doorkeeper 3.1.0 → 4.4.3

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -1,8 +1,6 @@
 module Doorkeeper
   module OAuth
-    class RefreshTokenRequest
-      include Validations
-      include OAuth::RequestConcern
+    class RefreshTokenRequest < BaseRequest
       include OAuth::Helpers
 
       validate :token_presence, error: :invalid_request
@@ -29,16 +27,19 @@ module Doorkeeper
 
       private
 
-      attr_reader :refresh_token_parameter
-
       def before_successful_response
         refresh_token.transaction do
           refresh_token.lock!
           raise Errors::InvalidTokenReuse if refresh_token.revoked?
 
-          refresh_token.revoke
+          refresh_token.revoke unless refresh_token_revoked_on_use?
           create_access_token
         end
+        super
+      end
+
+      def refresh_token_revoked_on_use?
+        Doorkeeper::AccessToken.refresh_token_revoked_on_use?
       end
 
       def default_scopes
@@ -46,21 +47,29 @@ module Doorkeeper
       end
 
       def create_access_token
-        expires_in = Authorization::Token.access_token_expires_in(
-          server,
-          client
-        )
+        @access_token = AccessToken.create!(access_token_attributes)
+      end
 
-        @access_token = AccessToken.create!(
+      def access_token_attributes
+        {
           application_id: refresh_token.application_id,
           resource_owner_id: refresh_token.resource_owner_id,
           scopes: scopes.to_s,
-          expires_in: expires_in,
-          use_refresh_token: true)
+          expires_in: access_token_expires_in,
+          use_refresh_token: true
+        }.tap do |attributes|
+          if refresh_token_revoked_on_use?
+            attributes[:previous_refresh_token] = refresh_token.refresh_token
+          end
+        end
+      end
+
+      def access_token_expires_in
+        Authorization::Token.access_token_expires_in(server, client)
       end
 
       def validate_token_presence
-        refresh_token.present? || refresh_token_parameter.present?
+        refresh_token.present? || @refresh_token_parameter.present?
       end
 
       def validate_token

data/lib/doorkeeper/oauth/scopes.rb

@@ -45,20 +45,30 @@ module Doorkeeper
       end
 
       def +(other)
-        if other.is_a? Scopes
-          self.class.from_array(self.all + other.all)
-        else
-          super(other)
-        end
+        self.class.from_array(all + to_array(other))
       end
 
       def <=>(other)
-        self.map(&:to_s).sort <=> other.map(&:to_s).sort
+        if other.respond_to?(:map)
+          map(&:to_s).sort <=> other.map(&:to_s).sort
+        else
+          super
+        end
       end
 
       def &(other)
-        other_array = other.present? ? other.all : []
-        self.class.from_array(all & other_array)
+        self.class.from_array(all & to_array(other))
+      end
+
+      private
+
+      def to_array(other)
+        case other
+        when Scopes
+          other.all
+        else
+          other.to_a
+        end
       end
     end
   end

data/lib/doorkeeper/oauth/token.rb

@@ -1,7 +1,23 @@
 module Doorkeeper
   module OAuth
     class Token
-      module Methods
+      class << self
+        def from_request(request, *methods)
+          methods.inject(nil) do |credentials, method|
+            method = self.method(method) if method.is_a?(Symbol)
+            credentials = method.call(request)
+            break credentials unless credentials.blank?
+          end
+        end
+
+        def authenticate(request, *methods)
+          if (token = from_request(request, *methods))
+            access_token = AccessToken.by_token(token)
+            access_token.revoke_previous_refresh_token! if access_token
+            access_token
+          end
+        end
+
         def from_access_token_param(request)
           request.parameters[:access_token]
         end
@@ -26,12 +42,11 @@ module Doorkeeper
 
         def token_from_basic_header(header, pattern)
           encoded_header = token_from_header(header, pattern)
-          token, _ = decode_basic_credentials(encoded_header)
-          token
+          decode_basic_credentials_token(encoded_header)
         end
 
-        def decode_basic_credentials(encoded_header)
-          Base64.decode64(encoded_header).split(/:/, 2)
+        def decode_basic_credentials_token(encoded_header)
+          Base64.decode64(encoded_header).split(/:/, 2).first
         end
 
         def token_from_header(header, pattern)
@@ -42,22 +57,6 @@ module Doorkeeper
           header && header.match(pattern)
         end
       end
-
-      extend Methods
-
-      def self.from_request(request, *methods)
-        methods.inject(nil) do |credentials, method|
-          method = self.method(method) if method.is_a?(Symbol)
-          credentials = method.call(request)
-          break credentials unless credentials.blank?
-        end
-      end
-
-      def self.authenticate(request, *methods)
-        if token = from_request(request, *methods)
-          AccessToken.by_token(token)
-        end
-      end
     end
   end
 end

