, through: :authorized_tokens, source: :application
 
     def self.column_names_with_table
-      self.column_names.map { |c| "#{self.table_name}.#{c}" }
+      self.column_names.map { |c| "#{table_name}.#{c}" }
     end
 
     def self.authorized_for(resource_owner)
       joins(:authorized_applications).
-        where(Doorkeeper::AccessToken.table_name => { resource_owner_id: resource_owner.id, revoked_at: nil }).
+        where(AccessToken.table_name => { resource_owner_id: resource_owner.id, revoked_at: nil }).
         group(column_names_with_table.join(','))
     end
   end

data/lib/doorkeeper/models/application.rb

@@ -1,6 +1,6 @@
 module Doorkeeper
   class Application
-    include Doorkeeper::OAuth::Helpers
+    include OAuth::Helpers
 
     has_many :access_grants, dependent: :destroy, class_name: 'Doorkeeper::AccessGrant'
     has_many :access_tokens, dependent: :destroy, class_name: 'Doorkeeper::AccessToken'

data/lib/doorkeeper/models/mongo_mapper/access_grant.rb

@@ -1,9 +1,6 @@
-require 'doorkeeper/models/mongo_mapper/revocable'
-
 module Doorkeeper
   class AccessGrant
     include MongoMapper::Document
-    include Doorkeeper::Models::MongoMapper::Revocable
     safe
     timestamps!
 

data/lib/doorkeeper/models/mongo_mapper/access_token.rb

@@ -1,9 +1,6 @@
-require 'doorkeeper/models/mongo_mapper/revocable'
-
 module Doorkeeper
   class AccessToken
     include MongoMapper::Document
-    include Doorkeeper::Models::MongoMapper::Revocable
     safe
     timestamps!
 

data/lib/doorkeeper/models/mongoid2/access_grant.rb

@@ -1,12 +1,10 @@
-require 'doorkeeper/models/mongoid/revocable'
 require 'doorkeeper/models/mongoid/scopes'
 
 module Doorkeeper
   class AccessGrant
     include Mongoid::Document
     include Mongoid::Timestamps
-    include Doorkeeper::Models::Mongoid::Revocable
-    include Doorkeeper::Models::Mongoid::Scopes
+    include Models::Mongoid::Scopes
 
     self.store_in :oauth_access_grants
 

data/lib/doorkeeper/models/mongoid2/access_token.rb

@@ -1,12 +1,10 @@
-require 'doorkeeper/models/mongoid/revocable'
 require 'doorkeeper/models/mongoid/scopes'
 
 module Doorkeeper
   class AccessToken
     include Mongoid::Document
     include Mongoid::Timestamps
-    include Doorkeeper::Models::Mongoid::Revocable
-    include Doorkeeper::Models::Mongoid::Scopes
+    include Models::Mongoid::Scopes
 
     self.store_in :oauth_access_tokens
 

data/lib/doorkeeper/models/mongoid3_4/access_grant.rb

@@ -1,4 +1,3 @@
-require 'doorkeeper/models/mongoid/revocable'
 require 'doorkeeper/models/mongoid/scopes'
 require 'doorkeeper/models/mongoid/version'
 
@@ -6,9 +5,8 @@ module Doorkeeper
   class AccessGrant
     include Mongoid::Document
     include Mongoid::Timestamps
-    include Doorkeeper::Models::Mongoid::Revocable
-    include Doorkeeper::Models::Mongoid::Scopes
-    extend Doorkeeper::Models::Mongoid::Version
+    include Models::Mongoid::Scopes
+    extend Models::Mongoid::Version
 
     self.store_in collection: :oauth_access_grants
 

data/lib/doorkeeper/models/mongoid3_4/access_token.rb

@@ -1,4 +1,3 @@
-require 'doorkeeper/models/mongoid/revocable'
 require 'doorkeeper/models/mongoid/scopes'
 require 'doorkeeper/models/mongoid/version'
 
@@ -6,9 +5,8 @@ module Doorkeeper
   class AccessToken
     include Mongoid::Document
     include Mongoid::Timestamps
-    include Doorkeeper::Models::Mongoid::Revocable
-    include Doorkeeper::Models::Mongoid::Scopes
-    extend Doorkeeper::Models::Mongoid::Version
+    include Models::Mongoid::Scopes
+    extend Models::Mongoid::Version
 
     self.store_in collection: :oauth_access_tokens
 

data/lib/doorkeeper/models/revocable.rb

@@ -2,7 +2,7 @@ module Doorkeeper
   module Models
     module Revocable
       def revoke(clock = DateTime)
-        update_column :revoked_at, clock.now
+        update_attribute :revoked_at, clock.now
       end
 
       def revoked?

