doorkeeper 4.3.0 → 4.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 323927e89a9c1c31f4f5dda92873c1959f2455a9
-  data.tar.gz: 956c2a288dbc09fa8cc4bcb7d809ef5dd53bd4ba
+  metadata.gz: 8d76a49e22bc442139a55528594bc6a3849fc53d
+  data.tar.gz: eeaca97997f68ca0017c2bbc350323cb1bc9df32
 SHA512:
-  metadata.gz: a1dbfedef840dc12c3e3ce33ba854963df84aaed81b97bc1828b177ef3c9d9ab4454dda6f37abe75f855eb39561a8e524a047bdffd9ddf44bf8a80d9d24b5c59
-  data.tar.gz: 27d2b543b67f67e750e8c317680b38583bb53473d8a0350aecccb7f9723ec00238b0ac07c72df3b2ace2ce74522f67d6e14811eb20acbb136497f71a368e4b2c
+  metadata.gz: 961beb33acfb9ba24831ec3e4fbcc2e4cbcc58ccd1a47bd0672aafe9e8e1d993918f1f5bd1ce7df4f3e20ae70a455c6cf698b697489b1247ff6eeecd89950ec0
+  data.tar.gz: ed000ab156a89e92973bc0d22896250ec73ddc52fd7adc6a229b9eb82d1517372b521477af5c394031b9af6164d373967937429093f24179104a6743f2778b87

data/.github/ISSUE_TEMPLATE.md

@@ -14,6 +14,12 @@ Tell us what should happen
 Tell us what happens instead
 
 ### System configuration
+You can help us to understand your problem if you will share some very
+useful information about your project environment (don't forget to
+remove any confidential data if it exists).
+
+**Doorkeeper initializer**:
+
 **Ruby version**:
 
-**Gemfile.lock**
+**Gemfile.lock**:

data/.travis.yml

@@ -4,10 +4,10 @@ sudo: false
 
 rvm:
   - 2.1
-  - 2.2.9
-  - 2.3.6
-  - 2.4.3
-  - 2.5.0
+  - 2.2
+  - 2.3
+  - 2.4
+  - 2.5
 
 before_install:
   - gem update --system # Need for Ruby 2.5.0. https://github.com/travis-ci/travis-ci/issues/8978
@@ -30,5 +30,9 @@ matrix:
       rvm: 2.1
     - gemfile: gemfiles/rails_master.gemfile
       rvm: 2.1
+    - gemfile: gemfiles/rails_master.gemfile
+      rvm: 2.2
+    - gemfile: gemfiles/rails_master.gemfile
+      rvm: 2.3
   allow_failures:
     - gemfile: gemfiles/rails_master.gemfile

data/NEWS.md

@@ -4,6 +4,18 @@ User-visible changes worth mentioning.
 
 ## master
 
+Replace this text with you changelog entry. Look at the examples below.
+
+## 4.3.1
+
+- Remove `BaseRecord` and introduce additional concern for ordering methods to fix
+  braking changes for Doorkeeper models.
+- [#1032] Refactor BaseRequest callbacks into configurable lambdas
+- [#1040] Clear mixins from ActiveRecord DSL and save only overridable API. It
+  allows to use this mixins in Doorkeeper ORM extensions with minimum code boilerplate.
+
+## 4.3.0
+
 - [#976] Fix to invalidate the second redirect URI when the first URI is the native URI
 - [#1035] Allow `Application#redirect_uri=` to handle array of URIs.
 - [#1036] Allow to forbid Application redirect URI's with specific rules.
@@ -22,7 +34,6 @@ User-visible changes worth mentioning.
 - [#1019] Remove translation not in use: `invalid_resource_owner`.
 - Use Ruby 2 hash style syntax (min required Ruby version = 2.1)
 - [#948] Make Scopes.<=> work with any "other" value.
-- [#970] Escape certain attributes in authorization forms.
 - [#974] Redirect URI is checked without query params within AuthorizationCodeRequest.
 - [#1004] More explicit help text for `native_redirect_uri`.
 - [#1023] Update Ruby versions and test against 2.5.0 on Travis CI.
@@ -30,6 +41,10 @@ User-visible changes worth mentioning.
 - [#1025] Improve documentation for adding foreign keys
 - [#1028] Make it possible to have composit strategy names.
 
+## 4.2.6
+
+- [#970] Escape certain attributes in authorization forms.
+
 ## 4.2.5
 
 - [#936] Deprecate `Doorkeeper#configured?`, `Doorkeeper#database_installed?`, and

data/README.md

@@ -1,4 +1,4 @@
-# Doorkeeper - awesome OAuth2 provider for your Rails app.
+# Doorkeeper - awesome OAuth 2 provider for your Rails app.
 
 [![Gem Version](https://badge.fury.io/rb/doorkeeper.svg)](https://rubygems.org/gems/doorkeeper)
 [![Build Status](https://travis-ci.org/doorkeeper-gem/doorkeeper.svg?branch=master)](https://travis-ci.org/doorkeeper-gem/doorkeeper)
@@ -43,11 +43,13 @@ https://github.com/doorkeeper-gem/doorkeeper/releases
     - [Active Record](#active-record)
     - [MongoDB](#mongodb)
     - [Sequel](#sequel)
+    - [Couchbase](#couchbase)
   - [Routes](#routes)
   - [Authenticating](#authenticating)
   - [Internationalization (I18n)](#internationalization-i18n)
 - [Protecting resources with OAuth (a.k.a your API endpoint)](#protecting-resources-with-oauth-aka-your-api-endpoint)
-  - [Protect your API with OAuth when using Grape](#protect-your-api-with-oauth-when-using-grape)
+  - [Ruby on Rails controllers](#ruby-on-rails-controllers)
+  - [Grape endpoints](#grape-endpoints)
   - [Route Constraints and other integrations](#route-constraints-and-other-integrations)
   - [Access Token Scopes](#access-token-scopes)
   - [Custom Access Token Generator](#custom-access-token-generator)
@@ -87,8 +89,8 @@ This will install the doorkeeper initializer into `config/initializers/doorkeepe
 
 #### Active Record
 
-By default doorkeeper is configured to use active record, so to start you have
-to generate the migration tables:
+By default doorkeeper is configured to use Active Record, so to start you have
+to generate the migration tables (supports Rails >= 5 migrations versioning):
 
     rails generate doorkeeper:migration
 
@@ -100,21 +102,26 @@ for each table that includes a `resource_owner_id` column:
 add_foreign_key :table_name, :users, column: :resource_owner_id
 ```
 
+Then run migrations:
+
+```sh
+rake db:migrate
+```
+
 Remember to add associations to your model so the related records are deleted.
 If you don't do this an `ActiveRecord::InvalidForeignKey`-error will be raised
 when you try to destroy a model with related access grants or access tokens.
 
 ```ruby
 class User < ApplicationRecord
-  has_many :access_grants, class_name: "Doorkeeper::AccessGrant", foreign_key: :resource_owner_id, dependent: :delete_all # or :destroy if you need callbacks
-  has_many :access_tokens, class_name: "Doorkeeper::AccessToken", foreign_key: :resource_owner_id, dependent: :delete_all # or :destroy if you need callbacks
-end
-```
-
-Then run migrations:
+  has_many :access_grants, class_name: "Doorkeeper::AccessGrant",
+                           foreign_key: :resource_owner_id,
+                           dependent: :delete_all # or :destroy if you need callbacks
 
-```sh
-rake db:migrate
+  has_many :access_tokens, class_name: "Doorkeeper::AccessToken",
+                           foreign_key: :resource_owner_id,
+                           dependent: :delete_all # or :destroy if you need callbacks
+end
 ```
 
 #### MongoDB
@@ -132,6 +139,12 @@ Follow configuration instructions for setting up the necessary Doorkeeper ORM.
 [Sequel gem]: https://github.com/jeremyevans/sequel/
 [doorkeeper-sequel extension]: https://github.com/nbulaj/doorkeeper-sequel
 
+#### Couchbase
+
+Use [doorkeeper-couchbase] extension if you are using Couchbase database.
+
+[doorkeeper-couchbase]: https://github.com/acaprojects/doorkeeper-couchbase
+
 ### Routes
 
 The installation script will also automatically add the Doorkeeper routes into
@@ -169,7 +182,7 @@ and authentication block in `config/initializers/doorkeeper.rb`:
 ``` ruby
 Doorkeeper.configure do
   resource_owner_authenticator do
-    User.find_by_id(session[:current_user_id]) || redirect_to(login_url)
+    User.find_by(id: session[:current_user_id]) || redirect_to(login_url)
   end
 end
 ```
@@ -182,16 +195,17 @@ the methods defined over there.
 You may want to check other ways of authentication
 [here](https://github.com/doorkeeper-gem/doorkeeper/wiki/Authenticating-using-Clearance-or-DIY).
 
-
 ### Internationalization (I18n)
 
 See language files in [the I18n repository](https://github.com/doorkeeper-gem/doorkeeper-i18n).
 
-
 ## Protecting resources with OAuth (a.k.a your API endpoint)
 
-To protect your API with OAuth, you just need to setup `before_action`s
-specifying the actions you want to protect. For example:
+### Ruby on Rails controllers
+
+To protect your controllers (usual one or `ActionController::API`) with OAuth,
+you just need to setup `before_action`s specifying the actions you want to
+protect. For example:
 
 ``` ruby
 class Api::V1::ProductsController < Api::V1::ApiController
@@ -204,16 +218,17 @@ end
 You can pass any option `before_action` accepts, such as `if`, `only`,
 `except`, and others.
 
-### Protect your API with OAuth when using Grape
+### Grape endpoints
 
-As of [PR 567] doorkeeper has helpers for Grape >= 0.10. One of them is
-`doorkeeper_authorize!` and can be used in a similar way as an example above.
-Note that you have to use `require 'doorkeeper/grape/helpers'` and
-`helpers Doorkeeper::Grape::Helpers`.
+Starting from version 2.2 Doorkeeper provides helpers for the
+[Grape framework] >= 0.10. One of them is `doorkeeper_authorize!` that
+can be used in a similar way as an example above to protect your API
+with OAuth. Note that you have to use `require 'doorkeeper/grape/helpers'`
+and `helpers Doorkeeper::Grape::Helpers` in your Grape API class.
 
 For more information about integration with Grape see the [Wiki].
 
-[PR 567]: https://github.com/doorkeeper-gem/doorkeeper/pull/567
+[Grape framework]: https://github.com/ruby-grape/grape
 [Wiki]: https://github.com/doorkeeper-gem/doorkeeper/wiki/Grape-Integration
 
 ``` ruby
@@ -239,7 +254,6 @@ module API
 end
 ```
 
-
 ### Route Constraints and other integrations
 
 You can leverage the `Doorkeeper.authenticate` facade to easily extract a
@@ -254,7 +268,6 @@ module Constraint
       token = Doorkeeper.authenticate(request)
       token && token.accessible?
     end
-
   end
 end
 ```
@@ -326,8 +339,10 @@ JWT token support is available with
 
 ### Custom Base Controller
 
-By default Doorkeeper's main controller `Doorkeeper::ApplicationController` inherits from `ActionController::Base`.
-You may want to use your own controller to inherit from, to keep Doorkeeper controllers in the same context than the rest your app:
+By default Doorkeeper's main controller `Doorkeeper::ApplicationController`
+inherits from `ActionController::Base`. You may want to use your own
+controller to inherit from, to keep Doorkeeper controllers in the same
+context than the rest your app:
 
 ```ruby
 Doorkeeper.configure do
@@ -372,7 +387,7 @@ To protect the endpoint you should uncomment these lines:
 # config/initializers/doorkeeper.rb
 Doorkeeper.configure do
   admin_authenticator do |routes|
-    Admin.find_by_id(session[:admin_id]) || redirect_to(routes.new_admin_session_url)
+    Admin.find_by(id: session[:admin_id]) || redirect_to(routes.new_admin_session_url)
   end
 end
 ```
@@ -387,6 +402,16 @@ For more information see the page
 
 - [Associate users to OAuth applications (ownership)](https://github.com/doorkeeper-gem/doorkeeper/wiki/Associate-users-to-OAuth-applications-%28ownership%29)
 - [CORS - Cross Origin Resource Sharing](https://github.com/doorkeeper-gem/doorkeeper/wiki/%5BCORS%5D-Cross-Origin-Resource-Sharing)
+- see more on [Wiki page](https://github.com/doorkeeper-gem/doorkeeper/wiki)
+
+## Testing
+
+You can use Doorkeeper models in your application test suite. Note that starting from
+Doorkeeper 4.3.0 it uses [ActiveSupport lazy loading hooks](http://api.rubyonrails.org/classes/ActiveSupport/LazyLoadHooks.html)
+to load models. There are [known issues](https://github.com/doorkeeper-gem/doorkeeper/issues/1043)
+with the `factory_bot_rails` gem (it executes factories building before `ActiveRecord::Base`
+is initialized using hooks in gem railtie, so you can catch a `uninitialized constant` error).
+It is recommended to use pure `factory_bot` gem to solve this problem. 
 
 ## Upgrading
 
@@ -413,8 +438,6 @@ tests with a specific ORM and Rails version:
 rails=4.2.0 orm=active_record bundle exec rake
 ```
 
-Or you might prefer to run `script/run_all` to integrate against all ORMs.
-
 ## Contributing
 
 Want to contribute and don't know where to start? Check out [features we're
@@ -430,7 +453,7 @@ page](https://github.com/doorkeeper-gem/doorkeeper/wiki/Contributing).
 
 ### Wiki
 
-You can find everything about doorkeeper in our [wiki
+You can find everything about Doorkeeper in our [wiki
 here](https://github.com/doorkeeper-gem/doorkeeper/wiki).
 
