doorkeeper 4.4.0 → 5.6.6

data/app/controllers/doorkeeper/applications_controller.rb

@@ -1,64 +1,99 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class ApplicationsController < Doorkeeper::ApplicationController
-    layout 'doorkeeper/admin'
+    layout "doorkeeper/admin" unless Doorkeeper.configuration.api_only
 
     before_action :authenticate_admin!
-    before_action :set_application, only: [:show, :edit, :update, :destroy]
+    before_action :set_application, only: %i[show edit update destroy]
 
     def index
-      @applications = if Application.respond_to?(:ordered_by)
-                        Application.ordered_by(:created_at)
-                      else
-                        ActiveSupport::Deprecation.warn <<-MSG.squish
-                          Doorkeeper #{Doorkeeper.configuration.orm} extension must implement #ordered_by
-                          method for it's models as it will be used by default in Doorkeeper 5.
-                        MSG
-
-                        Application.all
-                      end
+      @applications = Doorkeeper.config.application_model.ordered_by(:created_at)
+
+      respond_to do |format|
+        format.html
+        format.json { head :no_content }
+      end
     end
 
-    def show; end
+    def show
+      respond_to do |format|
+        format.html
+        format.json { render json: @application, as_owner: true }
+      end
+    end
 
     def new
-      @application = Application.new
+      @application = Doorkeeper.config.application_model.new
     end
 
     def create
-      @application = Application.new(application_params)
+      @application = Doorkeeper.config.application_model.new(application_params)
+
       if @application.save
-        flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :create])
-        redirect_to oauth_application_url(@application)
+        flash[:notice] = I18n.t(:notice, scope: %i[doorkeeper flash applications create])
+        flash[:application_secret] = @application.plaintext_secret
+
+        respond_to do |format|
+          format.html { redirect_to oauth_application_url(@application) }
+          format.json { render json: @application, as_owner: true }
+        end
       else
-        render :new
+        respond_to do |format|
+          format.html { render :new }
+          format.json do
+            errors = @application.errors.full_messages
+
+            render json: { errors: errors }, status: :unprocessable_entity
+          end
+        end
       end
     end
 
     def edit; end
 
     def update
-      if @application.update_attributes(application_params)
-        flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :update])
-        redirect_to oauth_application_url(@application)
+      if @application.update(application_params)
+        flash[:notice] = I18n.t(:notice, scope: i18n_scope(:update))
+
+        respond_to do |format|
+          format.html { redirect_to oauth_application_url(@application) }
+          format.json { render json: @application, as_owner: true }
+        end
       else
-        render :edit
+        respond_to do |format|
+          format.html { render :edit }
+          format.json do
+            errors = @application.errors.full_messages
+
+            render json: { errors: errors }, status: :unprocessable_entity
+          end
+        end
       end
     end
 
     def destroy
-      flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :destroy]) if @application.destroy
-      redirect_to oauth_applications_url
+      flash[:notice] = I18n.t(:notice, scope: i18n_scope(:destroy)) if @application.destroy
+
+      respond_to do |format|
+        format.html { redirect_to oauth_applications_url }
+        format.json { head :no_content }
+      end
     end
 
     private
 
     def set_application
-      @application = Application.find(params[:id])
+      @application = Doorkeeper.config.application_model.find(params[:id])
     end
 
     def application_params
-      params.require(:doorkeeper_application).
-        permit(:name, :redirect_uri, :scopes, :confidential)
+      params.require(:doorkeeper_application)
+        .permit(:name, :redirect_uri, :scopes, :confidential)
+    end
+
+    def i18n_scope(action)
+      %i[doorkeeper flash applications] << action
     end
   end
 end

data/app/controllers/doorkeeper/authorizations_controller.rb

@@ -1,49 +1,115 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AuthorizationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!
 
     def new
       if pre_auth.authorizable?
-        if skip_authorization? || matching_token?
-          auth = authorization.authorize
-          redirect_to auth.redirect_uri
-        else
-          render :new
-        end
+        render_success
       else
-        render :error
+        render_error
       end
     end
 
