doorkeeper 4.2.6 → 4.3.0

data/app/validators/redirect_uri_validator.rb

@@ -11,7 +11,8 @@ class RedirectUriValidator < ActiveModel::EachValidator
     else
       value.split.each do |val|
         uri = ::URI.parse(val)
-        return if native_redirect_uri?(uri)
+        next if native_redirect_uri?(uri)
+        record.errors.add(attribute, :forbidden_uri) if forbidden_uri?(uri)
         record.errors.add(attribute, :fragment_present) unless uri.fragment.nil?
         record.errors.add(attribute, :relative_uri) if uri.scheme.nil? || uri.host.nil?
         record.errors.add(attribute, :secured_uri) if invalid_ssl_uri?(uri)
@@ -27,8 +28,17 @@ class RedirectUriValidator < ActiveModel::EachValidator
     self.class.native_redirect_uri.present? && uri.to_s == self.class.native_redirect_uri.to_s
   end
 
+  def forbidden_uri?(uri)
+    Doorkeeper.configuration.forbid_redirect_uri.call(uri)
+  end
+
   def invalid_ssl_uri?(uri)
     forces_ssl = Doorkeeper.configuration.force_ssl_in_redirect_uri
-    forces_ssl && uri.try(:scheme) == 'http'
+
+    if forces_ssl.respond_to?(:call)
+      forces_ssl.call(uri)
+    else
+      forces_ssl && uri.try(:scheme) == 'http'
+    end
   end
 end

data/app/views/doorkeeper/applications/_form.html.erb

@@ -41,7 +41,7 @@
   <div class="form-group">
     <div class="col-sm-offset-2 col-sm-10">
       <%= f.submit t('doorkeeper.applications.buttons.submit'), class: "btn btn-primary" %>
-      <%= link_to t('doorkeeper.applications.buttons.cancel'), oauth_applications_path, :class => "btn btn-default" %>
+      <%= link_to t('doorkeeper.applications.buttons.cancel'), oauth_applications_path, class: "btn btn-default" %>
     </div>
   </div>
 <% end %>

data/app/views/doorkeeper/authorized_applications/index.html.erb

@@ -9,7 +9,6 @@
       <th><%= t('doorkeeper.authorized_applications.index.application') %></th>
       <th><%= t('doorkeeper.authorized_applications.index.created_at') %></th>
       <th></th>
-      <th></th>
     </tr>
     </thead>
     <tbody>

data/config/locales/en.yml

@@ -13,6 +13,7 @@ en:
               invalid_uri: 'must be a valid URI.'
               relative_uri: 'must be an absolute URI.'
               secured_uri: 'must be an HTTPS/SSL URI.'
+              forbidden_uri: 'is forbidden by the server.'
 
   doorkeeper:
     applications:
@@ -28,7 +29,7 @@ en:
         error: 'Whoops! Check your form for possible errors'
       help:
         redirect_uri: 'Use one line per URI'
-        native_redirect_uri: 'Use %{native_redirect_uri} for local tests'
+        native_redirect_uri: 'Use %{native_redirect_uri} if you want to add localhost URIs for development purposes'
         scopes: 'Separate scopes with spaces. Leave blank to use the default scopes.'
       edit:
         title: 'Edit application'
@@ -75,7 +76,7 @@ en:
       messages:
         # Common error messages
         invalid_request: 'The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.'
-        invalid_redirect_uri: 'The redirect uri included is not valid.'
+        invalid_redirect_uri: "The requested redirect uri is malformed or doesn't match client redirect URI."
         unauthorized_client: 'The client is not authorized to perform this request using this method.'
         access_denied: 'The resource owner or authorization server denied the request.'
         invalid_scope: 'The requested scope is invalid, unknown, or malformed.'
@@ -94,9 +95,6 @@ en:
         invalid_grant: 'The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client.'
         unsupported_grant_type: 'The authorization grant type is not supported by the authorization server.'
 
