doorkeeper 4.4.3 → 5.5.2

data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Doorkeeper
+  # ActiveModel validator for redirect URI validation in according
+  # to OAuth standards and Doorkeeper configuration.
+  class RedirectUriValidator < ActiveModel::EachValidator
+    def validate_each(record, attribute, value)
+      if value.blank?
+        return if Doorkeeper.config.allow_blank_redirect_uri?(record)
+
+        record.errors.add(attribute, :blank)
+      else
+        value.split.each do |val|
+          next if oob_redirect_uri?(val)
+
+          uri = ::URI.parse(val)
+          record.errors.add(attribute, :forbidden_uri) if forbidden_uri?(uri)
+          record.errors.add(attribute, :fragment_present) unless uri.fragment.nil?
+          record.errors.add(attribute, :unspecified_scheme) if unspecified_scheme?(uri)
+          record.errors.add(attribute, :relative_uri) if relative_uri?(uri)
+          record.errors.add(attribute, :secured_uri) if invalid_ssl_uri?(uri)
+          record.errors.add(attribute, :invalid_uri) if unspecified_host?(uri)
+        end
+      end
+    rescue URI::InvalidURIError
+      record.errors.add(attribute, :invalid_uri)
+    end
+
+    private
+
+    def oob_redirect_uri?(uri)
+      Doorkeeper::OAuth::NonStandard::IETF_WG_OAUTH2_OOB_METHODS.include?(uri)
+    end
+
+    def forbidden_uri?(uri)
+      Doorkeeper.config.forbid_redirect_uri.call(uri)
+    end
+
+    def unspecified_scheme?(uri)
+      return true if uri.opaque.present?
+
+      %w[localhost].include?(uri.try(:scheme))
+    end
+
+    def unspecified_host?(uri)
+      uri.is_a?(URI::HTTP) && uri.host.nil?
+    end
+
+    def relative_uri?(uri)
+      uri.scheme.nil? && uri.host.nil?
+    end
+
+    def invalid_ssl_uri?(uri)
+      forces_ssl = Doorkeeper.config.force_ssl_in_redirect_uri
+      non_https = uri.try(:scheme) == "http"
+
+      if forces_ssl.respond_to?(:call)
+        forces_ssl.call(uri) && non_https
+      else
+        forces_ssl && non_https
+      end
+    end
+  end
+end

data/lib/doorkeeper/orm/active_record/stale_records_cleaner.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Orm
+    module ActiveRecord
+      # Helper class to clear stale and non-active tokens and grants.
+      # Used by Doorkeeper Rake tasks.
+      #
+      class StaleRecordsCleaner
+        def initialize(base_scope)
+          @base_scope = base_scope
+        end
+
+        # Clears revoked records
+        def clean_revoked
+          table = @base_scope.arel_table
+
+          @base_scope.where.not(revoked_at: nil)
+            .where(table[:revoked_at].lt(Time.current))
+            .in_batches(&:delete_all)
+        end
+
+        # Clears expired records
+        def clean_expired(ttl)
+          table = @base_scope.arel_table
+
+          @base_scope.where(table[:created_at].lt(Time.current - ttl))
+            .in_batches(&:delete_all)
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/orm/active_record.rb

@@ -1,17 +1,27 @@
-require 'active_support/lazy_load_hooks'
+# frozen_string_literal: true
+
+require "active_support/lazy_load_hooks"
 
 module Doorkeeper
   module Orm
+    # ActiveRecord ORM for Doorkeeper entity models.
+    # Consists of three main OAuth entities:
+    #   * Access Token
+    #   * Access Grant
+    #   * Application (client)
+    #
+    # Do a lazy loading of all the required and configured stuff.
+    #
     module ActiveRecord
       def self.initialize_models!
         lazy_load do
-          require 'doorkeeper/orm/active_record/access_grant'
-          require 'doorkeeper/orm/active_record/access_token'
-          require 'doorkeeper/orm/active_record/application'
+          require "doorkeeper/orm/active_record/stale_records_cleaner"
+          require "doorkeeper/orm/active_record/access_grant"
+          require "doorkeeper/orm/active_record/access_token"
+          require "doorkeeper/orm/active_record/application"
 
-          if Doorkeeper.configuration.active_record_options[:establish_connection]
-            [Doorkeeper::AccessGrant, Doorkeeper::AccessToken, Doorkeeper::Application].each do |model|
-              options = Doorkeeper.configuration.active_record_options[:establish_connection]
+          if (options = Doorkeeper.config.active_record_options[:establish_connection])
+            Doorkeeper::Orm::ActiveRecord.models.each do |model|
               model.establish_connection(options)
             end
           end
@@ -20,15 +30,23 @@ module Doorkeeper
 
       def self.initialize_application_owner!
         lazy_load do
-          require 'doorkeeper/models/concerns/ownership'
+          require "doorkeeper/models/concerns/ownership"
 
