doorkeeper 3.1.0 → 4.2.6

data/lib/generators/doorkeeper/templates/migration.rb

@@ -6,14 +6,14 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
       t.string  :secret,       null: false
       t.text    :redirect_uri, null: false
       t.string  :scopes,       null: false, default: ''
-      t.timestamps
+      t.timestamps             null: false
     end
 
     add_index :oauth_applications, :uid, unique: true
 
     create_table :oauth_access_grants do |t|
       t.integer  :resource_owner_id, null: false
-      t.integer  :application_id,    null: false
+      t.references :application,     null: false
       t.string   :token,             null: false
       t.integer  :expires_in,        null: false
       t.text     :redirect_uri,      null: false
@@ -23,10 +23,15 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
     end
 
     add_index :oauth_access_grants, :token, unique: true
+    add_foreign_key(
+      :oauth_access_grants,
+      :oauth_applications,
+      column: :application_id
+    )
 
     create_table :oauth_access_tokens do |t|
       t.integer  :resource_owner_id
-      t.integer  :application_id
+      t.references :application
 
       # If you use a custom token generator you may need to change this column
       # from string to text, so that it accepts tokens larger than 255
@@ -34,17 +39,30 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
       # https://github.com/doorkeeper-gem/doorkeeper/tree/v3.0.0.rc1#custom-access-token-generator
       #
       # t.text     :token,             null: false
-      t.string   :token,             null: false
+      t.string   :token,                  null: false
 
       t.string   :refresh_token
       t.integer  :expires_in
       t.datetime :revoked_at
-      t.datetime :created_at,        null: false
+      t.datetime :created_at,             null: false
       t.string   :scopes
+
+      # If there is a previous_refresh_token column,
+      # refresh tokens will be revoked after a related access token is used.
+      # If there is no previous_refresh_token column,
+      # previous tokens are revoked as soon as a new access token is created.
+      # Comment out this line if you'd rather have refresh tokens
+      # instantly revoked.
+      t.string   :previous_refresh_token, null: false, default: ""
     end
 
     add_index :oauth_access_tokens, :token, unique: true
     add_index :oauth_access_tokens, :resource_owner_id
     add_index :oauth_access_tokens, :refresh_token, unique: true
+    add_foreign_key(
+      :oauth_access_tokens,
+      :oauth_applications,
+      column: :application_id
+    )
   end
 end

data/spec/controllers/application_metal_controller.rb

@@ -0,0 +1,10 @@
+require "spec_helper_integration"
+
+describe Doorkeeper::ApplicationMetalController do
+  it "lazy run hooks" do
+    i = 0
+    ActiveSupport.on_load(:doorkeeper_metal_controller) { i += 1 }
+
+    expect(i).to eq 1
+  end
+end

data/spec/controllers/authorizations_controller_spec.rb

@@ -3,17 +3,33 @@ require 'spec_helper_integration'
 describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   include AuthorizationRequestHelper
 
-  def fragments(param)
-    fragment = URI.parse(response.location).fragment
-    Rack::Utils.parse_query(fragment)[param]
+  if Rails::VERSION::MAJOR == 5
+    class ActionDispatch::TestResponse
+      def query_params
+        @_query_params ||= begin
+          fragment = URI.parse(location).fragment
+          Rack::Utils.parse_query(fragment)
+        end
+      end
+    end
+  else
+    class ActionController::TestResponse
+      def query_params
+        @_query_params ||= begin
+          fragment = URI.parse(location).fragment
+          Rack::Utils.parse_query(fragment)
+        end
+      end
+    end
   end
 
   def translated_error_message(key)
     I18n.translate key, scope: [:doorkeeper, :errors, :messages]
   end
 
-  let(:client) { FactoryGirl.create :application }
-  let(:user)   { User.create!(name: 'Joe', password: 'sekret') }
+  let(:client)        { FactoryGirl.create :application }
+  let(:user)          { User.create!(name: 'Joe', password: 'sekret') }
+  let(:access_token)  { FactoryGirl.build :access_token, resource_owner_id: user.id, application_id: client.id }
 
   before do
     allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["implicit"])
@@ -34,15 +50,15 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'includes access token in fragment' do
-      expect(fragments('access_token')).to eq(Doorkeeper::AccessToken.first.token)
+      expect(response.query_params['access_token']).to eq(Doorkeeper::AccessToken.first.token)
     end
 
     it 'includes token type in fragment' do
-      expect(fragments('token_type')).to eq('bearer')
+      expect(response.query_params['token_type']).to eq('bearer')
     end
 