-    # TODO: Handle raise invalid authorization
     def create
-      redirect_or_render authorization.authorize
+      redirect_or_render(authorize_response)
     end
 
     def destroy
-      redirect_or_render authorization.deny
+      redirect_or_render(authorization.deny)
+    rescue Doorkeeper::Errors::InvalidTokenStrategy => e
+      error_response = get_error_response_from_exception(e)
+
+      if Doorkeeper.configuration.api_only
+        render json: error_response.body, status: :bad_request
+      else
+        render :error, locals: { error_response: error_response }
+      end
     end
 
     private
 
+    def render_success
+      if skip_authorization? || (matching_token? && pre_auth.client.application.confidential?)
+        redirect_or_render(authorize_response)
+      elsif Doorkeeper.configuration.api_only
+        render json: pre_auth
+      else
+        render :new
+      end
+    end
+
+    def render_error
+      if Doorkeeper.configuration.api_only
+        render json: pre_auth.error_response.body,
+               status: :bad_request
+      else
+        render :error, locals: { error_response: pre_auth.error_response }
+      end
+    end
+
+    # Active access token issued for the same client and resource owner with
+    # the same set of the scopes exists?
     def matching_token?
-      AccessToken.matching_token_for pre_auth.client,
-                                     current_resource_owner.id,
-                                     pre_auth.scopes
+      Doorkeeper.config.access_token_model.matching_token_for(
+        pre_auth.client,
+        current_resource_owner,
+        pre_auth.scopes,
+      )
     end
 
     def redirect_or_render(auth)
       if auth.redirectable?
-        redirect_to auth.redirect_uri
+        if Doorkeeper.configuration.api_only
+          if pre_auth.form_post_response?
+            render(
+              json: { status: :post, redirect_uri: pre_auth.redirect_uri, body: auth.body },
+              status: auth.status,
+            )
+          else
+            render(
+              json: { status: :redirect, redirect_uri: auth.redirect_uri },
+              status: auth.status,
+            )
+          end
+        elsif pre_auth.form_post_response?
+          render :form_post
+        else
+          redirect_to auth.redirect_uri, allow_other_host: true
+        end
       else
         render json: auth.body, status: auth.status
       end
     end
 
     def pre_auth
-      @pre_auth ||= OAuth::PreAuthorization.new(Doorkeeper.configuration,
-                                                server.client_via_uid,
-                                                params)
+      @pre_auth ||= OAuth::PreAuthorization.new(
+        Doorkeeper.configuration,
+        pre_auth_params,
+        current_resource_owner,
+      )
+    end
+
+    def pre_auth_params
+      params.slice(*pre_auth_param_fields).permit(*pre_auth_param_fields)
+    end
+
+    def pre_auth_param_fields
+      custom_access_token_attributes + %i[
+        client_id
+        code_challenge
+        code_challenge_method
+        response_type
+        response_mode
+        redirect_uri
+        scope
+        state
+      ]
+    end
+
+    def custom_access_token_attributes
+      Doorkeeper.config.custom_access_token_attributes.map(&:to_sym)
     end
 
     def authorization
@@ -51,7 +117,35 @@ module Doorkeeper
     end
 
     def strategy
-      @strategy ||= server.authorization_request pre_auth.response_type
+      @strategy ||= server.authorization_request(pre_auth.response_type)
+    end
+
+    def authorize_response
+      @authorize_response ||= begin
+        return pre_auth.error_response unless pre_auth.authorizable?
+
+        context = build_context(pre_auth: pre_auth)
+        before_successful_authorization(context)
+
+        auth = strategy.authorize
+
+        context = build_context(auth: auth)
+        after_successful_authorization(context)
+
+        auth
+      end
+    end
+
+    def build_context(**attributes)
+      Doorkeeper::OAuth::Hooks::Context.new(**attributes)
+    end
+
+    def before_successful_authorization(context = nil)
+      Doorkeeper.config.before_successful_authorization.call(self, context)
+    end
+
+    def after_successful_authorization(context)
+      Doorkeeper.config.after_successful_authorization.call(self, context)
     end
   end
 end

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -1,14 +1,33 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AuthorizedApplicationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!
 
     def index
-      @applications = Application.authorized_for(current_resource_owner)
+      @applications = Doorkeeper.config.application_model.authorized_for(current_resource_owner)
+
+      respond_to do |format|
+        format.html
+        format.json { render json: @applications, current_resource_owner: current_resource_owner }
+      end
     end
 
     def destroy
-      AccessToken.revoke_all_for params[:id], current_resource_owner
-      redirect_to oauth_authorized_applications_url, notice: I18n.t(:notice, scope: [:doorkeeper, :flash, :authorized_applications, :destroy])
+      Doorkeeper.config.application_model.revoke_tokens_and_grants_for(
+        params[:id],
+        current_resource_owner,
+      )
+
+      respond_to do |format|
+        format.html do
+          redirect_to oauth_authorized_applications_url, notice: I18n.t(
+            :notice, scope: %i[doorkeeper flash authorized_applications destroy],
+          )
+        end
+
+        format.json { head :no_content }
+      end
     end
   end
 end

data/app/controllers/doorkeeper/token_info_controller.rb

@@ -1,13 +1,25 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class TokenInfoController < Doorkeeper::ApplicationMetalController
     def show
-      if doorkeeper_token && doorkeeper_token.accessible?
-        render json: doorkeeper_token, status: :ok
+      if doorkeeper_token&.accessible?
+        render json: doorkeeper_token_to_json, status: :ok
       else
-        error = OAuth::ErrorResponse.new(name: :invalid_request)
+        error = OAuth::InvalidTokenResponse.new
         response.headers.merge!(error.headers)
-        render json: error.body, status: error.status
+        render json: error_to_json(error), status: error.status
       end
     end
+
+    protected
+
+    def doorkeeper_token_to_json
+      doorkeeper_token
+    end
+
+    def error_to_json(error)
+      error.body
+    end
   end
 end

data/app/controllers/doorkeeper/tokens_controller.rb

@@ -1,49 +1,89 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class TokensController < Doorkeeper::ApplicationMetalController
+    before_action :validate_presence_of_client, only: [:revoke]
+
     def create
-      response = authorize_response
-      headers.merge! response.headers
-      self.response_body = response.body.to_json
-      self.status = response.status
+      headers.merge!(authorize_response.headers)
+      render json: authorize_response.body,
+             status: authorize_response.status
     rescue Errors::DoorkeeperError => e
-      handle_token_exception e
+      handle_token_exception(e)
     end
 
-    # OAuth 2.0 Token Revocation - http://tools.ietf.org/html/rfc7009
+    # OAuth 2.0 Token Revocation - https://datatracker.ietf.org/doc/html/rfc7009
     def revoke
-      # The authorization server, if applicable, first authenticates the client
-      # and checks its ownership of the provided token.
-      #
-      # Doorkeeper does not use the token_type_hint logic described in the
-      # RFC 7009 due to the refresh token implementation that is a field in
-      # the access token model.
-      if authorized?
+      # The authorization server responds with HTTP status code 200 if the client
+      # submitted an invalid token or the token has been revoked successfully.
+      if token.blank?
+        render json: {}, status: 200
+      # The authorization server validates [...] and whether the token
+      # was issued to the client making the revocation request. If this
+      # validation fails, the request is refused and the client is informed
+      # of the error by the authorization server as described below.
+      elsif authorized?
         revoke_token
+        render json: {}, status: 200
+      else
+        render json: revocation_error_response, status: :forbidden
       end
-
-      # The authorization server responds with HTTP status code 200 if the token
-      # has been revoked successfully or if the client submitted an invalid
-      # token
-      render json: {}, status: 200
     end
 
+    # OAuth 2.0 Token Introspection - https://datatracker.ietf.org/doc/html/rfc7662
     def introspect
       introspection = OAuth::TokenIntrospection.new(server, token)
 
       if introspection.authorized?
         render json: introspection.to_json, status: 200
       else
-        error = OAuth::ErrorResponse.new(name: introspection.error)
-        response.headers.merge!(error.headers)
+        error = introspection.error_response
+        headers.merge!(error.headers)
         render json: error.body, status: error.status
       end
     end
 