-          Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
+          Doorkeeper.config.application_model.include(Doorkeeper::Models::Ownership)
         end
       end
 
       def self.lazy_load(&block)
         ActiveSupport.on_load(:active_record, {}, &block)
       end
+
+      def self.models
+        [
+          Doorkeeper.config.access_grant_model,
+          Doorkeeper.config.access_token_model,
+          Doorkeeper.config.application_model,
+        ]
+      end
     end
   end
 end

data/lib/doorkeeper/rails/helpers.rb

@@ -1,12 +1,12 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     module Helpers
       def doorkeeper_authorize!(*scopes)
-        @_doorkeeper_scopes = scopes.presence || Doorkeeper.configuration.default_scopes
+        @_doorkeeper_scopes = scopes.presence || Doorkeeper.config.default_scopes
 
-        unless valid_doorkeeper_token?
-          doorkeeper_render_error
-        end
+        doorkeeper_render_error unless valid_doorkeeper_token?
       end
 
       def doorkeeper_unauthorized_render_options(**); end
@@ -14,13 +14,15 @@ module Doorkeeper
       def doorkeeper_forbidden_render_options(**); end
 
       def valid_doorkeeper_token?
-        doorkeeper_token && doorkeeper_token.acceptable?(@_doorkeeper_scopes)
+        doorkeeper_token&.acceptable?(@_doorkeeper_scopes)
       end
 
       private
 
       def doorkeeper_render_error
         error = doorkeeper_error
+        error.raise_exception! if Doorkeeper.config.raise_on_errors?
+
         headers.merge!(error.headers.reject { |k| k == "Content-Type" })
         doorkeeper_render_error_with(error)
       end
@@ -28,7 +30,7 @@ module Doorkeeper
       def doorkeeper_render_error_with(error)
         options = doorkeeper_render_options(error) || {}
         status = doorkeeper_status_for_error(
-          error, options.delete(:respond_not_found_when_forbidden)
+          error, options.delete(:respond_not_found_when_forbidden),
         )
         if options.blank?
           head status
@@ -68,9 +70,9 @@ module Doorkeeper
       end
 
       def doorkeeper_token
-        @_doorkeeper_token ||= OAuth::Token.authenticate(
+        @doorkeeper_token ||= OAuth::Token.authenticate(
           request,
-          *Doorkeeper.configuration.access_token_methods
+          *Doorkeeper.config.access_token_methods,
         )
       end
     end

data/lib/doorkeeper/rails/routes/abstract_router.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Rails
+    # Abstract router module that implements base behavior
+    # for generating and mapping Rails routes.
+    #
+    # Could be reused in Doorkeeper extensions.
+    #
+    module AbstractRouter
+      extend ActiveSupport::Concern
+
+      attr_reader :routes
+
+      def initialize(routes, mapper = Mapper.new, &block)
+        @routes = routes
+        @mapping = mapper.map(&block)
+      end
+
+      def generate_routes!(**_options)
+        raise NotImplementedError, "must be redefined for #{self.class.name}!"
+      end
+
+      private
+
+      def map_route(name, method)
+        return if @mapping.skipped?(name)
+
+        send(method, @mapping[name])
+
+        mapping[name] = @mapping[name]
+      end
+    end
+  end
+end

data/lib/doorkeeper/rails/routes/mapper.rb

@@ -1,9 +1,11 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     class Routes # :nodoc:
       class Mapper
-        def initialize
-          @mapping = Mapping.new
+        def initialize(mapping = Mapping.new)
+          @mapping = mapping
         end
 
         def map(&block)

data/lib/doorkeeper/rails/routes/mapping.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     class Routes # :nodoc:
@@ -6,17 +8,17 @@ module Doorkeeper
 
         def initialize
           @controllers = {
-            authorizations: 'doorkeeper/authorizations',
-            applications: 'doorkeeper/applications',
-            authorized_applications: 'doorkeeper/authorized_applications',
-            tokens: 'doorkeeper/tokens',
-            token_info: 'doorkeeper/token_info'
+            authorizations: "doorkeeper/authorizations",
+            applications: "doorkeeper/applications",
+            authorized_applications: "doorkeeper/authorized_applications",
+            tokens: "doorkeeper/tokens",
+            token_info: "doorkeeper/token_info",
           }
 
           @as = {
             authorizations: :authorization,
             tokens: :token,
-            token_info: :token_info
+            token_info: :token_info,
           }
 
