doorkeeper 3.1.0 → 4.4.3

data/lib/doorkeeper/models/concerns/revocable.rb

@@ -1,12 +1,47 @@
 module Doorkeeper
   module Models
     module Revocable
+      # Revokes the object (updates `:revoked_at` attribute setting its value
+      # to the specific time).
+      #
+      # @param clock [Time] time object
+      #
       def revoke(clock = Time)
-        update_attribute :revoked_at, clock.now
+        update_attribute :revoked_at, clock.now.utc
       end
 
+      # Indicates whether the object has been revoked.
+      #
+      # @return [Boolean] true if revoked, false in other case
+      #
       def revoked?
-        !!(revoked_at && revoked_at <= Time.now)
+        !!(revoked_at && revoked_at <= Time.now.utc)
+      end
+
+      # Revokes token with `:refresh_token` equal to `:previous_refresh_token`
+      # and clears `:previous_refresh_token` attribute.
+      #
+      def revoke_previous_refresh_token!
+        return unless refresh_token_revoked_on_use?
+        old_refresh_token.revoke if old_refresh_token
+        update_attribute :previous_refresh_token, ""
+      end
+
+      private
+
+      # Searches for Access Token record with `:refresh_token` equal to
+      # `:previous_refresh_token` value.
+      #
+      # @return [Doorkeeper::AccessToken, nil]
+      #   Access Token record or nil if nothing found
+      #
+      def old_refresh_token
+        @old_refresh_token ||=
+          AccessToken.by_refresh_token(previous_refresh_token)
+      end
+
+      def refresh_token_revoked_on_use?
+        AccessToken.refresh_token_revoked_on_use?
       end
     end
   end

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -4,19 +4,33 @@ module Doorkeeper
       class Token
         attr_accessor :pre_auth, :resource_owner, :token
 
+        class << self
+          def access_token_expires_in(server, pre_auth_or_oauth_client)
+            if (expiration = custom_expiration(server, pre_auth_or_oauth_client))
+              expiration
+            else
+              server.access_token_expires_in
+            end
+          end
+
+          private
+
+          def custom_expiration(server, pre_auth_or_oauth_client)
+            oauth_client = if pre_auth_or_oauth_client.respond_to?(:client)
+                             pre_auth_or_oauth_client.client
+                           else
+                             pre_auth_or_oauth_client
+                           end
+
+            server.custom_access_token_expires_in.call(oauth_client)
+          end
+        end
+
         def initialize(pre_auth, resource_owner)
           @pre_auth       = pre_auth
           @resource_owner = resource_owner
         end
 
-        def self.access_token_expires_in(server, pre_auth_or_oauth_client)
-          if expiration = custom_expiration(server, pre_auth_or_oauth_client)
-            expiration
-          else
-            server.access_token_expires_in
-          end
-        end
-
         def issue_token
           @token ||= AccessToken.find_or_create_for(
             pre_auth.client,
@@ -37,16 +51,6 @@ module Doorkeeper
 
         private
 
-        def self.custom_expiration(server, pre_auth_or_oauth_client)
-          oauth_client = if pre_auth_or_oauth_client.respond_to?(:client)
-                           pre_auth_or_oauth_client.client
-                         else
-                           pre_auth_or_oauth_client
-                         end
-
-          server.custom_access_token_expires_in.call(oauth_client)
-        end
-
         def configuration
           Doorkeeper.configuration
         end

data/lib/doorkeeper/oauth/authorization/uri_builder.rb

@@ -1,27 +1,29 @@
+require 'rack/utils'
+
 module Doorkeeper
   module OAuth
     module Authorization
-      module URIBuilder
-        include Rack::Utils
-
-        extend self
+      class URIBuilder
+        class << self
+          def uri_with_query(url, parameters = {})
+            uri            = URI.parse(url)
+            original_query = Rack::Utils.parse_query(uri.query)
+            uri.query      = build_query(original_query.merge(parameters))
+            uri.to_s
+          end
 
