doorkeeper 4.2.5 → 5.0.0

data/doorkeeper.gemspec

@@ -1,30 +1,30 @@
-$LOAD_PATH.push File.expand_path("../lib", __FILE__)
+$LOAD_PATH.push File.expand_path('../lib', __FILE__)
 
-require "doorkeeper/version"
+require 'doorkeeper/version'
 
 Gem::Specification.new do |s|
-  s.name        = "doorkeeper"
-  s.version     = Doorkeeper::VERSION
-  s.authors     = ["Felipe Elias Philipp", "Tute Costa", "Jon Moss"]
-  s.email       = %w(me@jonathanmoss.me)
-  s.homepage    = "https://github.com/doorkeeper-gem/doorkeeper"
-  s.summary     = "OAuth 2 provider for Rails and Grape"
-  s.description = "Doorkeeper is an OAuth 2 provider for Rails and Grape."
+  s.name        = 'doorkeeper'
+  s.version     = Doorkeeper.gem_version
+  s.authors     = ['Felipe Elias Philipp', 'Tute Costa', 'Jon Moss', 'Nikita Bulai']
+  s.email       = %w(bulaj.nikita@gmail.com)
+  s.homepage    = 'https://github.com/doorkeeper-gem/doorkeeper'
+  s.summary     = 'OAuth 2 provider for Rails and Grape'
+  s.description = 'Doorkeeper is an OAuth 2 provider for Rails and Grape.'
   s.license     = 'MIT'
 
   s.files         = `git ls-files`.split("\n")
   s.test_files    = `git ls-files -- spec/*`.split("\n")
-  s.require_paths = ["lib"]
+  s.require_paths = ['lib']
 
-  s.add_dependency "railties", ">= 4.2"
-  s.required_ruby_version = ">= 2.1"
+  s.add_dependency 'railties', '>= 4.2'
+  s.required_ruby_version = '>= 2.1'
 
-  s.add_development_dependency "capybara"
-  s.add_development_dependency "coveralls"
-  s.add_development_dependency "database_cleaner", "~> 1.5.3"
-  s.add_development_dependency "factory_girl", "~> 4.7.0"
-  s.add_development_dependency "generator_spec", "~> 0.9.3"
-  s.add_development_dependency "rake", ">= 11.3.0"
-  s.add_development_dependency "rspec-rails"
-  s.add_development_dependency "timecop", "~> 0.8.1"
+  s.add_development_dependency 'capybara', '~> 2.18'
+  s.add_development_dependency 'coveralls'
+  s.add_development_dependency 'grape'
+  s.add_development_dependency 'database_cleaner', '~> 1.6'
+  s.add_development_dependency 'factory_bot', '~> 4.8'
+  s.add_development_dependency 'generator_spec', '~> 0.9.3'
+  s.add_development_dependency 'rake', '>= 11.3.0'
+  s.add_development_dependency 'rspec-rails'
 end

data/gemfiles/rails_4_2.gemfile

@@ -4,8 +4,10 @@ source "https://rubygems.org"
 
 gem "rails", "~> 4.2.0"
 gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", :platform => :jruby
-gem "sqlite3", :platform => [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", :platforms => [:mingw, :mswin, :x64_mingw]
+gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
+gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+# Older Grape requires Ruby >= 2.2.2
+gem "grape", '~> 0.16', '< 0.19.2'
 
-gemspec :path => "../"
+gemspec path: "../"

data/gemfiles/rails_5_0.gemfile

@@ -4,9 +4,9 @@ source "https://rubygems.org"
 
 gem "rails", "~> 5.0.0"
 gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", :platform => :jruby
-gem "sqlite3", :platform => [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", :platforms => [:mingw, :mswin, :x64_mingw]
+gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
+gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
 gem "rspec-rails", "~> 3.5"
 
