doorkeeper 4.4.0 → 5.6.6

data/lib/doorkeeper/oauth/token_request.rb

@@ -1,36 +1,24 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenRequest
-      attr_accessor :pre_auth, :resource_owner
+      attr_reader :pre_auth, :resource_owner
 
       def initialize(pre_auth, resource_owner)
-        @pre_auth       = pre_auth
+        @pre_auth = pre_auth
         @resource_owner = resource_owner
       end
 
       def authorize
-        if pre_auth.authorizable?
-          auth = Authorization::Token.new(pre_auth, resource_owner)
-          auth.issue_token
-          @response = CodeResponse.new pre_auth,
-                                       auth,
-                                       response_on_fragment: true
-        else
-          @response = error_response
-        end
+        auth = Authorization::Token.new(pre_auth, resource_owner)
+        auth.issue_token!
+        CodeResponse.new(pre_auth, auth, response_on_fragment: true)
       end
 
       def deny
         pre_auth.error = :access_denied
-        error_response
-      end
-
-      private
-
-      def error_response
-        ErrorResponse.from_request pre_auth,
-                                   redirect_uri: pre_auth.redirect_uri,
-                                   response_on_fragment: true
+        pre_auth.error_response
       end
     end
   end

data/lib/doorkeeper/oauth/token_response.rb

@@ -1,7 +1,9 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenResponse
-      attr_accessor :token
+      attr_reader :token
 
       def initialize(token)
         @token = token
@@ -9,12 +11,12 @@ module Doorkeeper
 
       def body
         {
-          'access_token'  => token.token,
-          'token_type'    => token.token_type,
-          'expires_in'    => token.expires_in_seconds,
-          'refresh_token' => token.refresh_token,
-          'scope'         => token.scopes_string,
-          'created_at'    => token.created_at.to_i
+          "access_token" => token.plaintext_token,
+          "token_type" => token.token_type,
+          "expires_in" => token.expires_in_seconds,
+          "refresh_token" => token.plaintext_refresh_token,
+          "scope" => token.scopes_string,
+          "created_at" => token.created_at.to_i,
         }.reject { |_, value| value.blank? }
       end
 
@@ -23,9 +25,10 @@ module Doorkeeper
       end
 
       def headers
-        { 'Cache-Control' => 'no-store',
-          'Pragma' => 'no-cache',
-          'Content-Type' => 'application/json; charset=utf-8' }
+        {
+          "Cache-Control" => "no-store, no-cache",
+          "Content-Type" => "application/json; charset=utf-8",
+        }
       end
     end
   end

data/lib/doorkeeper/oauth.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    GRANT_TYPES = [
+      AUTHORIZATION_CODE = "authorization_code",
+      IMPLICIT = "implicit",
+      PASSWORD = "password",
+      CLIENT_CREDENTIALS = "client_credentials",
+      REFRESH_TOKEN = "refresh_token",
+    ].freeze
+  end
+end

data/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -1,34 +1,9 @@
-module Doorkeeper
-  class AccessGrant < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}".to_sym
-
-    include AccessGrantMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    belongs_to_options = {
-      class_name: 'Doorkeeper::Application',
-      inverse_of: :access_grants
-    }
-
-    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
-      belongs_to_options[:optional] = true
-    end
+# frozen_string_literal: true
 
-    belongs_to :application, belongs_to_options
+require "doorkeeper/orm/active_record/mixins/access_grant"
 
-    validates :resource_owner_id, :application_id, :token, :expires_in, :redirect_uri, presence: true
-    validates :token, uniqueness: true
-
-    before_validation :generate_token, on: :create
-
-    private
-
-    # Generates token value with UniqueToken class.
-    #
-    # @return [String] token value
-    #
-    def generate_token
-      self.token = UniqueToken.generate
-    end
+module Doorkeeper
+  class AccessGrant < ::ActiveRecord::Base
+    include Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant
   end
 end

data/lib/doorkeeper/orm/active_record/access_token.rb

@@ -1,47 +1,9 @@
-module Doorkeeper
-  class AccessToken < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}".to_sym
-
-    include AccessTokenMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    belongs_to_options = {
-      class_name: 'Doorkeeper::Application',
-      inverse_of: :access_tokens
-    }
-
-    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
-      belongs_to_options[:optional] = true
-    end
-
-    belongs_to :application, belongs_to_options
+# frozen_string_literal: true
 
-    validates :token, presence: true, uniqueness: true
-    validates :refresh_token, uniqueness: true, if: :use_refresh_token?
+require "doorkeeper/orm/active_record/mixins/access_token"
 
-    # @attr_writer [Boolean, nil] use_refresh_token
-    #   indicates the possibility of using refresh token
-    attr_writer :use_refresh_token
-
-    before_validation :generate_token, on: :create
-    before_validation :generate_refresh_token,
-                      on: :create, if: :use_refresh_token?
-
-    # Searches for not revoked Access Tokens associated with the
-    # specific Resource Owner.
-    #
-    # @param resource_owner [ActiveRecord::Base]
-    #   Resource Owner model instance
-    #
-    # @return [ActiveRecord::Relation]
-    #   active Access Tokens for Resource Owner
-    #
-    def self.active_for(resource_owner)
-      where(resource_owner_id: resource_owner.id, revoked_at: nil)
-    end
-
-    def self.refresh_token_revoked_on_use?
-      column_names.include?('previous_refresh_token')
-    end
+module Doorkeeper
+  class AccessToken < ::ActiveRecord::Base
+    include Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken
   end
 end

data/lib/doorkeeper/orm/active_record/application.rb

@@ -1,61 +1,10 @@
-module Doorkeeper
-  class Application < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}".to_sym
-
-    include ApplicationMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    has_many :access_grants, dependent: :delete_all, class_name: 'Doorkeeper::AccessGrant'
-    has_many :access_tokens, dependent: :delete_all, class_name: 'Doorkeeper::AccessToken'
-
-    validates :name, :secret, :uid, presence: true
-    validates :uid, uniqueness: true
-    validates :redirect_uri, redirect_uri: true
-    validates :confidential, inclusion: { in: [true, false] }
-
-    before_validation :generate_uid, :generate_secret, on: :create
-
-    has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: 'AccessToken'
-    has_many :authorized_applications, through: :authorized_tokens, source: :application
+# frozen_string_literal: true
 
-    # Returns Applications associated with active (not revoked) Access Tokens
-    # that are owned by the specific Resource Owner.
-    #
-    # @param resource_owner [ActiveRecord::Base]
-    #   Resource Owner model instance
-    #
-    # @return [ActiveRecord::Relation]
-    #   Applications authorized for the Resource Owner
-    #
-    def self.authorized_for(resource_owner)
-      resource_access_tokens = AccessToken.active_for(resource_owner)
-      where(id: resource_access_tokens.select(:application_id).distinct)
-    end
+require "doorkeeper/orm/active_record/redirect_uri_validator"
+require "doorkeeper/orm/active_record/mixins/application"
 
-    # Fallback to existing, default behaviour of assuming all apps to be
-    # confidential if the migration hasn't been run
-    def confidential
-      return super if self.class.supports_confidentiality?
-      ActiveSupport::Deprecation.warn 'You are susceptible to security bug ' \
-        'CVE-2018-1000211. Please follow instructions outlined in ' \
-        'Doorkeeper::CVE_2018_1000211_WARNING'
-      true
-    end
-
-    alias_method :confidential?, :confidential
-
-    def self.supports_confidentiality?
-      column_names.include?('confidential')
-    end
-
-    private
-
-    def generate_uid
-      self.uid = UniqueToken.generate if uid.blank?
-    end
-
-    def generate_secret
-      self.secret = UniqueToken.generate if secret.blank?
-    end
+module Doorkeeper
+  class Application < ::ActiveRecord::Base
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::Application
   end
 end

data/lib/doorkeeper/orm/active_record/mixins/access_grant.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+module Doorkeeper::Orm::ActiveRecord::Mixins
+  module AccessGrant
+    extend ActiveSupport::Concern
+
+    included do
+      self.table_name = compute_doorkeeper_table_name
+      self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
+
+      include ::Doorkeeper::AccessGrantMixin
+
+      belongs_to :application, class_name: Doorkeeper.config.application_class.to_s,
+                               optional: true,
+                               inverse_of: :access_grants
+
+      validates :application_id,
+                :token,
+                :expires_in,
+                :redirect_uri,
+                presence: true
+
+      validates :token, uniqueness: { case_sensitive: true }
+
+      before_validation :generate_token, on: :create
+
+      # We keep a volatile copy of the raw token for initial communication
+      # The stored refresh_token may be mapped and not available in cleartext.
+      #
+      # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+      # while hashing strategies do not, so you cannot rely on this value
+      # returning a present value for persisted tokens.
+      def plaintext_token
+        if secret_strategy.allows_restoring_secrets?
+          secret_strategy.restore_secret(self, :token)
+        else
+          @raw_token
+        end
+      end
+
+      private
+
+      # Generates token value with UniqueToken class.
+      #
+      # @return [String] token value
+      #
+      def generate_token
+        @raw_token = Doorkeeper::OAuth::Helpers::UniqueToken.generate
+        secret_strategy.store_secret(self, :token, @raw_token)
+      end
+    end
+
+    module ClassMethods
+      private
+
+      def compute_doorkeeper_table_name
+        table_name = "oauth_access_grant"
+        table_name = table_name.pluralize if pluralize_table_names
+        "#{table_name_prefix}#{table_name}#{table_name_suffix}"
+      end
+    end
+  end
+end

data/lib/doorkeeper/orm/active_record/mixins/access_token.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module Doorkeeper::Orm::ActiveRecord::Mixins
+  module AccessToken
+    extend ActiveSupport::Concern
+
+    included do
+      self.table_name = compute_doorkeeper_table_name
+      self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
+
+      include ::Doorkeeper::AccessTokenMixin
+
+      belongs_to :application, class_name: Doorkeeper.config.application_class.to_s,
+                               inverse_of: :access_tokens,
+                               optional: true
+
+      validates :token, presence: true, uniqueness: { case_sensitive: true }
+      validates :refresh_token, uniqueness: { case_sensitive: true }, if: :use_refresh_token?
+
+      # @attr_writer [Boolean, nil] use_refresh_token
+      #   indicates the possibility of using refresh token
+      attr_writer :use_refresh_token
+
+      before_validation :generate_token, on: :create
+      before_validation :generate_refresh_token,
+                        on: :create, if: :use_refresh_token?
+    end
+
+    module ClassMethods
+      # Searches for not revoked Access Tokens associated with the
+      # specific Resource Owner.
+      #
+      # @param resource_owner [ActiveRecord::Base]
+      #   Resource Owner model instance
+      #
+      # @return [ActiveRecord::Relation]
+      #   active Access Tokens for Resource Owner
+      #
+      def active_for(resource_owner)
+        by_resource_owner(resource_owner).where(revoked_at: nil)
+      end
+
+      def refresh_token_revoked_on_use?
+        column_names.include?("previous_refresh_token")
+      end
+
+      # Returns non-expired and non-revoked access tokens
+      def not_expired
+        relation = where(revoked_at: nil)
+
+        if supports_expiration_time_math?
+          # have not reached the expiration time or it never expires
+          relation.where("#{expiration_time_sql} > ?", Time.now.utc).or(
+            relation.where(expires_in: nil)
+          )
+        else
+          ::Kernel.warn <<~WARNING.squish
+            [DOORKEEPER] Doorkeeper doesn't support expiration time math for your database adapter (#{adapter_name}).
+            Please add a class method `custom_expiration_time_sql` for your AccessToken class/mixin to provide a custom
+            SQL expression to calculate access token expiration time. See lib/doorkeeper/orm/active_record/mixins/access_token.rb
+            for more details.
+          WARNING
+
+          relation
+        end
+      end
+
+      private
+
+      def compute_doorkeeper_table_name
+        table_name = "oauth_access_token"
+        table_name = table_name.pluralize if pluralize_table_names
+        "#{table_name_prefix}#{table_name}#{table_name_suffix}"
+      end
+    end
+  end
+end

data/lib/doorkeeper/orm/active_record/mixins/application.rb

@@ -0,0 +1,210 @@
+# frozen_string_literal: true
+
+module Doorkeeper::Orm::ActiveRecord::Mixins
+  module Application
+    extend ActiveSupport::Concern
+
+    included do
+      self.table_name = compute_doorkeeper_table_name
+      self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
+
+      include ::Doorkeeper::ApplicationMixin
+
+      has_many :access_grants,
+               foreign_key: :application_id,
+               dependent: :delete_all,
+               class_name: Doorkeeper.config.access_grant_class.to_s
+
+      has_many :access_tokens,
+               foreign_key: :application_id,
+               dependent: :delete_all,
+               class_name: Doorkeeper.config.access_token_class.to_s
+
+      validates :name, :secret, :uid, presence: true
+      validates :uid, uniqueness: { case_sensitive: true }
+      validates :redirect_uri, "doorkeeper/redirect_uri": true
+      validates :confidential, inclusion: { in: [true, false] }
+
+      validate :scopes_match_configured, if: :enforce_scopes?
+
+      before_validation :generate_uid, :generate_secret, on: :create
+
+      has_many :authorized_tokens,
+               -> { where(revoked_at: nil) },
+               foreign_key: :application_id,
+               class_name: Doorkeeper.config.access_token_class.to_s
+
+      has_many :authorized_applications,
+               through: :authorized_tokens,
+               source: :application
+
+      # Generates a new secret for this application, intended to be used
+      # for rotating the secret or in case of compromise.
+      #
+      # @return [String] new transformed secret value
+      #
+      def renew_secret
+        @raw_secret = secret_generator.generate
+        secret_strategy.store_secret(self, :secret, @raw_secret)
+      end
+
+      # We keep a volatile copy of the raw secret for initial communication
+      # The stored refresh_token may be mapped and not available in cleartext.
+      #
+      # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+      # while hashing strategies do not, so you cannot rely on this value
+      # returning a present value for persisted tokens.
+      def plaintext_secret
+        if secret_strategy.allows_restoring_secrets?
+          secret_strategy.restore_secret(self, :secret)
+        else
+          @raw_secret
+        end
+      end
+
+      # Represents client as set of it's attributes in JSON format.
+      # This is the right way how we want to override ActiveRecord #to_json.
+      #
+      # Respects privacy settings and serializes minimum set of attributes
+      # for public/private clients and full set for authorized owners.
+      #
+      # @return [Hash] entity attributes for JSON
+      #
+      def as_json(options = {})
+        # if application belongs to some owner we need to check if it's the same as
+        # the one passed in the options or check if we render the client as an owner
+        if (respond_to?(:owner) && owner && owner == options[:current_resource_owner]) ||
+           options[:as_owner]
+          # Owners can see all the client attributes, fallback to ActiveModel serialization
+          super
+        else
+          # if application has no owner or it's owner doesn't match one from the options
+          # we render only minimum set of attributes that could be exposed to a public
+          only = extract_serializable_attributes(options)
+          super(options.merge(only: only))
+        end
+      end
+
+      def authorized_for_resource_owner?(resource_owner)
+        Doorkeeper.configuration.authorize_resource_owner_for_client.call(self, resource_owner)
+      end
+
+      # We need to hook into this method to allow serializing plan-text secrets
+      # when secrets hashing enabled.
+      #
+      # @param key [String] attribute name
+      #
+      def read_attribute_for_serialization(key)
+        return super unless key.to_s == "secret"
+
+        plaintext_secret || secret
+      end
+
+      private
+
+      def secret_generator
+        generator_name = Doorkeeper.config.application_secret_generator
+        generator = generator_name.constantize
+
+        return generator if generator.respond_to?(:generate)
+
+        raise Errors::UnableToGenerateToken, "#{generator} does not respond to `.generate`."
+      rescue NameError
+        raise Errors::TokenGeneratorNotFound, "#{generator_name} not found"
+      end
+
+      def generate_uid
+        self.uid = Doorkeeper::OAuth::Helpers::UniqueToken.generate if uid.blank?
+      end
+
+      def generate_secret
+        return if secret.present?
+
+        renew_secret
+      end
+
+      def scopes_match_configured
+        if scopes.present? && !Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
+          scope_str: scopes.to_s,
+          server_scopes: Doorkeeper.config.scopes,
+        )
+          errors.add(:scopes, :not_match_configured)
+        end
+      end
+
+      def enforce_scopes?
+        Doorkeeper.config.enforce_configured_scopes?
+      end
+
+      # Helper method to extract collection of serializable attribute names
+      # considering serialization options (like `only`, `except` and so on).
+      #
+      # @param options [Hash] serialization options
+      #
+      # @return [Array<String>]
+      #   collection of attributes to be serialized using #as_json
+      #
+      def extract_serializable_attributes(options = {})
+        opts = options.try(:dup) || {}
+        only = Array.wrap(opts[:only]).map(&:to_s)
+
+        only = if only.blank?
+                 client_serializable_attributes
+               else
+                 only & client_serializable_attributes
+               end
+
+        only -= Array.wrap(opts[:except]).map(&:to_s) if opts.key?(:except)
+        only.uniq
+      end
+
+      # Collection of attributes that could be serialized for public.
+      # Override this method if you need additional attributes to be serialized.
+      #
+      # @return [Array<String>] collection of serializable attributes
+      #
+      # NOTE: `serializable_attributes` method already taken by Rails >= 6
+      #
+      def client_serializable_attributes
+        attributes = %w[id name created_at]
+        attributes << "uid" unless confidential?
+        attributes
+      end
+    end
+
+    module ClassMethods
+      # Returns Applications associated with active (not revoked) Access Tokens
+      # that are owned by the specific Resource Owner.
+      #
+      # @param resource_owner [ActiveRecord::Base]
+      #   Resource Owner model instance
+      #
+      # @return [ActiveRecord::Relation]
+      #   Applications authorized for the Resource Owner
+      #
+      def authorized_for(resource_owner)
+        resource_access_tokens = Doorkeeper.config.access_token_model.active_for(resource_owner)
+        where(id: resource_access_tokens.select(:application_id).distinct)
+      end
+
+      # Revokes AccessToken and AccessGrant records that have not been revoked and
+      # associated with the specific Application and Resource Owner.
+      #
+      # @param resource_owner [ActiveRecord::Base]
+      #   instance of the Resource Owner model
+      #
+      def revoke_tokens_and_grants_for(id, resource_owner)
+        Doorkeeper.config.access_token_model.revoke_all_for(id, resource_owner)
+        Doorkeeper.config.access_grant_model.revoke_all_for(id, resource_owner)
+      end
+
+      private
+
+      def compute_doorkeeper_table_name
+        table_name = "oauth_application"
+        table_name = table_name.pluralize if pluralize_table_names
+        "#{table_name_prefix}#{table_name}#{table_name_suffix}"
+      end
+    end
+  end
+end

