doorkeeper 5.0.0 → 5.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: db3333346ca1b82cd7aa332bb1e43f8d979534c0
-  data.tar.gz: 12511ea5d14b0bba28fef47893cc925c9e45ebcd
+SHA256:
+  metadata.gz: d8ea67fd14f902f63a276aed1f57a134c39fa02322d4b1f114571e2a90310ead
+  data.tar.gz: 44f9f0b886117c6dabe6a09c236107ba6b8c3469b40526a4f6c10f2e4b3e8eac
 SHA512:
-  metadata.gz: a5265ed62b206c4f9f117c3cbc8e6d905840636297a342ea952e5dfced01f7ce4bd6b59fc7efd6a4f0e6558475c566bf59ba4a793ef3f87942cf8935dde061ba
-  data.tar.gz: 18d2b90ae8e5f2e6e80f518fe0a251c49ba3187fda34c9213f14c0152f301dfd149d11db14dcd94a69bb8048352f8a945107c572cfb3fa03aeabc6d6383b706c
+  metadata.gz: 2aa8f4fbe445a84f98035e8ebeb99e715860fb7d29637d8e6cca994bf18a9ba7c051d38fda66829a5dd260f93ee74ff9f6f6d863e610203fa690da7b698b7da1
+  data.tar.gz: 5d474565c95e341b7b4773a7c1e2a782fa1bc27c4f22874428db52ceb4df10ccbb342420ba5266ba0d779380d42df3576f56449d390ecbf795e4deee50bdaff4

data/.hound.yml

@@ -1,2 +1,3 @@
-ruby:
+rubocop:
   config_file: .rubocop.yml
+  version: 0.64.0

data/.rubocop.yml

@@ -1,17 +1,50 @@
 AllCops:
+  TargetRubyVersion: 2.4
   Exclude:
     - "spec/dummy/db/*"
+    - "spec/dummy/config/*"
+    - "Dangerfile"
+    - "gemfiles/*.gemfile"
 
 Metrics/BlockLength:
   Exclude:
     - spec/**/*
+    - lib/doorkeeper/rake/*
 
-LineLength:
+Metrics/LineLength:
   Exclude:
     - spec/**/*
+  Max: 100
 
-StringLiterals:
-  Enabled: false
+Metrics/MethodLength:
+  Exclude:
+    - spec/dummy/db/*
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+Style/StringLiteralsInInterpolation:
+  EnforcedStyle: double_quotes
+
+Style/FrozenStringLiteralComment:
+  Enabled: true
+
+Style/TrailingCommaInHashLiteral:
+  EnforcedStyleForMultiline: consistent_comma
+Style/TrailingCommaInArrayLiteral:
+  EnforcedStyleForMultiline: consistent_comma
+
+Style/SymbolArray:
+  MinSize: 3
+Style/WordArray:
+  MinSize: 3
+
+Style/ClassAndModuleChildren:
+  Exclude:
+    - spec/**/*
 
-TrailingBlankLines:
+Layout/MultilineMethodCallIndentation:
+  EnforcedStyle: indented
+Layout/TrailingBlankLines:
   Enabled: true
+Layout/DotPosition:
+  EnforcedStyle: leading

data/.travis.yml

@@ -1,40 +1,35 @@
-cache: bundler
 language: ruby
-sudo: false
+cache: bundler
 
 rvm:
-  - 2.1
-  - 2.2
-  - 2.3
   - 2.4
   - 2.5
-  - ruby-2.6.0-preview1
+  - 2.6
+  - ruby-head
 