-gemspec :path => "../"
+gemspec path: "../"

data/gemfiles/rails_5_1.gemfile

@@ -2,12 +2,11 @@
 
 source "https://rubygems.org"
 
-gem "rails", :github => "rails/rails"
+gem "rails", "~> 5.1.0"
 gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", :platform => :jruby
-gem "sqlite3", :platform => [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", :platforms => [:mingw, :mswin, :x64_mingw]
-gem "arel", :github => "rails/arel"
-gem "rspec-rails", "~> 3.5"
+gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
+gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+gem "rspec-rails", "~> 3.7"
 
-gemspec :path => "../"
+gemspec path: "../"

data/gemfiles/rails_5_2.gemfile

@@ -0,0 +1,12 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "5.2.0"
+gem "appraisal"
+gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
+gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+gem "rspec-rails", "~> 3.7"
+
+gemspec path: "../"

data/gemfiles/rails_master.gemfile

@@ -0,0 +1,17 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", git: 'https://github.com/rails/rails'
+gem "arel", git: 'https://github.com/rails/arel'
+
+gem "appraisal"
+gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
+gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+
+%w[rspec-core rspec-expectations rspec-mocks rspec-rails rspec-support].each do |lib|
+  gem lib, git: "https://github.com/rspec/#{lib}.git", branch: 'master'
+end
+
+gemspec path: "../"

data/lib/doorkeeper/config.rb

@@ -15,19 +15,19 @@ module Doorkeeper
   end
 
   def self.configuration
-    @config || (fail MissingConfiguration)
+    @config || (raise MissingConfiguration)
   end
 
   def self.setup_orm_adapter
     @orm_adapter = "doorkeeper/orm/#{configuration.orm}".classify.constantize
-  rescue NameError => e
-    fail e, "ORM adapter not found (#{configuration.orm})", <<-ERROR_MSG.squish
-[doorkeeper] ORM adapter not found (#{configuration.orm}), or there was an error
-trying to load it.
-
-You probably need to add the related gem for this adapter to work with
-doorkeeper.
-      ERROR_MSG
+  rescue NameError => error
+    raise error, "ORM adapter not found (#{configuration.orm})", <<-ERROR_MSG.strip_heredoc
+      [doorkeeper] ORM adapter not found (#{configuration.orm}), or there was an error
+      trying to load it.
+
+      You probably need to add the related gem for this adapter to work with
+      doorkeeper.
+    ERROR_MSG
   end
 
   def self.setup_orm_models
@@ -59,12 +59,12 @@ doorkeeper.
       # @option opts[Boolean] :confirmation (false)
       #   Set confirm_application_owner variable
       def enable_application_owner(opts = {})
-        @config.instance_variable_set('@enable_application_owner', true)
+        @config.instance_variable_set(:@enable_application_owner, true)
         confirm_application_owner if opts[:confirmation].present? && opts[:confirmation]
       end
 
       def confirm_application_owner
-        @config.instance_variable_set('@confirm_application_owner', true)
+        @config.instance_variable_set(:@confirm_application_owner, true)
       end
 
       # Define default access token scopes for your provider
@@ -72,7 +72,7 @@ doorkeeper.
       # @param scopes [Array] Default set of access (OAuth::Scopes.new)
       # token scopes
       def default_scopes(*scopes)
-        @config.instance_variable_set('@default_scopes', OAuth::Scopes.from_array(scopes))
+        @config.instance_variable_set(:@default_scopes, OAuth::Scopes.from_array(scopes))
       end
 
       # Define default access token scopes for your provider
@@ -80,7 +80,7 @@ doorkeeper.
       # @param scopes [Array] Optional set of access (OAuth::Scopes.new)
       # token scopes
       def optional_scopes(*scopes)
-        @config.instance_variable_set('@optional_scopes', OAuth::Scopes.from_array(scopes))
+        @config.instance_variable_set(:@optional_scopes, OAuth::Scopes.from_array(scopes))
       end
 