     it 'includes token expiration in fragment' do
-      expect(fragments('expires_in').to_i).to eq(2.hours.to_i)
+      expect(response.query_params['expires_in'].to_i).to eq(2.hours.to_i)
     end
 
     it 'issues the token for the current client' do
@@ -69,15 +85,15 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'does not include access token in fragment' do
-      expect(fragments('access_token')).to be_nil
+      expect(response.query_params['access_token']).to be_nil
     end
 
     it 'includes error in fragment' do
-      expect(fragments('error')).to eq('invalid_scope')
+      expect(response.query_params['error']).to eq('invalid_scope')
     end
 
     it 'includes error description in fragment' do
-      expect(fragments('error_description')).to eq(translated_error_message(:invalid_scope))
+      expect(response.query_params['error_description']).to eq(translated_error_message(:invalid_scope))
     end
 
     it 'does not issue any access token' do
@@ -86,16 +102,19 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   end
 
   describe 'POST #create with application already authorized' do
-    it 'returns the existing access token in a fragment'
-  end
-
-  describe 'GET #new' do
     before do
-      get :new, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
+      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+
+      access_token.save!
+      post :create, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
+    end
+
+    it 'returns the existing access token in a fragment' do
+      expect(response.query_params['access_token']).to eq(access_token.token)
     end
 
-    it 'renders new template' do
-      expect(response).to render_template(:new)
+    it 'does not creates a new access token' do
+      expect(Doorkeeper::AccessToken.count).to eq(1)
     end
   end
 
@@ -165,11 +184,11 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
     end
 
     it 'includes token type in fragment' do
-      expect(fragments('token_type')).to eq('bearer')
+      expect(response.query_params['token_type']).to eq('bearer')
     end
 
     it 'includes token expiration in fragment' do
-      expect(fragments('expires_in').to_i).to eq(2.hours.to_i)
+      expect(response.query_params['expires_in'].to_i).to eq(2.hours.to_i)
     end
 
     it 'issues the token for the current client' do
@@ -191,10 +210,6 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
       expect(response).to_not be_redirect
     end
 
-    it 'renders error template' do
-      expect(response).to render_template(:error)
-    end
-
     it 'does not issue any token' do
       expect(Doorkeeper::AccessGrant.count).to eq 0
       expect(Doorkeeper::AccessToken.count).to eq 0

data/spec/controllers/protected_resources_controller_spec.rb

@@ -2,27 +2,35 @@ require 'spec_helper_integration'
 
 module ControllerActions
   def index
-    render text: 'index'
+    render plain: 'index'
   end
 
   def show
-    render text: 'show'
+    render plain: 'show'
+  end
+
+  def doorkeeper_unauthorized_render_options(*)
+  end
+
+  def doorkeeper_forbidden_render_options(*)
   end
 end
 
 describe 'doorkeeper authorize filter' do
   context 'accepts token code specified as' do
     controller do
-      before_filter :doorkeeper_authorize!
+      before_action :doorkeeper_authorize!
 
       def index
-        render text: 'index'
+        render plain: 'index'
       end
     end
 
     let(:token_string) { '1A2BC3' }
     let(:token) do
-      double(Doorkeeper::AccessToken, acceptable?: true)
+      double(Doorkeeper::AccessToken,
+             acceptable?: true, previous_refresh_token: "",
+             revoke_previous_refresh_token!: true)
     end
 
     it 'access_token param' do
@@ -58,7 +66,7 @@ describe 'doorkeeper authorize filter' do
 
   context 'defined for all actions' do
     controller do
-      before_filter :doorkeeper_authorize!
+      before_action :doorkeeper_authorize!
 
       include ControllerActions
     end
@@ -92,7 +100,7 @@ describe 'doorkeeper authorize filter' do
 
   context 'defined with scopes' do
     controller do
-      before_filter -> { doorkeeper_authorize! :write }
+      before_action -> { doorkeeper_authorize! :write }
 
       include ControllerActions
     end
@@ -100,16 +108,26 @@ describe 'doorkeeper authorize filter' do
     let(:token_string) { '1A2DUWE' }
 
     it 'allows if the token has particular scopes' do
-      token = double(Doorkeeper::AccessToken, accessible?: true, scopes: %w(write public))
+      token = double(Doorkeeper::AccessToken,
+                     accessible?: true, scopes: %w(write public),
+                     previous_refresh_token: "",
+                     revoke_previous_refresh_token!: true)
       expect(token).to receive(:acceptable?).with([:write]).and_return(true)
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
+      expect(
+        Doorkeeper::AccessToken
+      ).to receive(:by_token).with(token_string).and_return(token)
       get :index, access_token: token_string
       expect(response).to be_success
     end
 