-before_install:
-  - gem update --system # Need for Ruby 2.5.0. https://github.com/travis-ci/travis-ci/issues/8978
-  - gem install bundler -v '~> 1.10'
+#before_install:
+#  - gem update --system
+#  - gem install bundler
 
 gemfile:
-  - gemfiles/rails_4_2.gemfile
   - gemfiles/rails_5_0.gemfile
   - gemfiles/rails_5_1.gemfile
   - gemfiles/rails_5_2.gemfile
+  - gemfiles/rails_6_0.gemfile
   - gemfiles/rails_master.gemfile
 
 matrix:
   fast_finish: true
+  # Run Danger only once
+  include:
+    - rvm: 2.5
+      gemfile: gemfiles/rails_5_2.gemfile
+      script: bundle exec danger
   exclude:
-    - gemfile: gemfiles/rails_5_0.gemfile
-      rvm: 2.1
-    - gemfile: gemfiles/rails_5_1.gemfile
-      rvm: 2.1
-    - gemfile: gemfiles/rails_5_2.gemfile
-      rvm: 2.1
-    - gemfile: gemfiles/rails_master.gemfile
-      rvm: 2.1
-    - gemfile: gemfiles/rails_master.gemfile
-      rvm: 2.2
+    - gemfile: gemfiles/rails_6_0.gemfile
+      rvm: 2.4
     - gemfile: gemfiles/rails_master.gemfile
-      rvm: 2.3
+      rvm: 2.4
   allow_failures:
     - gemfile: gemfiles/rails_master.gemfile
+    - rvm: ruby-head

data/Appraisals

@@ -1,18 +1,40 @@
-appraise "rails-4-2" do
-  gem "rails", "~> 4.2.0"
-end
+# frozen_string_literal: true
 
 appraise "rails-5-0" do
   gem "rails", "~> 5.0.0"
-  gem "rspec-rails", "~> 3.7"
+  gem "sqlite3", "~> 1.3", "< 1.4", platform: %i[ruby mswin mingw x64_mingw]
 end
 
 appraise "rails-5-1" do
   gem "rails", "~> 5.1.0"
-  gem "rspec-rails", "~> 3.7"
+  gem "sqlite3", "~> 1.3", "< 1.4", platform: %i[ruby mswin mingw x64_mingw]
+end
+
+appraise "rails-5-2" do
+  gem "rails", "~> 5.2.0"
+  gem "sqlite3", "~> 1.3", "< 1.4", platform: %i[ruby mswin mingw x64_mingw]
+end
+
+appraise "rails-6-0" do
+  gem "rails", "~> 6.0.0.beta3"
+  gem "sqlite3", "~> 1.4", platform: %i[ruby mswin mingw x64_mingw]
+
+  # TODO: Remove when rspec-rails 4.0 released
+  gem "rspec-core", github: "rspec/rspec-core"
+  gem "rspec-expectations", github: "rspec/rspec-expectations"
+  gem "rspec-mocks", github: "rspec/rspec-mocks"
+  gem "rspec-rails", github: "rspec/rspec-rails", branch: "4-0-dev"
+  gem "rspec-support", github: "rspec/rspec-support"
 end
 
 appraise "rails-master" do
-  gem "rails", git: 'https://github.com/rails/rails'
-  gem "arel", git: 'https://github.com/rails/arel'
+  gem "rails", git: "https://github.com/rails/rails"
+  gem "sqlite3", "~> 1.4", platform: %i[ruby mswin mingw x64_mingw]
+
+  # TODO: Remove when rspec-rails 4.0 released
+  gem "rspec-core", github: "rspec/rspec-core"
+  gem "rspec-expectations", github: "rspec/rspec-expectations"
+  gem "rspec-mocks", github: "rspec/rspec-mocks"
+  gem "rspec-rails", github: "rspec/rspec-rails", branch: "4-0-dev"
+  gem "rspec-support", github: "rspec/rspec-support"
 end

