doorkeeper 5.0.0 → 5.0.2

data/lib/doorkeeper/oauth/code_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class CodeResponse < BaseResponse

data/lib/doorkeeper/oauth/error.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     Error = Struct.new(:name, :state) do

data/lib/doorkeeper/oauth/error_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class ErrorResponse < BaseResponse
@@ -55,6 +57,10 @@ module Doorkeeper
         }
       end
 
+      def raise_exception!
+        raise exception_class.new(self), description
+      end
+
       protected
 
       delegate :realm, to: :configuration
@@ -63,6 +69,10 @@ module Doorkeeper
         Doorkeeper.configuration
       end
 
+      def exception_class
+        raise NotImplementedError, "error response must define #exception_class"
+      end
+
       private
 
       def authenticate_info

data/lib/doorkeeper/oauth/forbidden_token_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class ForbiddenTokenResponse < ErrorResponse
@@ -21,8 +23,13 @@ module Doorkeeper
       end
 
       def description
-        scope = { scope: %i[doorkeeper scopes] }
-        @description ||= @scopes.map { |r| I18n.translate r, scope }.join('\n')
+        @description ||= @scopes.map { |s| I18n.t(s, scope: %i[doorkeeper scopes]) }.join("\n")
+      end
+
+      protected
+
+      def exception_class
+        Doorkeeper::Errors::TokenForbidden
       end
     end
   end

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     module Helpers

data/lib/doorkeeper/oauth/helpers/unique_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     module Helpers

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     module Helpers
@@ -14,12 +16,13 @@ module Doorkeeper
           url = as_uri(url)
           client_url = as_uri(client_url)
 
-          if client_url.query.present?
+          unless client_url.query.nil?
             return false unless query_matches?(url.query, client_url.query)
             # Clear out queries so rest of URI can be tested. This allows query
             # params to be in the request but order not mattering.
             client_url.query = nil
           end
+
           url.query = nil
           url == client_url
         end
@@ -33,7 +36,7 @@ module Doorkeeper
         end
 
         def self.query_matches?(query, client_query)
-          return true if client_query.nil? && query.nil?
+          return true if client_query.blank? && query.blank?
           return false if client_query.nil? || query.nil?
           # Will return true independent of query order
           client_query.split('&').sort == query.split('&').sort

data/lib/doorkeeper/oauth/invalid_token_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class InvalidTokenResponse < ErrorResponse
@@ -24,6 +26,22 @@ module Doorkeeper
         scope = { scope: %i[doorkeeper errors messages invalid_token] }
         @description ||= I18n.translate @reason, scope
       end
+
+      protected
+
+      def exception_class
+        errors_mapping.fetch(reason)
+      end
+
+      private
+
+      def errors_mapping
+        {
+          expired: Doorkeeper::Errors::TokenExpired,
+          revoked: Doorkeeper::Errors::TokenRevoked,
+          unknown: Doorkeeper::Errors::TokenUnknown
+        }
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class PasswordAccessTokenRequest < BaseRequest

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class PreAuthorization

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class RefreshTokenRequest < BaseRequest
@@ -82,11 +84,17 @@ module Doorkeeper
       end
 
       def validate_client
-        !credentials || !!client
+        return true if credentials.blank?
+
+        client.present?
       end
 
+      # @see https://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-1.5
+      #
       def validate_client_match
-        !client || refresh_token.application_id == client.id
+        return true if refresh_token.application_id.blank?
+
+        client && refresh_token.application_id == client.id
       end
 
       def validate_scope

data/lib/doorkeeper/oauth/scopes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class Scopes

data/lib/doorkeeper/oauth/token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class Token

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     # RFC7662 OAuth 2.0 Token Introspection

data/lib/doorkeeper/oauth/token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenRequest

data/lib/doorkeeper/oauth/token_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenResponse

data/lib/doorkeeper/orm/active_record.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'active_support/lazy_load_hooks'
 
 require 'doorkeeper/orm/active_record/stale_records_cleaner'

data/lib/doorkeeper/rails/helpers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     module Helpers
@@ -19,6 +21,8 @@ module Doorkeeper
 
       def doorkeeper_render_error
         error = doorkeeper_error
+        error.raise_exception! if Doorkeeper.configuration.raise_on_errors?
+
         headers.merge!(error.headers.reject { |k| k == "Content-Type" })
         doorkeeper_render_error_with(error)
       end

data/lib/doorkeeper/rails/routes/mapper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     class Routes # :nodoc:

data/lib/doorkeeper/rails/routes/mapping.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     class Routes # :nodoc:

data/lib/doorkeeper/rails/routes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'doorkeeper/rails/routes/mapping'
 require 'doorkeeper/rails/routes/mapper'
 
