doorkeeper 2.0.0.rc2 → 2.0.0.rc3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 210e4fe74a245228a17d33cee59e3ca0b623cf6f
-  data.tar.gz: d639da9ead08dc48b5dbe89837bd086e909e14c0
+  metadata.gz: b6af4f799e8a70cbaf372a0fc40c916ef361b724
+  data.tar.gz: 6ec873aec540c727246755b3dbb3c910c97d4c98
 SHA512:
-  metadata.gz: 9e01e9c004ced7e97eef6920c963fbb27c7fa7e3179c2bd00df7a3474c7e0185409cb029d1f2854ea66288f8d16fc27afc8d3bd50c548e37abb77cfbbcdad97b
-  data.tar.gz: 1516f21f124320f14516e5167fb498075105e3453f683465fe08953b44e779d5d7e68fb7ca3f5a97b9db7e822e1bf151ac81813c45d0932d00cacc1bb1faa0eb
+  metadata.gz: 59e4096fcacac6391f65fa6006dc9704cac6b8b8f85e1988bca2c731ecd70017b67916a96443671a585c05fefce61512936640dcbb9f8fb37d7cb0b68ba73ae7
+  data.tar.gz: 8a30f7ceeeb1d32c248e862c51e9ad0b504aadb8b82d01888a12ae0545c5ddd3fd3a8f6512f795f2b82fe3a68d085dd9b8deaa3bb841199c2511e94debe1b91f

data/CHANGELOG.md

@@ -8,9 +8,13 @@
   `before_action :doorkeeper_authorize!`.
 - [#469] Allow client applications to restrict the set of allowable scopes.
   Fixes #317. `oauth_applications` relation needs a new `scopes` string column,
-  non nullable, which defaults to an empty string. Run `rails generate
-  doorkeeper:application_scopes` to add the column. If you’d rather do it by
-  hand, your ActiveRecord migration should contain:
+  non nullable, which defaults to an empty string. To add the column run:
+
+  ```
+  rails generate doorkeeper:application_scopes
+  ```
+
+  If you’d rather do it by hand, your ActiveRecord migration should contain:
 
