doorkeeper 2.1.2 → 2.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d01017121a759c48e73796768589be94d4b30483
-  data.tar.gz: 34ff11b0a073fa7fac25a650e412c1d273e3d035
+  metadata.gz: 1d2ce14647afc9a16514c9f3b340eb31b8b24f88
+  data.tar.gz: fa3a726152a14c5496abb9433a1ea92f0d588b9f
 SHA512:
-  metadata.gz: 66f566988c4106206e84b287aece9b3595bfbca30b51b65a18ae5e534051b1896b967c6830d8765ac7c7c49e94745474c0777c41618bf73b0559762fb1e31e47
-  data.tar.gz: 0b44401eebd4070efbbda7227174f8b9fd7b943444683c8bfe1bf83d67efa5ae0935986e9be440e046230a41ea2ab21230c496cb32368a51509cfab8f5068fde
+  metadata.gz: f9877675927e23991fd103d4e08480270e1dc5d365f3ba7fd4bf1fd1cce5a27c916a56572c0e5f9083c76be0850f128fa2baf5628679910e3f5efd68a46e4bcd
+  data.tar.gz: 684c840627ac5e3b7a6eeddac43c3ef758222f5b2296021c3686cbb51bdc50a701269cd80bec2164c24fd5be4bb668f5b3ed63ec9bb492fcab1e2406ff229424

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 2.1.3
+
+- [#588] Fixes scopes_match? bug that skipped authorization form in some cases
+
+
 ## 2.1.2
 
 - [#574] Remove unused update authorization route.

data/RELEASING.md

@@ -0,0 +1,15 @@
+# Releasing doorkeeper
+
+1. Update `lib/doorkeeper/version.rb` file accordingly.
+2. Update `CHANGELOG.md` to reflect the changes since last release.
+3. Commit changes. There shouldn’t be code changes, and thus CI doesn’t need to
+   run, you can then add “[ci skip]” to the commit message.
+4. Tag the release: `git tag vVERSION`
+5. Push changes: `git push --tags`
+6. Build and publish the gem:
+   ```bash
+   gem build doorkeeper.gemspec
+   gem push doorkeeper-*.gem
+   ```
+7. Announce the new release, making sure to say “thank you” to the contributors
+   who helped shape this version!

data/doorkeeper.gemspec

@@ -16,7 +16,7 @@ Gem::Specification.new do |s|
   s.test_files    = `git ls-files -- test/*`.split("\n")
   s.require_paths = ["lib"]
 
-  s.add_dependency "railties", ">= 3.1"
+  s.add_dependency "railties", ">= 3.2"
 
   s.add_development_dependency "sqlite3", "~> 1.3.5"
   s.add_development_dependency "rspec-rails", "~> 2.99.0"

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -59,7 +59,7 @@ module Doorkeeper
 
       def scopes_match?(token_scopes, param_scopes, app_scopes)
         (!token_scopes.present? && !param_scopes.present?) ||
-          Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
+          Doorkeeper::OAuth::Helpers::ScopeChecker.match?(
             token_scopes.to_s,
             param_scopes,
             app_scopes

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -2,16 +2,42 @@ module Doorkeeper
   module OAuth
     module Helpers
       module ScopeChecker
+        class Validator
+          attr_reader :parsed_scopes, :scope_str
+
+          def initialize(scope_str, server_scopes, application_scopes)
+            @parsed_scopes = OAuth::Scopes.from_string(scope_str)
+            @scope_str = scope_str
+            @valid_scopes = valid_scopes(server_scopes, application_scopes)
+          end
+
+          def valid?
+            scope_str.present? &&
+              scope_str !~ /[\n|\r|\t]/ &&
+              @valid_scopes.has_scopes?(parsed_scopes)
+          end
+
+          def match?
+            valid? && parsed_scopes.has_scopes?(@valid_scopes)
+          end
+
+          private
+
+          def valid_scopes(server_scopes, application_scopes)
+            if application_scopes.present?
+              server_scopes & application_scopes
+            else
+              server_scopes
+            end
+          end
+        end
+
         def self.valid?(scope_str, server_scopes, application_scopes = nil)
-          valid_scopes = if application_scopes.present?
-                           server_scopes & application_scopes
-                         else
-                           server_scopes
-                         end
+          Validator.new(scope_str, server_scopes, application_scopes).valid?
+        end
 
-          scope_str.present? &&
-            scope_str !~ /[\n|\r|\t]/ &&
-            valid_scopes.has_scopes?(OAuth::Scopes.from_string(scope_str))
+        def self.match?(scope_str, server_scopes, application_scopes = nil)
+          Validator.new(scope_str, server_scopes, application_scopes).match?
         end
       end
     end

data/lib/doorkeeper/rails/helpers.rb

@@ -6,7 +6,7 @@ module Doorkeeper
       def doorkeeper_authorize!(*scopes)
         @_doorkeeper_scopes = scopes || Doorkeeper.configuration.default_scopes
 
-        if doorkeeper_token_is_invalid?
+        if !valid_doorkeeper_token?
           doorkeeper_render_error
         end
       end
@@ -19,12 +19,12 @@ module Doorkeeper
         nil
       end
 