       # Change the way client credentials are retrieved from the request object.
@@ -90,7 +90,7 @@ doorkeeper.
       #
       # @param methods [Array] Define client credentials
       def client_credentials(*methods)
-        @config.instance_variable_set('@client_credentials', methods)
+        @config.instance_variable_set(:@client_credentials_methods, methods)
       end
 
       # Change the way access token is authenticated from the request object.
@@ -100,57 +100,41 @@ doorkeeper.
       #
       # @param methods [Array] Define access token methods
       def access_token_methods(*methods)
-        @config.instance_variable_set('@access_token_methods', methods)
+        @config.instance_variable_set(:@access_token_methods, methods)
       end
 
-      # Issue access tokens with refresh token (disabled by default)
-      def use_refresh_token
-        @config.instance_variable_set('@refresh_token_enabled', true)
-      end
-
-      # WWW-Authenticate Realm (default "Doorkeeper").
-      #
-      # @param realm [String] ("Doorkeeper") Authentication realm
-      def realm(realm)
-        @config.instance_variable_set('@realm', realm)
+      # Issue access tokens with refresh token (disabled if not set)
+      def use_refresh_token(enabled = true, &block)
+        @config.instance_variable_set(
+          :@refresh_token_enabled,
+          block ? block : enabled
+        )
       end
 
       # Reuse access token for the same resource owner within an application
       # (disabled by default)
       # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383
       def reuse_access_token
-        @config.instance_variable_set("@reuse_access_token", true)
+        @config.instance_variable_set(:@reuse_access_token, true)
       end
 
-      # Forces the usage of the HTTPS protocol in non-native redirect uris
-      # (enabled by default in non-development environments). OAuth2
-      # delegates security in communication to the HTTPS protocol so it is
-      # wise to keep this enabled.
-      #
-      # @param [Boolean] boolean value for the parameter, true by default in
-      # non-development environment
-      def force_ssl_in_redirect_uri(boolean)
-        @config.instance_variable_set("@force_ssl_in_redirect_uri", boolean)
+      # Use an API mode for applications generated with --api argument
+      # It will skip applications controller, disable forgery protection
+      def api_only
+        @config.instance_variable_set(:@api_only, true)
       end
 
-      # Use a custom class for generating the access token.
-      # https://github.com/doorkeeper-gem/doorkeeper#custom-access-token-generator
-      #
-      # @param access_token_generator [String]
-      #   the name of the access token generator class
-      def access_token_generator(access_token_generator)
-        @config.instance_variable_set(
-          '@access_token_generator', access_token_generator
-        )
+      # Forbids creating/updating applications with arbitrary scopes that are
+      # not in configuration, i.e. `default_scopes` or `optional_scopes`.
+      # (disabled by default)
+      def enforce_configured_scopes
+        @config.instance_variable_set(:@enforce_configured_scopes, true)
       end
 
-      # The controller Doorkeeper::ApplicationController inherits from.
-      # Defaults to ActionController::Base.
-      # https://github.com/doorkeeper-gem/doorkeeper#custom-base-controller
-      #
-      # @param base_controller [String] the name of the base controller
-      def base_controller(base_controller)
-        @config.instance_variable_set('@base_controller', base_controller)
+      # Enforce request content type as the spec requires:
+      # disabled by default for backward compatibility.
+      def enforce_content_type
+        @config.instance_variable_set(:@enforce_content_type, true)
       end
     end
 
@@ -210,10 +194,6 @@ doorkeeper.
 