     it 'does not allow if the token does not include given scope' do
-      token = double(Doorkeeper::AccessToken, accessible?: true, scopes: ['public'], revoked?: false, expired?: false)
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
+      token = double(Doorkeeper::AccessToken,
+                     accessible?: true, scopes: ['public'], revoked?: false,
+                     expired?: false, previous_refresh_token: "",
+                     revoke_previous_refresh_token!: true)
+      expect(
+        Doorkeeper::AccessToken
+      ).to receive(:by_token).with(token_string).and_return(token)
       expect(token).to receive(:acceptable?).with([:write]).and_return(false)
       get :index, access_token: token_string
       expect(response.status).to eq 403
@@ -119,7 +137,7 @@ describe 'doorkeeper authorize filter' do
 
   context 'when custom unauthorized render options are configured' do
     controller do
-      before_filter :doorkeeper_authorize!
+      before_action :doorkeeper_authorize!
 
       include ControllerActions
     end
@@ -127,6 +145,7 @@ describe 'doorkeeper authorize filter' do
     context 'with a JSON custom render', token: :invalid do
       before do
         module ControllerActions
+          remove_method :doorkeeper_unauthorized_render_options
           def doorkeeper_unauthorized_render_options(error: nil)
             { json: ActiveSupport::JSON.encode(error_message: error.description) }
           end
@@ -134,6 +153,7 @@ describe 'doorkeeper authorize filter' do
       end
       after do
         module ControllerActions
+          remove_method :doorkeeper_unauthorized_render_options
           def doorkeeper_unauthorized_render_options(error: nil)
           end
         end
@@ -153,13 +173,15 @@ describe 'doorkeeper authorize filter' do
     context 'with a text custom render', token: :invalid do
       before do
         module ControllerActions
+          remove_method :doorkeeper_unauthorized_render_options
           def doorkeeper_unauthorized_render_options(error: nil)
-            { text: 'Unauthorized' }
+            { plain: 'Unauthorized' }
           end
         end
       end
       after do
         module ControllerActions
+          remove_method :doorkeeper_unauthorized_render_options
           def doorkeeper_unauthorized_render_options(error: nil)
           end
         end
@@ -168,7 +190,7 @@ describe 'doorkeeper authorize filter' do
       it 'it renders a custom text response', token: :invalid do
         get :index, access_token: token_string
         expect(response.status).to eq 401
-        expect(response.content_type).to eq('text/html')
+        expect(response.content_type).to eq('text/plain')
         expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
         expect(response.body).to eq('Unauthorized')
       end
@@ -183,26 +205,30 @@ describe 'doorkeeper authorize filter' do
 
     after do
       module ControllerActions
+        remove_method :doorkeeper_forbidden_render_options
         def doorkeeper_forbidden_render_options(*)
         end
       end
     end
 
     controller do
-      before_filter -> { doorkeeper_authorize! :write }
+      before_action -> { doorkeeper_authorize! :write }
 
       include ControllerActions
     end
 
     let(:token) do
       double(Doorkeeper::AccessToken,
-             accessible?: true, scopes: ['public'], revoked?: false, expired?: false)
+             accessible?: true, scopes: ['public'], revoked?: false,
+             expired?: false, previous_refresh_token: "",
+             revoke_previous_refresh_token!: true)
     end
     let(:token_string) { '1A2DUWE' }
 
     context 'with a JSON custom render' do
       before do
         module ControllerActions
+          remove_method :doorkeeper_forbidden_render_options
           def doorkeeper_forbidden_render_options(*)
             { json: { error_message: 'Forbidden' } }
           end
@@ -223,6 +249,7 @@ describe 'doorkeeper authorize filter' do
     context 'with a status and JSON custom render' do
       before do
         module ControllerActions
+          remove_method :doorkeeper_forbidden_render_options
           def doorkeeper_forbidden_render_options(*)
             { json: { error_message: 'Not Found' },
               respond_not_found_when_forbidden: true }
@@ -239,8 +266,9 @@ describe 'doorkeeper authorize filter' do
     context 'with a text custom render' do
       before do
         module ControllerActions
+          remove_method :doorkeeper_forbidden_render_options
           def doorkeeper_forbidden_render_options(*)
-            { text: 'Forbidden' }
+            { plain: 'Forbidden' }
           end
         end
       end
@@ -256,8 +284,9 @@ describe 'doorkeeper authorize filter' do
     context 'with a status and text custom render' do
       before do
         module ControllerActions
+          remove_method :doorkeeper_forbidden_render_options
           def doorkeeper_forbidden_render_options(*)
-            { respond_not_found_when_forbidden: true, text: 'Not Found' }
+            { respond_not_found_when_forbidden: true, plain: 'Not Found' }
           end
         end
       end