data/Dangerfile

@@ -0,0 +1,67 @@
+CHANGELOG_FILE = 'NEWS.md'
+GITHUB_REPO = 'https://github.com/doorkeeper-gem/doorkeeper'
+
+def changelog_changed?
+  git.modified_files.include?(CHANGELOG_FILE) || git.added_files.include?(CHANGELOG_FILE)
+end
+
+def changelog_entry_example
+  pr_number = github.pr_json['number']
+  pr_title = github.pr_title
+                   .sub(/[?.!,;]?$/, '')
+                   .capitalize
+
+  "- [##{pr_number}]: #{pr_title}."
+end
+
+# --------------------------------------------------------------------------------------------------------------------
+# Has any changes happened inside the actual library code?
+# --------------------------------------------------------------------------------------------------------------------
+has_app_changes = !git.modified_files.grep(/lib|app/).empty?
+has_spec_changes = !git.modified_files.grep(/spec/).empty?
+
+# --------------------------------------------------------------------------------------------------------------------
+# You've made changes to lib, but didn't write any tests?
+# --------------------------------------------------------------------------------------------------------------------
+if has_app_changes && !has_spec_changes
+  warn("There're library changes, but not tests. That's OK as long as you're refactoring existing code.", sticky: false)
+end
+
+# --------------------------------------------------------------------------------------------------------------------
+# You've made changes to specs, but no library code has changed?
+# --------------------------------------------------------------------------------------------------------------------
+if !has_app_changes && has_spec_changes
+  message('We really appreciate pull requests that demonstrate issues, even without a fix. That said, the next step is to try and fix the failing tests!', sticky: false)
+end
+
+# Mainly to encourage writing up some reasoning about the PR, rather than
+# just leaving a title
+if github.pr_body.length < 10
+  fail "Please provide a summary in the Pull Request description"
+end
+
+# --------------------------------------------------------------------------------------------------------------------
+# Have you updated CHANGELOG.md?
+# --------------------------------------------------------------------------------------------------------------------
+# Add a CHANGELOG entry for app changes
+if has_app_changes && !changelog_changed?
+  markdown <<-MARKDOWN
+Here's an example of a #{CHANGELOG_FILE} entry:
+```markdown
+#{changelog_entry_example}
+```
+  MARKDOWN
+
+  warn(
+    "Please include a changelog entry. \nYou can find it at [#{CHANGELOG_FILE}](#{GITHUB_REPO}/blob/master/#{CHANGELOG_FILE})." +
+      "You can skip this warning only if you made some typo fix or other small changes that didn't affect the API."
+  )
+end
+
+if git.commits.any? { |commit| commit.message =~ /^Merge branch '#{github.branch_for_base}'/ }
+  warn('Please rebase to get rid of the merge commits in this PR')
+end
+
+if git.commits.length > 1
+  warn('Please squash all your commits to a single one')
+end

data/Gemfile

@@ -1,10 +1,24 @@
+# frozen_string_literal: true
+
 source "https://rubygems.org"
+git_source(:github) { |repo| "https://github.com/#{repo}.git" }
+
+gemspec
+
+gem "rails", "~> 6.0.0.beta3"
 
-gem "rails", "~> 5.2"
+# TODO: Remove when rspec-rails 4.0 released
+gem "rspec-core", github: "rspec/rspec-core"
+gem "rspec-expectations", github: "rspec/rspec-expectations"
+gem "rspec-mocks", github: "rspec/rspec-mocks"
+gem "rspec-rails", github: "rspec/rspec-rails", branch: "4-0-dev"
+gem "rspec-support", github: "rspec/rspec-support"
 
-gem "appraisal"
+gem "rubocop", "~> 0.66"
+
+gem "bcrypt", "~> 3.1", require: false
 
 gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
-gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
-gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw]
-gemspec
+gem "sqlite3", "~> 1.4", platform: %i[ruby mswin mingw x64_mingw]
+
+gem "tzinfo-data", platforms: %i[mingw mswin x64_mingw]

data/NEWS.md

@@ -7,7 +7,83 @@ User-visible changes worth mentioning.
 