         public attribute
       end
-
-      def extended(base)
-        base.send(:private, :option)
-      end
     end
 
     extend Option
@@ -221,48 +201,120 @@ doorkeeper.
     option :resource_owner_authenticator,
            as: :authenticate_resource_owner,
            default: (lambda do |_routes|
-             logger.warn(I18n.translate('doorkeeper.errors.messages.resource_owner_authenticator_not_configured'))
+             ::Rails.logger.warn(
+               I18n.t('doorkeeper.errors.messages.resource_owner_authenticator_not_configured')
+             )
+
              nil
            end)
+
     option :admin_authenticator,
            as: :authenticate_admin,
-           default: ->(_routes) {}
+           default: (lambda do |_routes|
+             ::Rails.logger.warn(
+               I18n.t('doorkeeper.errors.messages.admin_authenticator_not_configured')
+             )
+
+             head :forbidden
+           end)
+
     option :resource_owner_from_credentials,
            default: (lambda do |_routes|
-             warn(I18n.translate('doorkeeper.errors.messages.credential_flow_not_configured'))
+             ::Rails.logger.warn(
+               I18n.t('doorkeeper.errors.messages.credential_flow_not_configured')
+             )
+
              nil
            end)
-
+    option :before_successful_authorization, default: ->(_context) {}
+    option :after_successful_authorization, default: ->(_context) {}
+    option :before_successful_strategy_response, default: ->(_request) {}
+    option :after_successful_strategy_response,
+           default: ->(_request, _response) {}
     option :skip_authorization,             default: ->(_routes) {}
     option :access_token_expires_in,        default: 7200
-    option :custom_access_token_expires_in, default: ->(_app) { nil }
+    option :custom_access_token_expires_in, default: ->(_context) { nil }
     option :authorization_code_expires_in,  default: 600
     option :orm,                            default: :active_record
     option :native_redirect_uri,            default: 'urn:ietf:wg:oauth:2.0:oob'
     option :active_record_options,          default: {}
+    option :grant_flows,                    default: %w[authorization_code client_credentials]
+
+    # Allows to forbid specific Application redirect URI's by custom rules.
+    # Doesn't forbid any URI by default.
+    #
+    # @param forbid_redirect_uri [Proc] Block or any object respond to #call
+    #
+    option :forbid_redirect_uri,            default: ->(_uri) { false }
+
+    # WWW-Authenticate Realm (default "Doorkeeper").
+    #
+    # @param realm [String] ("Doorkeeper") Authentication realm
+    #
     option :realm,                          default: 'Doorkeeper'
+
+    # Forces the usage of the HTTPS protocol in non-native redirect uris
+    # (enabled by default in non-development environments). OAuth2
+    # delegates security in communication to the HTTPS protocol so it is
+    # wise to keep this enabled.
+    #
+    # @param [Boolean] boolean_or_block value for the parameter, true by default in
+    # non-development environment
+    #
+    # @yield [uri] Conditional usage of SSL redirect uris.
+    # @yieldparam [URI] Redirect URI
+    # @yieldreturn [Boolean] Indicates necessity of usage of the HTTPS protocol
+    #   in non-native redirect uris
+    #
     option :force_ssl_in_redirect_uri,      default: !Rails.env.development?
-    option :grant_flows,                    default: %w(authorization_code client_credentials)
+
+    # Use a custom class for generating the access token.
+    # https://github.com/doorkeeper-gem/doorkeeper#custom-access-token-generator
+    #
+    # @param access_token_generator [String]
+    #   the name of the access token generator class
+    #
     option :access_token_generator,
            default: 'Doorkeeper::OAuth::Helpers::UniqueToken'
+
+    # The controller Doorkeeper::ApplicationController inherits from.
+    # Defaults to ActionController::Base.
+    # https://github.com/doorkeeper-gem/doorkeeper#custom-base-controller
+    #
+    # @param base_controller [String] the name of the base controller
     option :base_controller,
            default: 'ActionController::Base'
 
     attr_reader :reuse_access_token
+    attr_reader :api_only
+    attr_reader :enforce_content_type
+
+    def api_only
+      @api_only ||= false
+    end
+
+    def enforce_content_type
+      @enforce_content_type ||= false
+    end
 