 ### Screencast
@@ -452,7 +475,6 @@ here](https://github.com/doorkeeper-gem/doorkeeper/wiki/Testing-your-provider-wi
 Thanks to all our [awesome
 contributors](https://github.com/doorkeeper-gem/doorkeeper/graphs/contributors)!
 
-
 ### IETF Standards
 
 * [The OAuth 2.0 Authorization Framework](http://tools.ietf.org/html/rfc6749)

data/SECURITY.md

@@ -6,7 +6,9 @@ policy as outlined below:
 
 1. Do NOT open up a GitHub issue with your report. Security reports
    should be kept private until a possible fix is determined.
-2. Send an email to Jon Moss, Doorkeeper's maintainer, at doorkeeper AT jonathanmoss.me. You should receive a prompt response.
+2. Send an email to Nikita Bulai at bulaj.nikita AT gmail.com or one of
+   the others Doorkeeper maintainers listed in gemspec. You should receive
+   a prompt response.
 3. Be patient. Since Doorkeeper is in a stable maintenance phase, we want to
    do as little as possible to rock the boat of the project.
 

data/doorkeeper.gemspec

@@ -5,8 +5,8 @@ require "doorkeeper/version"
 Gem::Specification.new do |s|
   s.name        = "doorkeeper"
   s.version     = Doorkeeper.gem_version
-  s.authors     = ["Felipe Elias Philipp", "Tute Costa", "Jon Moss"]
-  s.email       = %w(me@jonathanmoss.me)
+  s.authors     = ["Felipe Elias Philipp", "Tute Costa", "Jon Moss", "Nikita Bulai"]
+  s.email       = %w(bulaj.nikita@gmail.com)
   s.homepage    = "https://github.com/doorkeeper-gem/doorkeeper"
   s.summary     = "OAuth 2 provider for Rails and Grape"
   s.description = "Doorkeeper is an OAuth 2 provider for Rails and Grape."

data/lib/doorkeeper.rb

@@ -34,6 +34,7 @@ require 'doorkeeper/oauth/token_introspection'
 require 'doorkeeper/oauth/invalid_token_response'
 require 'doorkeeper/oauth/forbidden_token_response'
 
+require 'doorkeeper/models/concerns/orderable'
 require 'doorkeeper/models/concerns/scopes'
 require 'doorkeeper/models/concerns/expirable'
 require 'doorkeeper/models/concerns/revocable'

data/lib/doorkeeper/config.rb

@@ -192,7 +192,9 @@ doorkeeper.
              ::Rails.logger.warn(I18n.t('doorkeeper.errors.messages.credential_flow_not_configured'))
              nil
            end)
-
+    option :before_successful_strategy_response, default: ->(_request) {}
+    option :after_successful_strategy_response,
+           default: ->(_request, _response) {}
     option :skip_authorization,             default: ->(_routes) {}
     option :access_token_expires_in,        default: 7200
     option :custom_access_token_expires_in, default: ->(_app) { nil }

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -6,25 +6,8 @@ module Doorkeeper
     include Models::Expirable
     include Models::Revocable
     include Models::Accessible
+    include Models::Orderable
     include Models::Scopes
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    included do
-      belongs_to_options = {
-        class_name: 'Doorkeeper::Application',
-        inverse_of: :access_grants
-      }
-      if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
-        belongs_to_options[:optional] = true
-      end
-
-      belongs_to :application, belongs_to_options
-
-      validates :resource_owner_id, :application_id, :token, :expires_in, :redirect_uri, presence: true
-      validates :token, uniqueness: true
-
-      before_validation :generate_token, on: :create
-    end
 
     module ClassMethods
       # Searches for Doorkeeper::AccessGrant record with the
@@ -39,15 +22,5 @@ module Doorkeeper
         find_by(token: token.to_s)
       end
     end
-
-    private
-
-    # Generates token value with UniqueToken class.
-    #
-    # @return [String] token value
-    #
-    def generate_token
-      self.token = UniqueToken.generate
-    end
   end
 end

