doorkeeper 4.2.5 → 5.0.0

data/spec/dummy/config/routes.rb

@@ -1,52 +1,13 @@
 Rails.application.routes.draw do
   use_doorkeeper
-  use_doorkeeper scope: 'scope'
 
-  scope 'inner_space' do
-    use_doorkeeper scope: 'scope' do
-      controllers authorizations: 'custom_authorizations',
-                  tokens: 'custom_authorizations',
-                  applications: 'custom_authorizations',
-                  token_info: 'custom_authorizations'
-
-      as authorizations: 'custom_auth',
-         tokens: 'custom_token',
-         token_info: 'custom_token_info'
-    end
-  end
-
-  scope 'space' do
-    use_doorkeeper do
-      controllers authorizations: 'custom_authorizations',
-                  tokens: 'custom_authorizations',
-                  applications: 'custom_authorizations',
-                  token_info: 'custom_authorizations'
-
-      as authorizations: 'custom_auth',
-         tokens: 'custom_token',
-         token_info: 'custom_token_info'
-    end
-  end
-
-  scope 'outer_space' do
-    use_doorkeeper do
-      controllers authorizations: 'custom_authorizations',
-                  tokens: 'custom_authorizations',
-                  token_info: 'custom_authorizations'
-
-      as authorizations: 'custom_auth',
-         tokens: 'custom_token',
-         token_info: 'custom_token_info'
-
-      skip_controllers :tokens, :applications, :token_info
-    end
-  end
+  resources :semi_protected_resources
+  resources :full_protected_resources
 
   get 'metal.json' => 'metal#index'
 
   get '/callback', to: 'home#callback'
   get '/sign_in',  to: 'home#sign_in'
-  resources :semi_protected_resources
-  resources :full_protected_resources
+
   root to: 'home#index'
 end

data/spec/dummy/db/migrate/20111122132257_create_users.rb

@@ -1,4 +1,6 @@
-class CreateUsers < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class CreateUsers < ActiveRecord::Migration[4.2]
   def change
     create_table :users do |t|
       t.string :name

data/spec/dummy/db/migrate/20120312140401_add_password_to_users.rb

@@ -1,4 +1,6 @@
-class AddPasswordToUsers < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class AddPasswordToUsers < ActiveRecord::Migration[4.2]
   def change
     add_column :users, :password, :string
   end

data/spec/dummy/db/migrate/20151223192035_create_doorkeeper_tables.rb

@@ -1,4 +1,6 @@
-class CreateDoorkeeperTables < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class CreateDoorkeeperTables < ActiveRecord::Migration[4.2]
   def change
     create_table :oauth_applications do |t|
       t.string  :name,         null: false

data/spec/dummy/db/migrate/20151223200000_add_owner_to_application.rb

@@ -1,4 +1,6 @@
-class AddOwnerToApplication < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class AddOwnerToApplication < ActiveRecord::Migration[4.2]
   def change
     add_column :oauth_applications, :owner_id, :integer, null: true
     add_column :oauth_applications, :owner_type, :string, null: true

data/spec/dummy/db/migrate/20160320211015_add_previous_refresh_token_to_access_tokens.rb

@@ -1,4 +1,6 @@
-class AddPreviousRefreshTokenToAccessTokens < ActiveRecord::Migration
+# frozen_string_literal: true
+
+class AddPreviousRefreshTokenToAccessTokens < ActiveRecord::Migration[4.2]
   def change
     add_column(
       :oauth_access_tokens,

data/spec/dummy/db/migrate/20170822064514_enable_pkce.rb

@@ -0,0 +1,6 @@
+class EnablePkce < ActiveRecord::Migration[4.2]
+  def change
+    add_column :oauth_access_grants, :code_challenge, :string, null: true
+    add_column :oauth_access_grants, :code_challenge_method, :string, null: true
+  end
+end

data/spec/dummy/db/migrate/20180210183654_add_confidential_to_applications.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddConfidentialToApplications < ActiveRecord::Migration[5.1]
+  def change
+    add_column(
+      :oauth_applications,
+      :confidential,
+      :boolean,
+      null: false,
+      default: true # maintaining backwards compatibility: require secrets
+    )
+  end
+end