@@ -91,11 +93,16 @@ module Doorkeeper
       end
 
       def application_routes(mapping)
-        routes.resources :doorkeeper_applications, controller: mapping[:controllers], as: :applications, path: 'applications'
+        routes.resources :doorkeeper_applications,
+                         controller: mapping[:controllers],
+                         as: :applications,
+                         path: 'applications'
       end
 
       def authorized_applications_routes(mapping)
-        routes.resources :authorized_applications, only: %i[index destroy], controller: mapping[:controllers]
+        routes.resources :authorized_applications,
+                         only: %i[index destroy],
+                         controller: mapping[:controllers]
       end
     end
   end

data/lib/doorkeeper/rake/db.rake

@@ -13,26 +13,26 @@ namespace :doorkeeper do
     namespace :cleanup do
       desc 'Removes stale access tokens'
       task revoked_tokens: 'doorkeeper:setup' do
-        cleaner = Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner.new(Doorkeeper::AccessToken)
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessToken)
         cleaner.clean_revoked
       end
 
       desc 'Removes expired (TTL passed) access tokens'
       task expired_tokens: 'doorkeeper:setup' do
         expirable_tokens = Doorkeeper::AccessToken.where(refresh_token: nil)
-        cleaner = Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner.new(expirable_tokens)
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(expirable_tokens)
         cleaner.clean_expired(Doorkeeper.configuration.access_token_expires_in)
       end
 
       desc 'Removes stale access grants'
       task revoked_grants: 'doorkeeper:setup' do
-        cleaner = Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
         cleaner.clean_revoked
       end
 
       desc 'Removes expired (TTL passed) access grants'
       task expired_grants: 'doorkeeper:setup' do
-        cleaner = Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
         cleaner.clean_expired(Doorkeeper.configuration.authorization_code_expires_in)
       end
     end

data/lib/doorkeeper/request/authorization_code.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class AuthorizationCode < Strategy

data/lib/doorkeeper/request/client_credentials.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class ClientCredentials < Strategy

data/lib/doorkeeper/request/code.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Code < Strategy

data/lib/doorkeeper/request/password.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Password < Strategy

data/lib/doorkeeper/request/refresh_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class RefreshToken < Strategy

data/lib/doorkeeper/request/strategy.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Strategy

data/lib/doorkeeper/request/token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Token < Strategy

data/lib/doorkeeper/request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class << self

data/lib/doorkeeper/server.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class Server
     attr_accessor :context

data/lib/doorkeeper/stale_records_cleaner.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  class StaleRecordsCleaner
+    CLEANER_CLASS = 'StaleRecordsCleaner'.freeze
+
+    def self.for(base_scope)
+      orm_adapter = "doorkeeper/orm/#{Doorkeeper.configuration.orm}".classify
+
+      orm_cleaner = "#{orm_adapter}::#{CLEANER_CLASS}".constantize
+      orm_cleaner.new(base_scope)
+    rescue NameError
+      raise Doorkeeper::Errors::NoOrmCleaner, "'#{Doorkeeper.configuration.orm}' ORM has no cleaner!"
+    end
+
+    def self.new(base_scope)
+      self.for(base_scope)
+    end
+  end
+end

data/lib/doorkeeper/validations.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Validations
     extend ActiveSupport::Concern

data/lib/doorkeeper/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   def self.gem_version
     Gem::Version.new VERSION::STRING
@@ -7,7 +9,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 0
-    TINY = 0
+    TINY = 2
     PRE = nil
 
     # Full version number

data/lib/doorkeeper.rb

@@ -67,6 +67,7 @@ require 'doorkeeper/rails/routes'
 require 'doorkeeper/rails/helpers'
 
 require 'doorkeeper/rake'
+require 'doorkeeper/stale_records_cleaner'
 
 require 'doorkeeper/orm/active_record'
 

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -68,7 +68,11 @@ Doorkeeper.configure do
   #
   # base_controller 'ApplicationController'
 
-  # Reuse access token for the same resource owner within an application (disabled by default)
+  # Reuse access token for the same resource owner within an application (disabled by default).
+  #
+  # This option protects your application from creating new tokens before old valid one becomes
+  # expired so your database doesn't bloat. Keep in mind that when this option is `on` Doorkeeper
+  # doesn't updates existing token expiration time, it will create a new token instead.
   # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383
   #
   # reuse_access_token
@@ -121,7 +125,8 @@ Doorkeeper.configure do
   # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
 
   # Change the native redirect uri for client apps
-  # When clients register with the following redirect uri, they won't be redirected to any server and the authorization code will be displayed within the provider
+  # When clients register with the following redirect uri, they won't be redirected to any server and
+  # the authorizationcode will be displayed within the provider
   # The value can be any string. Use nil to disable this feature. When disabled, clients must provide a valid URL
   # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi)
   #
@@ -147,6 +152,19 @@ Doorkeeper.configure do
   #
   # forbid_redirect_uri { |uri| uri.scheme.to_s.downcase == 'javascript' }
 
