doorkeeper 3.1.0 → 4.4.3

data/spec/controllers/tokens_controller_spec.rb

@@ -2,9 +2,7 @@ require 'spec_helper_integration'
 
 describe Doorkeeper::TokensController do
   describe 'when authorization has succeeded' do
-    let :token do
-      double(:token, authorize: true)
-    end
+    let(:token) { double(:token, authorize: true) }
 
     before do
       allow(controller).to receive(:token) { token }
@@ -38,7 +36,7 @@ describe Doorkeeper::TokensController do
       allow(I18n).to receive(:translate).
         with(
           custom_message,
-          hash_including(scope: [:doorkeeper, :errors, :messages]),
+          hash_including(scope: %i[doorkeeper errors messages]),
         ).
         and_return('Authorization custom message')
 
@@ -57,19 +55,71 @@ describe Doorkeeper::TokensController do
       }
       expect(response.status).to eq 401
       expect(response.headers['WWW-Authenticate']).to match(/Bearer/)
-      expect(JSON.load(response.body)).to eq expected_response_body
+      expect(JSON.parse(response.body)).to eq expected_response_body
     end
   end
 
-  describe 'when revoke authorization has failed' do
-    # http://tools.ietf.org/html/rfc7009#section-2.2
-    it 'returns no error response' do
-      token = double(:token, authorize: false)
-      allow(controller).to receive(:token) { token }
+  # http://tools.ietf.org/html/rfc7009#section-2.2
+  describe 'revoking tokens' do
+    let(:client) { FactoryBot.create(:application) }
+    let(:access_token) { FactoryBot.create(:access_token, application: client) }
+
+    before(:each) do
+      allow(controller).to receive(:token) { access_token }
+    end
+
+    context 'when associated app is public' do
+      let(:client) { FactoryBot.create(:application, confidential: false) }
+
+      it 'returns 200' do
+        post :revoke
+
+        expect(response.status).to eq 200
+      end
+
+      it 'revokes the access token' do
+        post :revoke
+
+        expect(access_token.reload).to have_attributes(revoked?: true)
+      end
+    end
+
+    context 'when associated app is confidential' do
+      let(:client) { FactoryBot.create(:application, confidential: true) }
+      let(:oauth_client) { Doorkeeper::OAuth::Client.new(client) }
+
+      before(:each) do
+        allow_any_instance_of(Doorkeeper::Server).to receive(:client) { oauth_client }
+      end
+
+      it 'returns 200' do
+        post :revoke
+
+        expect(response.status).to eq 200
+      end
+
+      it 'revokes the access token' do
+        post :revoke
+
+        expect(access_token.reload).to have_attributes(revoked?: true)
+      end
+
+      context 'when authorization fails' do
+        let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
+        let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
+
+        it 'returns 200' do
+          post :revoke
 
-      post :revoke
+          expect(response.status).to eq 200
+        end
 
-      expect(response.status).to eq 200
+        it 'does not revoke the access token' do
+          post :revoke
+
+          expect(access_token.reload).to have_attributes(revoked?: false)
+        end
+      end
     end
   end
 