data/spec/dummy/db/schema.rb

@@ -1,4 +1,3 @@
-# encoding: UTF-8
 # This file is auto-generated from the current state of the database. Instead
 # of editing this file, please use the migrations feature of Active Record to
 # incrementally modify your database, and then regenerate this schema definition.
@@ -11,57 +10,59 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20160320211015) do
+ActiveRecord::Schema.define(version: 20180210183654) do
 
   create_table "oauth_access_grants", force: :cascade do |t|
-    t.integer  "resource_owner_id", null: false
-    t.integer  "application_id",    null: false
-    t.string   "token",             null: false
-    t.integer  "expires_in",        null: false
-    t.text     "redirect_uri",      null: false
-    t.datetime "created_at",        null: false
+    t.integer "resource_owner_id", null: false
+    t.integer "application_id", null: false
+    t.string "token", null: false
+    t.integer "expires_in", null: false
+    t.text "redirect_uri", null: false
+    t.datetime "created_at", null: false
     t.datetime "revoked_at"
-    t.string   "scopes"
+    t.string "scopes"
+    unless ENV['WITHOUT_PKCE']
+      t.string   "code_challenge"
+      t.string   "code_challenge_method"
+    end
+    t.index ["token"], name: "index_oauth_access_grants_on_token", unique: true
   end
 
-  add_index "oauth_access_grants", ["token"], name: "index_oauth_access_grants_on_token", unique: true
-
   create_table "oauth_access_tokens", force: :cascade do |t|
-    t.integer  "resource_owner_id"
-    t.integer  "application_id"
-    t.string   "token",                               null: false
-    t.string   "refresh_token"
-    t.integer  "expires_in"
+    t.integer "resource_owner_id"
+    t.integer "application_id"
+    t.string "token", null: false
+    t.string "refresh_token"
+    t.integer "expires_in"
     t.datetime "revoked_at"
-    t.datetime "created_at",                          null: false
-    t.string   "scopes"
-    t.string   "previous_refresh_token", default: "", null: false
+    t.datetime "created_at", null: false
+    t.string "scopes"
+    t.string "previous_refresh_token", default: "", null: false
+    t.index ["refresh_token"], name: "index_oauth_access_tokens_on_refresh_token", unique: true
+    t.index ["resource_owner_id"], name: "index_oauth_access_tokens_on_resource_owner_id"
+    t.index ["token"], name: "index_oauth_access_tokens_on_token", unique: true
   end
 
-  add_index "oauth_access_tokens", ["refresh_token"], name: "index_oauth_access_tokens_on_refresh_token", unique: true
-  add_index "oauth_access_tokens", ["resource_owner_id"], name: "index_oauth_access_tokens_on_resource_owner_id"
-  add_index "oauth_access_tokens", ["token"], name: "index_oauth_access_tokens_on_token", unique: true
-
   create_table "oauth_applications", force: :cascade do |t|
-    t.string   "name",                      null: false
-    t.string   "uid",                       null: false
-    t.string   "secret",                    null: false
-    t.text     "redirect_uri",              null: false
-    t.string   "scopes",       default: "", null: false
-    t.datetime "created_at"
-    t.datetime "updated_at"
-    t.integer  "owner_id"
-    t.string   "owner_type"
+    t.string "name", null: false
+    t.string "uid", null: false
+    t.string "secret", null: false
+    t.text "redirect_uri", null: false
+    t.string "scopes", default: "", null: false
+    t.datetime "created_at", null: false
+    t.datetime "updated_at", null: false
+    t.integer "owner_id"
+    t.string "owner_type"
+    t.boolean "confidential", default: true, null: false
+    t.index ["owner_id", "owner_type"], name: "index_oauth_applications_on_owner_id_and_owner_type"
+    t.index ["uid"], name: "index_oauth_applications_on_uid", unique: true
   end
 