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -0,0 +1,128 @@
+module Doorkeeper
+  module OAuth
+    # RFC7662 OAuth 2.0 Token Introspection
+    #
+    # @see https://tools.ietf.org/html/rfc7662
+    class TokenIntrospection
+      attr_reader :server, :token
+      attr_reader :error
+
+      def initialize(server, token)
+        @server = server
+        @token = token
+
+        authorize!
+      end
+
+      def authorized?
+        @error.blank?
+      end
+
+      def to_json
+        active? ? success_response : failure_response
+      end
+
+      private
+
+      # If the protected resource uses OAuth 2.0 client credentials to
+      # authenticate to the introspection endpoint and its credentials are
+      # invalid, the authorization server responds with an HTTP 401
+      # (Unauthorized) as described in Section 5.2 of OAuth 2.0 [RFC6749].
+      #
+      # Endpoint must first validate the authentication.
+      # If the authentication is invalid, the endpoint should respond with
+      # an HTTP 401 status code and an invalid_client response.
+      #
+      # @see https://www.oauth.com/oauth2-servers/token-introspection-endpoint/
+      #
+      def authorize!
+        # Requested client authorization
+        if server.credentials
+          @error = :invalid_client unless authorized_client
+        else
+          # Requested bearer token authorization
+          @error = :invalid_request unless authorized_token
+        end
+      end
+
+      # Client Authentication
+      def authorized_client
+        @_authorized_client ||= server.credentials && server.client
+      end
+
+      # Bearer Token Authentication
+      def authorized_token
+        @_authorized_token ||=
+          OAuth::Token.authenticate(server.context.request, :from_bearer_authorization)
+      end
+
+      # 2.2. Introspection Response
+      def success_response
+        {
+          active: true,
+          scope: @token.scopes_string,
+          client_id: @token.try(:application).try(:uid),
+          token_type: @token.token_type,
+          exp: @token.expires_at.to_i,
+          iat: @token.created_at.to_i
+        }
+      end
+
+      # If the introspection call is properly authorized but the token is not
+      # active, does not exist on this server, or the protected resource is
+      # not allowed to introspect this particular token, then the
+      # authorization server MUST return an introspection response with the
+      # "active" field set to "false".  Note that to avoid disclosing too
+      # much of the authorization server's state to a third party, the
+      # authorization server SHOULD NOT include any additional information
+      # about an inactive token, including why the token is inactive.
+      #
+      # @see https://tools.ietf.org/html/rfc7662 2.2. Introspection Response
+      #
+      def failure_response
+        {
+          active: false
+        }
+      end
+
+      # Boolean indicator of whether or not the presented token
+      # is currently active.  The specifics of a token's "active" state
+      # will vary depending on the implementation of the authorization
+      # server and the information it keeps about its tokens, but a "true"
+      # value return for the "active" property will generally indicate
+      # that a given token has been issued by this authorization server,
+      # has not been revoked by the resource owner, and is within its
+      # given time window of validity (e.g., after its issuance time and
+      # before its expiration time).
+      #
+      # Any other error is considered an "inactive" token.
+      #
+      # * The token requested does not exist or is invalid
+      # * The token expired
+      # * The token was issued to a different client than is making this request
+      #
+      def active?
+        if authorized_client
+          valid_token? && authorized_for_client?
+        else
+          valid_token?
+        end
+      end
+
+      # Token can be valid only if it is not expired or revoked.
+      def valid_token?
+        @token.present? && @token.accessible?
+      end
+
+      # If token doesn't belong to some client, then it is public.
+      # Otherwise in it required for token to be connected to the same client.
+      def authorized_for_client?
+        if @token.application.present?
+          @token.application == authorized_client.application
+        else
+          true
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/token_request.rb

@@ -1,11 +1,10 @@
 module Doorkeeper
   module OAuth
     class TokenRequest
-      attr_accessor :pre_auth, :resource_owner, :client
+      attr_accessor :pre_auth, :resource_owner
 
       def initialize(pre_auth, resource_owner)
         @pre_auth       = pre_auth
-        @client         = pre_auth.client
         @resource_owner = resource_owner
       end
 

data/lib/doorkeeper/oauth/token_response.rb

@@ -14,7 +14,7 @@ module Doorkeeper
           'expires_in'    => token.expires_in_seconds,
           'refresh_token' => token.refresh_token,
           'scope'         => token.scopes_string,
-          'created_at'    => token.created_at.to_i,
+          'created_at'    => token.created_at.to_i
         }.reject { |_, value| value.blank? }
       end
 

data/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -3,5 +3,32 @@ module Doorkeeper
     self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}".to_sym
 