data/spec/controllers/tokens_controller_spec.rb

@@ -64,7 +64,7 @@ describe Doorkeeper::TokensController do
   describe 'when revoke authorization has failed' do
     # http://tools.ietf.org/html/rfc7009#section-2.2
     it 'returns no error response' do
-      token = double(:token, authorize: false)
+      token = double(:token, authorize: false, application_id?: true)
       allow(controller).to receive(:token) { token }
 
       post :revoke

data/spec/dummy/app/controllers/full_protected_resources_controller.rb

@@ -1,12 +1,12 @@
 class FullProtectedResourcesController < ApplicationController
-  before_filter -> { doorkeeper_authorize! :write, :admin }, only: :show
-  before_filter :doorkeeper_authorize!, only: :index
+  before_action -> { doorkeeper_authorize! :write, :admin }, only: :show
+  before_action :doorkeeper_authorize!, only: :index
 
   def index
-    render text: 'index'
+    render plain: 'index'
   end
 
   def show
-    render text: 'show'
+    render plain: 'show'
   end
 end

data/spec/dummy/app/controllers/home_controller.rb

@@ -12,6 +12,6 @@ class HomeController < ApplicationController
   end
 
   def callback
-    render text: 'ok'
+    render plain: 'ok'
   end
 end

data/spec/dummy/app/controllers/metal_controller.rb

@@ -3,7 +3,7 @@ class MetalController < ActionController::Metal
   include ActionController::Head
   include Doorkeeper::Rails::Helpers
 
-  before_filter :doorkeeper_authorize!
+  before_action :doorkeeper_authorize!
 
   def index
     self.response_body = { ok: true }.to_json

data/spec/dummy/app/controllers/semi_protected_resources_controller.rb

@@ -1,11 +1,11 @@
 class SemiProtectedResourcesController < ApplicationController
-  before_filter :doorkeeper_authorize!, only: :index
+  before_action :doorkeeper_authorize!, only: :index
 
   def index
-    render text: 'protected index'
+    render plain: 'protected index'
   end
 
   def show
-    render text: 'non protected show'
+    render plain: 'non protected show'
   end
 end

data/spec/dummy/app/models/user.rb

@@ -1,8 +1,4 @@
 class User < ActiveRecord::Base
-  if respond_to?(:attr_accessible)
-    attr_accessible :name, :password
-  end
-
   def self.authenticate!(name, password)
     User.where(name: name, password: password).first
   end

data/spec/dummy/config/application.rb

@@ -1,9 +1,8 @@
 require File.expand_path('../boot', __FILE__)
 
-require 'action_controller/railtie'
-require 'sprockets/railtie'
+require 'rails/all'
 
-Bundler.require :default
+Bundler.require(*Rails.groups)
 
 require 'yaml'
 
@@ -20,38 +19,5 @@ module Dummy
     # Settings in config/environments/* take precedence over those specified here.
     # Application configuration should go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded.
-
-    # Only load the plugins named here, in the order given (default is alphabetical).
-    # :all can be used as a placeholder for all plugins not explicitly named.
-    # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
-
-    # Activate observers that should always be running.
-    # config.active_record.observers = :cacher, :garbage_collector, :forum_observer
-
-    if defined?(ActiveRecord) && Rails.version.to_i < 4
-      config.active_record.whitelist_attributes = true
-    end
-
-    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
-    # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
-    # config.time_zone = 'Central Time (US & Canada)'
-
-    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
-    config.i18n.load_path += Dir[Rails.root.join('../../', 'config/locales', '*.{rb,yml}').to_s]
-    # config.i18n.default_locale = :en
-
-    # Configure the default encoding used in templates for Ruby 1.9.
-    config.encoding = 'utf-8'
-
-    # Configure sensitive parameters which will be filtered from the log file.
-    config.filter_parameters += [:password]
-
-    # Enable the asset pipeline
-    config.assets.enabled = true
-
-    # Version of your assets, change this if you want to expire all your assets
-    config.assets.version = '1.0'
-
-    I18n.enforce_available_locales = false
   end
 end

data/spec/dummy/config/environment.rb

@@ -2,4 +2,4 @@
 require File.expand_path('../application', __FILE__)
 
 # Initialize the rails application
-Dummy::Application.initialize!
+Rails.application.initialize!

data/spec/dummy/config/environments/test.rb

@@ -7,21 +7,10 @@ Dummy::Application.configure do
   # and recreated between test runs.  Don't rely on the data there!
   config.cache_classes = true
 