           @skips = []
@@ -25,7 +27,7 @@ module Doorkeeper
         def [](routes)
           {
             controllers: @controllers[routes],
-            as: @as[routes]
+            as: @as[routes],
           }
         end
 

data/lib/doorkeeper/rails/routes/registry.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Rails
+    class Routes
+      # Thread-safe registry of any Doorkeeper additional routes.
+      # Used to allow implementing of Doorkeeper extensions that must
+      # use their own routes.
+      #
+      module Registry
+        ROUTES_ACCESS_LOCK = Mutex.new
+        ROUTES_DEFINITION_LOCK = Mutex.new
+
+        InvalidRouterClass = Class.new(StandardError)
+
+        # Collection of additional registered routes for Doorkeeper.
+        #
+        # @return [Array<Object>] set of registered routes
+        #
+        def registered_routes
+          ROUTES_DEFINITION_LOCK.synchronize do
+            @registered_routes ||= Set.new
+          end
+        end
+
+        # Registers additional routes in the Doorkeeper registry
+        #
+        # @param [Object] routes
+        #   routes class
+        #
+        def register_routes(routes)
+          if !routes.is_a?(Module) || !(routes < AbstractRouter)
+            raise InvalidRouterClass, "routes class must include Doorkeeper::Rails::AbstractRouter"
+          end
+
+          ROUTES_ACCESS_LOCK.synchronize do
+            registered_routes << routes
+          end
+        end
+
+        alias register register_routes
+      end
+    end
+  end
+end

data/lib/doorkeeper/rails/routes.rb

@@ -1,5 +1,9 @@
-require 'doorkeeper/rails/routes/mapping'
-require 'doorkeeper/rails/routes/mapper'
+# frozen_string_literal: true
+
+require "doorkeeper/rails/routes/mapping"
+require "doorkeeper/rails/routes/mapper"
+require "doorkeeper/rails/routes/abstract_router"
+require "doorkeeper/rails/routes/registry"
 
 module Doorkeeper
   module Rails
@@ -10,23 +14,29 @@ module Doorkeeper
         end
       end
 
-      def self.install!
-        ActionDispatch::Routing::Mapper.send :include, Doorkeeper::Rails::Routes::Helper
+      include AbstractRouter
+      extend Registry
+
+      mattr_reader :mapping do
+        {}
       end
 
-      attr_reader :routes
+      def self.install!
+        ActionDispatch::Routing::Mapper.include Doorkeeper::Rails::Routes::Helper
+
+        registered_routes.each(&:install!)
+      end
 
-      def initialize(routes, &block)
-        @routes = routes
-        @mapping = Mapper.new.map(&block)
+      def initialize(routes, mapper = Mapper.new, &block)
+        super
       end
 
       def generate_routes!(options)
-        routes.scope options[:scope] || 'oauth', as: 'oauth' do
+        routes.scope options[:scope] || "oauth", as: "oauth" do
           map_route(:authorizations, :authorization_routes)
           map_route(:tokens, :token_routes)
           map_route(:tokens, :revoke_routes)
-          map_route(:tokens, :introspect_routes)
+          map_route(:tokens, :introspect_routes) unless Doorkeeper.config.allow_token_introspection.is_a?(FalseClass)
           map_route(:applications, :application_routes)
           map_route(:authorized_applications, :authorized_applications_routes)
           map_route(:token_info, :token_info_routes)
@@ -35,59 +45,56 @@ module Doorkeeper
 
       private
 
-      def map_route(name, method)
-        send(method, @mapping[name]) unless @mapping.skipped?(name)
-      end
-
       def authorization_routes(mapping)
         routes.resource(
           :authorization,
-          path: 'authorize',
+          path: "authorize",
           only: %i[create destroy],
           as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         ) do
-          routes.get native_authorization_code_route, action: :show, on: :member
-          routes.get '/', action: :new, on: :member
+          routes.get "/native", action: :show, on: :member
+          routes.get "/", action: :new, on: :member
         end
       end
 
       def token_routes(mapping)
         routes.resource(
           :token,
-          path: 'token',
+          path: "token",
           only: [:create], as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         )
       end
 
       def revoke_routes(mapping)
-        routes.post 'revoke', controller: mapping[:controllers], action: :revoke
+        routes.post "revoke", controller: mapping[:controllers], action: :revoke
       end
 
       def introspect_routes(mapping)
-        routes.post 'introspect', controller: mapping[:controllers], action: :introspect
+        routes.post "introspect", controller: mapping[:controllers], action: :introspect
       end
 
       def token_info_routes(mapping)
         routes.resource(
           :token_info,
-          path: 'token/info',
+          path: "token/info",
           only: [:show], as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         )
       end
 
       def application_routes(mapping)
-        routes.resources :doorkeeper_applications, controller: mapping[:controllers], as: :applications, path: 'applications'
+        routes.resources :doorkeeper_applications,
+                         controller: mapping[:controllers],
+                         as: :applications,
+                         path: "applications"
       end
 
       def authorized_applications_routes(mapping)
-        routes.resources :authorized_applications, only: %i[index destroy], controller: mapping[:controllers]
-      end
-
-      def native_authorization_code_route
-        Doorkeeper.configuration.native_authorization_code_route
+        routes.resources :authorized_applications,
+                         only: %i[index destroy],
+                         controller: mapping[:controllers]
       end
     end
   end