-  add_index "oauth_applications", ["owner_id", "owner_type"], name: "index_oauth_applications_on_owner_id_and_owner_type"
-  add_index "oauth_applications", ["uid"], name: "index_oauth_applications_on_uid", unique: true
-
   create_table "users", force: :cascade do |t|
-    t.string   "name"
+    t.string "name"
     t.datetime "created_at"
     t.datetime "updated_at"
-    t.string   "password"
+    t.string "password"
   end
 
 end

data/spec/factories.rb

@@ -1,4 +1,4 @@
-FactoryGirl.define do
+FactoryBot.define do
   factory :access_grant, class: Doorkeeper::AccessGrant do
     sequence(:resource_owner_id) { |n| n }
     application

data/spec/generators/application_owner_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/application_owner_generator'
 
 describe 'Doorkeeper::ApplicationOwnerGenerator' do
@@ -10,13 +10,32 @@ describe 'Doorkeeper::ApplicationOwnerGenerator' do
   describe 'after running the generator' do
     before :each do
       prepare_destination
-      FileUtils.mkdir(::File.expand_path('config', Pathname(destination_root)))
-      FileUtils.copy_file(::File.expand_path('../templates/routes.rb', __FILE__), ::File.expand_path('config/routes.rb', Pathname.new(destination_root)))
-      run_generator
     end
 
-    it 'creates a migration' do
-      assert_migration 'db/migrate/add_owner_to_application.rb'
+    context 'pre Rails 5.0.0' do
+      it 'creates a migration with no version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 4)
+        stub_const("ActiveRecord::VERSION::MINOR", 2)
+
+        run_generator
+
+        assert_migration 'db/migrate/add_owner_to_application.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration\n")
+        end
+      end
+    end
+
+    context 'post Rails 5.0.0' do
+      it 'creates a migration with a version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 5)
+        stub_const("ActiveRecord::VERSION::MINOR", 0)
+
+        run_generator
+
+        assert_migration 'db/migrate/add_owner_to_application.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration[5.0]\n")
+        end
+      end
     end
   end
 end

data/spec/generators/confidential_applications_generator_spec.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'generators/doorkeeper/confidential_applications_generator'
+
+describe 'Doorkeeper::ConfidentialApplicationsGenerator' do
+  include GeneratorSpec::TestCase
+
+  tests Doorkeeper::ConfidentialApplicationsGenerator
+  destination ::File.expand_path('../tmp/dummy', __FILE__)
+
+  describe 'after running the generator' do
+    before :each do
+      prepare_destination
+    end
+
+    context 'pre Rails 5.0.0' do
+      it 'creates a migration with no version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 4)
+        stub_const("ActiveRecord::VERSION::MINOR", 2)
+
+        run_generator
+
+        assert_migration 'db/migrate/add_confidential_to_applications.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration\n")
+          assert migration.include?(':confidential')
+        end
+      end
+    end
+
+    context 'post Rails 5.0.0' do
+      it 'creates a migration with a version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 5)
+        stub_const("ActiveRecord::VERSION::MINOR", 0)
+
+        run_generator
+
+        assert_migration 'db/migrate/add_confidential_to_applications.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration[5.0]\n")
+          assert migration.include?(':confidential')
+        end
+      end
+    end
+  end
+end

data/spec/generators/install_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/install_generator'
 
 describe 'Doorkeeper::InstallGenerator' do

data/spec/generators/migration_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/migration_generator'
 
 describe 'Doorkeeper::MigrationGenerator' do
@@ -10,11 +10,32 @@ describe 'Doorkeeper::MigrationGenerator' do
   describe 'after running the generator' do
     before :each do
       prepare_destination
-      run_generator
     end
 