-  # Configure static asset server for tests with Cache-Control for performance
-  config.static_cache_control = 'public, max-age=3600'
-
-  if Rails.version.to_i < 4
-    # Log error messages when you accidentally call methods on nil
-    config.whiny_nils = true
-  end
-
-  if Rails.version.to_i >= 4
-    # Do not eager load code on boot. This avoids loading your whole application
-    # just for the purpose of running a single test. If you are using a tool that
-    # preloads Rails for running tests, you may have to set it to true.
-    config.eager_load = false
-    config.i18n.enforce_available_locales = true
-  end
+  # Do not eager load code on boot. This avoids loading your whole application
+  # just for the purpose of running a single test. If you are using a tool that
+  # preloads Rails for running tests, you may have to set it to true.
+  config.eager_load = false
 
   # Show full error reports and disable caching
   config.consider_all_requests_local       = true

data/spec/dummy/config/initializers/active_record_belongs_to_required_by_default.rb

@@ -0,0 +1,6 @@
+# Require `belongs_to` associations by default. This is a new Rails 5.0
+# default, so it is introduced as a configuration option to ensure that apps
+# made on earlier versions of Rails are not affected when upgrading.
+if Rails.version.to_i >= 5
+  Rails.application.config.active_record.belongs_to_required_by_default = true
+end

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -30,10 +30,10 @@ Doorkeeper.configure do
   use_refresh_token
 
   # Provide support for an owner to be assigned to each registered application (disabled by default)
-  # Optional parameter :confirmation => true (default false) if you want to enforce ownership of
+  # Optional parameter confirmation: true (default false) if you want to enforce ownership of
   # a registered application
   # Note: you must also run the rails g doorkeeper:application_owner generator to provide the necessary support
-  # enable_application_owner :confirmation => false
+  # enable_application_owner confirmation: false
 
   # Define access token scopes for your provider
   # For more information go to

data/spec/dummy/db/migrate/{20130902165751_create_doorkeeper_tables.rb → 20151223192035_create_doorkeeper_tables.rb}

@@ -4,29 +4,43 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
       t.string  :name,         null: false
       t.string  :uid,          null: false
       t.string  :secret,       null: false
-      t.string  :redirect_uri, null: false, limit: 2048
-      t.timestamps
+      t.text    :redirect_uri, null: false
+      t.string  :scopes,       null: false, default: ''
+      t.timestamps             null: false
     end
 
     add_index :oauth_applications, :uid, unique: true
 
     create_table :oauth_access_grants do |t|
       t.integer  :resource_owner_id, null: false
-      t.integer  :application_id,    null: false
+      t.references :application,     null: false
       t.string   :token,             null: false
       t.integer  :expires_in,        null: false
-      t.string   :redirect_uri,      null: false, limit: 2048
+      t.text     :redirect_uri,      null: false
       t.datetime :created_at,        null: false
       t.datetime :revoked_at
       t.string   :scopes
     end
 
     add_index :oauth_access_grants, :token, unique: true
+    add_foreign_key(
+      :oauth_access_grants,
+      :oauth_applications,
+      column: :application_id,
+    )
 
     create_table :oauth_access_tokens do |t|
       t.integer  :resource_owner_id
-      t.integer  :application_id
+      t.references :application
+
+      # If you use a custom token generator you may need to change this column
+      # from string to text, so that it accepts tokens larger than 255
+      # characters. More info on custom token generators in:
+      # https://github.com/doorkeeper-gem/doorkeeper/tree/v3.0.0.rc1#custom-access-token-generator
+      #
+      # t.text     :token,             null: false
       t.string   :token,             null: false
+
       t.string   :refresh_token
       t.integer  :expires_in
       t.datetime :revoked_at
@@ -37,5 +51,10 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
     add_index :oauth_access_tokens, :token, unique: true
     add_index :oauth_access_tokens, :resource_owner_id
     add_index :oauth_access_tokens, :refresh_token, unique: true
+    add_foreign_key(
+      :oauth_access_tokens,
+      :oauth_applications,
+      column: :application_id,
+    )
   end
 end

data/spec/dummy/db/migrate/20160320211015_add_previous_refresh_token_to_access_tokens.rb

@@ -0,0 +1,11 @@
+class AddPreviousRefreshTokenToAccessTokens < ActiveRecord::Migration
+  def change
+    add_column(
+      :oauth_access_tokens,
+      :previous_refresh_token,
+      :string,
+      default: "",
+      null: false
+    )
+  end
+end