   ```ruby
   add_column :oauth_applications, :scopes, :string, null: false, default: ‘’
@@ -23,6 +27,7 @@
 
 ### Other changes/enhancements
 
+- [#484] Performance improvement - avoid performing order_by when not required.
 - [#450] When password is invalid in Password Credentials Grant, Doorkeeper
   returned 'invalid_resource_owner' instead of 'invalid_grant', as the spec
   declares. Fixes #444.
@@ -35,6 +40,8 @@
 - [#496] Tests with Rails 4.2.
 - [#489] Adds `force_ssl_in_redirect_uri` to force the usage of the HTTPS
   protocol in non-native redirect uris.
+- [#516] Adds `protect_from_forgery` to `Doorkeeper::ApplicationController`
+- [#518] Fix random failures in mongodb.
 
 
 ## 1.4.0

data/app/controllers/doorkeeper/application_controller.rb

@@ -2,6 +2,12 @@ module Doorkeeper
   class ApplicationController < ActionController::Base
     include Helpers::Controller
 
+    if ::Rails.version.to_i < 4
+      protect_from_forgery
+    else
+      protect_from_forgery with: :exception
+    end
+
     helper 'doorkeeper/dashboard'
   end
 end

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -23,7 +23,7 @@ module Doorkeeper
 
     module ClassMethods
       def by_token(token)
-        where(token: token).first
+        where(token: token).limit(1).to_a.first
       end
     end
 

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -31,7 +31,7 @@ module Doorkeeper
 
     module ClassMethods
       def by_token(token)
-        where(token: token).first
+        where(token: token).limit(1).to_a.first
       end
 
       def by_refresh_token(refresh_token)
@@ -77,6 +77,7 @@ module Doorkeeper
               revoked_at: nil).
           send(order_method, created_at_desc).
           limit(1).
+          to_a.
           first
       end
     end

data/lib/doorkeeper/models/application_mixin.rb

@@ -22,11 +22,11 @@ module Doorkeeper
 
     module ClassMethods
       def by_uid_and_secret(uid, secret)
-        where(uid: uid, secret: secret).first
+        where(uid: uid, secret: secret).limit(1).to_a.first
       end
 
       def by_uid(uid)
-        where(uid: uid).first
+        where(uid: uid).limit(1).to_a.first
       end
     end
 

data/lib/doorkeeper/orm/active_record/access_token.rb

@@ -13,6 +13,7 @@ module Doorkeeper
     def self.order_method
       :order
     end
+
     def self.created_at_desc
       'created_at desc'
     end

data/lib/doorkeeper/orm/mongo_mapper/access_token.rb

@@ -27,19 +27,17 @@ module Doorkeeper
     end
     private_class_method :delete_all_for
 
-    def self.last_authorized_token_for(application_id, resource_owner_id)
-      where(application_id: application_id,
-            resource_owner_id: resource_owner_id,
-            revoked_at: nil).
-        sort(:created_at.desc).
-        limit(1).
-        first
-    end
-    private_class_method :last_authorized_token_for
-
     def self.create_indexes
       ensure_index :token, unique: true
       ensure_index [[:refresh_token, 1]], unique: true, sparse: true
     end
+
+    def self.order_method
+      :sort
+    end
+
+    def self.created_at_desc
+      :created_at.desc
+    end
   end
 end

data/lib/doorkeeper/orm/mongoid2/access_token.rb

@@ -29,6 +29,7 @@ module Doorkeeper
     def self.order_method
       :order_by
     end
+
     def self.created_at_desc
       [:created_at, :desc]
     end

data/lib/doorkeeper/orm/mongoid3/access_token.rb

@@ -29,6 +29,7 @@ module Doorkeeper
     def self.order_method
       :order_by
     end
+
     def self.created_at_desc
       [:created_at, :desc]
     end

data/lib/doorkeeper/orm/mongoid4/access_token.rb

@@ -29,6 +29,7 @@ module Doorkeeper
     def self.order_method
       :order_by
     end
+
     def self.created_at_desc
       [:created_at, :desc]
     end

data/lib/doorkeeper/version.rb

@@ -1,3 +1,3 @@
 module Doorkeeper
-  VERSION = '2.0.0.rc2'
+  VERSION = '2.0.0.rc3'
 end

data/spec/requests/endpoints/authorization_spec.rb

@@ -51,4 +51,27 @@ feature 'Authorization endpoint' do
       i_should_see_translated_error_message :unsupported_response_type
     end
   end
+
+  context 'forgery protection enabled' do
+    before do
+      ActionController::Base.allow_forgery_protection = true
+    end
+
+    after do
+      ActionController::Base.allow_forgery_protection = false
+    end
+
+    background do
+      create_resource_owner
+      sign_in
+    end
+
+    scenario 'raises exception on forged requests' do
+      ActionController::Base.any_instance.should_receive(:handle_unverified_request)
+      post "/oauth/authorize",
+        client_id:      @client.uid,
+        redirect_uri:   @client.redirect_uri,
+        response_type:  'code'
+    end
+  end
 end

data/spec/requests/flows/refresh_token_spec.rb

@@ -74,15 +74,24 @@ feature 'Refresh Token Flow' do
       # enable password auth to simulate other devices
       config_is_set(:resource_owner_from_credentials) { User.authenticate! params[:username], params[:password] }
       create_resource_owner
+      _another_token = post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+      last_token.update_attribute :created_at, 5.seconds.ago
+
       @token = FactoryGirl.create(:access_token, application: @client, resource_owner_id: @resource_owner.id, use_refresh_token: true)
+      @token.update_attribute :expires_in, -100
     end
 
     scenario 'client request a token after creating another token with the same user' do
-      @token.update_attribute :expires_in, -100
-      post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
       post refresh_token_endpoint_url(client: @client, refresh_token: @token.refresh_token)
-      should_have_json 'refresh_token', Doorkeeper::AccessToken.last.refresh_token
+
+      should_have_json 'refresh_token', last_token.refresh_token
       expect(@token.reload).to be_revoked
     end
+
+    def last_token
+      Doorkeeper::AccessToken.last_authorized_token_for(
+        @client.id, @resource_owner.id
+      )
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 2.0.0.rc2
+  version: 2.0.0.rc3
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-12-09 00:00:00.000000000 Z
+date: 2014-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties