doorkeeper 4.4.3 → 5.5.2

data/gemfiles/rails_master.gemfile

@@ -1,14 +0,0 @@
-# This file was generated by Appraisal
-
-source "https://rubygems.org"
-
-gem "rails", git: 'https://github.com/rails/rails'
-gem "arel", git: 'https://github.com/rails/arel'
-
-gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
-gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
-gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
-gem "rspec-rails", "~> 3.7"
-
-gemspec path: "../"

data/lib/doorkeeper/oauth/client_credentials/validation.rb

@@ -1,45 +0,0 @@
-require 'doorkeeper/validations'
-require 'doorkeeper/oauth/scopes'
-require 'doorkeeper/oauth/helpers/scope_checker'
-
-module Doorkeeper
-  module OAuth
-    class ClientCredentialsRequest < BaseRequest
-      class Validation
-        include Validations
-        include OAuth::Helpers
-
-        validate :client, error: :invalid_client
-        validate :scopes, error: :invalid_scope
-
-        def initialize(server, request)
-          @server, @request, @client = server, request, request.client
-
-          validate
-        end
-
-        private
-
-        def validate_client
-          @client.present?
-        end
-
-        def validate_scopes
-          return true unless @request.scopes.present?
-
-          application_scopes = if @client.present?
-                                 @client.application.scopes
-                               else
-                                 ''
-                               end
-
-          ScopeChecker.valid?(
-            @request.scopes.to_s,
-            @server.scopes,
-            application_scopes
-          )
-        end
-      end
-    end
-  end
-end

data/lib/generators/doorkeeper/add_client_confidentiality_generator.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-require 'rails/generators/active_record'
-
-module Doorkeeper
-  class AddClientConfidentialityGenerator < ::Rails::Generators::Base
-    include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Adds a migration to fix CVE-2018-1000211.'
-
-    def install
-      migration_template(
-        'add_confidential_to_application_migration.rb.erb',
-        'db/migrate/add_confidential_to_doorkeeper_application.rb',
-        migration_version: migration_version
-      )
-    end
-
-    def self.next_migration_number(dirname)
-      ::ActiveRecord::Generators::Base.next_migration_number(dirname)
-    end
-
-    private
-
-    def migration_version
-      if ::ActiveRecord::VERSION::MAJOR >= 5
-        "[#{::ActiveRecord::VERSION::MAJOR}.#{::ActiveRecord::VERSION::MINOR}]"
-      end
-    end
-  end
-end

data/lib/generators/doorkeeper/templates/add_confidential_to_application_migration.rb.erb

@@ -1,11 +0,0 @@
-class AddConfidentialToDoorkeeperApplication < ActiveRecord::Migration<%= migration_version %>
-  def change
-    add_column(
-      :oauth_applications,
-      :confidential,
-      :boolean,
-      null: false,
-      default: true # maintaining backwards compatibility: require secrets
-    )
-  end
-end

data/spec/controllers/application_metal_controller.rb

@@ -1,10 +0,0 @@
-require "spec_helper_integration"
-
-describe Doorkeeper::ApplicationMetalController do
-  it "lazy run hooks" do
-    i = 0
-    ActiveSupport.on_load(:doorkeeper_metal_controller) { i += 1 }
-
-    expect(i).to eq 1
-  end
-end