-        def uri_with_query(url, parameters = {})
-          uri            = URI.parse(url)
-          original_query = parse_query(uri.query)
-          uri.query      = build_query(original_query.merge(parameters))
-          uri.to_s
-        end
+          def uri_with_fragment(url, parameters = {})
+            uri = URI.parse(url)
+            uri.fragment = build_query(parameters)
+            uri.to_s
+          end
 
-        def uri_with_fragment(url, parameters = {})
-          uri = URI.parse(url)
-          uri.fragment = build_query(parameters)
-          uri.to_s
-        end
+          private
 
-        def build_query(parameters = {})
-          parameters = parameters.reject { |k, v| v.blank? }
-          super parameters
+          def build_query(parameters = {})
+            parameters = parameters.reject { |_, v| v.blank? }
+            Rack::Utils.build_query parameters
+          end
         end
       end
     end

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -1,12 +1,10 @@
 module Doorkeeper
   module OAuth
-    class AuthorizationCodeRequest
-      include Validations
-      include OAuth::RequestConcern
-
+    class AuthorizationCodeRequest < BaseRequest
       validate :attributes,   error: :invalid_request
       validate :client,       error: :invalid_client
       validate :grant,        error: :invalid_grant
+      # @see https://tools.ietf.org/html/rfc6749#section-5.2
       validate :redirect_uri, error: :invalid_grant
 
       attr_accessor :server, :grant, :client, :redirect_uri, :access_token
@@ -31,6 +29,7 @@ module Doorkeeper
                                       grant.scopes,
                                       server)
         end
+        super
       end
 
       def validate_attributes
@@ -47,7 +46,10 @@ module Doorkeeper
       end
 
       def validate_redirect_uri
-        grant.redirect_uri == redirect_uri
+        Helpers::URIChecker.valid_for_authorization?(
+          redirect_uri,
+          grant.redirect_uri
+        )
       end
     end
   end

data/lib/doorkeeper/oauth/{request_concern.rb → base_request.rb}

@@ -1,8 +1,11 @@
 module Doorkeeper
   module OAuth
-    module RequestConcern
+    class BaseRequest
+      include Validations
+
       def authorize
         validate
+
         if valid?
           before_successful_response
           @response = TokenResponse.new(access_token)
@@ -35,13 +38,17 @@ module Doorkeeper
           resource_owner_id,
           scopes,
           Authorization::Token.access_token_expires_in(server, client),
-          server.refresh_token_enabled?)
+          server.refresh_token_enabled?
+        )
       end
 
       def before_successful_response
+        Doorkeeper.configuration.before_successful_strategy_response.call(self)
       end
 
       def after_successful_response
+        Doorkeeper.configuration.after_successful_strategy_response.
+          call(self, @response)
       end
     end
   end

data/lib/doorkeeper/oauth/base_response.rb

@@ -0,0 +1,29 @@
+module Doorkeeper
+  module OAuth
+    class BaseResponse
+      def body
+        {}
+      end
+
+      def description
+        ""
+      end
+
+      def headers
+        {}
+      end
+
+      def redirectable?
+        false
+      end
+
+      def redirect_uri
+        ""
+      end
+
+      def status
+        :ok
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -1,19 +1,32 @@
 module Doorkeeper
   module OAuth
     class Client
-      class Credentials < Struct.new(:uid, :secret)
-        extend Methods
+      Credentials = Struct.new(:uid, :secret) do
+        class << self
+          def from_request(request, *credentials_methods)
+            credentials_methods.inject(nil) do |credentials, method|
+              method = self.method(method) if method.is_a?(Symbol)
+              credentials = Credentials.new(*method.call(request))
+              break credentials unless credentials.blank?
+            end
+          end
+
+          def from_params(request)
+            request.parameters.values_at(:client_id, :client_secret)
+          end
 