+  # Specify how authorization errors should be handled.
+  # By default, doorkeeper renders json errors when access token
+  # is invalid, expired, revoked or has invalid scopes.
+  #
+  # If you want to render error response yourself (i.e. rescue exceptions),
+  # set  handle_auth_errors to `:raise` and rescue Doorkeeper::Errors::InvalidToken
+  # or following specific errors:
+  #
+  #   Doorkeeper::Errors::TokenForbidden, Doorkeeper::Errors::TokenExpired,
+  #   Doorkeeper::Errors::TokenRevoked, Doorkeeper::Errors::TokenUnknown
+  #
+  # handle_auth_errors :raise
+
   # Specify what grant flows are enabled in array of Strings. The valid
   # strings and the flows they enable are:
   #

data/lib/generators/doorkeeper/templates/migration.rb.erb

@@ -13,7 +13,7 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
     add_index :oauth_applications, :uid, unique: true
 
     create_table :oauth_access_grants do |t|
-      t.integer  :resource_owner_id, null: false
+      t.references :resource_owner,  null: false
       t.references :application,     null: false
       t.string   :token,             null: false
       t.integer  :expires_in,        null: false
@@ -31,7 +31,7 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
     )
 
     create_table :oauth_access_tokens do |t|
-      t.integer  :resource_owner_id
+      t.references :resource_owner, index: true
       t.references :application
 
       # If you use a custom token generator you may need to change this column
@@ -58,7 +58,6 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
     end
 
     add_index :oauth_access_tokens, :token, unique: true
-    add_index :oauth_access_tokens, :resource_owner_id
     add_index :oauth_access_tokens, :refresh_token, unique: true
     add_foreign_key(
       :oauth_access_tokens,

data/spec/controllers/applications_controller_spec.rb

@@ -13,12 +13,12 @@ module Doorkeeper
       it 'creates an application' do
         expect do
           post :create, params: {
-             doorkeeper_application: {
-               name: 'Example',
-               redirect_uri: 'https://example.com'
-             }, format: :json
-           }
-        end.to change { Doorkeeper::Application.count }
+            doorkeeper_application: {
+              name: 'Example',
+              redirect_uri: 'https://example.com'
+            }, format: :json
+          }
+        end.to(change { Doorkeeper::Application.count })
 
         expect(response).to be_successful
 
@@ -31,11 +31,11 @@ module Doorkeeper
       it 'returns validation errors on wrong create params' do
         expect do
           post :create, params: {
-             doorkeeper_application: {
-               name: 'Example'
-             }, format: :json
-           }
-        end.not_to change { Doorkeeper::Application.count }
+            doorkeeper_application: {
+              name: 'Example'
+            }, format: :json
+          }
+        end.not_to(change { Doorkeeper::Application.count })
 
         expect(response).to have_http_status(422)
 
@@ -108,14 +108,13 @@ module Doorkeeper
 
       it 'does not create application' do
         expect do
-          post :create,
-               params: {
-                 doorkeeper_application: {
-                   name: 'Example',
-                   redirect_uri: 'https://example.com'
-                 }
-               }
-        end.not_to change { Doorkeeper::Application.count }
+          post :create, params: {
+            doorkeeper_application: {
+              name: 'Example',
+              redirect_uri: 'https://example.com'
+            }
+          }
+        end.not_to(change { Doorkeeper::Application.count })
       end
     end
 
@@ -139,13 +138,12 @@ module Doorkeeper
 
       it 'creates application' do
         expect do
-          post :create,
-               params: {
-                 doorkeeper_application: {
-                   name: 'Example',
-                   redirect_uri: 'https://example.com'
-                 }
-               }
+          post :create, params: {
+            doorkeeper_application: {
+              name: 'Example',
+              redirect_uri: 'https://example.com'
+            }
+          }
         end.to change { Doorkeeper::Application.count }.by(1)
 
         expect(response).to be_redirect
@@ -153,27 +151,25 @@ module Doorkeeper
 
       it 'does not allow mass assignment of uid or secret' do
         application = FactoryBot.create(:application)
-        put :update,
-            params: {
-              id: application.id,
-              doorkeeper_application: {
-                uid: '1A2B3C4D',
-                secret: '1A2B3C4D'
-              }
-            }
+        put :update, params: {
+          id: application.id,
+          doorkeeper_application: {
+            uid: '1A2B3C4D',
+            secret: '1A2B3C4D'
+          }
+        }
 
         expect(application.reload.uid).not_to eq '1A2B3C4D'
       end
 
       it 'updates application' do
         application = FactoryBot.create(:application)
-        put :update,
-            params: {
-              id: application.id, doorkeeper_application: {
-                name: 'Example',
-                redirect_uri: 'https://example.com'
-              }
-            }
+        put :update, params: {
+          id: application.id, doorkeeper_application: {
+            name: 'Example',
+            redirect_uri: 'https://example.com'
+          }
+        }
 
         expect(application.reload.name).to eq 'Example'
       end