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -6,32 +6,8 @@ module Doorkeeper
     include Models::Expirable
     include Models::Revocable
     include Models::Accessible
+    include Models::Orderable
     include Models::Scopes
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    included do
-      belongs_to_options = {
-        class_name: 'Doorkeeper::Application',
-        inverse_of: :access_tokens
-      }
-      if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
-        belongs_to_options[:optional] = true
-      end
-
-      belongs_to :application, belongs_to_options
-
-      validates :token, presence: true, uniqueness: true
-      validates :refresh_token, uniqueness: true, if: :use_refresh_token?
-
-      # @attr_writer [Boolean, nil] use_refresh_token
-      #   indicates the possibility of using refresh token
-      attr_writer :use_refresh_token
-
-      before_validation :generate_token, on: :create
-      before_validation :generate_refresh_token,
-                        on: :create,
-                        if: :use_refresh_token?
-    end
 
     module ClassMethods
       # Returns an instance of the Doorkeeper::AccessToken with
@@ -110,7 +86,7 @@ module Doorkeeper
       # @param app_scopes [String]
       #   Application scopes
       #
-      # @return [Boolean] true if all scopes and blank or matches
+      # @return [Boolean] true if all scopes are blank or matches
       #   and false in other cases
       #
       def scopes_match?(token_scopes, param_scopes, app_scopes)
@@ -231,7 +207,7 @@ module Doorkeeper
     # @return [String] refresh token value
     #
     def generate_refresh_token
-      write_attribute :refresh_token, UniqueToken.generate
+      self.refresh_token = UniqueToken.generate
     end
 
     # Generates and sets the token value with the
@@ -247,12 +223,7 @@ module Doorkeeper
     def generate_token
       self.created_at ||= Time.now.utc
 
-      generator = token_generator
-      unless generator.respond_to?(:generate)
-        raise Errors::UnableToGenerateToken, "#{generator} does not respond to `.generate`."
-      end
-
-      self.token = generator.generate(
+      self.token = token_generator.generate(
         resource_owner_id: resource_owner_id,
         scopes: scopes,
         application: application,
@@ -263,7 +234,11 @@ module Doorkeeper
 
     def token_generator
       generator_name = Doorkeeper.configuration.access_token_generator
-      generator_name.constantize
+      generator = generator_name.constantize
+
+      return generator if generator.respond_to?(:generate)
+
+      raise Errors::UnableToGenerateToken, "#{generator} does not respond to `.generate`."
     rescue NameError
       raise Errors::TokenGeneratorNotFound, "#{generator_name} not found"
     end

data/lib/doorkeeper/models/application_mixin.rb

@@ -3,19 +3,8 @@ module Doorkeeper
     extend ActiveSupport::Concern
 
     include OAuth::Helpers
+    include Models::Orderable
     include Models::Scopes
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    included do
-      has_many :access_grants, dependent: :delete_all, class_name: 'Doorkeeper::AccessGrant'
-      has_many :access_tokens, dependent: :delete_all, class_name: 'Doorkeeper::AccessToken'
-
-      validates :name, :secret, :uid, presence: true
-      validates :uid, uniqueness: true
-      validates :redirect_uri, redirect_uri: true
-
-      before_validation :generate_uid, :generate_secret, on: :create
-    end
 
     module ClassMethods
       # Returns an instance of the Doorkeeper::Application with
@@ -51,20 +40,5 @@ module Doorkeeper
     def redirect_uri=(uris)
       super(uris.is_a?(Array) ? uris.join("\n") : uris)
     end
-
-    private
-
-    def has_scopes?
-      Doorkeeper.configuration.orm != :active_record ||
-        Doorkeeper::Application.column_names.include?("scopes")
-    end
-
-    def generate_uid
-      self.uid = UniqueToken.generate if uid.blank?
-    end
-
-    def generate_secret
-      self.secret = UniqueToken.generate if secret.blank?
-    end
   end
 end

data/lib/doorkeeper/models/concerns/orderable.rb

@@ -0,0 +1,13 @@
+module Doorkeeper
+  module Models
+    module Orderable
+      extend ActiveSupport::Concern
+
+      module ClassMethods
+        def ordered_by(attribute, direction = :asc)
+          order(attribute => direction)
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/base_request.rb

@@ -42,9 +42,14 @@ module Doorkeeper
         )
       end
 
-      def before_successful_response; end
+      def before_successful_response
+        Doorkeeper.configuration.before_successful_strategy_response.call(self)
+      end
 
-      def after_successful_response; end
+      def after_successful_response
+        Doorkeeper.configuration.after_successful_strategy_response.
+          call(self, @response)
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/invalid_token_response.rb