-        def self.from_request(request, *credentials_methods)
-          credentials_methods.inject(nil) do |credentials, method|
-            method = self.method(method) if method.is_a?(Symbol)
-            credentials = Credentials.new *method.call(request)
-            break credentials unless credentials.blank?
+          def from_basic(request)
+            authorization = request.authorization
+            if authorization.present? && authorization =~ /^Basic (.*)/m
+              Base64.decode64(Regexp.last_match(1)).split(/:/, 2)
+            end
           end
         end
 
+        # Public clients may have their secret blank, but "credentials" are
+        # still present
         def blank?
-          uid.blank? || secret.blank?
+          uid.blank?
         end
       end
     end

data/lib/doorkeeper/oauth/client.rb

@@ -1,4 +1,3 @@
-require 'doorkeeper/oauth/client/methods'
 require 'doorkeeper/oauth/client/credentials'
 
 module Doorkeeper
@@ -13,7 +12,7 @@ module Doorkeeper
       end
 
       def self.find(uid, method = Application.method(:by_uid))
-        if application = method.call(uid)
+        if (application = method.call(uid))
           new(application)
         end
       end
@@ -21,7 +20,7 @@ module Doorkeeper
       def self.authenticate(credentials, method = Application.method(:by_uid_and_secret))
         return false if credentials.blank?
 
-        if application = method.call(credentials.uid, credentials.secret)
+        if (application = method.call(credentials.uid, credentials.secret))
           new(application)
         end
       end

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -1,6 +1,6 @@
 module Doorkeeper
   module OAuth
-    class ClientCredentialsRequest
+    class ClientCredentialsRequest < BaseRequest
       class Creator
         def call(client, scopes, attributes = {})
           AccessToken.find_or_create_for(

data/lib/doorkeeper/oauth/client_credentials/issuer.rb

@@ -2,12 +2,13 @@ require 'doorkeeper/oauth/client_credentials/validation'
 
 module Doorkeeper
   module OAuth
-    class ClientCredentialsRequest
+    class ClientCredentialsRequest < BaseRequest
       class Issuer
         attr_accessor :token, :validation, :error
 
         def initialize(server, validation)
-          @server, @validation = server, validation
+          @server = server
+          @validation = validation
         end
 
         def create(client, scopes, creator = Creator.new)

data/lib/doorkeeper/oauth/client_credentials/validation.rb

@@ -4,7 +4,7 @@ require 'doorkeeper/oauth/helpers/scope_checker'
 
 module Doorkeeper
   module OAuth
-    class ClientCredentialsRequest
+    class ClientCredentialsRequest < BaseRequest
       class Validation
         include Validations
         include OAuth::Helpers

data/lib/doorkeeper/oauth/client_credentials_request.rb

@@ -4,13 +4,12 @@ require 'doorkeeper/oauth/client_credentials/validation'
 
 module Doorkeeper
   module OAuth
-    class ClientCredentialsRequest
-      include Validations
-      include OAuth::RequestConcern
-
-      attr_accessor :issuer, :server, :client, :original_scopes
+    class ClientCredentialsRequest < BaseRequest
+      attr_accessor :server, :client, :original_scopes
       attr_reader :response
-      alias :error_response :response
+      attr_writer :issuer
+
+      alias_method :error_response, :response
 
       delegate :error, to: :issuer
 
@@ -19,8 +18,9 @@ module Doorkeeper
       end
 
       def initialize(server, client, parameters = {})
-        @client, @server = client, server
-        @response        = nil
+        @client = client
+        @server = server
+        @response = nil
         @original_scopes = parameters[:scope]
       end
 

data/lib/doorkeeper/oauth/code_response.rb

@@ -1,13 +1,13 @@
 module Doorkeeper
   module OAuth
-    class CodeResponse
-      include OAuth::Authorization::URIBuilder
+    class CodeResponse < BaseResponse
       include OAuth::Helpers
 
       attr_accessor :pre_auth, :auth, :response_on_fragment
 
       def initialize(pre_auth, auth, options = {})
-        @pre_auth, @auth      = pre_auth, auth
+        @pre_auth = pre_auth
+        @auth = auth
         @response_on_fragment = options[:response_on_fragment]
       end
 