-      private
-
-      def doorkeeper_token_is_invalid?
-        !doorkeeper_token || !doorkeeper_token.acceptable?(@_doorkeeper_scopes)
+      def valid_doorkeeper_token?
+        doorkeeper_token && doorkeeper_token.acceptable?(@_doorkeeper_scopes)
       end
 
+      private
+
       def doorkeeper_render_error
         error = doorkeeper_error
         headers.merge! error.headers.reject { |k| "Content-Type" == k }

data/lib/doorkeeper/version.rb

@@ -1,3 +1,3 @@
 module Doorkeeper
-  VERSION = '2.1.2'
+  VERSION = '2.1.3'
 end

data/spec/models/doorkeeper/access_token_spec.rb

@@ -202,12 +202,24 @@ module Doorkeeper
         expect(last_token).to be_nil
       end
 
-      it 'matches the scopes' do
+      it 'matches token with fewer scopes' do
+        FactoryGirl.create :access_token, default_attributes.merge(scopes: 'public')
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        expect(last_token).to be_nil
+      end
+
+      it 'matches token with different scopes' do
         FactoryGirl.create :access_token, default_attributes.merge(scopes: 'public email')
         last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
         expect(last_token).to be_nil
       end
 
+      it 'matches token with more scopes' do
+        FactoryGirl.create :access_token, default_attributes.merge(scopes: 'public write email')
+        last_token = AccessToken.matching_token_for(application, resource_owner_id, scopes)
+        expect(last_token).to be_nil
+      end
+
       it 'matches application scopes' do
         application = FactoryGirl.create :application, scopes: "private read"
         FactoryGirl.create :access_token, default_attributes.merge(

data/spec/requests/flows/authorization_code_spec.rb

@@ -104,5 +104,19 @@ feature 'Authorization Code Flow' do
 
       should_have_json 'access_token', Doorkeeper::AccessToken.last.token
     end
+
+    scenario 'resource owner authorizes the client with extra scopes' do
+      client_is_authorized(@client, @resource_owner, scopes: 'public')
+      visit authorization_endpoint_url(client: @client, scope: 'public write')
+      click_on 'Authorize'
+
+      authorization_code = Doorkeeper::AccessGrant.first.token
+      post token_endpoint_url(code: authorization_code, client: @client)
+
+      expect(Doorkeeper::AccessToken.count).to be(2)
+
+      should_have_json 'access_token', Doorkeeper::AccessToken.last.token
+      access_token_should_have_scopes :public, :write
+    end
   end
 end

data/spec/requests/flows/skip_authorization_spec.rb

@@ -24,17 +24,36 @@ feature 'Skip authorization form' do
       url_should_have_param 'code', Doorkeeper::AccessGrant.first.token
     end
 
-    scenario 'does not skip authorization when scopes differ' do
+    scenario 'does not skip authorization when scopes differ (new request has fewer scopes)' do
       client_is_authorized(@client, @resource_owner, scopes: 'public write')
       visit authorization_endpoint_url(client: @client, scope: 'public')
       i_should_see 'Authorize'
     end
 
+    scenario 'does not skip authorization when scopes differ (new request has more scopes)' do
+      client_is_authorized(@client, @resource_owner, scopes: 'public write')
+      visit authorization_endpoint_url(client: @client, scopes: 'public write email')
+      i_should_see 'Authorize'
+    end
+
     scenario 'creates grant with new scope when scopes differ' do
       client_is_authorized(@client, @resource_owner, scopes: 'public write')
       visit authorization_endpoint_url(client: @client, scope: 'public')
       click_on 'Authorize'
       access_grant_should_have_scopes :public
     end
+
+    scenario 'doesn not skip authorization when scopes are greater' do
+      client_is_authorized(@client, @resource_owner, scopes: 'public')
+      visit authorization_endpoint_url(client: @client, scope: 'public write')
+      i_should_see 'Authorize'
+    end
+
+    scenario 'creates grant with new scope when scopes are greater' do
+      client_is_authorized(@client, @resource_owner, scopes: 'public')
+      visit authorization_endpoint_url(client: @client, scope: 'public write')
+      click_on 'Authorize'
+      access_grant_should_have_scopes :public, :write
+    end
   end
 end

data/spec/support/helpers/model_helper.rb

@@ -37,7 +37,7 @@ module ModelHelper
   end
 
   def access_token_should_have_scopes(*args)
-    grant = Doorkeeper::AccessToken.first
+    grant = Doorkeeper::AccessToken.last
     expect(grant.scopes).to eq(Doorkeeper::OAuth::Scopes.from_array(args))
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 2.1.2
+  version: 2.1.3
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-02-26 00:00:00.000000000 Z
+date: 2015-03-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -17,14 +17,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.2'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '3.1'
+        version: '3.2'
 - !ruby/object:Gem::Dependency
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
@@ -181,6 +181,7 @@ files:
 - Gemfile
 - MIT-LICENSE
 - README.md
+- RELEASING.md
 - Rakefile
 - app/assets/stylesheets/doorkeeper/admin/application.css
 - app/assets/stylesheets/doorkeeper/application.css