@@ -21,7 +21,7 @@ module Doorkeeper
       end
 
       def description
-        scope = { scope: [:doorkeeper, :errors, :messages, :invalid_token] }
+        scope = { scope: %i[doorkeeper errors messages invalid_token] }
         @description ||= I18n.translate @reason, scope
       end
     end

data/lib/doorkeeper/orm/active_record.rb

@@ -5,7 +5,6 @@ module Doorkeeper
     module ActiveRecord
       def self.initialize_models!
         lazy_load do
-          require 'doorkeeper/orm/active_record/base_record'
           require 'doorkeeper/orm/active_record/access_grant'
           require 'doorkeeper/orm/active_record/access_token'
           require 'doorkeeper/orm/active_record/application'

data/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -1,7 +1,34 @@
 module Doorkeeper
-  class AccessGrant < BaseRecord
+  class AccessGrant < ActiveRecord::Base
     self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}".to_sym
 
     include AccessGrantMixin
+    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
+
+    belongs_to_options = {
+      class_name: 'Doorkeeper::Application',
+      inverse_of: :access_grants
+    }
+
+    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
+      belongs_to_options[:optional] = true
+    end
+
+    belongs_to :application, belongs_to_options
+
+    validates :resource_owner_id, :application_id, :token, :expires_in, :redirect_uri, presence: true
+    validates :token, uniqueness: true
+
+    before_validation :generate_token, on: :create
+
+    private
+
+    # Generates token value with UniqueToken class.
+    #
+    # @return [String] token value
+    #
+    def generate_token
+      self.token = UniqueToken.generate
+    end
   end
 end

data/lib/doorkeeper/orm/active_record/access_token.rb

@@ -1,8 +1,31 @@
 module Doorkeeper
-  class AccessToken < BaseRecord
+  class AccessToken < ActiveRecord::Base
     self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}".to_sym
 
     include AccessTokenMixin
+    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
+
+    belongs_to_options = {
+      class_name: 'Doorkeeper::Application',
+      inverse_of: :access_tokens
+    }
+
+    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
+      belongs_to_options[:optional] = true
+    end
+
+    belongs_to :application, belongs_to_options
+
+    validates :token, presence: true, uniqueness: true
+    validates :refresh_token, uniqueness: true, if: :use_refresh_token?
+
+    # @attr_writer [Boolean, nil] use_refresh_token
+    #   indicates the possibility of using refresh token
+    attr_writer :use_refresh_token
+
+    before_validation :generate_token, on: :create
+    before_validation :generate_refresh_token,
+                      on: :create, if: :use_refresh_token?
 
     # Searches for not revoked Access Tokens associated with the
     # specific Resource Owner.

data/lib/doorkeeper/orm/active_record/application.rb

@@ -1,8 +1,18 @@
 module Doorkeeper
-  class Application < BaseRecord
+  class Application < ActiveRecord::Base
     self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}".to_sym
 
     include ApplicationMixin
+    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
+
+    has_many :access_grants, dependent: :delete_all, class_name: 'Doorkeeper::AccessGrant'
+    has_many :access_tokens, dependent: :delete_all, class_name: 'Doorkeeper::AccessToken'
+
+    validates :name, :secret, :uid, presence: true
+    validates :uid, uniqueness: true
+    validates :redirect_uri, redirect_uri: true
+
+    before_validation :generate_uid, :generate_secret, on: :create
 
     has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: 'AccessToken'
     has_many :authorized_applications, through: :authorized_tokens, source: :application
@@ -20,5 +30,15 @@ module Doorkeeper
       resource_access_tokens = AccessToken.active_for(resource_owner)
       where(id: resource_access_tokens.select(:application_id).distinct)
     end
+
+    private
+
+    def generate_uid
+      self.uid = UniqueToken.generate if uid.blank?
+    end
+
+    def generate_secret
+      self.secret = UniqueToken.generate if secret.blank?
+    end
   end
 end

data/lib/doorkeeper/version.rb

@@ -7,7 +7,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 4
     MINOR = 3
-    TINY = 0
+    TINY = 1
 
     # Full version number
     STRING = [MAJOR, MINOR, TINY].compact.join('.')

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -116,6 +116,17 @@ Doorkeeper.configure do
   #
   # grant_flows %w[authorization_code client_credentials]
 
+  # Hook into the strategies' request & response life-cycle in case your
+  # application needs advanced customization or logging:
+  #
+  # before_successful_strategy_response do |request|
+  #   puts "BEFORE HOOK FIRED! #{request}"
+  # end
+  #
+  # after_successful_strategy_response do |request, response|
+  #   puts "AFTER HOOK FIRED! #{request}, #{response}"
+  # end
+
   # Under some circumstances you might want to have applications auto-approved,
   # so that the user skips the authorization step.
   # For example if dealing with a trusted application.

data/spec/controllers/authorizations_controller_spec.rb

@@ -24,7 +24,7 @@ describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
   end
 
   def translated_error_message(key)
-    I18n.translate key, scope: [:doorkeeper, :errors, :messages]
+    I18n.translate key, scope: %i[doorkeeper errors messages]
   end
 
   let(:client)        { FactoryBot.create :application }

data/spec/controllers/tokens_controller_spec.rb

@@ -36,7 +36,7 @@ describe Doorkeeper::TokensController do
       allow(I18n).to receive(:translate).
         with(
           custom_message,
-          hash_including(scope: [:doorkeeper, :errors, :messages]),
+          hash_including(scope: %i[doorkeeper errors messages]),
         ).
         and_return('Authorization custom message')
 