data/lib/doorkeeper/models/scopes.rb

@@ -4,11 +4,15 @@ module Doorkeeper
       def self.included(base)
         base.class_eval do
           define_method :scopes do
-            Doorkeeper::OAuth::Scopes.from_string(self[:scopes])
+            OAuth::Scopes.from_string(self[:scopes])
           end
 
           define_method :scopes_string do
-            Doorkeeper::OAuth::Scopes.from_string(self[:scopes]).to_s
+            OAuth::Scopes.from_string(self[:scopes]).to_s
+          end
+
+          define_method :includes_scope? do |required_scopes|
+            required_scopes.blank? || required_scopes.any? { |s| scopes.exists?(s) }
           end
         end
       end

data/lib/doorkeeper/oauth/authorization/code.rb

@@ -19,6 +19,10 @@ module Doorkeeper
           )
         end
 
+        def native_redirect
+          { action: :show, code: token.token }
+        end
+
         def configuration
           Doorkeeper.configuration
         end

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -19,6 +19,14 @@ module Doorkeeper
           )
         end
 
+        def native_redirect
+          {
+            controller: 'doorkeeper/token_info',
+            action: :show,
+            access_token: token.token
+          }
+        end
+
         def configuration
           Doorkeeper.configuration
         end

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -1,8 +1,8 @@
 module Doorkeeper
   module OAuth
     class AuthorizationCodeRequest
-      include Doorkeeper::Validations
-      include Doorkeeper::OAuth::RequestConcern
+      include Validations
+      include OAuth::RequestConcern
 
       validate :attributes,   error: :invalid_request
       validate :client,       error: :invalid_client

data/lib/doorkeeper/oauth/client.rb

@@ -4,13 +4,13 @@ require 'doorkeeper/oauth/client/credentials'
 module Doorkeeper
   module OAuth
     class Client
-      def self.find(uid, method = Doorkeeper::Application.method(:by_uid))
+      def self.find(uid, method = Application.method(:by_uid))
         if application = method.call(uid)
           new(application)
         end
       end
 
-      def self.authenticate(credentials, method = Doorkeeper::Application.method(:authenticate))
+      def self.authenticate(credentials, method = Application.method(:authenticate))
         return false if credentials.blank?
         if application = method.call(credentials.uid, credentials.secret)
           new(application)

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -3,7 +3,7 @@ module Doorkeeper
     class ClientCredentialsRequest
       class Creator
         def call(client, scopes, attributes = {})
-          Doorkeeper::AccessToken.create(attributes.merge(
+          AccessToken.create(attributes.merge(
             application_id: client.id,
             scopes: scopes.to_s
           ))

data/lib/doorkeeper/oauth/client_credentials/validation.rb

@@ -6,8 +6,8 @@ module Doorkeeper
   module OAuth
     class ClientCredentialsRequest
       class Validation
-        include Doorkeeper::Validations
-        include Doorkeeper::OAuth::Helpers
+        include Validations
+        include OAuth::Helpers
 
         validate :client, error: :invalid_client
         validate :scopes, error: :invalid_scope

data/lib/doorkeeper/oauth/client_credentials_request.rb

@@ -5,10 +5,10 @@ require 'doorkeeper/oauth/client_credentials/validation'
 module Doorkeeper
   module OAuth
     class ClientCredentialsRequest
-      include Doorkeeper::Validations
-      include Doorkeeper::OAuth::RequestConcern
+      include Validations
+      include OAuth::RequestConcern
 
-      attr_accessor :issuer, :server, :client, :original_scopes, :scopes
+      attr_accessor :issuer, :server, :client, :original_scopes
       attr_reader :response
       alias :error_response :response
 
@@ -28,15 +28,6 @@ module Doorkeeper
         issuer.token
       end
 
-      # TODO: Why can't it use RequestConcern's implementation?
-      def scopes
-        @scopes ||= if @original_scopes.present?
-                      Doorkeeper::OAuth::Scopes.from_string(@original_scopes)
-                    else
-                      server.default_scopes
-                    end
-      end
-
       private
 
       def valid?