data/spec/controllers/applications_controller_spec.rb

@@ -1,69 +0,0 @@
-require 'spec_helper_integration'
-
-module Doorkeeper
-  describe ApplicationsController do
-    context 'when admin is not authenticated' do
-      before do
-        allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(proc do
-          redirect_to main_app.root_url
-        end)
-      end
-
-      it 'redirects as set in Doorkeeper.authenticate_admin' do
-        get :index
-        expect(response).to redirect_to(controller.main_app.root_url)
-      end
-
-      it 'does not create application' do
-        expect do
-          post :create, doorkeeper_application: {
-            name: 'Example',
-            redirect_uri: 'https://example.com' }
-        end.not_to change { Doorkeeper::Application.count }
-      end
-    end
-
-    context 'when admin is authenticated' do
-      render_views
-
-      before do
-        allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(->(*) { true })
-      end
-
-      it 'sorts applications by created_at' do
-        first_application = FactoryBot.create(:application)
-        second_application = FactoryBot.create(:application)
-        expect(Doorkeeper::Application).to receive(:ordered_by).and_call_original
-        get :index
-        expect(response.body).to have_selector("tbody tr:first-child#application_#{first_application.id}")
-        expect(response.body).to have_selector("tbody tr:last-child#application_#{second_application.id}")
-      end
-
-      it 'creates application' do
-        expect do
-          post :create, doorkeeper_application: {
-            name: 'Example',
-            redirect_uri: 'https://example.com' }
-        end.to change { Doorkeeper::Application.count }.by(1)
-        expect(response).to be_redirect
-      end
-
-      it 'does not allow mass assignment of uid or secret' do
-        application = FactoryBot.create(:application)
-        put :update, id: application.id, doorkeeper_application: {
-          uid: '1A2B3C4D',
-          secret: '1A2B3C4D' }
-
-        expect(application.reload.uid).not_to eq '1A2B3C4D'
-      end
-
-      it 'updates application' do
-        application = FactoryBot.create(:application)
-        put :update, id: application.id, doorkeeper_application: {
-          name: 'Example',
-          redirect_uri: 'https://example.com' }
-        expect(application.reload.name).to eq 'Example'
-      end
-    end
-  end
-end

