doorkeeper 5.0.0 → 5.1.0.rc1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: db3333346ca1b82cd7aa332bb1e43f8d979534c0
-  data.tar.gz: 12511ea5d14b0bba28fef47893cc925c9e45ebcd
+SHA256:
+  metadata.gz: 5773ab2b97881fdf1bb6fa66a4e176299d58c536f354ea9e9f4f7bb6dc0dcdea
+  data.tar.gz: 69ac6937d7eb7786a8c9ac331f540ef5aa1321b7c0624a0778c7437151764569
 SHA512:
-  metadata.gz: a5265ed62b206c4f9f117c3cbc8e6d905840636297a342ea952e5dfced01f7ce4bd6b59fc7efd6a4f0e6558475c566bf59ba4a793ef3f87942cf8935dde061ba
-  data.tar.gz: 18d2b90ae8e5f2e6e80f518fe0a251c49ba3187fda34c9213f14c0152f301dfd149d11db14dcd94a69bb8048352f8a945107c572cfb3fa03aeabc6d6383b706c
+  metadata.gz: 5e4b8470847ab8e642d50d27972838c0b5181b3c97c4a25afca18861b3878e513346f7b72d5c5d6c31b5d8513d90c1e6426e0cfcfce51a06b1e04e563ae09ab0
+  data.tar.gz: 79c4363faf9a3f41bc639ee6e6ec756efbd99a96e4670e788bc4201b6f69eb992ffc95f2f56e3efbcd5645f2ed76e2c8d29f6e9807ffb6841becd31d868c6963

data/.travis.yml

@@ -1,5 +1,5 @@
-cache: bundler
 language: ruby
+cache: bundler
 sudo: false
 
 rvm:
@@ -8,10 +8,12 @@ rvm:
   - 2.3
   - 2.4
   - 2.5
-  - ruby-2.6.0-preview1
+  - 2.6
+  - ruby-head
 
 before_install:
-  - gem update --system # Need for Ruby 2.5.0. https://github.com/travis-ci/travis-ci/issues/8978
+  - "find /home/travis/.rvm/rubies -wholename '*default/bundler-*.gemspec' -delete"
+  - rvm @global do gem uninstall bundler -a -x -I || true
   - gem install bundler -v '~> 1.10'
 
 gemfile:
@@ -23,6 +25,11 @@ gemfile:
 
 matrix:
   fast_finish: true
+  # Run Danger only once
+  include:
+    - rvm: 2.5
+      gemfile: gemfiles/rails_5_2.gemfile
+      script: bundle exec danger
   exclude:
     - gemfile: gemfiles/rails_5_0.gemfile
       rvm: 2.1
@@ -36,5 +43,7 @@ matrix:
       rvm: 2.2
     - gemfile: gemfiles/rails_master.gemfile
       rvm: 2.3
+    - gemfile: gemfiles/rails_master.gemfile
+      rvm: 2.4
   allow_failures:
     - gemfile: gemfiles/rails_master.gemfile

data/Dangerfile

@@ -0,0 +1,67 @@
+CHANGELOG_FILE = 'NEWS.md'
+GITHUB_REPO = 'https://github.com/doorkeeper-gem/doorkeeper'
+
+def changelog_changed?
+  git.modified_files.include?(CHANGELOG_FILE) || git.added_files.include?(CHANGELOG_FILE)
+end
+
+def changelog_entry_example
+  pr_number = github.pr_json['number']
+  pr_title = github.pr_title
+                   .sub(/[?.!,;]?$/, '')
+                   .capitalize
+
+  "- [##{pr_number}]: #{pr_title}."
+end
+
+# --------------------------------------------------------------------------------------------------------------------
+# Has any changes happened inside the actual library code?
+# --------------------------------------------------------------------------------------------------------------------
+has_app_changes = !git.modified_files.grep(/lib|app/).empty?
+has_spec_changes = !git.modified_files.grep(/spec/).empty?
+
+# --------------------------------------------------------------------------------------------------------------------
+# You've made changes to lib, but didn't write any tests?
+# --------------------------------------------------------------------------------------------------------------------
+if has_app_changes && !has_spec_changes
+  warn("There're library changes, but not tests. That's OK as long as you're refactoring existing code.", sticky: false)
+end
+
+# --------------------------------------------------------------------------------------------------------------------
+# You've made changes to specs, but no library code has changed?
+# --------------------------------------------------------------------------------------------------------------------
+if !has_app_changes && has_spec_changes
+  message('We really appreciate pull requests that demonstrate issues, even without a fix. That said, the next step is to try and fix the failing tests!', sticky: false)
+end
+
+# Mainly to encourage writing up some reasoning about the PR, rather than
+# just leaving a title
+if github.pr_body.length < 10
+  fail "Please provide a summary in the Pull Request description"
+end
+
+# --------------------------------------------------------------------------------------------------------------------
+# Have you updated CHANGELOG.md?
+# --------------------------------------------------------------------------------------------------------------------
+# Add a CHANGELOG entry for app changes
+if has_app_changes && !changelog_changed?
+  markdown <<-MARKDOWN
+Here's an example of a #{CHANGELOG_FILE} entry:
+```markdown
+#{changelog_entry_example}
+```
+  MARKDOWN
+
+  warn(
+    "Please include a changelog entry. \nYou can find it at [#{CHANGELOG_FILE}](#{GITHUB_REPO}/blob/master/#{CHANGELOG_FILE})." +
+      "You can skip this warning only if you made some typo fix or other small changes that didn't affect the API."
+  )
+end
+
+if git.commits.any? { |commit| commit.message =~ /^Merge branch '#{github.branch_for_base}'/ }
+  warn('Please rebase to get rid of the merge commits in this PR')
+end
+
+if git.commits.length > 1
+  warn('Please squash all your commits to a single one')
+end