-    it 'creates a migration' do
-      assert_migration 'db/migrate/create_doorkeeper_tables.rb'
+    context 'pre Rails 5.0.0' do
+      it 'creates a migration with no version specifier' do
+        stub_const('ActiveRecord::VERSION::MAJOR', 4)
+        stub_const('ActiveRecord::VERSION::MINOR', 2)
+
+        run_generator
+
+        assert_migration 'db/migrate/create_doorkeeper_tables.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration\n")
+        end
+      end
+    end
+
+    context 'post Rails 5.0.0' do
+      it 'creates a migration with a version specifier' do
+        stub_const('ActiveRecord::VERSION::MAJOR', 5)
+        stub_const('ActiveRecord::VERSION::MINOR', 0)
+
+        run_generator
+
+        assert_migration 'db/migrate/create_doorkeeper_tables.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration[5.0]\n")
+        end
+      end
     end
   end
 end

data/spec/generators/pkce_generator_spec.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'generators/doorkeeper/pkce_generator'
+
+describe 'Doorkeeper::PkceGenerator' do
+  include GeneratorSpec::TestCase
+
+  tests Doorkeeper::PkceGenerator
+  destination ::File.expand_path('../tmp/dummy', __FILE__)
+
+  describe 'after running the generator' do
+    before :each do
+      prepare_destination
+    end
+
+    context 'pre Rails 5.0.0' do
+      it 'creates a migration with no version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 4)
+        stub_const("ActiveRecord::VERSION::MINOR", 2)
+
+        run_generator
+
+        assert_migration 'db/migrate/enable_pkce.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration\n")
+        end
+      end
+    end
+
+    context 'post Rails 5.0.0' do
+      it 'creates a migration with a version specifier' do
+        stub_const("ActiveRecord::VERSION::MAJOR", 5)
+        stub_const("ActiveRecord::VERSION::MINOR", 0)
+
+        run_generator
+
+        assert_migration 'db/migrate/enable_pkce.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration[5.0]\n")
+        end
+      end
+    end
+  end
+end

data/spec/generators/previous_refresh_token_generator_spec.rb

@@ -0,0 +1,57 @@
+require 'spec_helper'
+require 'generators/doorkeeper/previous_refresh_token_generator'
+
+describe 'Doorkeeper::PreviousRefreshTokenGenerator' do
+  include GeneratorSpec::TestCase
+
+  tests Doorkeeper::PreviousRefreshTokenGenerator
+  destination ::File.expand_path('../tmp/dummy', __FILE__)
+
+  describe 'after running the generator' do
+    before :each do
+      prepare_destination
+
+      allow_any_instance_of(Doorkeeper::PreviousRefreshTokenGenerator).to(
+        receive(:no_previous_refresh_token_column?).and_return(true)
+      )
+    end
+
+    context 'pre Rails 5.0.0' do
+      it 'creates a migration with no version specifier' do
+        stub_const('ActiveRecord::VERSION::MAJOR', 4)
+        stub_const('ActiveRecord::VERSION::MINOR', 2)
+
+        run_generator
+
+        assert_migration 'db/migrate/add_previous_refresh_token_to_access_tokens.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration\n")
+        end
+      end
+    end
+
+    context 'post Rails 5.0.0' do
+      it 'creates a migration with a version specifier' do
+        stub_const('ActiveRecord::VERSION::MAJOR', 5)
+        stub_const('ActiveRecord::VERSION::MINOR', 0)
+
+        run_generator
+
+        assert_migration 'db/migrate/add_previous_refresh_token_to_access_tokens.rb' do |migration|
+          assert migration.include?("ActiveRecord::Migration[5.0]\n")
+        end
+      end
+    end
+
+    context 'already exist' do
+      it 'does not create a migration' do
+        allow_any_instance_of(Doorkeeper::PreviousRefreshTokenGenerator).to(
+          receive(:no_previous_refresh_token_column?).and_call_original
+        )
+
+        run_generator
+
+        assert_no_migration 'db/migrate/add_previous_refresh_token_to_access_tokens.rb'
+      end
+    end
+  end
+end

data/spec/generators/views_generator_spec.rb

@@ -1,4 +1,4 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 require 'generators/doorkeeper/views_generator'
 