@@ -85,4 +135,140 @@ describe Doorkeeper::TokensController do
       post :create
     end
   end
+
+  describe 'when requested token introspection' do
+    context 'authorized using Bearer token' do
+      let(:client) { FactoryBot.create(:application) }
+      let(:access_token) { FactoryBot.create(:access_token, application: client) }
+
+      it 'responds with full token introspection' do
+        request.headers['Authorization'] = "Bearer #{access_token.token}"
+
+        post :introspect, token: access_token.token
+
+        should_have_json 'active', true
+        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
+      end
+    end
+
+    context 'authorized using Client Authentication' do
+      let(:client) { FactoryBot.create(:application) }
+      let(:access_token) { FactoryBot.create(:access_token, application: client) }
+
+      it 'responds with full token introspection' do
+        request.headers['Authorization'] = basic_auth_header_for_client(client)
+
+        post :introspect, token: access_token.token
+
+        should_have_json 'active', true
+        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
+        should_have_json 'client_id', client.uid
+      end
+    end
+
+    context 'public access token' do
+      let(:client) { FactoryBot.create(:application) }
+      let(:access_token) { FactoryBot.create(:access_token, application: nil) }
+
+      it 'responds with full token introspection' do
+        request.headers['Authorization'] = basic_auth_header_for_client(client)
+
+        post :introspect, token: access_token.token
+
+        should_have_json 'active', true
+        expect(json_response).to include('client_id', 'token_type', 'exp', 'iat')
+        should_have_json 'client_id', nil
+      end
+    end
+
+    context 'token was issued to a different client than is making this request' do
+      let(:client) { FactoryBot.create(:application) }
+      let(:different_client) { FactoryBot.create(:application) }
+      let(:access_token) { FactoryBot.create(:access_token, application: client) }
+
+      it 'responds with only active state' do
+        request.headers['Authorization'] = basic_auth_header_for_client(different_client)
+
+        post :introspect, token: access_token.token
+
+        expect(response).to be_successful
+
+        should_have_json 'active', false
+        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
+      end
+    end
+
+    context 'using invalid credentials to authorize' do
+      let(:client) { double(uid: '123123', secret: '666999') }
+      let(:access_token) { FactoryBot.create(:access_token) }
+
+      it 'responds with invalid_client error' do
+        request.headers['Authorization'] = basic_auth_header_for_client(client)
+
+        post :introspect, token: access_token.token
+
+        expect(response).not_to be_successful
+        response_status_should_be 401
+
+        should_not_have_json 'active'
+        should_have_json 'error', 'invalid_client'
+      end
+    end
+
+    context 'using wrong token value' do
+      let(:client) { FactoryBot.create(:application) }
+      let(:access_token) { FactoryBot.create(:access_token, application: client) }
+
+      it 'responds with only active state' do
+        request.headers['Authorization'] = basic_auth_header_for_client(client)
+
+        post :introspect, token: SecureRandom.hex(16)
+
+        should_have_json 'active', false
+        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
+      end
+    end
+
+    context 'when requested Access Token expired' do
+      let(:client) { FactoryBot.create(:application) }
+      let(:access_token) { FactoryBot.create(:access_token, application: client, created_at: 1.year.ago) }
+
+      it 'responds with only active state' do
+        request.headers['Authorization'] = basic_auth_header_for_client(client)
+
+        post :introspect, token: access_token.token
+
+        should_have_json 'active', false
+        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
+      end
+    end
+
+    context 'when requested Access Token revoked' do
+      let(:client) { FactoryBot.create(:application) }
+      let(:access_token) { FactoryBot.create(:access_token, application: client, revoked_at: 1.year.ago) }
+
+      it 'responds with only active state' do
+        request.headers['Authorization'] = basic_auth_header_for_client(client)
+
+        post :introspect, token: access_token.token
+
+        should_have_json 'active', false
+        expect(json_response).not_to include('client_id', 'token_type', 'exp', 'iat')
+      end
+    end
+
+    context 'unauthorized (no bearer token or client credentials)' do
+      let(:access_token) { FactoryBot.create(:access_token) }
+
+      it 'responds with invalid_request error' do
+        post :introspect, token: access_token.token
+
+        expect(response).not_to be_successful
+        response_status_should_be 401
+
+        should_not_have_json 'active'
+        should_have_json 'error', 'invalid_request'
+      end
+    end
+  end
 end

data/spec/dummy/app/controllers/full_protected_resources_controller.rb

@@ -1,12 +1,12 @@
 class FullProtectedResourcesController < ApplicationController
-  before_filter -> { doorkeeper_authorize! :write, :admin }, only: :show
-  before_filter :doorkeeper_authorize!, only: :index
+  before_action -> { doorkeeper_authorize! :write, :admin }, only: :show
+  before_action :doorkeeper_authorize!, only: :index
 
   def index
-    render text: 'index'
+    render plain: 'index'
   end
 
   def show
-    render text: 'show'
+    render plain: 'show'
   end
 end

data/spec/dummy/app/controllers/home_controller.rb

@@ -12,6 +12,6 @@ class HomeController < ApplicationController
   end
 
   def callback
-    render text: 'ok'
+    render plain: 'ok'
   end
 end

data/spec/dummy/app/controllers/metal_controller.rb

@@ -3,7 +3,7 @@ class MetalController < ActionController::Metal
   include ActionController::Head
   include Doorkeeper::Rails::Helpers
 
-  before_filter :doorkeeper_authorize!
+  before_action :doorkeeper_authorize!
 
   def index
     self.response_body = { ok: true }.to_json

data/spec/dummy/app/controllers/semi_protected_resources_controller.rb

@@ -1,11 +1,11 @@
 class SemiProtectedResourcesController < ApplicationController
-  before_filter :doorkeeper_authorize!, only: :index
+  before_action :doorkeeper_authorize!, only: :index
 
   def index
-    render text: 'protected index'
+    render plain: 'protected index'
   end
 
   def show
-    render text: 'non protected show'
+    render plain: 'non protected show'
   end
 end

data/spec/dummy/app/models/user.rb

@@ -1,8 +1,4 @@
 class User < ActiveRecord::Base
-  if respond_to?(:attr_accessible)
-    attr_accessible :name, :password
-  end
-
   def self.authenticate!(name, password)
     User.where(name: name, password: password).first
   end

data/spec/dummy/config/application.rb

@@ -1,9 +1,8 @@
 require File.expand_path('../boot', __FILE__)
 