 ## master
 
-- [#PR ID] Add PR description.
+- [#PR] Add your PR description here.
+
+## 5.1.0
+
+- [#1243]: Add nil check operator in token checking at token introspection.
+- [#1241] Explaining foreign key options for resource owner in a single place
+- [#1237] Allow to set blank redirect URI if Doorkeeper configured to use redirect URI-less grant flows.
+- [#1234] Fix `StaleRecordsCleaner` to properly work with big amount of records.
+- [#1228] Allow to explicitly set non-expiring tokens in `custom_access_token_expires_in` configuration
+  option using `Float::INIFINITY` return value.
+- [#1224] Do not try to store token if not found by fallback hashing strategy.
+- [#1223] Update Hound/Rubocop rules, correct Doorkeeper codebase to follow style-guides.
+- [#1220] Drop Rails 4.2 & Ruby < 2.4 support.
+
+## 5.1.0.rc2
+
+- [#1208] Unify hashing implementation into secret storing strategies
+
+  **[IMPORTANT]**: If you have been using the master branch of doorkeeper with bcrypt in your Gemfile.lock,
+  your application secrets have been hashed using BCrypt. To restore this behavior, use the initializer option
+  `use_application_hashing using: 'Doorkeeper::SecretStoring::BCrypt`.
+
+- [#1216] Add nil check to `expires_at` method.
+- [#1215] Fix deprecates for Rails 6.
+- [#1214] Scopes field accepts array.
+- [#1209] Fix tokens validation for Token Introspection request.
+- [#1202] Use correct HTTP status codes for error responses.
+
+  **[IMPORTANT]**: this change might break your application if you were relying on the previous
+  401 status codes, this is now a 400 by default, or a 401 for `invalid_client` and `invalid_token` errors.
+
+- [#1201] Fix custom TTL block `client` parameter to always be an `Doorkeeper::Application` instance.
+
+  **[IMPORTANT]**: those who defined `custom_access_token_expires_in` configuration option need to check
+  their block implementation: if you are using `oauth_client.application` to get `Doorkeeper::Application`
+  instance, then you need to replace it with just `oauth_client`.
+
+- [#1200] Increase default Doorkeeper access token value complexity (`urlsafe_base64` instead of just `hex`)
+  matching RFC6749/RFC6750.
+
+  **[IMPORTANT]**: this change have possible side-effects in case you have custom database constraints for
+  access token value, application secrets, refresh tokens or you patched Doorkeeper models and introduced
+  token value validations, or you are using database with case-insensitive WHERE clause like MySQL
+  (you can face some collisions). Before this change access token value matched `[a-f0-9]` regex, and now
+  it matches `[a-zA-Z0-9\-_]`. In case you have such restrictions and your don't use custom token generator
+  please change configuration option `default_generator_method ` to `:hex`.
+
+- [#1195] Allow to customize Token Introspection response (fixes #1194).
+- [#1189] Option to set `token_reuse_limit`.
+- [#1191] Try to load bcrypt for hashing of application secrets, but add fallback.
+
+## 5.1.0.rc1
+
+- [#1188] Use `params` instead of `request.POST` in tokens controller (fixes #1183).
+- [#1182] Fix loopback IP redirect URIs to conform with RFC8252, p. 7.3 (fixes #1170).
+- [#1179] Authorization Code Grant Flow without client id returns invalid_client error.
+- [#1177] Allow to limit `scopes` for certain `grant_types`
+- [#1176] Fix test factory support for `factory_bot_rails`
+- [#1175] Internal refactor: use `scopes_string` inside `scopes`.
+- [#1168] Allow optional hashing of tokens and secrets.
+- [#1164] Fix error when `root_path` is not defined.
+- [#1162] Fix `enforce_content_type` for requests without body.
+
+## 5.0.2
+
+- [#1158] Fix initializer template: change `handle_auth_errors` option
+- [#1157] Remove redundant index from migration template.
+
+## 5.0.1
+
+- [#1154] Refactor `StaleRecordsCleaner` to be ORM agnostic.
+- [#1152] Fix migration template: change resource owner data type from integer to Rails generic `references`
+- [#1151] Fix Refresh Token strategy: add proper validation of client credentials both for Public & Private clients.
+- [#1149] Fix for `URIChecker#valid_for_authorization?` false negative when query is blank, but `?` present.
+- [#1140] Allow rendering custom errors from exceptions (issue #844). Originally opened as [#944].
+- [#1138] Revert regression bug (check for token expiration in Authorizations controller so authorization
+  triggers every time)
 
 ## 5.0.0
 
@@ -15,14 +91,14 @@ User-visible changes worth mentioning.
 
 ## 5.0.0.rc2
 
-- [#1106] Restrict access to AdminController with 'Forbidden 403' if admin_authenticator is not
-  configured by developers..
-- [#1108] Simple formating of callback URLs when listing oauth applications
+- [#1122] Fix AuthorizationsController#new error response to be in JSON format
+- [#1119] Fix token revocation for OAuth apps using "implicit" grant flow
 - [#1116] `AccessGrant`s will now be revoked along with `AccessToken`s when
   hitting the `AuthorizedApplicationController#destroy` route.
 - [#1114] Make token info endpoint's attributes consistent with token creation
-- [#1119] Fix token revocation for OAuth apps using "implicit" grant flow
-- [#1122] Fix AuthorizationsController#new error response to be in JSON format
+- [#1108] Simple formating of callback URLs when listing oauth applications
+- [#1106] Restrict access to AdminController with 'Forbidden 403' if admin_authenticator is not
+  configured by developers.
 
 ## 5.0.0.rc1
 
@@ -43,6 +119,12 @@ User-visible changes worth mentioning.
   `Doorkeeper#installed?` method
 - [#1031] Allow public clients to authenticate without `client_secret`. Define an app as
   either public or private/confidential
+
+  **[IMPORTANT]**: all the applications (clients) now are considered as private by default.
+    You need to manually change `confidential` column to `false` if you are using public clients,
+    in other case your mobile (or other) applications will not be able to authorize.
+    See [#1142](https://github.com/doorkeeper-gem/doorkeeper/issues/1142) for more details.
+
 - [#1010] Add configuration to enforce configured scopes (`default_scopes` and
   `optional_scopes`) for applications
 - [#1060] Ensure that the native redirect_uri parameter matches with redirect_uri of the client
@@ -60,20 +142,31 @@ User-visible changes worth mentioning.
 - [#1076] Add config to enforce content type to application/x-www-form-urlencoded
 - Fix bug with `force_ssl_in_redirect_uri` when it breaks existing applications with an
   SSL redirect_uri.
-  
+
+## 4.4.3
+
+- [#1143] Adds a config option `opt_out_native_route_change` to opt out of the breaking api
+  changed introduced in https://github.com/doorkeeper-gem/doorkeeper/pull/1003
+
+
 ## 4.4.2
 
 - [#1130] Backport fix for native redirect_uri from 5.x.
-  
+
 ## 4.4.1
 
 - [#1127] Backport token type to comply with the RFC6750 specification.
 - [#1125] Backport Quote surround I18n yes/no keys
-  
+
 ## 4.4.0
-  
+
 - [#1120] Backport security fix from 5.x for token revocation when using public clients
 
+  **[IMPORTANT]**: all the applications (clients) now are considered as private by default.
+  You need to manually change `confidential` column to `false` if you are using public clients,
+  in other case your mobile (or other) applications will not be able to authorize.
+  See [#1142](https://github.com/doorkeeper-gem/doorkeeper/issues/1142) for more details.
+
 ## 4.3.2
 
 - [#1053] Support authorizing with query params in the request `redirect_uri` if explicitly present in app's `Application#redirect_uri`
@@ -101,6 +194,10 @@ User-visible changes worth mentioning.
 - [#985] Generate valid migration files for Rails >= 5
 - [#972] Replace Struct subclassing with block-form initialization
 - [#1003] Use URL query param to pass through native redirect auth code so automated apps can find it.
+
+  **[IMPORTANT]**: Previously authorization code response route was `/oauth/authorize/<code>`,
+  now it is `oauth/authorize/native?code=<code>` (in order to help applications to automatically find the code value).
+
 - [#868] `Scopes#&` and `Scopes#+` now take an array or any other enumerable
   object.
 - [#1019] Remove translation not in use: `invalid_resource_owner`.