data/Gemfile

@@ -1,9 +1,11 @@
 source "https://rubygems.org"
 
-gem "rails", "~> 5.2"
+gem "rails", ">= 5.2.1.1", "< 6.0"
 
 gem "appraisal"
 
+gem "bcrypt", "~> 3.1"
+
 gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
 gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
 gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw]

data/NEWS.md

@@ -7,7 +7,30 @@ User-visible changes worth mentioning.
 
 ## master
 
-- [#PR ID] Add PR description.
+- [#1188]  Use `params` instead of `request.POST` in tokens controller (fixes #1183).
+- [#1179] Authorization Code Grant Flow without client id returns invalid_client error.
+- [#1182] Fix loopback IP redirect URIs to conform with RFC8252, p. 7.3 (fixes #1170).
+- [#1177] Allow to limit `scopes` for certain `grant_types`
+- [#1162] Fix `enforce_content_type` for requests without body.
+- [#1164] Fix error when `root_path` is not defined.
+- [#1175] Internal refactor: use `scopes_string` inside `scopes`.
+- [#1176] Fix test factory support for `factory_bot_rails`
+- [#1168]: Allow optional hashing of tokens and secrets.
+
+## 5.0.2
+
+- [#1158] Fix initializer template: change `handle_auth_errors` option
+- [#1157] Remove redundant index from migration template.
+
+## 5.0.1
+
+- [#1140] Allow rendering custom errors from exceptions (issue #844). Originally opened as [#944].
+- [#1138] Revert regression bug (check for token expiration in Authorizations controller so authorization
+  triggers every time)
+- [#1149] Fix for `URIChecker#valid_for_authorization?` false negative when query is blank, but `?` present.
+- [#1151] Fix Refresh Token strategy: add proper validation of client credentials both for Public & Private clients.
+- [#1152] Fix migration template: change resource owner data type from integer to Rails generic `references`
+- [#1154] Refactor `StaleRecordsCleaner` to be ORM agnostic.
 
 ## 5.0.0
 
@@ -43,6 +66,12 @@ User-visible changes worth mentioning.
   `Doorkeeper#installed?` method
 - [#1031] Allow public clients to authenticate without `client_secret`. Define an app as
   either public or private/confidential
+
+  **[IMPORTANT]**: all the applications (clients) now are considered as private by default.
+    You need to manually change `confidential` column to `false` if you are using public clients,
+    in other case your mobile (or other) applications will not be able to authorize.
+    See [#1142](https://github.com/doorkeeper-gem/doorkeeper/issues/1142) for more details.
+
 - [#1010] Add configuration to enforce configured scopes (`default_scopes` and
   `optional_scopes`) for applications
 - [#1060] Ensure that the native redirect_uri parameter matches with redirect_uri of the client
@@ -60,20 +89,31 @@ User-visible changes worth mentioning.
 - [#1076] Add config to enforce content type to application/x-www-form-urlencoded
 - Fix bug with `force_ssl_in_redirect_uri` when it breaks existing applications with an
   SSL redirect_uri.
-  
+
+## 4.4.3
+
+- [#1143] Adds a config option `opt_out_native_route_change` to opt out of the breaking api
+  changed introduced in https://github.com/doorkeeper-gem/doorkeeper/pull/1003
+
+
 ## 4.4.2
 
 - [#1130] Backport fix for native redirect_uri from 5.x.
-  
+
 ## 4.4.1
 
 - [#1127] Backport token type to comply with the RFC6750 specification.
 - [#1125] Backport Quote surround I18n yes/no keys
-  
+
 ## 4.4.0
-  
+
 - [#1120] Backport security fix from 5.x for token revocation when using public clients
 
+  **[IMPORTANT]**: all the applications (clients) now are considered as private by default.
+  You need to manually change `confidential` column to `false` if you are using public clients,
+  in other case your mobile (or other) applications will not be able to authorize.
+  See [#1142](https://github.com/doorkeeper-gem/doorkeeper/issues/1142) for more details.
+
 ## 4.3.2
 