-require 'action_controller/railtie'
-require 'sprockets/railtie'
+require 'rails/all'
 
-Bundler.require :default
+Bundler.require(*Rails.groups)
 
 require 'yaml'
 
@@ -20,38 +19,5 @@ module Dummy
     # Settings in config/environments/* take precedence over those specified here.
     # Application configuration should go into files in config/initializers
     # -- all .rb files in that directory are automatically loaded.
-
-    # Only load the plugins named here, in the order given (default is alphabetical).
-    # :all can be used as a placeholder for all plugins not explicitly named.
-    # config.plugins = [ :exception_notification, :ssl_requirement, :all ]
-
-    # Activate observers that should always be running.
-    # config.active_record.observers = :cacher, :garbage_collector, :forum_observer
-
-    if defined?(ActiveRecord) && Rails.version.to_i < 4
-      config.active_record.whitelist_attributes = true
-    end
-
-    # Set Time.zone default to the specified zone and make Active Record auto-convert to this zone.
-    # Run "rake -D time" for a list of tasks for finding time zone names. Default is UTC.
-    # config.time_zone = 'Central Time (US & Canada)'
-
-    # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
-    config.i18n.load_path += Dir[Rails.root.join('../../', 'config/locales', '*.{rb,yml}').to_s]
-    # config.i18n.default_locale = :en
-
-    # Configure the default encoding used in templates for Ruby 1.9.
-    config.encoding = 'utf-8'
-
-    # Configure sensitive parameters which will be filtered from the log file.
-    config.filter_parameters += [:password]
-
-    # Enable the asset pipeline
-    config.assets.enabled = true
-
-    # Version of your assets, change this if you want to expire all your assets
-    config.assets.version = '1.0'
-
-    I18n.enforce_available_locales = false
   end
 end

data/spec/dummy/config/environment.rb

@@ -2,4 +2,4 @@
 require File.expand_path('../application', __FILE__)
 
 # Initialize the rails application
-Dummy::Application.initialize!
+Rails.application.initialize!

data/spec/dummy/config/environments/test.rb

@@ -7,21 +7,10 @@ Dummy::Application.configure do
   # and recreated between test runs.  Don't rely on the data there!
   config.cache_classes = true
 
-  # Configure static asset server for tests with Cache-Control for performance
-  config.static_cache_control = 'public, max-age=3600'
-
-  if Rails.version.to_i < 4
-    # Log error messages when you accidentally call methods on nil
-    config.whiny_nils = true
-  end
-
-  if Rails.version.to_i >= 4
-    # Do not eager load code on boot. This avoids loading your whole application
-    # just for the purpose of running a single test. If you are using a tool that
-    # preloads Rails for running tests, you may have to set it to true.
-    config.eager_load = false
-    config.i18n.enforce_available_locales = true
-  end
+  # Do not eager load code on boot. This avoids loading your whole application
+  # just for the purpose of running a single test. If you are using a tool that
+  # preloads Rails for running tests, you may have to set it to true.
+  config.eager_load = false
 
   # Show full error reports and disable caching
   config.consider_all_requests_local       = true

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -29,11 +29,16 @@ Doorkeeper.configure do
   # Issue access tokens with refresh token (disabled by default)
   use_refresh_token
 
+  # Opt out of breaking api change to the native authorization code flow. Opting out sets the authorization
+  # code response route for native redirect uris to oauth/authorize/<code>. The default is oauth/authorize/native?code=<code>.
+  # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1143
+  # opt_out_native_route_change
+
   # Provide support for an owner to be assigned to each registered application (disabled by default)
-  # Optional parameter :confirmation => true (default false) if you want to enforce ownership of
+  # Optional parameter confirmation: true (default false) if you want to enforce ownership of
   # a registered application
   # Note: you must also run the rails g doorkeeper:application_owner generator to provide the necessary support
-  # enable_application_owner :confirmation => false
+  # enable_application_owner confirmation: false
 
   # Define access token scopes for your provider
   # For more information go to
@@ -82,7 +87,18 @@ Doorkeeper.configure do
   #   http://tools.ietf.org/html/rfc6819#section-4.4.2
   #   http://tools.ietf.org/html/rfc6819#section-4.4.3
   #
-  # grant_flows %w(authorization_code client_credentials)
+  # grant_flows %w[authorization_code client_credentials]
+
+  # Hook into the strategies' request & response life-cycle in case your
+  # application needs advanced customization or logging:
+  #
+  # before_successful_strategy_response do |request|
+  #   puts "BEFORE HOOK FIRED! #{request}"
+  # end
+  #
+  # after_successful_strategy_response do |request, response|
+  #   puts "AFTER HOOK FIRED! #{request}, #{response}"
+  # end
 
   # Under some circumstances you might want to have applications auto-approved,
   # so that the user skips the authorization step.

data/spec/dummy/config/initializers/new_framework_defaults.rb

@@ -0,0 +1,6 @@
+# Require `belongs_to` associations by default. This is a new Rails 5.0
+# default, so it is introduced as a configuration option to ensure that apps
+# made on earlier versions of Rails are not affected when upgrading.
+if Rails::VERSION::MAJOR >= 5
+  Rails.application.config.active_record.belongs_to_required_by_default = true
+end

data/spec/dummy/config/initializers/secret_token.rb

@@ -5,5 +5,4 @@
 # Make sure the secret is at least 30 characters and all random,
 # no regular words or you'll be exposed to dictionary attacks.
 Dummy::Application.config.secret_key_base =
-  Dummy::Application.config.secret_token =
   'c00157b5a1bb6181792f0f4a8a080485de7bab9987e6cf159dc74c4f0573345c1bfa713b5d756e1491fc0b098567e8a619e2f8d268eda86a20a720d05d633780'

data/spec/dummy/db/migrate/20111122132257_create_users.rb

@@ -1,4 +1,6 @@
-class CreateUsers < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class CreateUsers < ActiveRecord::Migration[4.2]
   def change
     create_table :users do |t|
       t.string :name

data/spec/dummy/db/migrate/20120312140401_add_password_to_users.rb

@@ -1,4 +1,6 @@
-class AddPasswordToUsers < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class AddPasswordToUsers < ActiveRecord::Migration[4.2]
   def change
     add_column :users, :password, :string
   end

data/{lib/generators/doorkeeper/templates/migration.rb → spec/dummy/db/migrate/20151223192035_create_doorkeeper_tables.rb}

@@ -1,4 +1,6 @@
-class CreateDoorkeeperTables < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class CreateDoorkeeperTables < ActiveRecord::Migration[4.2]
   def change
     create_table :oauth_applications do |t|
       t.string  :name,         null: false
@@ -6,14 +8,14 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
       t.string  :secret,       null: false
       t.text    :redirect_uri, null: false
       t.string  :scopes,       null: false, default: ''
-      t.timestamps
+      t.timestamps             null: false
     end
 
     add_index :oauth_applications, :uid, unique: true
 
     create_table :oauth_access_grants do |t|
       t.integer  :resource_owner_id, null: false
-      t.integer  :application_id,    null: false
+      t.references :application,     null: false
       t.string   :token,             null: false
       t.integer  :expires_in,        null: false
       t.text     :redirect_uri,      null: false
@@ -23,10 +25,15 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
     end
 
     add_index :oauth_access_grants, :token, unique: true
+    add_foreign_key(
+      :oauth_access_grants,
+      :oauth_applications,
+      column: :application_id,
+    )
 
     create_table :oauth_access_tokens do |t|
       t.integer  :resource_owner_id
-      t.integer  :application_id
+      t.references :application
 
       # If you use a custom token generator you may need to change this column
       # from string to text, so that it accepts tokens larger than 255
@@ -46,5 +53,10 @@ class CreateDoorkeeperTables < ActiveRecord::Migration
     add_index :oauth_access_tokens, :token, unique: true
     add_index :oauth_access_tokens, :resource_owner_id
     add_index :oauth_access_tokens, :refresh_token, unique: true
+    add_foreign_key(
+      :oauth_access_tokens,
+      :oauth_applications,
+      column: :application_id,
+    )
   end
 end

data/{lib/generators/doorkeeper/templates/add_owner_to_application_migration.rb → spec/dummy/db/migrate/20151223200000_add_owner_to_application.rb}