     include AccessGrantMixin
+    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
+
+    belongs_to_options = {
+      class_name: 'Doorkeeper::Application',
+      inverse_of: :access_grants
+    }
+
+    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
+      belongs_to_options[:optional] = true
+    end
+
+    belongs_to :application, belongs_to_options
+
+    validates :resource_owner_id, :application_id, :token, :expires_in, :redirect_uri, presence: true
+    validates :token, uniqueness: true
+
+    before_validation :generate_token, on: :create
+
+    private
+
+    # Generates token value with UniqueToken class.
+    #
+    # @return [String] token value
+    #
+    def generate_token
+      self.token = UniqueToken.generate
+    end
   end
 end

data/lib/doorkeeper/orm/active_record/access_token.rb

@@ -3,19 +3,45 @@ module Doorkeeper
     self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}".to_sym
 
     include AccessTokenMixin
+    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
 
-    def self.delete_all_for(application_id, resource_owner)
-      where(application_id: application_id,
-            resource_owner_id: resource_owner.id).delete_all
+    belongs_to_options = {
+      class_name: 'Doorkeeper::Application',
+      inverse_of: :access_tokens
+    }
+
+    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
+      belongs_to_options[:optional] = true
     end
-    private_class_method :delete_all_for
 
-    def self.order_method
-      :order
+    belongs_to :application, belongs_to_options
+
+    validates :token, presence: true, uniqueness: true
+    validates :refresh_token, uniqueness: true, if: :use_refresh_token?
+
+    # @attr_writer [Boolean, nil] use_refresh_token
+    #   indicates the possibility of using refresh token
+    attr_writer :use_refresh_token
+
+    before_validation :generate_token, on: :create
+    before_validation :generate_refresh_token,
+                      on: :create, if: :use_refresh_token?
+
+    # Searches for not revoked Access Tokens associated with the
+    # specific Resource Owner.
+    #
+    # @param resource_owner [ActiveRecord::Base]
+    #   Resource Owner model instance
+    #
+    # @return [ActiveRecord::Relation]
+    #   active Access Tokens for Resource Owner
+    #
+    def self.active_for(resource_owner)
+      where(resource_owner_id: resource_owner.id, revoked_at: nil)
     end
 
-    def self.created_at_desc
-      'created_at desc'
+    def self.refresh_token_revoked_on_use?
+      column_names.include?('previous_refresh_token')
     end
   end
 end

data/lib/doorkeeper/orm/active_record/application.rb

@@ -3,22 +3,59 @@ module Doorkeeper
     self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}".to_sym
 
     include ApplicationMixin
+    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
 
-    if ActiveRecord::VERSION::MAJOR >= 4
-      has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: 'AccessToken'
-    else
-      has_many :authorized_tokens, class_name: 'AccessToken', conditions: { revoked_at: nil }
-    end
+    has_many :access_grants, dependent: :delete_all, class_name: 'Doorkeeper::AccessGrant'
+    has_many :access_tokens, dependent: :delete_all, class_name: 'Doorkeeper::AccessToken'
+
+    validates :name, :secret, :uid, presence: true
+    validates :uid, uniqueness: true
+    validates :redirect_uri, redirect_uri: true
+    validates :confidential, inclusion: { in: [true, false] }
+
+    before_validation :generate_uid, :generate_secret, on: :create
+
+    has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: 'AccessToken'
     has_many :authorized_applications, through: :authorized_tokens, source: :application
 
-    def self.column_names_with_table
-      self.column_names.map { |c| "#{table_name}.#{c}" }
+    # Returns Applications associated with active (not revoked) Access Tokens
+    # that are owned by the specific Resource Owner.
+    #
+    # @param resource_owner [ActiveRecord::Base]
+    #   Resource Owner model instance
+    #
+    # @return [ActiveRecord::Relation]
+    #   Applications authorized for the Resource Owner
+    #
+    def self.authorized_for(resource_owner)
+      resource_access_tokens = AccessToken.active_for(resource_owner)
+      where(id: resource_access_tokens.select(:application_id).distinct)
     end
 
-    def self.authorized_for(resource_owner)
-      joins(:authorized_applications).
-        where(AccessToken.table_name => { resource_owner_id: resource_owner.id, revoked_at: nil }).
-        group(column_names_with_table.join(','))
+    # Fallback to existing, default behaviour of assuming all apps to be
+    # confidential if the migration hasn't been run
+    def confidential
+      return super if self.class.supports_confidentiality?
+      ActiveSupport::Deprecation.warn 'You are susceptible to security bug ' \
+        'CVE-2018-1000211. Please follow instructions outlined in ' \
+        'Doorkeeper::CVE_2018_1000211_WARNING'
+      true
+    end
+
+    alias_method :confidential?, :confidential
+
+    def self.supports_confidentiality?
+      column_names.include?('confidential')
+    end
+
+    private
+
+    def generate_uid
+      self.uid = UniqueToken.generate if uid.blank?
+    end
+
+    def generate_secret
+      self.secret = UniqueToken.generate if secret.blank?
     end
   end
 end