     def refresh_token_enabled?
-      @refresh_token_enabled ||= false
-      !!@refresh_token_enabled
+      if defined?(@refresh_token_enabled)
+        @refresh_token_enabled
+      else
+        false
+      end
+    end
+
+    def enforce_configured_scopes?
+      !!(defined?(@enforce_configured_scopes) && @enforce_configured_scopes)
     end
 
     def enable_application_owner?
-      @enable_application_owner ||= false
-      !!@enable_application_owner
+      !!(defined?(@enable_application_owner) && @enable_application_owner)
     end
 
     def confirm_application_owner?
-      @confirm_application_owner ||= false
-      !!@confirm_application_owner
+      !!(defined?(@confirm_application_owner) && @confirm_application_owner)
     end
 
     def default_scopes
@@ -278,19 +330,19 @@ doorkeeper.
     end
 
     def client_credentials_methods
-      @client_credentials ||= [:from_basic, :from_params]
+      @client_credentials_methods ||= %i[from_basic from_params]
     end
 
     def access_token_methods
-      @access_token_methods ||= [:from_bearer_authorization, :from_access_token_param, :from_bearer_param]
+      @access_token_methods ||= %i[from_bearer_authorization from_access_token_param from_bearer_param]
     end
 
     def authorization_response_types
-      @authorization_response_types ||= calculate_authorization_response_types
+      @authorization_response_types ||= calculate_authorization_response_types.freeze
     end
 
     def token_grant_types
-      @token_grant_types ||= calculate_token_grant_types
+      @token_grant_types ||= calculate_token_grant_types.freeze
     end
 
     private

data/lib/doorkeeper/engine.rb

@@ -1,7 +1,7 @@
 module Doorkeeper
   class Engine < Rails::Engine
     initializer "doorkeeper.params.filter" do |app|
-      parameters = %w(client_secret code authentication_token access_token refresh_token)
+      parameters = %w[client_secret code authentication_token access_token refresh_token]
       app.config.filter_parameters << /^(#{Regexp.union parameters})$/
     end
 
@@ -17,10 +17,14 @@ module Doorkeeper
 
     if defined?(Sprockets) && Sprockets::VERSION.chr.to_i >= 4
       initializer 'doorkeeper.assets.precompile' do |app|
-        app.config.assets.precompile += %w(
+        # Force users to use:
+        #    //= link doorkeeper/admin/application.css
+        # in Doorkeeper 5 for Sprockets 4 instead of precompile.
+        # Add note to official docs & Wiki
+        app.config.assets.precompile += %w[
           doorkeeper/application.css
           doorkeeper/admin/application.css
-        )
+        ]
       end
     end
   end

data/lib/doorkeeper/errors.rb

@@ -1,27 +1,42 @@
 module Doorkeeper
   module Errors
     class DoorkeeperError < StandardError
+      def type
+        message
+      end
     end
 
     class InvalidAuthorizationStrategy < DoorkeeperError
+      def type
+        :unsupported_response_type
+      end
     end
 
     class InvalidTokenReuse < DoorkeeperError
+      def type
+        :invalid_request
+      end
     end
 
     class InvalidGrantReuse < DoorkeeperError
+      def type
+        :invalid_grant
+      end
     end
 
     class InvalidTokenStrategy < DoorkeeperError
+      def type
+        :unsupported_grant_type
+      end
     end
 
     class MissingRequestStrategy < DoorkeeperError
+      def type
+        :invalid_request
+      end
     end
 