     private
 
+    def validate_presence_of_client
+      return if Doorkeeper.config.skip_client_authentication_for_password_grant
+
+      # @see 2.1.  Revocation Request
+      #
+      #  The client constructs the request by including the following
+      #  parameters using the "application/x-www-form-urlencoded" format in
+      #  the HTTP request entity-body:
+      #     token   REQUIRED.
+      #     token_type_hint  OPTIONAL.
+      #
+      #  The client also includes its authentication credentials as described
+      #  in Section 2.3. of [RFC6749].
+      #
+      #  The authorization server first validates the client credentials (in
+      #  case of a confidential client) and then verifies whether the token
+      #  was issued to the client making the revocation request.
+      return if server.client
+
+      # If this validation [client credentials / token ownership] fails, the request is
+      # refused and the  client is informed of the error by the authorization server as
+      # described below.
+      #
+      # @see 2.2.1.  Error Response
+      #
+      # The error presentation conforms to the definition in Section 5.2 of [RFC6749].
+      render json: revocation_error_response, status: :forbidden
+    end
+
     # OAuth 2.0 Section 2.1 defines two client types, "public" & "confidential".
-    # Public clients (as per RFC 7009) do not require authentication whereas
-    # confidential clients must be authenticated for their token revocation.
+    #
+    # RFC7009
+    # Section 5. Security Considerations
+    # A malicious client may attempt to guess valid tokens on this endpoint
+    # by making revocation requests against potential token strings.
+    # According to this specification, a client's request must contain a
+    # valid client_id, in the case of a public client, or valid client
+    # credentials, in the case of a confidential client. The token being
+    # revoked must also belong to the requesting client.
     #
     # Once a confidential client is authenticated, it must be authorized to
     # revoke the provided access or refresh token. This ensures one client
@@ -55,38 +95,67 @@ module Doorkeeper
     # types, they set the application_id as null (since the claim cannot be
     # verified).
     #
-    # https://tools.ietf.org/html/rfc6749#section-2.1
-    # https://tools.ietf.org/html/rfc7009
+    # https://datatracker.ietf.org/doc/html/rfc6749#section-2.1
+    # https://datatracker.ietf.org/doc/html/rfc7009
     def authorized?
-      return unless token.present?
-      # Client is confidential, therefore client authentication & authorization
-      # is required
+      # Token belongs to specific client, so we need to check if
+      # authenticated client could access it.
       if token.application_id? && token.application.confidential?
         # We authorize client by checking token's application
         server.client && server.client.application == token.application
       else
-        # Client is public, authentication unnecessary
+        # Token was issued without client, authorization unnecessary
         true
       end
     end
 
     def revoke_token
-      if token.accessible?
-        token.revoke
-      end
+      # The authorization server responds with HTTP status code 200 if the token
+      # has been revoked successfully or if the client submitted an invalid
+      # token
+      token.revoke if token&.accessible?
     end
 
     def token
-      @token ||= AccessToken.by_token(request.POST['token']) ||
-        AccessToken.by_refresh_token(request.POST['token'])
+      @token ||=
+        if params[:token_type_hint] == "refresh_token"
+          Doorkeeper.config.access_token_model.by_refresh_token(params["token"])
+        else
+          Doorkeeper.config.access_token_model.by_token(params["token"]) ||
+            Doorkeeper.config.access_token_model.by_refresh_token(params["token"])
+        end
     end
 
     def strategy
-      @strategy ||= server.token_request params[:grant_type]
+      @strategy ||= server.token_request(params[:grant_type])
     end
 
     def authorize_response
-      @authorize_response ||= strategy.authorize
+      @authorize_response ||= begin
+        before_successful_authorization
+        auth = strategy.authorize
+        context = build_context(auth: auth)
+        after_successful_authorization(context) unless auth.is_a?(Doorkeeper::OAuth::ErrorResponse)
+        auth
+      end
+    end
+
+    def build_context(**attributes)
+      Doorkeeper::OAuth::Hooks::Context.new(**attributes)
+    end
+
+    def before_successful_authorization(context = nil)
+      Doorkeeper.config.before_successful_authorization.call(self, context)
+    end
+
+    def after_successful_authorization(context)
+      Doorkeeper.config.after_successful_authorization.call(self, context)
+    end
+
+    def revocation_error_response
+      error_description = I18n.t(:unauthorized, scope: %i[doorkeeper errors messages revoke])
+
+      { error: :unauthorized_client, error_description: error_description }
     end
   end
 end

data/app/helpers/doorkeeper/dashboard_helper.rb

@@ -1,15 +1,17 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module DashboardHelper
     def doorkeeper_errors_for(object, method)
-      if object.errors[method].present?
-        output = object.errors[method].map do |msg|
-          content_tag(:span, class: 'help-block') do
-            msg.capitalize
-          end
-        end
+      return if object.errors[method].blank?
 
-        safe_join(output)
+      output = object.errors[method].map do |msg|
+        content_tag(:span, class: "invalid-feedback") do
+          msg.capitalize
+        end
       end
+
+      safe_join(output)
     end
 
     def doorkeeper_submit_path(application)

data/app/views/doorkeeper/applications/_delete_form.html.erb

@@ -1,4 +1,6 @@
 <%- submit_btn_css ||= 'btn btn-link' %>
 <%= form_tag oauth_application_path(application), method: :delete do %>
-  <%= submit_tag t('doorkeeper.applications.buttons.destroy'), onclick: "return confirm('#{ t('doorkeeper.applications.confirmations.destroy') }')", class: submit_btn_css %>
+  <%= submit_tag t('doorkeeper.applications.buttons.destroy'),
+                 onclick: "return confirm('#{ t('doorkeeper.applications.confirmations.destroy') }')",
+                 class: submit_btn_css %>
 <% end %>