data/spec/controllers/authorizations_controller_spec.rb

@@ -1,250 +0,0 @@
-require 'spec_helper_integration'
-
-describe Doorkeeper::AuthorizationsController, 'implicit grant flow' do
-  include AuthorizationRequestHelper
-
-  if Rails::VERSION::MAJOR >= 5
-    class ActionDispatch::TestResponse
-      def query_params
-        @_query_params ||= begin
-          fragment = URI.parse(location).fragment
-          Rack::Utils.parse_query(fragment)
-        end
-      end
-    end
-  else
-    class ActionController::TestResponse
-      def query_params
-        @_query_params ||= begin
-          fragment = URI.parse(location).fragment
-          Rack::Utils.parse_query(fragment)
-        end
-      end
-    end
-  end
-
-  def translated_error_message(key)
-    I18n.translate key, scope: %i[doorkeeper errors messages]
-  end
-
-  let(:client)        { FactoryBot.create :application }
-  let(:user)          { User.create!(name: 'Joe', password: 'sekret') }
-  let(:access_token)  { FactoryBot.build :access_token, resource_owner_id: user.id, application_id: client.id }
-
-  before do
-    allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["implicit"])
-    allow(controller).to receive(:current_resource_owner).and_return(user)
-  end
-
-  describe 'POST #create' do
-    before do
-      post :create, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
-    end
-
-    it 'redirects after authorization' do
-      expect(response).to be_redirect
-    end
-
-    it 'redirects to client redirect uri' do
-      expect(response.location).to match(%r{^#{client.redirect_uri}})
-    end
-
-    it 'includes access token in fragment' do
-      expect(response.query_params['access_token']).to eq(Doorkeeper::AccessToken.first.token)
-    end
-
-    it 'includes token type in fragment' do
-      expect(response.query_params['token_type']).to eq('Bearer')
-    end
-
-    it 'includes token expiration in fragment' do
-      expect(response.query_params['expires_in'].to_i).to eq(2.hours.to_i)
-    end
-
-    it 'issues the token for the current client' do
-      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
-    end
-
-    it 'issues the token for the current resource owner' do
-      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
-    end
-  end
-
-  describe 'POST #create with errors' do
-    before do
-      default_scopes_exist :public
-      post :create, client_id: client.uid, response_type: 'token', scope: 'invalid', redirect_uri: client.redirect_uri
-    end
-
-    it 'redirects after authorization' do
-      expect(response).to be_redirect
-    end
-
-    it 'redirects to client redirect uri' do
-      expect(response.location).to match(%r{^#{client.redirect_uri}})
-    end
-
-    it 'does not include access token in fragment' do
-      expect(response.query_params['access_token']).to be_nil
-    end
-
-    it 'includes error in fragment' do
-      expect(response.query_params['error']).to eq('invalid_scope')
-    end
-
-    it 'includes error description in fragment' do
-      expect(response.query_params['error_description']).to eq(translated_error_message(:invalid_scope))
-    end
-
-    it 'does not issue any access token' do
-      expect(Doorkeeper::AccessToken.all).to be_empty
-    end
-  end
-
-  describe 'POST #create with application already authorized' do
-    before do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
-
-      access_token.save!
-      post :create, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
-    end
-
-    it 'returns the existing access token in a fragment' do
-      expect(response.query_params['access_token']).to eq(access_token.token)
-    end
-
-    it 'does not creates a new access token' do
-      expect(Doorkeeper::AccessToken.count).to eq(1)
-    end
-  end
-
-  describe 'GET #new token request with native url and skip_authorization true' do
-    before do
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
-        true
-      end)
-      client.update_attribute :redirect_uri, 'urn:ietf:wg:oauth:2.0:oob'
-      get :new, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
-    end
-
-    it 'should redirect immediately' do
-      expect(response).to be_redirect
-      expect(response.location).to match(/oauth\/token\/info\?access_token=/)
-    end
-
-    it 'should not issue a grant' do
-      expect(Doorkeeper::AccessGrant.count).to be 0
-    end
-
-    it 'should issue a token' do
-      expect(Doorkeeper::AccessToken.count).to be 1
-    end
-  end
-
-  describe 'GET #new code request with native url and skip_authorization true' do
-    before do
-      allow(Doorkeeper.configuration).to receive(:grant_flows).
-        and_return(%w[authorization_code])
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
-        true
-      end)
-      client.update_attribute :redirect_uri, 'urn:ietf:wg:oauth:2.0:oob'
-      get :new, client_id: client.uid, response_type: 'code', redirect_uri: client.redirect_uri
-    end
-
-    it 'should redirect immediately' do
-      expect(response).to be_redirect
-      expect(response.location).to match(/oauth\/authorize\/native\?code=#{Doorkeeper::AccessGrant.first.token}/)
-    end
-
-    it 'should issue a grant' do
-      expect(Doorkeeper::AccessGrant.count).to be 1
-    end
-
-    it 'should not issue a token' do
-      expect(Doorkeeper::AccessToken.count).to be 0
-    end
-
-    context 'with opt_out_native_route_change' do
-      around(:each) do |example|
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-          opt_out_native_route_change
-        end
-
-        Rails.application.reload_routes!
-
-        example.run
-
-        Doorkeeper.configure do
-          orm DOORKEEPER_ORM
-        end
-
-        Rails.application.reload_routes!
-      end
-
-      it 'should redirect immediately' do
-        expect(response).to be_redirect
-        expect(response.location).to match(/oauth\/authorize\/#{Doorkeeper::AccessGrant.first.token}/)
-      end
-
-      it 'should issue a grant' do
-        expect(Doorkeeper::AccessGrant.count).to be 1
-      end
-
-      it 'should not issue a token' do
-        expect(Doorkeeper::AccessToken.count).to be 0
-      end
-    end
-  end
-
-  describe 'GET #new with skip_authorization true' do
-    before do
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
-        true
-      end)
-      get :new, client_id: client.uid, response_type: 'token', redirect_uri: client.redirect_uri
-    end
-
-    it 'should redirect immediately' do
-      expect(response).to be_redirect
-      expect(response.location).to match(%r{^#{client.redirect_uri}})
-    end
-
-    it 'should issue a token' do
-      expect(Doorkeeper::AccessToken.count).to be 1
-    end
-
-    it 'includes token type in fragment' do
-      expect(response.query_params['token_type']).to eq('Bearer')
-    end
-
-    it 'includes token expiration in fragment' do
-      expect(response.query_params['expires_in'].to_i).to eq(2.hours.to_i)
-    end
-
-    it 'issues the token for the current client' do
-      expect(Doorkeeper::AccessToken.first.application_id).to eq(client.id)
-    end
-
-    it 'issues the token for the current resource owner' do
-      expect(Doorkeeper::AccessToken.first.resource_owner_id).to eq(user.id)
-    end
-  end
-
-  describe 'GET #new with errors' do
-    before do
-      default_scopes_exist :public
-      get :new, an_invalid: 'request'
-    end
-
-    it 'does not redirect' do
-      expect(response).to_not be_redirect
-    end
-
-    it 'does not issue any token' do
-      expect(Doorkeeper::AccessGrant.count).to eq 0
-      expect(Doorkeeper::AccessToken.count).to eq 0
-    end
-  end
-end

data/spec/controllers/protected_resources_controller_spec.rb

@@ -1,309 +0,0 @@
-require 'spec_helper_integration'
-
-module ControllerActions
-  def index
-    render plain: 'index'
-  end
-
-  def show
-    render plain: 'show'
-  end
-
-  def doorkeeper_unauthorized_render_options(*); end
-
-  def doorkeeper_forbidden_render_options(*); end
-end
-
-describe 'doorkeeper authorize filter' do
-  context 'accepts token code specified as' do
-    controller do
-      before_action :doorkeeper_authorize!
-
-      def index
-        render plain: 'index'
-      end
-    end
-
-    let(:token_string) { '1A2BC3' }
-    let(:token) do
-      double(Doorkeeper::AccessToken,
-             acceptable?: true, previous_refresh_token: "",
-             revoke_previous_refresh_token!: true)
-    end
-
-    it 'access_token param' do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      get :index, access_token: token_string
-    end
-
-    it 'bearer_token param' do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      get :index, bearer_token: token_string
-    end
-
-    it 'Authorization header' do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      request.env['HTTP_AUTHORIZATION'] = "Bearer #{token_string}"
-      get :index
-    end
-
-    it 'different kind of Authorization header' do
-      expect(Doorkeeper::AccessToken).not_to receive(:by_token)
-      request.env['HTTP_AUTHORIZATION'] = "MAC #{token_string}"
-      get :index
-    end
-
-    it 'does not change Authorization header value' do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).exactly(2).times.and_return(token)
-      request.env['HTTP_AUTHORIZATION'] = "Bearer #{token_string}"
-      get :index
-      controller.send(:remove_instance_variable, :@_doorkeeper_token)
-      get :index
-    end
-  end
-
-  context 'defined for all actions' do
-    controller do
-      before_action :doorkeeper_authorize!
-
-      include ControllerActions
-    end
-
-    context 'with valid token', token: :valid do
-      it 'allows into index action' do
-        get :index, access_token: token_string
-        expect(response).to be_successful
-      end
-
-      it 'allows into show action' do
-        get :show, id: '4', access_token: token_string
-        expect(response).to be_successful
-      end
-    end
-
-    context 'with invalid token', token: :invalid do
-      it 'does not allow into index action' do
-        get :index, access_token: token_string
-        expect(response.status).to eq 401
-        expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
-      end
-
-      it 'does not allow into show action' do
-        get :show, id: '4', access_token: token_string
-        expect(response.status).to eq 401
-        expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
-      end
-    end
-  end
-
-  context 'defined with scopes' do
-    controller do
-      before_action -> { doorkeeper_authorize! :write }
-
-      include ControllerActions
-    end
-
-    let(:token_string) { '1A2DUWE' }
-
-    it 'allows if the token has particular scopes' do
-      token = double(Doorkeeper::AccessToken,
-                     accessible?: true, scopes: %w[write public],
-                     previous_refresh_token: "",
-                     revoke_previous_refresh_token!: true)
-      expect(token).to receive(:acceptable?).with([:write]).and_return(true)
-      expect(
-        Doorkeeper::AccessToken
-      ).to receive(:by_token).with(token_string).and_return(token)
-
-      get :index, access_token: token_string
-      expect(response).to be_successful
-    end
-
-    it 'does not allow if the token does not include given scope' do
-      token = double(Doorkeeper::AccessToken,
-                     accessible?: true, scopes: ['public'], revoked?: false,
-                     expired?: false, previous_refresh_token: "",
-                     revoke_previous_refresh_token!: true)
-      expect(
-        Doorkeeper::AccessToken
-      ).to receive(:by_token).with(token_string).and_return(token)
-      expect(token).to receive(:acceptable?).with([:write]).and_return(false)
-
-      get :index, access_token: token_string
-      expect(response.status).to eq 403
-      expect(response.header).to_not include('WWW-Authenticate')
-    end
-  end
-
-  context 'when custom unauthorized render options are configured' do
-    controller do
-      before_action :doorkeeper_authorize!
-
-      include ControllerActions
-    end
-
-    context 'with a JSON custom render', token: :invalid do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_unauthorized_render_options
-
-          def doorkeeper_unauthorized_render_options(error: nil)
-            { json: ActiveSupport::JSON.encode(error_message: error.description) }