-    class UnableToGenerateToken < DoorkeeperError
-    end
-
-    class TokenGeneratorNotFound < DoorkeeperError
-    end
+    UnableToGenerateToken = Class.new(DoorkeeperError)
+    TokenGeneratorNotFound = Class.new(DoorkeeperError)
   end
 end

data/lib/doorkeeper/grape/helpers.rb

@@ -9,7 +9,7 @@ module Doorkeeper
 
       # endpoint specific scopes > parameter scopes > default scopes
       def doorkeeper_authorize!(*scopes)
-        endpoint_scopes = env["api.endpoint"].route_setting(:scopes)
+        endpoint_scopes = endpoint.route_setting(:scopes) || endpoint.options[:route_options][:scopes]
         scopes = if endpoint_scopes
                    Doorkeeper::OAuth::Scopes.from_array(endpoint_scopes)
                  elsif scopes && !scopes.empty?
@@ -20,20 +20,18 @@ module Doorkeeper
       end
 
       def doorkeeper_render_error_with(error)
-        status_code = case error.status
-                      when :unauthorized
-                        401
-                      when :forbidden
-                        403
-                      end
-
+        status_code = error_status_codes[error.status]
         error!({ error: error.description }, status_code, error.headers)
       end
 
       private
 
+      def endpoint
+        env['api.endpoint']
+      end
+
       def doorkeeper_token
-        @_doorkeeper_token ||= OAuth::Token.authenticate(
+        @doorkeeper_token ||= OAuth::Token.authenticate(
           decorated_request,
           *Doorkeeper.configuration.access_token_methods
         )
@@ -42,6 +40,13 @@ module Doorkeeper
       def decorated_request
         AuthorizationDecorator.new(request)
       end
+
+      def error_status_codes
+        {
+          unauthorized: 401,
+          forbidden: 403
+        }
+      end
     end
   end
 end

data/lib/doorkeeper/helpers/controller.rb

@@ -5,11 +5,13 @@ module Doorkeeper
     module Controller
       private
 
-      def authenticate_resource_owner! # :doc:
+      # :doc:
+      def authenticate_resource_owner!
         current_resource_owner
       end
 
-      def current_resource_owner # :doc:
+      # :doc:
+      def current_resource_owner
         instance_eval(&Doorkeeper.configuration.authenticate_resource_owner)
       end
 
@@ -17,7 +19,8 @@ module Doorkeeper
         instance_eval(&Doorkeeper.configuration.resource_owner_from_credentials)
       end
 
-      def authenticate_admin! # :doc:
+      # :doc:
+      def authenticate_admin!
         instance_eval(&Doorkeeper.configuration.authenticate_admin)
       end
 
@@ -25,31 +28,17 @@ module Doorkeeper
         @server ||= Server.new(self)
       end
 
-      def doorkeeper_token # :doc:
-        @token ||= OAuth::Token.authenticate request, *config_methods
+      # :doc:
+      def doorkeeper_token
+        @doorkeeper_token ||= OAuth::Token.authenticate request, *config_methods
       end
 
       def config_methods
-        @methods ||= Doorkeeper.configuration.access_token_methods
+        @config_methods ||= Doorkeeper.configuration.access_token_methods
       end
 
       def get_error_response_from_exception(exception)
-        error_name = case exception
-                     when Errors::InvalidTokenStrategy
-                       :unsupported_grant_type
-                     when Errors::InvalidAuthorizationStrategy
-                       :unsupported_response_type
-                     when Errors::MissingRequestStrategy
-                       :invalid_request
-                     when Errors::InvalidTokenReuse
-                       :invalid_request
-                     when Errors::InvalidGrantReuse
-                       :invalid_grant
-                     when Errors::DoorkeeperError
-                       exception.message
-                     end
-
-        OAuth::ErrorResponse.new name: error_name, state: params[:state]
+        OAuth::ErrorResponse.new name: exception.type, state: params[:state]
       end
 
       def handle_token_exception(exception)
@@ -62,6 +51,11 @@ module Doorkeeper
       def skip_authorization?
         !!instance_exec([@server.current_resource_owner, @pre_auth.client], &Doorkeeper.configuration.skip_authorization)
       end
+
+      def enforce_content_type
+        return if request.content_type == 'application/x-www-form-urlencoded'
+        render json: {}, status: :unsupported_media_type
+      end
     end
   end
 end