-        # Password Access token errors
-        invalid_resource_owner: 'The provided resource owner credentials are not valid, or resource owner cannot be found'
-
         invalid_token:
           revoked: "The access token was revoked"
           expired: "The access token expired"

data/doorkeeper.gemspec

@@ -4,7 +4,7 @@ require "doorkeeper/version"
 
 Gem::Specification.new do |s|
   s.name        = "doorkeeper"
-  s.version     = Doorkeeper::VERSION
+  s.version     = Doorkeeper.gem_version
   s.authors     = ["Felipe Elias Philipp", "Tute Costa", "Jon Moss"]
   s.email       = %w(me@jonathanmoss.me)
   s.homepage    = "https://github.com/doorkeeper-gem/doorkeeper"
@@ -21,8 +21,9 @@ Gem::Specification.new do |s|
 
   s.add_development_dependency "capybara"
   s.add_development_dependency "coveralls"
-  s.add_development_dependency "database_cleaner", "~> 1.5.3"
-  s.add_development_dependency "factory_girl", "~> 4.7.0"
+  s.add_development_dependency "grape"
+  s.add_development_dependency "database_cleaner", "~> 1.6"
+  s.add_development_dependency "factory_bot", "~> 4.8"
   s.add_development_dependency "generator_spec", "~> 0.9.3"
   s.add_development_dependency "rake", ">= 11.3.0"
   s.add_development_dependency "rspec-rails"

data/gemfiles/rails_4_2.gemfile

@@ -4,8 +4,10 @@ source "https://rubygems.org"
 
 gem "rails", "~> 4.2.0"
 gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", :platform => :jruby
-gem "sqlite3", :platform => [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", :platforms => [:mingw, :mswin, :x64_mingw]
+gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
+gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+# Older Grape requires Ruby >= 2.2.2
+gem "grape", '~> 0.16', '< 0.19.2'
 
-gemspec :path => "../"
+gemspec path: "../"

data/gemfiles/rails_5_0.gemfile

@@ -4,9 +4,9 @@ source "https://rubygems.org"
 
 gem "rails", "~> 5.0.0"
 gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", :platform => :jruby
-gem "sqlite3", :platform => [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", :platforms => [:mingw, :mswin, :x64_mingw]
+gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
+gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
 gem "rspec-rails", "~> 3.5"
 
-gemspec :path => "../"
+gemspec path: "../"

data/gemfiles/rails_5_1.gemfile

@@ -2,12 +2,11 @@
 
 source "https://rubygems.org"
 
-gem "rails", :github => "rails/rails"
+gem "rails", "~> 5.1.0"
 gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", :platform => :jruby
-gem "sqlite3", :platform => [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", :platforms => [:mingw, :mswin, :x64_mingw]
-gem "arel", :github => "rails/arel"
-gem "rspec-rails", "~> 3.5"
+gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
+gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+gem "rspec-rails", "~> 3.7"
 
-gemspec :path => "../"
+gemspec path: "../"

data/gemfiles/rails_5_2.gemfile

@@ -0,0 +1,12 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "5.2.0.rc1"
+gem "appraisal"
+gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
+gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+gem "rspec-rails", "~> 3.7"
+
+gemspec path: "../"

data/gemfiles/rails_master.gemfile

@@ -0,0 +1,14 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", git: 'https://github.com/rails/rails'
+gem "arel", git: 'https://github.com/rails/arel'
+
+gem "appraisal"
+gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
+gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+gem "rspec-rails", "~> 3.7"
+
+gemspec path: "../"

data/lib/doorkeeper.rb

@@ -30,6 +30,7 @@ require 'doorkeeper/oauth/code_request'
 require 'doorkeeper/oauth/token_request'
 require 'doorkeeper/oauth/client'
 require 'doorkeeper/oauth/token'
+require 'doorkeeper/oauth/token_introspection'
 require 'doorkeeper/oauth/invalid_token_response'
 require 'doorkeeper/oauth/forbidden_token_response'
 

data/lib/doorkeeper/config.rb

@@ -59,12 +59,12 @@ doorkeeper.
       # @option opts[Boolean] :confirmation (false)
       #   Set confirm_application_owner variable
       def enable_application_owner(opts = {})
-        @config.instance_variable_set('@enable_application_owner', true)
+        @config.instance_variable_set(:@enable_application_owner, true)
         confirm_application_owner if opts[:confirmation].present? && opts[:confirmation]
       end
 
       def confirm_application_owner
-        @config.instance_variable_set('@confirm_application_owner', true)
+        @config.instance_variable_set(:@confirm_application_owner, true)
       end
 
       # Define default access token scopes for your provider
@@ -72,7 +72,7 @@ doorkeeper.
       # @param scopes [Array] Default set of access (OAuth::Scopes.new)
       # token scopes
       def default_scopes(*scopes)
-        @config.instance_variable_set('@default_scopes', OAuth::Scopes.from_array(scopes))
+        @config.instance_variable_set(:@default_scopes, OAuth::Scopes.from_array(scopes))
       end
 