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -84,6 +84,17 @@ Doorkeeper.configure do
   #
   # grant_flows %w[authorization_code client_credentials]
 
+  # Hook into the strategies' request & response life-cycle in case your
+  # application needs advanced customization or logging:
+  #
+  # before_successful_strategy_response do |request|
+  #   puts "BEFORE HOOK FIRED! #{request}"
+  # end
+  #
+  # after_successful_strategy_response do |request, response|
+  #   puts "AFTER HOOK FIRED! #{request}, #{response}"
+  # end
+
   # Under some circumstances you might want to have applications auto-approved,
   # so that the user skips the authorization step.
   # For example if dealing with a trusted application.

data/spec/lib/oauth/authorization_code_request_spec.rb

@@ -81,9 +81,9 @@ module Doorkeeper::OAuth
       expect { subject.authorize }.to_not change { Doorkeeper::AccessToken.count }
     end
 
-    it "calls BaseRequest callback methods" do
-      expect_any_instance_of(BaseRequest).to receive(:before_successful_response).once
-      expect_any_instance_of(BaseRequest).to receive(:after_successful_response).once
+    it "calls configured request callback methods" do
+      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
+      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
       subject.authorize
     end
 

data/spec/lib/oauth/base_request_spec.rb

@@ -69,7 +69,7 @@ module Doorkeeper::OAuth
         it "returns an ErrorResponse object" do
           error_description = I18n.translate(
             "server_error",
-            scope: [:doorkeeper, :errors, :messages]
+            scope: %i[doorkeeper errors messages]
           )
 
           result = subject.authorize

data/spec/lib/oauth/error_spec.rb

@@ -13,7 +13,7 @@ module Doorkeeper::OAuth
       it 'is translated from translation messages' do
         expect(I18n).to receive(:translate).with(
           :some_error,
-          scope: [:doorkeeper, :errors, :messages],
+          scope: %i[doorkeeper errors messages],
           default: :server_error
         )
         error.description

data/spec/lib/oauth/password_access_token_request_spec.rb

@@ -67,9 +67,9 @@ module Doorkeeper::OAuth
       end.to_not change { Doorkeeper::AccessToken.count }
     end
 
-    it "calls BaseRequest callback methods" do
-      expect_any_instance_of(BaseRequest).to receive(:before_successful_response).once
-      expect_any_instance_of(BaseRequest).to receive(:after_successful_response).once
+    it "calls configured request callback methods" do
+      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
+      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
       subject.authorize
     end
 

data/spec/lib/oauth/refresh_token_request_spec.rb

@@ -44,9 +44,9 @@ module Doorkeeper::OAuth
       expect { subject.authorize }.to change { refresh_token.revoked? }.from(false).to(true)
     end
 
-    it "calls BaseRequest callback methods" do
-      expect_any_instance_of(BaseRequest).to receive(:before_successful_response).once
-      expect_any_instance_of(BaseRequest).to receive(:after_successful_response).once
+    it "calls configured request callback methods" do
+      expect(Doorkeeper.configuration.before_successful_strategy_response).to receive(:call).with(subject).once
+      expect(Doorkeeper.configuration.after_successful_strategy_response).to receive(:call).with(subject, instance_of(Doorkeeper::OAuth::TokenResponse)).once
       subject.authorize
     end
 

data/spec/requests/flows/client_credentials_spec.rb

@@ -22,6 +22,7 @@ describe 'Client Credentials Request' do
     context 'with scopes' do
       before do
         optional_scopes_exist :write
+        default_scopes_exist :public
       end
 
       it 'adds the scope to the token an returns in the response' do
@@ -33,6 +34,33 @@ describe 'Client Credentials Request' do
         should_have_json 'access_token', Doorkeeper::AccessToken.first.token
         should_have_json 'scope', 'write'
       end
+
+      context 'that are default' do
+        it 'adds the scope to the token an returns in the response' do
+          headers = authorization client.uid, client.secret
+          params  = { grant_type: 'client_credentials', scope: 'public' }
+
+          post '/oauth/token', params, headers
+
+          should_have_json 'access_token', Doorkeeper::AccessToken.first.token
+          should_have_json 'scope', 'public'
+        end
+      end
+
+      context 'that are invalid' do
+        it 'does not authorize the client and returns the error' do
+          headers = authorization client.uid, client.secret
+          params  = { grant_type: 'client_credentials', scope: 'random' }
+
+          post '/oauth/token', params, headers
+
+          should_have_json 'error', 'invalid_scope'
+          should_have_json 'error_description', translated_error_message(:invalid_scope)
+          should_not_have_json 'access_token'
+
+          expect(response.status).to eq(401)
+        end
+      end
     end
   end
 