data/lib/doorkeeper/orm/active_record.rb

@@ -1,38 +1,33 @@
+require 'active_support/lazy_load_hooks'
+
 module Doorkeeper
   module Orm
     module ActiveRecord
       def self.initialize_models!
-        require 'doorkeeper/orm/active_record/access_grant'
-        require 'doorkeeper/orm/active_record/access_token'
-        require 'doorkeeper/orm/active_record/application'
+        lazy_load do
+          require 'doorkeeper/orm/active_record/access_grant'
+          require 'doorkeeper/orm/active_record/access_token'
+          require 'doorkeeper/orm/active_record/application'
 
-        if Doorkeeper.configuration.active_record_options[:establish_connection]
-          [Doorkeeper::AccessGrant, Doorkeeper::AccessToken, Doorkeeper::Application].each do |c|
-            c.send :establish_connection, Doorkeeper.configuration.active_record_options[:establish_connection]
+          if Doorkeeper.configuration.active_record_options[:establish_connection]
+            [Doorkeeper::AccessGrant, Doorkeeper::AccessToken, Doorkeeper::Application].each do |model|
+              options = Doorkeeper.configuration.active_record_options[:establish_connection]
+              model.establish_connection(options)
+            end
           end
         end
       end
 
       def self.initialize_application_owner!
-        require 'doorkeeper/models/concerns/ownership'
+        lazy_load do
+          require 'doorkeeper/models/concerns/ownership'
 
-        Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
+          Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
+        end
       end
 
-      def self.check_requirements!(_config)
-        if ::ActiveRecord::Base.connected? &&
-           ::ActiveRecord::Base.connection.table_exists?(
-             Doorkeeper::Application.table_name
-           )
-          unless Doorkeeper::Application.new.attributes.include?("scopes")
-            migration_path = '../../../generators/doorkeeper/templates/add_scopes_to_oauth_applications.rb'
-            puts <<-MSG.squish
-[doorkeeper] Missing column: `oauth_applications.scopes`.
-Create the following migration and run `rake db:migrate`.
-            MSG
-            puts File.read(File.expand_path(migration_path, __FILE__))
-          end
-        end
+      def self.lazy_load(&block)
+        ActiveSupport.on_load(:active_record, {}, &block)
       end
     end
   end

data/lib/doorkeeper/rails/helpers.rb

@@ -1,21 +1,17 @@
 module Doorkeeper
   module Rails
     module Helpers
-      extend ActiveSupport::Concern
-
       def doorkeeper_authorize!(*scopes)
         @_doorkeeper_scopes = scopes.presence || Doorkeeper.configuration.default_scopes
 
-        if !valid_doorkeeper_token?
+        unless valid_doorkeeper_token?
           doorkeeper_render_error
         end
       end
 
-      def doorkeeper_unauthorized_render_options(error: nil)
-      end
+      def doorkeeper_unauthorized_render_options(**); end
 
-      def doorkeeper_forbidden_render_options(error: nil)
-      end
+      def doorkeeper_forbidden_render_options(**); end
 
       def valid_doorkeeper_token?
         doorkeeper_token && doorkeeper_token.acceptable?(@_doorkeeper_scopes)
@@ -25,14 +21,15 @@ module Doorkeeper
 
       def doorkeeper_render_error
         error = doorkeeper_error
-        headers.merge! error.headers.reject { |k| "Content-Type" == k }
+        headers.merge!(error.headers.reject { |k| k == "Content-Type" })
         doorkeeper_render_error_with(error)
       end
 
       def doorkeeper_render_error_with(error)
         options = doorkeeper_render_options(error) || {}
         status = doorkeeper_status_for_error(
-          error, options.delete(:respond_not_found_when_forbidden))
+          error, options.delete(:respond_not_found_when_forbidden)
+        )
         if options.blank?
           head status
         else

data/lib/doorkeeper/rails/routes/mapper.rb

@@ -1,13 +1,13 @@
 module Doorkeeper
   module Rails
-    class Routes
+    class Routes # :nodoc:
       class Mapper
-        def initialize(mapping = Mapping.new)
-          @mapping = mapping
+        def initialize
+          @mapping = Mapping.new
         end
 
         def map(&block)
-          self.instance_eval(&block) if block
+          instance_eval(&block) if block
           @mapping
         end
 

data/lib/doorkeeper/rails/routes/mapping.rb

@@ -1,6 +1,6 @@
 module Doorkeeper
   module Rails
-    class Routes
+    class Routes # :nodoc:
       class Mapping
         attr_accessor :controllers, :as, :skips