 describe Doorkeeper::Generators::ViewsGenerator do

data/spec/grape/grape_integration_spec.rb

@@ -0,0 +1,135 @@
+require 'spec_helper'
+require 'grape'
+require 'rack/test'
+require 'doorkeeper/grape/helpers'
+
+# Test Grape API application
+module GrapeApp
+  class API < Grape::API
+    version 'v1', using: :path
+    format :json
+    prefix :api
+
+    helpers Doorkeeper::Grape::Helpers
+
+    resource :protected do
+      before do
+        doorkeeper_authorize!
+      end
+
+      desc 'Protected resource, requires token.'
+
+      get :status do
+        { token: doorkeeper_token.token }
+      end
+    end
+
+    resource :protected_with_endpoint_scopes do
+      before do
+        doorkeeper_authorize!
+      end
+
+      desc 'Protected resource, requires token with scopes (defined in endpoint).'
+
+      get :status, scopes: [:admin] do
+        { response: 'OK' }
+      end
+    end
+
+    resource :protected_with_helper_scopes do
+      before do
+        doorkeeper_authorize! :admin
+      end
+
+      desc 'Protected resource, requires token with scopes (defined in helper).'
+
+      get :status do
+        { response: 'OK' }
+      end
+    end
+
+    resource :public do
+      desc "Public resource, no token required."
+
+      get :status do
+        { response: 'OK' }
+      end
+    end
+  end
+end
+
+describe 'Grape integration' do
+  include Rack::Test::Methods
+
+  def app
+    GrapeApp::API
+  end
+
+  def json_body
+    JSON.parse(last_response.body)
+  end
+  
+  let(:client) { FactoryBot.create(:application) }
+  let(:resource) { FactoryBot.create(:doorkeeper_testing_user, name: 'Joe', password: 'sekret') }
+  let(:access_token) { client_is_authorized(client, resource) }
+
+  context 'with valid Access Token' do
+    it 'successfully requests protected resource' do
+      get "api/v1/protected/status.json?access_token=#{access_token.token}"
+
+      expect(last_response).to be_successful
+
+      expect(json_body['token']).to eq(access_token.token)
+    end
+
+    it 'successfully requests protected resource with token that has required scopes (Grape endpoint)' do
+      access_token = client_is_authorized(client, resource, scopes: 'admin')
+
+      get "api/v1/protected_with_endpoint_scopes/status.json?access_token=#{access_token.token}"
+
+      expect(last_response).to be_successful
+      expect(json_body).to have_key('response')
+    end
+
+    it 'successfully requests protected resource with token that has required scopes (Doorkeeper helper)' do
+      access_token = client_is_authorized(client, resource, scopes: 'admin')
+
+      get "api/v1/protected_with_helper_scopes/status.json?access_token=#{access_token.token}"
+
+      expect(last_response).to be_successful
+      expect(json_body).to have_key('response')
+    end
+
+    it 'successfully requests public resource' do
+      get "api/v1/public/status.json"
+
+      expect(last_response).to be_successful
+      expect(json_body).to have_key('response')
+    end
+  end
+
+  context 'with invalid Access Token' do
+    it 'fails without access token' do
+      get "api/v1/protected/status.json"
+
+      expect(last_response).not_to be_successful
+      expect(json_body).to have_key('error')
+    end
+
+    it 'fails for access token without scopes' do
+      get "api/v1/protected_with_endpoint_scopes/status.json?access_token=#{access_token.token}"
+
+      expect(last_response).not_to be_successful
+      expect(json_body).to have_key('error')
+    end
+
+    it 'fails for access token with invalid scopes' do
+      access_token = client_is_authorized(client, resource, scopes: 'read write')
+
+      get "api/v1/protected_with_endpoint_scopes/status.json?access_token=#{access_token.token}"
+
+      expect(last_response).not_to be_successful
+      expect(json_body).to have_key('error')
+    end
+  end
+end

data/spec/helpers/doorkeeper/dashboard_helper_spec.rb

@@ -1,7 +1,7 @@
-require 'spec_helper_integration'
+require 'spec_helper'
 
 describe Doorkeeper::DashboardHelper do
-  describe '.doorkeeper_errors_for' do
+  describe '#doorkeeper_errors_for' do
     let(:object) { double errors: { method: messages } }
     let(:messages) { ['first message', 'second message'] }