doorkeeper 5.0.0 → 5.0.2

data/spec/requests/flows/authorization_code_spec.rb

@@ -66,18 +66,36 @@ feature 'Authorization Code Flow' do
     page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
                                         redirect_uri: @client.redirect_uri)
 
-    expect(Doorkeeper::AccessToken).not_to exist
+    expect(Doorkeeper::AccessToken.count).to be_zero
 
     should_have_json 'error', 'invalid_client'
   end
 
+  scenario 'silently authorizes if matching token exists' do
+    default_scopes_exist :public, :write
+
+    access_token_exists application: @client,
+                        expires_in: -100, # even expired token
+                        resource_owner_id: @resource_owner.id,
+                        scopes: 'public write'
+
+    visit authorization_endpoint_url(client: @client, scope: 'public write')
+
+    response_status_should_be 200
+    i_should_not_see 'Authorize'
+  end
+
   context 'with PKCE' do
     context 'plain' do
       let(:code_challenge) { 'a45a9fea-0676-477e-95b1-a40f72ac3cfb' }
       let(:code_verifier) { 'a45a9fea-0676-477e-95b1-a40f72ac3cfb' }
 
       scenario 'resource owner authorizes the client with code_challenge parameter set' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'plain')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'plain'
+        )
         click_on 'Authorize'
 
         url_should_have_param('code', Doorkeeper::AccessGrant.first.token)
@@ -96,7 +114,11 @@ feature 'Authorization Code Flow' do
       end
 
       scenario 'mobile app requests an access token with authorization code and plain code challenge method' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'plain')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'plain'
+        )
         click_on 'Authorize'
 
         authorization_code = current_params['code']
@@ -130,7 +152,11 @@ feature 'Authorization Code Flow' do
       let(:code_verifier) { 'a45a9fea-0676-477e-95b1-a40f72ac3cfb' }
 
       scenario 'resource owner authorizes the client with code_challenge parameter set' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'S256'
+        )
         click_on 'Authorize'
 
         url_should_have_param('code', Doorkeeper::AccessGrant.first.token)
@@ -139,7 +165,11 @@ feature 'Authorization Code Flow' do
       end
 
       scenario 'mobile app requests an access token with authorization code and S256 code challenge method' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'S256'
+        )
         click_on 'Authorize'
 
         authorization_code = current_params['code']
@@ -155,7 +185,11 @@ feature 'Authorization Code Flow' do
       end
 
       scenario 'mobile app requests an access token with authorization code and without code_verifier' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'S256'
+        )
         click_on 'Authorize'
         authorization_code = current_params['code']
         create_access_token authorization_code, @client
@@ -164,7 +198,11 @@ feature 'Authorization Code Flow' do
       end
 
       scenario 'mobile app requests an access token with authorization code and without secret' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'S256'
+        )
         click_on 'Authorize'
 
         authorization_code = current_params['code']
@@ -180,8 +218,12 @@ feature 'Authorization Code Flow' do
         click_on 'Authorize'
 
         authorization_code = current_params['code']
-        page.driver.post token_endpoint_url(code: authorization_code, client_id: @client.uid,
-                                            redirect_uri: @client.redirect_uri, code_verifier: code_verifier)
+        page.driver.post token_endpoint_url(
+          code: authorization_code,
+          client_id: @client.uid,
+          redirect_uri: @client.redirect_uri,
+          code_verifier: code_verifier
+        )
         should_not_have_json 'error'
 
         should_have_json 'access_token', Doorkeeper::AccessToken.first.token
@@ -190,7 +232,11 @@ feature 'Authorization Code Flow' do
       end
 
       scenario 'mobile app requests an access token with authorization code but no code verifier' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'S256'
+        )
         click_on 'Authorize'
 
         authorization_code = current_params['code']
@@ -201,7 +247,11 @@ feature 'Authorization Code Flow' do
       end
 
       scenario 'mobile app requests an access token with authorization code with wrong verifier' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'S256'
+        )
         click_on 'Authorize'
 
         authorization_code = current_params['code']
@@ -212,12 +262,20 @@ feature 'Authorization Code Flow' do
       end
 
       scenario 'code_challenge_mehthod in token request is totally ignored' do
-        visit authorization_endpoint_url(client: @client, code_challenge: code_challenge, code_challenge_method: 'S256')
+        visit authorization_endpoint_url(
+          client: @client,
+          code_challenge: code_challenge,
+          code_challenge_method: 'S256'
+        )
         click_on 'Authorize'
 
         authorization_code = current_params['code']
-        page.driver.post token_endpoint_url(code: authorization_code, client: @client, code_verifier: code_challenge,
-                                            code_challenge_method: 'plain')
+        page.driver.post token_endpoint_url(
+          code: authorization_code,
+          client: @client,
+          code_verifier: code_challenge,
+          code_challenge_method: 'plain'
+        )
 
         should_not_have_json 'access_token'
         should_have_json 'error', 'invalid_grant'
@@ -324,6 +382,7 @@ describe 'Authorization Code Flow' do
       orm DOORKEEPER_ORM
       use_refresh_token
     end
+
     client_exists
   end
 
@@ -334,7 +393,8 @@ describe 'Authorization Code Flow' do
 
     it 'second of simultaneous client requests get an error for revoked acccess token' do
       authorization_code = Doorkeeper::AccessGrant.first.token
-      allow_any_instance_of(Doorkeeper::AccessGrant).to receive(:revoked?).and_return(false, true)
+      allow_any_instance_of(Doorkeeper::AccessGrant)
+        .to receive(:revoked?).and_return(false, true)
 
       post token_endpoint_url(code: authorization_code, client: @client)
 

data/spec/requests/flows/implicit_grant_errors_spec.rb

@@ -14,8 +14,8 @@ feature 'Implicit Grant Flow Errors' do
   end
 
   [
-    [:client_id,     :invalid_client],
-    [:redirect_uri,  :invalid_redirect_uri]
+    %i[client_id invalid_client],
+    %i[redirect_uri invalid_redirect_uri]
   ].each do |error|
     scenario "displays #{error.last} error for invalid #{error.first}" do
       visit authorization_endpoint_url(client: @client, error.first => 'invalid', response_type: 'token')

data/spec/requests/flows/password_spec.rb

@@ -57,7 +57,11 @@ describe 'Resource Owner Password Credentials Flow' do
         context "when client_secret incorrect" do
           it "should not issue new token" do
             expect do
-              post password_token_endpoint_url(client_id: @client.uid, client_secret: 'foobar', resource_owner: @resource_owner)
+              post password_token_endpoint_url(
+                client_id: @client.uid,
+                client_secret: 'foobar',
+                resource_owner: @resource_owner
+              )
             end.not_to(change { Doorkeeper::AccessToken.count })
 
             expect(response).not_to be_ok
@@ -148,7 +152,7 @@ describe 'Resource Owner Password Credentials Flow' do
 
     it 'issues new token without any scope' do
       expect do
-      post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
+        post password_token_endpoint_url(client: @client, resource_owner: @resource_owner)
       end.to change { Doorkeeper::AccessToken.count }.by(1)
 
       token = Doorkeeper::AccessToken.first

data/spec/requests/flows/refresh_token_spec.rb

@@ -6,6 +6,7 @@ describe 'Refresh Token Flow' do
       orm DOORKEEPER_ORM
       use_refresh_token
     end
+
     client_exists
   end
 
@@ -95,6 +96,62 @@ describe 'Refresh Token Flow' do
       end
     end
 
+    context "public & private clients" do
+      let(:public_client) do
+        FactoryBot.create(
+          :application,
+          confidential: false
+        )
+      end
+
+      let(:token_for_private_client) do
+        FactoryBot.create(
+          :access_token,
+          application: @client,
+          resource_owner_id: 1,
+          use_refresh_token: true
+        )
+      end
+
+      let(:token_for_public_client) do
+        FactoryBot.create(
+          :access_token,
+          application: public_client,
+          resource_owner_id: 1,
+          use_refresh_token: true
+        )
+      end
+
+      it 'issues a new token without client_secret when refresh token was issued to a public client' do
+        post refresh_token_endpoint_url(
+          client_id: public_client.uid,
+          refresh_token: token_for_public_client.refresh_token
+        )
+
+        new_token = Doorkeeper::AccessToken.last
+        should_have_json 'access_token',  new_token.token
+        should_have_json 'refresh_token', new_token.refresh_token
+      end
+
+      it 'returns an error without credentials' do
+        post refresh_token_endpoint_url(refresh_token: token_for_private_client.refresh_token)
+
+        should_not_have_json 'refresh_token'
+        should_have_json 'error', 'invalid_grant'
+      end
+
+      it 'returns an error with wrong credentials' do
+        post refresh_token_endpoint_url(
+          client_id: '1',
+          client_secret: '1',
+          refresh_token: token_for_private_client.refresh_token
+        )
+
+        should_not_have_json 'refresh_token'
+        should_have_json 'error', 'invalid_client'
+      end
+    end
+
     it 'client gets an error for invalid refresh token' do
       post refresh_token_endpoint_url(client: @client, refresh_token: 'invalid')
       should_not_have_json 'refresh_token'

data/spec/requests/flows/revoke_token_spec.rb

@@ -10,9 +10,9 @@ describe 'Revoke Token Flow' do
     let(:resource_owner) { User.create!(name: 'John', password: 'sekret') }
     let(:access_token) do
       FactoryBot.create(:access_token,
-                         application: client_application,
-                         resource_owner_id: resource_owner.id,
-                         use_refresh_token: true)
+                        application: client_application,
+                        resource_owner_id: resource_owner.id,
+                        use_refresh_token: true)
     end
 
     context 'with authenticated, confidential OAuth 2.0 client/application' do
@@ -103,9 +103,9 @@ describe 'Revoke Token Flow' do
     context 'with public OAuth 2.0 client/application' do
       let(:access_token) do
         FactoryBot.create(:access_token,
-                           application: nil,
-                           resource_owner_id: resource_owner.id,
-                           use_refresh_token: true)
+                          application: nil,
+                          resource_owner_id: resource_owner.id,
+                          use_refresh_token: true)
       end
 
       it 'should revoke the access token provided' do
@@ -129,9 +129,9 @@ describe 'Revoke Token Flow' do
       context 'with a valid token issued for a confidential client' do
         let(:access_token) do
           FactoryBot.create(:access_token,
-                             application: client_application,
-                             resource_owner_id: resource_owner.id,
-                             use_refresh_token: true)
+                            application: client_application,
+                            resource_owner_id: resource_owner.id,
+                            use_refresh_token: true)
         end
 
         it 'should not revoke the access token provided' do

data/spec/requests/protected_resources/private_api_spec.rb

@@ -41,10 +41,10 @@ feature 'Private API' do
   end
 
   scenario 'access token with no default scopes' do
-    Doorkeeper.configuration.instance_eval {
+    Doorkeeper.configuration.instance_eval do
       @default_scopes = Doorkeeper::OAuth::Scopes.from_array([:public])
       @scopes = default_scopes + optional_scopes
-    }
+    end
     @token.update_attribute :scopes, 'dummy'
     with_access_token_header @token.token
     visit '/full_protected_resources'

data/spec/support/doorkeeper_rspec.rb

@@ -4,7 +4,8 @@ module Doorkeeper
     # Doorkeeper configuration, etc.
     def self.print_configuration_info
       puts <<-INFO.strip_heredoc
-        ====> Doorkeeper ORM = #{Doorkeeper.configuration.orm}
+        ====> Doorkeeper ORM: '#{Doorkeeper.configuration.orm}'
+        ====> Doorkeeper version: #{Doorkeeper.gem_version}
         ====> Rails version: #{::Rails.version}
         ====> Ruby version: #{RUBY_VERSION} on #{RUBY_PLATFORM}
       INFO

data/spec/support/helpers/model_helper.rb

@@ -11,11 +11,15 @@ module ModelHelper
     @authorization = FactoryBot.create(:access_grant, options)
   end
 
+  def access_token_exists(options = {})
+    @access_token = FactoryBot.create(:access_token, options)
+  end
+
   def access_grant_should_exist_for(client, resource_owner)
     grant = Doorkeeper::AccessGrant.first
 
-    expect(grant.application).to have_attributes(id: client.id).
-      and(be_instance_of(Doorkeeper::Application))
+    expect(grant.application).to have_attributes(id: client.id)
+      .and(be_instance_of(Doorkeeper::Application))
 
     expect(grant.resource_owner_id).to eq(resource_owner.id)
   end
@@ -23,8 +27,8 @@ module ModelHelper
   def access_token_should_exist_for(client, resource_owner)
     token = Doorkeeper::AccessToken.first
 
-    expect(token.application).to have_attributes(id: client.id).
-      and(be_instance_of(Doorkeeper::Application))
+    expect(token.application).to have_attributes(id: client.id)
+      .and(be_instance_of(Doorkeeper::Application))
 
     expect(token.resource_owner_id).to eq(resource_owner.id)
   end

data/spec/support/helpers/url_helper.rb

@@ -2,9 +2,9 @@ module UrlHelper
   def token_endpoint_url(options = {})
     parameters = {
       code: options[:code],
-      client_id: options[:client_id] || (options[:client] ? options[:client].uid : nil),
-      client_secret: options[:client_secret] || (options[:client] ? options[:client].secret : nil),
-      redirect_uri: options[:redirect_uri]  || (options[:client] ? options[:client].redirect_uri : nil),
+      client_id: options[:client_id] || options[:client].try(:uid),
+      client_secret: options[:client_secret] || options[:client].try(:secret),
+      redirect_uri: options[:redirect_uri] || options[:client].try(:redirect_uri),
       grant_type: options[:grant_type] || 'authorization_code',
       code_verifier: options[:code_verifier],
       code_challenge_method: options[:code_challenge_method]
@@ -15,10 +15,10 @@ module UrlHelper
   def password_token_endpoint_url(options = {})
     parameters = {
       code: options[:code],
-      client_id: options[:client_id] || (options[:client] ? options[:client].uid : nil),
-      client_secret: options[:client_secret] || (options[:client] ? options[:client].secret : nil),
-      username: options[:resource_owner_username] || (options[:resource_owner] ? options[:resource_owner].name : nil),
-      password: options[:resource_owner_password] || (options[:resource_owner] ? options[:resource_owner].password : nil),
+      client_id: options[:client_id] || options[:client].try(:uid),
+      client_secret: options[:client_secret] || options[:client].try(:secret),
+      username: options[:resource_owner_username] || options[:resource_owner].try(:name),
+      password: options[:resource_owner_password] || options[:resource_owner].try(:password),
       scope: options[:scope],
       grant_type: 'password'
     }
@@ -27,8 +27,8 @@ module UrlHelper
 
   def authorization_endpoint_url(options = {})
     parameters = {
-      client_id: options[:client_id] || options[:client].uid,
-      redirect_uri: options[:redirect_uri] || options[:client].redirect_uri,
+      client_id: options[:client_id] || options[:client].try(:uid),
+      redirect_uri: options[:redirect_uri] || options[:client].try(:redirect_uri),
       response_type: options[:response_type] || 'code',
       scope: options[:scope],
       state: options[:state],
@@ -41,8 +41,8 @@ module UrlHelper
   def refresh_token_endpoint_url(options = {})
     parameters = {
       refresh_token: options[:refresh_token],
-      client_id: options[:client_id] || options[:client].uid,
-      client_secret: options[:client_secret] || options[:client].secret,
+      client_id: options[:client_id] || options[:client].try(:uid),
+      client_secret: options[:client_secret] || options[:client].try(:secret),
       grant_type: options[:grant_type] || 'refresh_token'
     }
     "/oauth/token?#{build_query(parameters)}"

data/spec/support/shared/controllers_shared_context.rb

@@ -63,3 +63,59 @@ shared_context 'invalid authorization request' do
     allow(controller).to receive(:authorization) { authorization }
   end
 end
+
+shared_context 'expired token', token: :expired do
+  let :token_string do
+    '1A2B3C4DEXP'
+  end
+
+  let :token do
+    double(Doorkeeper::AccessToken,
+           accessible?: false, revoked?: false, expired?: true,
+           includes_scope?: false, acceptable?: false,
+           previous_refresh_token: "", revoke_previous_refresh_token!: true)
+  end
+
+  before :each do
+    allow(
+      Doorkeeper::AccessToken
+    ).to receive(:by_token).with(token_string).and_return(token)
+  end
+end
+
+shared_context 'revoked token', token: :revoked do
+  let :token_string do
+    '1A2B3C4DREV'
+  end
+
+  let :token do
+    double(Doorkeeper::AccessToken,
+           accessible?: false, revoked?: true, expired?: false,
+           includes_scope?: false, acceptable?: false,
+           previous_refresh_token: "", revoke_previous_refresh_token!: true)
+  end
+
+  before :each do
+    allow(
+      Doorkeeper::AccessToken
+    ).to receive(:by_token).with(token_string).and_return(token)
+  end
+end
+
+shared_context 'forbidden token', token: :forbidden do
+  let :token_string do
+    '1A2B3C4DFORB'
+  end
+
+  let :token do
+    double(Doorkeeper::AccessToken,
+           accessible?: true, includes_scope?: true, acceptable?: false,
+           previous_refresh_token: "", revoke_previous_refresh_token!: true)
+  end
+
+  before :each do
+    allow(
+      Doorkeeper::AccessToken
+    ).to receive(:by_token).with(token_string).and_return(token)
+  end
+end

data/spec/validators/redirect_uri_validator_spec.rb

@@ -73,8 +73,8 @@ describe RedirectUriValidator do
     it 'accepts a non secured protocol when disabled' do
       subject.redirect_uri = 'http://example.com/callback'
       allow(Doorkeeper.configuration).to receive(
-                                             :force_ssl_in_redirect_uri
-                                         ).and_return(false)
+        :force_ssl_in_redirect_uri
+      ).and_return(false)
       expect(subject).to be_valid
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.0.0
+  version: 5.0.2
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-08-24 00:00:00.000000000 Z
+date: 2018-10-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -55,6 +55,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: danger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '5.0'
 - !ruby/object:Gem::Dependency
   name: grape
   requirement: !ruby/object:Gem::Requirement
@@ -158,6 +172,7 @@ files:
 - Appraisals
 - CODE_OF_CONDUCT.md
 - CONTRIBUTING.md
+- Dangerfile
 - Gemfile
 - MIT-LICENSE
 - NEWS.md
@@ -265,6 +280,7 @@ files:
 - lib/doorkeeper/request/strategy.rb
 - lib/doorkeeper/request/token.rb
 - lib/doorkeeper/server.rb
+- lib/doorkeeper/stale_records_cleaner.rb
 - lib/doorkeeper/validations.rb
 - lib/doorkeeper/version.rb
 - lib/generators/doorkeeper/application_owner_generator.rb
@@ -371,9 +387,9 @@ files:
 - spec/lib/oauth/token_request_spec.rb
 - spec/lib/oauth/token_response_spec.rb
 - spec/lib/oauth/token_spec.rb
-- spec/lib/orm/active_record/stale_records_cleaner_spec.rb
 - spec/lib/request/strategy_spec.rb
 - spec/lib/server_spec.rb
+- spec/lib/stale_records_cleaner_spec.rb
 - spec/models/doorkeeper/access_grant_spec.rb
 - spec/models/doorkeeper/access_token_spec.rb
 - spec/models/doorkeeper/application_spec.rb
@@ -527,9 +543,9 @@ test_files:
 - spec/lib/oauth/token_request_spec.rb
 - spec/lib/oauth/token_response_spec.rb
 - spec/lib/oauth/token_spec.rb
-- spec/lib/orm/active_record/stale_records_cleaner_spec.rb
 - spec/lib/request/strategy_spec.rb
 - spec/lib/server_spec.rb
+- spec/lib/stale_records_cleaner_spec.rb
 - spec/models/doorkeeper/access_grant_spec.rb
 - spec/models/doorkeeper/access_token_spec.rb
 - spec/models/doorkeeper/application_spec.rb