doorkeeper 4.4.0 → 5.6.6

data/lib/doorkeeper/engine.rb

@@ -1,8 +1,13 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class Engine < Rails::Engine
-    initializer "doorkeeper.params.filter" do |app|
-      parameters = %w[client_secret code authentication_token access_token refresh_token]
-      app.config.filter_parameters << /^(#{Regexp.union parameters})$/
+    initializer "doorkeeper.params.filter", after: :load_config_initializers do |app|
+      if Doorkeeper.configured?
+        parameters = %w[client_secret authentication_token access_token refresh_token]
+        parameters << "code" if Doorkeeper.config.grant_flows.include?("authorization_code")
+        app.config.filter_parameters << /^(#{Regexp.union(parameters)})$/
+      end
     end
 
     initializer "doorkeeper.routes" do
@@ -15,8 +20,16 @@ module Doorkeeper
       end
     end
 
+    config.to_prepare do
+      Doorkeeper.run_orm_hooks
+    end
+
     if defined?(Sprockets) && Sprockets::VERSION.chr.to_i >= 4
-      initializer 'doorkeeper.assets.precompile' do |app|
+      initializer "doorkeeper.assets.precompile" do |app|
+        # Force users to use:
+        #    //= link doorkeeper/admin/application.css
+        # in Doorkeeper 5 for Sprockets 4 instead of precompile.
+        # Add note to official docs & Wiki
         app.config.assets.precompile += %w[
           doorkeeper/application.css
           doorkeeper/admin/application.css

data/lib/doorkeeper/errors.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Errors
     class DoorkeeperError < StandardError
@@ -6,18 +8,6 @@ module Doorkeeper
       end
     end
 
-    class InvalidAuthorizationStrategy < DoorkeeperError
-      def type
-        :unsupported_response_type
-      end
-    end
-
-    class InvalidTokenReuse < DoorkeeperError
-      def type
-        :invalid_request
-      end
-    end
-
     class InvalidGrantReuse < DoorkeeperError
       def type
         :invalid_grant
@@ -30,16 +20,35 @@ module Doorkeeper
       end
     end
 
-    class MissingRequestStrategy < DoorkeeperError
+    class MissingRequiredParameter < DoorkeeperError
+      attr_reader :missing_param
+
+      def initialize(missing_param)
+        super
+        @missing_param = missing_param
+      end
+
       def type
         :invalid_request
       end
     end
 
-    class UnableToGenerateToken < DoorkeeperError
-    end
+    class BaseResponseError < DoorkeeperError
+      attr_reader :response
 
-    class TokenGeneratorNotFound < DoorkeeperError
+      def initialize(response)
+        @response = response
+      end
     end
+
+    UnableToGenerateToken = Class.new(DoorkeeperError)
+    TokenGeneratorNotFound = Class.new(DoorkeeperError)
+    NoOrmCleaner = Class.new(DoorkeeperError)
+
+    InvalidToken = Class.new(BaseResponseError)
+    TokenExpired = Class.new(InvalidToken)
+    TokenRevoked = Class.new(InvalidToken)
+    TokenUnknown = Class.new(InvalidToken)
+    TokenForbidden = Class.new(InvalidToken)
   end
 end

data/lib/doorkeeper/grant_flow/fallback_flow.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    class FallbackFlow < Flow
+      def handles_grant_type?
+        false
+      end
+
+      def handles_response_type?
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/grant_flow/flow.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    class Flow
+      attr_reader :name, :grant_type_matches, :grant_type_strategy,
+                  :response_type_matches, :response_type_strategy,
+                  :response_mode_matches
+
+      def initialize(name, **options)
+        @name = name
+        @grant_type_matches = options[:grant_type_matches]
+        @grant_type_strategy = options[:grant_type_strategy]
+        @response_type_matches = options[:response_type_matches]
+        @response_type_strategy = options[:response_type_strategy]
+        @response_mode_matches = options[:response_mode_matches]
+      end
+
+      def handles_grant_type?
+        grant_type_matches.present?
+      end
+
+      def handles_response_type?
+        response_type_matches.present?
+      end
+
+      def matches_grant_type?(value)
+        grant_type_matches === value
+      end
+
+      def matches_response_type?(value)
+        response_type_matches === value
+      end
+
+      def default_response_mode
+        response_mode_matches[0]
+      end
+
+      def matches_response_mode?(value)
+        response_mode_matches.include?(value)
+      end
+    end
+  end
+end

data/lib/doorkeeper/grant_flow/registry.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    module Registry
+      mattr_accessor :flows
+      self.flows = {}
+
+      mattr_accessor :aliases
+      self.aliases = {}
+
+      # Allows to register custom OAuth grant flow so that Doorkeeper
+      # could recognize and process it.
+      #
+      def register(name_or_flow, **options)
+        unless name_or_flow.is_a?(Doorkeeper::GrantFlow::Flow)
+          name_or_flow = Flow.new(name_or_flow, **options)
+        end
+
+        flow_key = name_or_flow.name.to_sym
+
+        if flows.key?(flow_key)
+          ::Kernel.warn <<~WARNING
+            [DOORKEEPER] '#{flow_key}' grant flow already registered and will be overridden
+            in #{caller(1..1).first}
+          WARNING
+        end
+
+        flows[flow_key] = name_or_flow
+      end
+
+      # Allows to register aliases that could be used in `grant_flows`
+      # configuration option. It is possible to have aliases like 1:1 or
+      # 1:N, i.e. "implicit_oidc" => ['token', 'id_token', 'id_token token'].
+      #
+      def register_alias(alias_name, **options)
+        aliases[alias_name.to_sym] = Array.wrap(options.fetch(:as))
+      end
+
+      def expand_alias(alias_name)
+        aliases.fetch(alias_name.to_sym, [])
+      end
+
+      # [NOTE]: make it to use #fetch after removing fallbacks
+      def get(name)
+        flows[name.to_sym]
+      end
+    end
+  end
+end

data/lib/doorkeeper/grant_flow.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require "doorkeeper/grant_flow/flow"
+require "doorkeeper/grant_flow/fallback_flow"
+require "doorkeeper/grant_flow/registry"
+
+module Doorkeeper
+  module GrantFlow
+    extend Registry
+
+    register(
+      :implicit,
+      response_type_matches: "token",
+      response_mode_matches: %w[fragment form_post],
+      response_type_strategy: Doorkeeper::Request::Token,
+    )
+
+    register(
+      :authorization_code,
+      response_type_matches: "code",
+      response_mode_matches: %w[query fragment form_post],
+      response_type_strategy: Doorkeeper::Request::Code,
+      grant_type_matches: "authorization_code",
+      grant_type_strategy: Doorkeeper::Request::AuthorizationCode,
+    )
+
+    register(
+      :client_credentials,
+      grant_type_matches: "client_credentials",
+      grant_type_strategy: Doorkeeper::Request::ClientCredentials,
+    )
+
+    register(
+      :password,
+      grant_type_matches: "password",
+      grant_type_strategy: Doorkeeper::Request::Password,
+    )
+
+    register(
+      :refresh_token,
+      grant_type_matches: "refresh_token",
+      grant_type_strategy: Doorkeeper::Request::RefreshToken,
+    )
+  end
+end

data/lib/doorkeeper/grape/authorization_decorator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Grape
     class AuthorizationDecorator < SimpleDelegator
@@ -7,10 +9,10 @@ module Doorkeeper
 
       def authorization
         env = __getobj__.env
-        env['HTTP_AUTHORIZATION'] ||
-          env['X-HTTP_AUTHORIZATION'] ||
-          env['X_HTTP_AUTHORIZATION'] ||
-          env['REDIRECT_X_HTTP_AUTHORIZATION']
+        env["HTTP_AUTHORIZATION"] ||
+          env["X-HTTP_AUTHORIZATION"] ||
+          env["X_HTTP_AUTHORIZATION"] ||
+          env["REDIRECT_X_HTTP_AUTHORIZATION"]
       end
     end
   end

data/lib/doorkeeper/grape/helpers.rb

@@ -1,7 +1,11 @@
-require 'doorkeeper/grape/authorization_decorator'
+# frozen_string_literal: true
+
+require "doorkeeper/grape/authorization_decorator"
 
 module Doorkeeper
   module Grape
+    # Doorkeeper helpers for Grape applications.
+    # Provides helpers for endpoints authorization based on defined set of scopes.
     module Helpers
       # These helpers are for grape >= 0.10
       extend ::Grape::API::Helpers
@@ -9,10 +13,12 @@ module Doorkeeper
 
       # endpoint specific scopes > parameter scopes > default scopes
       def doorkeeper_authorize!(*scopes)
-        endpoint_scopes = endpoint.route_setting(:scopes) || endpoint.options[:route_options][:scopes]
+        endpoint_scopes = endpoint.route_setting(:scopes) ||
+                          endpoint.options[:route_options][:scopes]
+
         scopes = if endpoint_scopes
                    Doorkeeper::OAuth::Scopes.from_array(endpoint_scopes)
-                 elsif scopes && !scopes.empty?
+                 elsif scopes.present?
                    Doorkeeper::OAuth::Scopes.from_array(scopes)
                  end
 
@@ -27,13 +33,13 @@ module Doorkeeper
       private
 
       def endpoint
-        env['api.endpoint']
+        env["api.endpoint"]
       end
 
       def doorkeeper_token
-        @_doorkeeper_token ||= OAuth::Token.authenticate(
+        @doorkeeper_token ||= OAuth::Token.authenticate(
           decorated_request,
-          *Doorkeeper.configuration.access_token_methods
+          *Doorkeeper.config.access_token_methods,
         )
       end
 
@@ -44,7 +50,7 @@ module Doorkeeper
       def error_status_codes
         {
           unauthorized: 401,
-          forbidden: 403
+          forbidden: 403,
         }
       end
     end

data/lib/doorkeeper/helpers/controller.rb

@@ -1,7 +1,11 @@
+# frozen_string_literal: true
+
 # Define methods that can be called in any controller that inherits from
 # Doorkeeper::ApplicationMetalController or Doorkeeper::ApplicationController
 module Doorkeeper
   module Helpers
+    # Rails controller helpers.
+    #
     module Controller
       private
 
@@ -12,16 +16,20 @@ module Doorkeeper
 
       # :doc:
       def current_resource_owner
-        instance_eval(&Doorkeeper.configuration.authenticate_resource_owner)
+        return @current_resource_owner if defined?(@current_resource_owner)
+
+        @current_resource_owner ||= begin
+          instance_eval(&Doorkeeper.config.authenticate_resource_owner)
+        end
       end
 
       def resource_owner_from_credentials
-        instance_eval(&Doorkeeper.configuration.resource_owner_from_credentials)
+        instance_eval(&Doorkeeper.config.resource_owner_from_credentials)
       end
 
       # :doc:
       def authenticate_admin!
-        instance_eval(&Doorkeeper.configuration.authenticate_admin)
+        instance_eval(&Doorkeeper.config.authenticate_admin)
       end
 
       def server
@@ -30,26 +38,51 @@ module Doorkeeper
 
       # :doc:
       def doorkeeper_token
-        @token ||= OAuth::Token.authenticate request, *config_methods
+        return @doorkeeper_token if defined?(@doorkeeper_token)
+
+        @doorkeeper_token ||= OAuth::Token.authenticate(request, *config_methods)
       end
 
       def config_methods
-        @methods ||= Doorkeeper.configuration.access_token_methods
+        @config_methods ||= Doorkeeper.config.access_token_methods
       end
 
       def get_error_response_from_exception(exception)
-        OAuth::ErrorResponse.new name: exception.type, state: params[:state]
+        if exception.respond_to?(:response)
+          exception.response
+        elsif exception.type == :invalid_request
+          OAuth::InvalidRequestResponse.new(
+            name: exception.type,
+            state: params[:state],
+            missing_param: exception.missing_param,
+          )
+        else
+          OAuth::ErrorResponse.new(name: exception.type, state: params[:state])
+        end
       end
 
       def handle_token_exception(exception)
-        error = get_error_response_from_exception exception
-        headers.merge! error.headers
+        error = get_error_response_from_exception(exception)
+        headers.merge!(error.headers)
         self.response_body = error.body.to_json
-        self.status        = error.status
+        self.status = error.status
       end
 
       def skip_authorization?
-        !!instance_exec([@server.current_resource_owner, @pre_auth.client], &Doorkeeper.configuration.skip_authorization)
+        !!instance_exec(
+          [server.current_resource_owner, @pre_auth.client],
+          &Doorkeeper.config.skip_authorization
+        )
+      end
+
+      def enforce_content_type
+        if (request.put? || request.post? || request.patch?) && !x_www_form_urlencoded?
+          render json: {}, status: :unsupported_media_type
+        end
+      end
+
+      def x_www_form_urlencoded?
+        request.media_type == "application/x-www-form-urlencoded"
       end
     end
   end

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module AccessGrantMixin
     extend ActiveSupport::Concern
@@ -7,7 +9,14 @@ module Doorkeeper
     include Models::Revocable
     include Models::Accessible
     include Models::Orderable
+    include Models::SecretStorable
     include Models::Scopes
+    include Models::ResourceOwnerable
+
+    # Never uses PKCE if PKCE migrations were not generated
+    def uses_pkce?
+      self.class.pkce_supported? && code_challenge.present?
+    end
 
     module ClassMethods
       # Searches for Doorkeeper::AccessGrant record with the
@@ -15,11 +24,96 @@ module Doorkeeper
       #
       # @param token [#to_s] token value (any object that responds to `#to_s`)
       #
-      # @return [Doorkeeper::AccessGrant, nil] AccessGrant object or nil
-      #   if there is no record with such token
+      # @return [Doorkeeper::AccessGrant, nil]
+      #   AccessGrant object or nil if there is no record with such token
       #
       def by_token(token)
-        find_by(token: token.to_s)
+        find_by_plaintext_token(:token, token)
+      end
+
+      # Revokes AccessGrant records that have not been revoked and associated
+      # with the specific Application and Resource Owner.
+      #
+      # @param application_id [Integer]
+      #   ID of the Application
+      # @param resource_owner [ActiveRecord::Base, Integer]
+      #   instance of the Resource Owner model or it's ID
+      #
+      def revoke_all_for(application_id, resource_owner, clock = Time)
+        by_resource_owner(resource_owner)
+          .where(
+            application_id: application_id,
+            revoked_at: nil,
+          )
+          .update_all(revoked_at: clock.now.utc)
+      end
+
+      # Implements PKCE code_challenge encoding without base64 padding as described in the spec.
+      # https://datatracker.ietf.org/doc/html/rfc7636#appendix-A
+      #   Appendix A.  Notes on Implementing Base64url Encoding without Padding
+      #
+      #   This appendix describes how to implement a base64url-encoding
+      #   function without padding, based upon the standard base64-encoding
+      #   function that uses padding.
+      #
+      #       To be concrete, example C# code implementing these functions is shown
+      #   below.  Similar code could be used in other languages.
+      #
+      #   static string base64urlencode(byte [] arg)
+      #   {
+      #       string s = Convert.ToBase64String(arg); // Regular base64 encoder
+      #       s = s.Split('=')[0]; // Remove any trailing '='s
+      #       s = s.Replace('+', '-'); // 62nd char of encoding
+      #       s = s.Replace('/', '_'); // 63rd char of encoding
+      #       return s;
+      #   }
+      #
+      #   An example correspondence between unencoded and encoded values
+      #   follows.  The octet sequence below encodes into the string below,
+      #   which when decoded, reproduces the octet sequence.
+      #
+      #   3 236 255 224 193
+      #
+      #   A-z_4ME
+      #
+      # https://ruby-doc.org/stdlib-2.1.3/libdoc/base64/rdoc/Base64.html#method-i-urlsafe_encode64
+      #
+      # urlsafe_encode64(bin)
+      # Returns the Base64-encoded version of bin. This method complies with
+      # "Base 64 Encoding with URL and Filename Safe Alphabet" in RFC 4648.
+      # The alphabet uses '-' instead of '+' and '_' instead of '/'.
+
+      # @param code_verifier [#to_s] a one time use value (any object that responds to `#to_s`)
+      #
+      # @return [#to_s] An encoded code challenge based on the provided verifier
+      # suitable for PKCE validation
+      #
+      def generate_code_challenge(code_verifier)
+        Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+      end
+
+      def pkce_supported?
+        column_names.include?("code_challenge")
+      end
+
+      ##
+      # Determines the secret storing transformer
+      # Unless configured otherwise, uses the plain secret strategy
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
+      def secret_strategy
+        ::Doorkeeper.config.token_secret_strategy
+      end
+
+      ##
+      # Determine the fallback storing strategy
+      # Unless configured, there will be no fallback
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
+      def fallback_secret_strategy
+        ::Doorkeeper.config.token_secret_fallback_strategy
       end
     end
   end