@@ -1,7 +1,9 @@
-class AddOwnerToApplication < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class AddOwnerToApplication < ActiveRecord::Migration[4.2]
   def change
     add_column :oauth_applications, :owner_id, :integer, null: true
     add_column :oauth_applications, :owner_type, :string, null: true
     add_index :oauth_applications, [:owner_id, :owner_type]
   end
-end
+end

data/spec/dummy/db/migrate/20160320211015_add_previous_refresh_token_to_access_tokens.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddPreviousRefreshTokenToAccessTokens < ActiveRecord::Migration[4.2]
+  def change
+    add_column(
+      :oauth_access_tokens,
+      :previous_refresh_token,
+      :string,
+      default: "",
+      null: false
+    )
+  end
+end

data/spec/dummy/db/migrate/20180210183654_add_confidential_to_application.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddConfidentialToApplication < ActiveRecord::Migration[5.1]
+  def change
+    add_column(
+      :oauth_applications,
+      :confidential,
+      :boolean,
+      null: false,
+      default: true # maintaining backwards compatibility: require secrets
+    )
+  end
+end

data/spec/dummy/db/schema.rb

@@ -11,55 +11,57 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20141209001746) do
+ActiveRecord::Schema.define(version: 20180210183654) do
 
-  create_table "oauth_access_grants", force: true do |t|
-    t.integer  "resource_owner_id",              null: false
-    t.integer  "application_id",                 null: false
-    t.string   "token",                          null: false
-    t.integer  "expires_in",                     null: false
-    t.string   "redirect_uri",      limit: 2048, null: false
-    t.datetime "created_at",                     null: false
+  create_table "oauth_access_grants", force: :cascade do |t|
+    t.integer  "resource_owner_id", null: false
+    t.integer  "application_id",    null: false
+    t.string   "token",             null: false
+    t.integer  "expires_in",        null: false
+    t.text     "redirect_uri",      null: false
+    t.datetime "created_at",        null: false
     t.datetime "revoked_at"
     t.string   "scopes"
   end
 
   add_index "oauth_access_grants", ["token"], name: "index_oauth_access_grants_on_token", unique: true
 
-  create_table "oauth_access_tokens", force: true do |t|
+  create_table "oauth_access_tokens", force: :cascade do |t|
     t.integer  "resource_owner_id"
     t.integer  "application_id"
-    t.string   "token",             null: false
+    t.string   "token",                               null: false
     t.string   "refresh_token"
     t.integer  "expires_in"
     t.datetime "revoked_at"
-    t.datetime "created_at",        null: false
+    t.datetime "created_at",                          null: false
     t.string   "scopes"
+    t.string   "previous_refresh_token", default: "", null: false
   end
 
   add_index "oauth_access_tokens", ["refresh_token"], name: "index_oauth_access_tokens_on_refresh_token", unique: true
   add_index "oauth_access_tokens", ["resource_owner_id"], name: "index_oauth_access_tokens_on_resource_owner_id"
   add_index "oauth_access_tokens", ["token"], name: "index_oauth_access_tokens_on_token", unique: true
 
-  create_table "oauth_applications", force: true do |t|
-    t.string   "name",                                   null: false
-    t.string   "uid",                                    null: false
-    t.string   "secret",                                 null: false
-    t.string   "redirect_uri", limit: 2048,              null: false
-    t.datetime "created_at",                             null: false
-    t.datetime "updated_at",                             null: false
+  create_table "oauth_applications", force: :cascade do |t|
+    t.string   "name",                      null: false
+    t.string   "uid",                       null: false
+    t.string   "secret",                    null: false
+    t.text     "redirect_uri",              null: false
+    t.string   "scopes",       default: "", null: false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.integer  "owner_id"
     t.string   "owner_type"
-    t.string   "scopes",                    default: "", null: false
+    t.boolean "confidential", default: true, null: false
   end
 
   add_index "oauth_applications", ["owner_id", "owner_type"], name: "index_oauth_applications_on_owner_id_and_owner_type"
   add_index "oauth_applications", ["uid"], name: "index_oauth_applications_on_uid", unique: true
 
-  create_table "users", force: true do |t|
+  create_table "users", force: :cascade do |t|
     t.string   "name"
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
+    t.datetime "created_at"
+    t.datetime "updated_at"
     t.string   "password"
   end
 

data/spec/factories.rb

@@ -1,4 +1,4 @@
-FactoryGirl.define do
+FactoryBot.define do
   factory :access_grant, class: Doorkeeper::AccessGrant do
     sequence(:resource_owner_id) { |n| n }
     application
@@ -22,5 +22,7 @@ FactoryGirl.define do
     redirect_uri 'https://app.com/callback'
   end
 
-  factory :user
+  # do not name this factory :user, otherwise it will conflict with factories
+  # from applications that use doorkeeper factories in their own tests
+  factory :doorkeeper_testing_user, class: :user
 end