data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Doorkeeper
+  # ActiveModel validator for redirect URI validation in according
+  # to OAuth standards and Doorkeeper configuration.
+  class RedirectUriValidator < ActiveModel::EachValidator
+    def validate_each(record, attribute, value)
+      if value.blank?
+        return if Doorkeeper.config.allow_blank_redirect_uri?(record)
+
+        record.errors.add(attribute, :blank)
+      else
+        value.split.each do |val|
+          next if oob_redirect_uri?(val)
+
+          uri = ::URI.parse(val)
+          record.errors.add(attribute, :forbidden_uri) if forbidden_uri?(uri)
+          record.errors.add(attribute, :fragment_present) unless uri.fragment.nil?
+          record.errors.add(attribute, :unspecified_scheme) if unspecified_scheme?(uri)
+          record.errors.add(attribute, :relative_uri) if relative_uri?(uri)
+          record.errors.add(attribute, :secured_uri) if invalid_ssl_uri?(uri)
+          record.errors.add(attribute, :invalid_uri) if unspecified_host?(uri)
+        end
+      end
+    rescue URI::InvalidURIError
+      record.errors.add(attribute, :invalid_uri)
+    end
+
+    private
+
+    def oob_redirect_uri?(uri)
+      Doorkeeper::OAuth::NonStandard::IETF_WG_OAUTH2_OOB_METHODS.include?(uri)
+    end
+
+    def forbidden_uri?(uri)
+      Doorkeeper.config.forbid_redirect_uri.call(uri)
+    end
+
+    def unspecified_scheme?(uri)
+      return true if uri.opaque.present?
+
+      %w[localhost].include?(uri.try(:scheme))
+    end
+
+    def unspecified_host?(uri)
+      uri.is_a?(URI::HTTP) && uri.host.blank?
+    end
+
+    def relative_uri?(uri)
+      uri.scheme.nil? && uri.host.blank?
+    end
+
+    def invalid_ssl_uri?(uri)
+      forces_ssl = Doorkeeper.config.force_ssl_in_redirect_uri
+      non_https = uri.try(:scheme) == "http"
+
+      if forces_ssl.respond_to?(:call)
+        forces_ssl.call(uri) && non_https
+      else
+        forces_ssl && non_https
+      end
+    end
+  end
+end