@@ -18,20 +18,20 @@ module Doorkeeper
       def redirect_uri
         if URIChecker.native_uri? pre_auth.redirect_uri
           auth.native_redirect
+        elsif response_on_fragment
+          Authorization::URIBuilder.uri_with_fragment(
+            pre_auth.redirect_uri,
+            access_token: auth.token.token,
+            token_type: auth.token.token_type,
+            expires_in: auth.token.expires_in_seconds,
+            state: pre_auth.state
+          )
         else
-          if response_on_fragment
-            uri_with_fragment(
-              pre_auth.redirect_uri,
-              access_token: auth.token.token,
-              token_type: auth.token.token_type,
-              expires_in: auth.token.expires_in,
-              state: pre_auth.state
-            )
-          else
-            uri_with_query pre_auth.redirect_uri,
-                           code: auth.token.token,
-                           state: pre_auth.state
-          end
+          Authorization::URIBuilder.uri_with_query(
+            pre_auth.redirect_uri,
+            code: auth.token.token,
+            state: pre_auth.state
+          )
         end
       end
     end

data/lib/doorkeeper/oauth/error.rb

@@ -1,10 +1,10 @@
 module Doorkeeper
   module OAuth
-    class Error < Struct.new(:name, :state)
+    Error = Struct.new(:name, :state) do
       def description
         I18n.translate(
           name,
-          scope: [:doorkeeper, :errors, :messages],
+          scope: %i[doorkeeper errors messages],
           default: :server_error
         )
       end

data/lib/doorkeeper/oauth/error_response.rb

@@ -1,12 +1,10 @@
 module Doorkeeper
   module OAuth
-    class ErrorResponse
-      include OAuth::Authorization::URIBuilder
+    class ErrorResponse < BaseResponse
       include OAuth::Helpers
 
       def self.from_request(request, attributes = {})
-        state = request.state if request.respond_to?(:state)
-        new(attributes.merge(name: request.error, state: state))
+        new(attributes.merge(name: request.error, state: request.try(:state)))
       end
 
       delegate :name, :description, :state, to: :@error
@@ -36,16 +34,12 @@ module Doorkeeper
 
       def redirect_uri
         if @response_on_fragment
-          uri_with_fragment @redirect_uri, body
+          Authorization::URIBuilder.uri_with_fragment @redirect_uri, body
         else
-          uri_with_query @redirect_uri, body
+          Authorization::URIBuilder.uri_with_query @redirect_uri, body
         end
       end
 
-      def authenticate_info
-        %(Bearer realm="#{realm}", error="#{name}", error_description="#{description}")
-      end
-
       def headers
         { 'Cache-Control' => 'no-store',
           'Pragma' => 'no-cache',
@@ -60,6 +54,12 @@ module Doorkeeper
       def configuration
         Doorkeeper.configuration
       end
+
+      private
+
+      def authenticate_info
+        %(Bearer realm="#{realm}", error="#{name}", error_description="#{description}")
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/forbidden_token_response.rb

@@ -21,7 +21,7 @@ module Doorkeeper
       end
 
       def description
-        scope = { scope: [:doorkeeper, :scopes] }
+        scope = { scope: %i[doorkeeper scopes] }
         @description ||= @scopes.map { |r| I18n.translate r, scope }.join('\n')
       end
     end

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -13,7 +13,7 @@ module Doorkeeper
 
           def valid?
             scope_str.present? &&
-              scope_str !~ /[\n|\r|\t]/ &&
+              scope_str !~ /[\n\r\t]/ &&
               @valid_scopes.has_scopes?(parsed_scopes)
           end
 