data/spec/requests/flows/password_spec.rb

@@ -77,6 +77,45 @@ describe 'Resource Owner Password Credentials Flow' do
       expect(Doorkeeper::AccessToken.count).to be(1)
       should_have_json 'access_token', Doorkeeper::AccessToken.first.token
     end
+
+    context 'with valid, default scope' do
+      before do
+        default_scopes_exist :public
+      end
+
+      it 'should issue new token' do
+        expect do
+          post password_token_endpoint_url(client: @client, resource_owner: @resource_owner, scope: 'public')
+        end.to change { Doorkeeper::AccessToken.count }.by(1)
+
+        token = Doorkeeper::AccessToken.first
+
+        expect(token.application_id).to eq @client.id
+        should_have_json 'access_token', token.token
+        should_have_json 'scope', 'public'
+      end
+    end
+  end
+
+  context 'with invalid scopes' do
+    subject do
+      post password_token_endpoint_url(client: @client,
+                                       resource_owner: @resource_owner,
+                                       scope: 'random')
+    end
+
+    it 'should not issue new token' do
+      expect { subject }.to_not(change { Doorkeeper::AccessToken.count })
+    end
+
+    it 'should return invalid_scope error' do
+      subject
+      should_have_json 'error', 'invalid_scope'
+      should_have_json 'error_description', translated_error_message(:invalid_scope)
+      should_not_have_json 'access_token'
+
+      expect(response.status).to eq(401)
+    end
   end
 
   context 'with invalid user credentials' do

data/spec/support/helpers/request_spec_helper.rb

@@ -77,7 +77,7 @@ module RequestSpecHelper
   end
 
   def translated_error_message(key)
-    I18n.translate key, scope: [:doorkeeper, :errors, :messages]
+    I18n.translate key, scope: %i[doorkeeper errors messages]
   end
 
   def response_status_should_be(status)

data/spec/support/helpers/url_helper.rb

@@ -17,6 +17,7 @@ module UrlHelper
       client_secret: options[:client_secret] || (options[:client] ? options[:client].secret : nil),
       username: options[:resource_owner_username] || (options[:resource_owner] ? options[:resource_owner].name : nil),
       password: options[:resource_owner_password] || (options[:resource_owner] ? options[:resource_owner].password : nil),
+      scope: options[:scope],
       grant_type: 'password'
     }
     "/oauth/token?#{build_query(parameters)}"

metadata

@@ -1,16 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 4.3.0
+  version: 4.3.1
 platform: ruby
 authors:
 - Felipe Elias Philipp
 - Tute Costa
 - Jon Moss
+- Nikita Bulai
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-02-23 00:00:00.000000000 Z
+date: 2018-03-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -140,7 +141,7 @@ dependencies:
         version: '0'
 description: Doorkeeper is an OAuth 2 provider for Rails and Grape.
 email:
-- me@jonathanmoss.me
+- bulaj.nikita@gmail.com
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -206,6 +207,7 @@ files:
 - lib/doorkeeper/models/application_mixin.rb
 - lib/doorkeeper/models/concerns/accessible.rb
 - lib/doorkeeper/models/concerns/expirable.rb
+- lib/doorkeeper/models/concerns/orderable.rb
 - lib/doorkeeper/models/concerns/ownership.rb
 - lib/doorkeeper/models/concerns/revocable.rb
 - lib/doorkeeper/models/concerns/scopes.rb
@@ -242,7 +244,6 @@ files:
 - lib/doorkeeper/orm/active_record/access_grant.rb
 - lib/doorkeeper/orm/active_record/access_token.rb
 - lib/doorkeeper/orm/active_record/application.rb
-- lib/doorkeeper/orm/active_record/base_record.rb
 - lib/doorkeeper/rails/helpers.rb
 - lib/doorkeeper/rails/routes.rb
 - lib/doorkeeper/rails/routes/mapper.rb
@@ -412,7 +413,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.5.2.2
+rubygems_version: 2.6.11
 signing_key: 
 specification_version: 4
 summary: OAuth 2 provider for Rails and Grape

data/lib/doorkeeper/orm/active_record/base_record.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  class BaseRecord < ActiveRecord::Base
-    self.abstract_class = true
-
-    def self.ordered_by(attribute, direction = :asc)
-      order(attribute => direction)
-    end
-  end
-end