       # Define default access token scopes for your provider
@@ -80,7 +80,7 @@ doorkeeper.
       # @param scopes [Array] Optional set of access (OAuth::Scopes.new)
       # token scopes
       def optional_scopes(*scopes)
-        @config.instance_variable_set('@optional_scopes', OAuth::Scopes.from_array(scopes))
+        @config.instance_variable_set(:@optional_scopes, OAuth::Scopes.from_array(scopes))
       end
 
       # Change the way client credentials are retrieved from the request object.
@@ -90,7 +90,7 @@ doorkeeper.
       #
       # @param methods [Array] Define client credentials
       def client_credentials(*methods)
-        @config.instance_variable_set('@client_credentials', methods)
+        @config.instance_variable_set(:@client_credentials, methods)
       end
 
       # Change the way access token is authenticated from the request object.
@@ -100,57 +100,19 @@ doorkeeper.
       #
       # @param methods [Array] Define access token methods
       def access_token_methods(*methods)
-        @config.instance_variable_set('@access_token_methods', methods)
+        @config.instance_variable_set(:@access_token_methods, methods)
       end
 
       # Issue access tokens with refresh token (disabled by default)
       def use_refresh_token
-        @config.instance_variable_set('@refresh_token_enabled', true)
-      end
-
-      # WWW-Authenticate Realm (default "Doorkeeper").
-      #
-      # @param realm [String] ("Doorkeeper") Authentication realm
-      def realm(realm)
-        @config.instance_variable_set('@realm', realm)
+        @config.instance_variable_set(:@refresh_token_enabled, true)
       end
 
       # Reuse access token for the same resource owner within an application
       # (disabled by default)
       # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383
       def reuse_access_token
-        @config.instance_variable_set("@reuse_access_token", true)
-      end
-
-      # Forces the usage of the HTTPS protocol in non-native redirect uris
-      # (enabled by default in non-development environments). OAuth2
-      # delegates security in communication to the HTTPS protocol so it is
-      # wise to keep this enabled.
-      #
-      # @param [Boolean] boolean value for the parameter, true by default in
-      # non-development environment
-      def force_ssl_in_redirect_uri(boolean)
-        @config.instance_variable_set("@force_ssl_in_redirect_uri", boolean)
-      end
-
-      # Use a custom class for generating the access token.
-      # https://github.com/doorkeeper-gem/doorkeeper#custom-access-token-generator
-      #
-      # @param access_token_generator [String]
-      #   the name of the access token generator class
-      def access_token_generator(access_token_generator)
-        @config.instance_variable_set(
-          '@access_token_generator', access_token_generator
-        )
-      end
-
-      # The controller Doorkeeper::ApplicationController inherits from.
-      # Defaults to ActionController::Base.
-      # https://github.com/doorkeeper-gem/doorkeeper#custom-base-controller
-      #
-      # @param base_controller [String] the name of the base controller
-      def base_controller(base_controller)
-        @config.instance_variable_set('@base_controller', base_controller)
+        @config.instance_variable_set(:@reuse_access_token, true)
       end
     end
 
@@ -210,10 +172,6 @@ doorkeeper.
 
         public attribute
       end
-
-      def extended(base)
-        base.send(:private, :option)
-      end
     end
 
     extend Option
@@ -221,15 +179,17 @@ doorkeeper.
     option :resource_owner_authenticator,
            as: :authenticate_resource_owner,
            default: (lambda do |_routes|
-             logger.warn(I18n.translate('doorkeeper.errors.messages.resource_owner_authenticator_not_configured'))
+             ::Rails.logger.warn(I18n.t('doorkeeper.errors.messages.resource_owner_authenticator_not_configured'))
              nil
            end)
+
     option :admin_authenticator,
            as: :authenticate_admin,
            default: ->(_routes) {}
+
     option :resource_owner_from_credentials,
            default: (lambda do |_routes|
-             warn(I18n.translate('doorkeeper.errors.messages.credential_flow_not_configured'))
+             ::Rails.logger.warn(I18n.t('doorkeeper.errors.messages.credential_flow_not_configured'))
              nil
            end)
 