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -3,6 +3,7 @@ module Doorkeeper
     module Helpers
       module URIChecker
         def self.valid?(url)
+          return true if native_uri?(url)
           uri = as_uri(url)
           uri.fragment.nil? && !uri.host.nil? && !uri.scheme.nil?
         rescue URI::InvalidURIError
@@ -10,7 +11,15 @@ module Doorkeeper
         end
 
         def self.matches?(url, client_url)
-          url, client_url = as_uri(url), as_uri(client_url)
+          url = as_uri(url)
+          client_url = as_uri(client_url)
+
+          if client_url.query.present?
+            return false unless query_matches?(url.query, client_url.query)
+            # Clear out queries so rest of URI can be tested. This allows query
+            # params to be in the request but order not mattering.
+            client_url.query = nil
+          end
           url.query = nil
           url == client_url
         end
@@ -23,6 +32,13 @@ module Doorkeeper
           URI.parse(url)
         end
 
+        def self.query_matches?(query, client_query)
+          return true if client_query.nil? && query.nil?
+          return false if client_query.nil? || query.nil?
+          # Will return true independent of query order
+          client_query.split('&').sort == query.split('&').sort
+        end
+
         def self.native_uri?(url)
           url == Doorkeeper.configuration.native_redirect_uri
         end

data/lib/doorkeeper/oauth/invalid_token_response.rb

@@ -1,11 +1,12 @@
 module Doorkeeper
   module OAuth
     class InvalidTokenResponse < ErrorResponse
+      attr_reader :reason
+
       def self.from_access_token(access_token, attributes = {})
-        reason = case
-                 when access_token.try(:revoked?)
+        reason = if access_token.try(:revoked?)
                    :revoked
-                 when access_token.try(:expired?)
+                 elsif access_token.try(:expired?)
                    :expired
                  else
                    :unknown
@@ -20,7 +21,7 @@ module Doorkeeper
       end
 
       def description
-        scope = { scope: [:doorkeeper, :errors, :messages, :invalid_token] }
+        scope = { scope: %i[doorkeeper errors messages invalid_token] }
         @description ||= I18n.translate @reason, scope
       end
     end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -1,33 +1,28 @@
 module Doorkeeper
   module OAuth
-    class PasswordAccessTokenRequest
-      include Validations
-      include OAuth::RequestConcern
+    class PasswordAccessTokenRequest < BaseRequest
       include OAuth::Helpers
 
       validate :client,         error: :invalid_client
       validate :resource_owner, error: :invalid_grant
       validate :scopes,         error: :invalid_scope
 
-      attr_accessor :server, :resource_owner, :credentials, :access_token
-      attr_accessor :client
+      attr_accessor :server, :client, :resource_owner, :parameters,
+                    :access_token
 
-      def initialize(server, credentials, resource_owner, parameters = {})
+      def initialize(server, client, resource_owner, parameters = {})
         @server          = server
         @resource_owner  = resource_owner
-        @credentials     = credentials
+        @client          = client
+        @parameters      = parameters
         @original_scopes = parameters[:scope]
-
-        if credentials
-          @client = Application.by_uid_and_secret credentials.uid,
-                                                  credentials.secret
-        end
       end
 
       private
 
       def before_successful_response
         find_or_create_access_token(client, resource_owner.id, scopes, server)
+        super
       end
 
       def validate_scopes
@@ -40,7 +35,7 @@ module Doorkeeper
       end
 
       def validate_client
-        !credentials || !!client
+        !parameters[:client_id] || !!client
       end
     end
   end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -57,9 +57,11 @@ module Doorkeeper
 
       # TODO: test uri should be matched against the client's one
       def validate_redirect_uri
-        return false unless redirect_uri.present?
-        Helpers::URIChecker.native_uri?(redirect_uri) ||
-          Helpers::URIChecker.valid_for_authorization?(redirect_uri, client.redirect_uri)
+        return false if redirect_uri.blank?
+
+        Helpers::URIChecker.valid_for_authorization?(
+          redirect_uri, client.redirect_uri
+        )
       end
     end
   end