data/lib/doorkeeper/oauth/code_response.rb

@@ -1,8 +1,8 @@
 module Doorkeeper
   module OAuth
     class CodeResponse
-      include Doorkeeper::OAuth::Authorization::URIBuilder
-      include Doorkeeper::OAuth::Helpers
+      include OAuth::Authorization::URIBuilder
+      include OAuth::Helpers
 
       attr_accessor :pre_auth, :auth, :response_on_fragment
 
@@ -15,10 +15,9 @@ module Doorkeeper
         true
       end
 
-      # TODO: configure the test oauth path?
       def redirect_uri
         if URIChecker.native_uri? pre_auth.redirect_uri
-          { action: :show, code: auth.token.token }
+          auth.native_redirect
         else
           if response_on_fragment
             uri_with_fragment(

data/lib/doorkeeper/oauth/error_response.rb

@@ -1,8 +1,8 @@
 module Doorkeeper
   module OAuth
     class ErrorResponse
-      include Doorkeeper::OAuth::Authorization::URIBuilder
-      include Doorkeeper::OAuth::Helpers
+      include OAuth::Authorization::URIBuilder
+      include OAuth::Helpers
 
       def self.from_request(request, attributes = {})
         state = request.state if request.respond_to?(:state)
@@ -12,7 +12,7 @@ module Doorkeeper
       delegate :name, :description, :state, to: :@error
 
       def initialize(attributes = {})
-        @error = Doorkeeper::OAuth::Error.new(*attributes.values_at(:name, :state))
+        @error = OAuth::Error.new(*attributes.values_at(:name, :state))
         @redirect_uri = attributes[:redirect_uri]
         @response_on_fragment = attributes[:response_on_fragment]
       end

data/lib/doorkeeper/oauth/forbidden_token_response.rb

@@ -0,0 +1,29 @@
+module Doorkeeper
+  module OAuth
+    class ForbiddenTokenResponse < ErrorResponse
+      def self.from_scopes(scopes, attributes = {})
+        new(attributes.merge(scopes: scopes))
+      end
+
+      def initialize(attributes = {})
+        super(attributes.merge(name: :invalid_scope, state: :forbidden))
+        @scopes = attributes[:scopes]
+      end
+
+      def status
+        :forbidden
+      end
+
+      def headers
+        headers = super
+        headers.delete 'WWW-Authenticate'
+        headers
+      end
+
+      def description
+        scope = { scope: [:doorkeeper, :scopes] }
+        @description ||= @scopes.map { |r| I18n.translate r, scope }.join('\n')
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -10,7 +10,7 @@ module Doorkeeper
         def self.valid?(scope, server_scopes)
           scope.present? &&
           scope !~ /[\n|\r|\t]/ &&
-          server_scopes.has_scopes?(Doorkeeper::OAuth::Scopes.from_string(scope))
+          server_scopes.has_scopes?(OAuth::Scopes.from_string(scope))
         end
       end
     end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -1,9 +1,9 @@
 module Doorkeeper
   module OAuth
     class PasswordAccessTokenRequest
-      include Doorkeeper::Validations
-      include Doorkeeper::OAuth::RequestConcern
-      include Doorkeeper::OAuth::Helpers
+      include Validations
+      include OAuth::RequestConcern
+      include OAuth::Helpers
 
       validate :client,         error: :invalid_client
       validate :resource_owner, error: :invalid_resource_owner
@@ -19,8 +19,8 @@ module Doorkeeper
         @original_scopes = parameters[:scope]
 
         if credentials
-          @client = Doorkeeper::Application.authenticate credentials.uid,
-                                                         credentials.secret
+          @client = Application.authenticate credentials.uid,
+                                             credentials.secret
         end
       end
 

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -1,7 +1,7 @@
 module Doorkeeper
   module OAuth
     class PreAuthorization
-      include Doorkeeper::Validations
+      include Validations
 
       validate :response_type, error: :unsupported_response_type
       validate :client, error: :invalid_client
@@ -33,7 +33,7 @@ module Doorkeeper
       end
 
       def error_response
-        Doorkeeper::OAuth::ErrorResponse.from_request(self)
+        OAuth::ErrorResponse.from_request(self)
       end
 
       private

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -1,9 +1,9 @@
 module Doorkeeper
   module OAuth
     class RefreshTokenRequest
-      include Doorkeeper::Validations
-      include Doorkeeper::OAuth::RequestConcern
-      include Doorkeeper::OAuth::Helpers
+      include Validations
+      include OAuth::RequestConcern
+      include OAuth::Helpers
 
       validate :token,        error: :invalid_request
       validate :client,       error: :invalid_client
@@ -20,8 +20,8 @@ module Doorkeeper
         @original_scopes  = parameters[:scopes]
 
         if credentials
-          @client = Doorkeeper::Application.authenticate credentials.uid,
-            credentials.secret
+          @client = Application.authenticate credentials.uid,
+                                             credentials.secret
         end
       end
 
@@ -37,7 +37,7 @@ module Doorkeeper
       end
 
       def create_access_token
-        @access_token = Doorkeeper::AccessToken.create!(
+        @access_token = AccessToken.create!(
           application_id:    refresh_token.application_id,
           resource_owner_id: refresh_token.resource_owner_id,
           scopes:            scopes.to_s,