@@ -240,11 +200,51 @@ doorkeeper.
     option :orm,                            default: :active_record
     option :native_redirect_uri,            default: 'urn:ietf:wg:oauth:2.0:oob'
     option :active_record_options,          default: {}
+    option :grant_flows,                    default: %w[authorization_code client_credentials]
+
+    # Allows to forbid specific Application redirect URI's by custom rules.
+    # Doesn't forbid any URI by default.
+    #
+    # @param forbid_redirect_uri [Proc] Block or any object respond to #call
+    #
+    option :forbid_redirect_uri,            default: ->(_uri) { false }
+
+    # WWW-Authenticate Realm (default "Doorkeeper").
+    #
+    # @param realm [String] ("Doorkeeper") Authentication realm
+    #
     option :realm,                          default: 'Doorkeeper'
+
+    # Forces the usage of the HTTPS protocol in non-native redirect uris
+    # (enabled by default in non-development environments). OAuth2
+    # delegates security in communication to the HTTPS protocol so it is
+    # wise to keep this enabled.
+    #
+    # @param [Boolean] boolean_or_block value for the parameter, true by default in
+    # non-development environment
+    #
+    # @yield [uri] Conditional usage of SSL redirect uris.
+    # @yieldparam [URI] Redirect URI
+    # @yieldreturn [Boolean] Indicates necessity of usage of the HTTPS protocol
+    #   in non-native redirect uris
+    #
     option :force_ssl_in_redirect_uri,      default: !Rails.env.development?
-    option :grant_flows,                    default: %w(authorization_code client_credentials)
+
+
+    # Use a custom class for generating the access token.
+    # https://github.com/doorkeeper-gem/doorkeeper#custom-access-token-generator
+    #
+    # @param access_token_generator [String]
+    #   the name of the access token generator class
+    #
     option :access_token_generator,
            default: 'Doorkeeper::OAuth::Helpers::UniqueToken'
+
+    # The controller Doorkeeper::ApplicationController inherits from.
+    # Defaults to ActionController::Base.
+    # https://github.com/doorkeeper-gem/doorkeeper#custom-base-controller
+    #
+    # @param base_controller [String] the name of the base controller
     option :base_controller,
            default: 'ActionController::Base'
 
@@ -278,11 +278,11 @@ doorkeeper.
     end
 
     def client_credentials_methods
-      @client_credentials ||= [:from_basic, :from_params]
+      @client_credentials ||= %i[from_basic from_params]
     end
 
     def access_token_methods
-      @access_token_methods ||= [:from_bearer_authorization, :from_access_token_param, :from_bearer_param]
+      @access_token_methods ||= %i[from_bearer_authorization from_access_token_param from_bearer_param]
     end
 
     def authorization_response_types

data/lib/doorkeeper/engine.rb

@@ -1,7 +1,7 @@
 module Doorkeeper
   class Engine < Rails::Engine
     initializer "doorkeeper.params.filter" do |app|
-      parameters = %w(client_secret code authentication_token access_token refresh_token)
+      parameters = %w[client_secret code authentication_token access_token refresh_token]
       app.config.filter_parameters << /^(#{Regexp.union parameters})$/
     end
 
@@ -17,10 +17,10 @@ module Doorkeeper
 
     if defined?(Sprockets) && Sprockets::VERSION.chr.to_i >= 4
       initializer 'doorkeeper.assets.precompile' do |app|
-        app.config.assets.precompile += %w(
+        app.config.assets.precompile += %w[
           doorkeeper/application.css
           doorkeeper/admin/application.css
-        )
+        ]
       end
     end
   end

data/lib/doorkeeper/grape/helpers.rb

@@ -9,7 +9,7 @@ module Doorkeeper
 
       # endpoint specific scopes > parameter scopes > default scopes
       def doorkeeper_authorize!(*scopes)
-        endpoint_scopes = env["api.endpoint"].route_setting(:scopes)
+        endpoint_scopes = endpoint.route_setting(:scopes) || endpoint.options[:route_options][:scopes]
         scopes = if endpoint_scopes
                    Doorkeeper::OAuth::Scopes.from_array(endpoint_scopes)
                  elsif scopes && !scopes.empty?
@@ -20,18 +20,16 @@ module Doorkeeper
       end
 
       def doorkeeper_render_error_with(error)
-        status_code = case error.status
-                      when :unauthorized
-                        401
-                      when :forbidden
-                        403
-                      end
-
+        status_code = error_status_codes[error.status]
         error!({ error: error.description }, status_code, error.headers)
       end
 
       private
 
+      def endpoint
+        env['api.endpoint']
+      end
+
       def doorkeeper_token
         @_doorkeeper_token ||= OAuth::Token.authenticate(
           decorated_request,
@@ -42,6 +40,13 @@ module Doorkeeper
       def decorated_request
         AuthorizationDecorator.new(request)
       end
+
+      def error_status_codes
+        {
+          unauthorized: 401,
+          forbidden: 403
+        }
+      end
     end
   end
 end