-          end
-        end
-      end
-
-      after do
-        module ControllerActions
-          remove_method :doorkeeper_unauthorized_render_options
-
-          def doorkeeper_unauthorized_render_options(error: nil)
-          end
-        end
-      end
-
-      it 'it renders a custom JSON response', token: :invalid do
-        get :index, access_token: token_string
-        expect(response.status).to eq 401
-        expect(response.content_type).to eq('application/json')
-        expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
-
-        expect(json_response).not_to be_nil
-        expect(json_response['error_message']).to match('token is invalid')
-      end
-    end
-
-    context 'with a text custom render', token: :invalid do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_unauthorized_render_options
-
-          def doorkeeper_unauthorized_render_options(**)
-            { plain: 'Unauthorized' }
-          end
-        end
-      end
-
-      after do
-        module ControllerActions
-          remove_method :doorkeeper_unauthorized_render_options
-
-          def doorkeeper_unauthorized_render_options(error: nil); end
-        end
-      end
-
-      it 'it renders a custom text response', token: :invalid do
-        get :index, access_token: token_string
-        expect(response.status).to eq 401
-        expect(response.content_type).to eq('text/plain')
-        expect(response.header['WWW-Authenticate']).to match(/^Bearer/)
-        expect(response.body).to eq('Unauthorized')
-      end
-    end
-  end
-
-  context 'when custom forbidden render options are configured' do
-    before do
-      expect(Doorkeeper::AccessToken).to receive(:by_token).with(token_string).and_return(token)
-      expect(token).to receive(:acceptable?).with([:write]).and_return(false)
-    end
-
-    after do
-      module ControllerActions
-        remove_method :doorkeeper_forbidden_render_options
-
-        def doorkeeper_forbidden_render_options(*); end
-      end
-    end
-
-    controller do
-      before_action -> { doorkeeper_authorize! :write }
-
-      include ControllerActions
-    end
-
-    let(:token) do
-      double(Doorkeeper::AccessToken,
-             accessible?: true, scopes: ['public'], revoked?: false,
-             expired?: false, previous_refresh_token: "",
-             revoke_previous_refresh_token!: true)
-    end
-
-    let(:token_string) { '1A2DUWE' }
-
-    context 'with a JSON custom render' do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_forbidden_render_options
-
-          def doorkeeper_forbidden_render_options(*)
-            { json: { error_message: 'Forbidden' } }
-          end
-        end
-      end
-
-      it 'renders a custom JSON response' do
-        get :index, access_token: token_string
-        expect(response.header).to_not include('WWW-Authenticate')
-        expect(response.content_type).to eq('application/json')
-        expect(response.status).to eq 403
-
-        expect(json_response).not_to be_nil
-        expect(json_response['error_message']).to match('Forbidden')
-      end
-    end
-
-    context 'with a status and JSON custom render' do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_forbidden_render_options
-          def doorkeeper_forbidden_render_options(*)
-            { json: { error_message: 'Not Found' },
-              respond_not_found_when_forbidden: true }
-          end
-        end
-      end
-
-      it 'overrides the default status code' do
-        get :index, access_token: token_string
-        expect(response.status).to eq 404
-      end
-    end
-
-    context 'with a text custom render' do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_forbidden_render_options
-
-          def doorkeeper_forbidden_render_options(*)
-            { plain: 'Forbidden' }
-          end
-        end
-      end
-
-      it 'renders a custom status code and text response' do
-        get :index, access_token: token_string
-        expect(response.header).to_not include('WWW-Authenticate')
-        expect(response.status).to eq 403
-        expect(response.body).to eq('Forbidden')
-      end
-    end
-
-    context 'with a status and text custom render' do
-      before do
-        module ControllerActions
-          remove_method :doorkeeper_forbidden_render_options
-
-          def doorkeeper_forbidden_render_options(*)
-            { respond_not_found_when_forbidden: true, plain: 'Not Found' }
-          end
-        end
-      end
-
-      it 'overrides the default status code' do
-        get :index, access_token: token_string
-        expect(response.status).to eq 404
-      end
-    end
-  end
-end