 - [#1053] Support authorizing with query params in the request `redirect_uri` if explicitly present in app's `Application#redirect_uri`
@@ -101,6 +141,10 @@ User-visible changes worth mentioning.
 - [#985] Generate valid migration files for Rails >= 5
 - [#972] Replace Struct subclassing with block-form initialization
 - [#1003] Use URL query param to pass through native redirect auth code so automated apps can find it.
+
+  **[IMPORTANT]**: Previously authorization code response route was `/oauth/authorize/<code>`,
+  now it is `oauth/authorize/native?code=<code>` (in order to help applications to automatically find the code value).
+
 - [#868] `Scopes#&` and `Scopes#+` now take an array or any other enumerable
   object.
 - [#1019] Remove translation not in use: `invalid_resource_owner`.

data/README.md

@@ -23,6 +23,9 @@ Supported features:
 - [OAuth 2.0 Token Revocation](http://tools.ietf.org/html/rfc7009)
 - [OAuth 2.0 Token Introspection](https://tools.ietf.org/html/rfc7662)
 
+See [list of tutorials](https://github.com/doorkeeper-gem/doorkeeper/wiki#how-tos--tutorials) in order to
+learn how to use the gem or integrate it with other solutions / gems.
+
 ## Documentation valid for `master` branch
 
 Please check the documentation for the version of doorkeeper you are using in:
@@ -50,6 +53,7 @@ https://github.com/doorkeeper-gem/doorkeeper/releases
   - [Routes](#routes)
   - [Authenticating](#authenticating)
   - [Internationalization (I18n)](#internationalization-i18n)
+  - [Customizing errors](#customizing-errors)
   - [Rake Tasks](#rake-tasks)
 - [Protecting resources with OAuth (a.k.a your API endpoint)](#protecting-resources-with-oauth-aka-your-api-endpoint)
   - [Ruby on Rails controllers](#ruby-on-rails-controllers)
@@ -113,7 +117,7 @@ migration:
 [PKCE flow]: https://tools.ietf.org/html/rfc7636
 
 ```sh
-    rails generate doorkeeper:pkce
+rails generate doorkeeper:pkce
 ```
 
 Then run migrations:
@@ -237,6 +241,14 @@ You may want to check other ways of authentication
 Doorkeeper support multiple languages. See language files in
 [the I18n repository](https://github.com/doorkeeper-gem/doorkeeper-i18n).
 
+### Customizing errors
+
+If you don't want to use default Doorkeeper error responses you can raise and rescue it's
+exceptions. All you need is to set configuration option `handle_auth_errors` to `:raise`.
+In this case Doorkeeper will raise `Doorkeeper::Errors::TokenForbidden`,
+`Doorkeeper::Errors::TokenExpired`, `Doorkeeper::Errors::TokenRevoked` or other exceptions
+that you need to care about.
+
 ### Rake Tasks
 
 If you are using `rake`, you can load rake tasks provided by this gem, by adding
@@ -372,7 +384,7 @@ end
 Please note that there is a logical OR between multiple required scopes. In the
 above example, `doorkeeper_authorize! :admin, :write` means that the access
 token is required to have either `:admin` scope or `:write` scope, but does not
-need have both of them.
+need to have both of them.
 
 If you want to require the access token to have multiple scopes at the same
 time, use multiple `doorkeeper_authorize!`, for example:
@@ -448,8 +460,11 @@ token owner.
 
 ### Applications list
 
-By default, the applications list (`/oauth/applications`) is publicly available.
-To protect the endpoint you should uncomment these lines:
+By default, the applications list (`/oauth/applications`) is publicly available (before 5.0 release).
+Starting from Doorkeeper 5.0 it returns 403 Forbidden if `admin_authenticator` option is not configured
+by developers.
+
+To change the protection rules of this endpoint you should uncomment these lines:
 
 ```ruby
 # config/initializers/doorkeeper.rb

data/app/controllers/doorkeeper/application_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class ApplicationController <
     Doorkeeper.configuration.base_controller.constantize

data/app/controllers/doorkeeper/application_metal_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class ApplicationMetalController < ActionController::Metal
     MODULES = [

data/app/controllers/doorkeeper/applications_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class ApplicationsController < Doorkeeper::ApplicationController
     layout 'doorkeeper/admin' unless Doorkeeper.configuration.api_only
@@ -77,8 +79,8 @@ module Doorkeeper
     end
 
     def application_params
-      params.require(:doorkeeper_application).
-        permit(:name, :redirect_uri, :scopes, :confidential)
+      params.require(:doorkeeper_application)
+        .permit(:name, :redirect_uri, :scopes, :confidential)
     end
   end
 end

data/app/controllers/doorkeeper/authorizations_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AuthorizationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!
@@ -41,13 +43,11 @@ module Doorkeeper
     end
 
     def matching_token?
-      token = AccessToken.matching_token_for(
+      AccessToken.matching_token_for(
         pre_auth.client,
         current_resource_owner.id,
         pre_auth.scopes
       )
-
-      token && token.accessible?
     end
 
     def redirect_or_render(auth)

data/app/controllers/doorkeeper/authorized_applications_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AuthorizedApplicationsController < Doorkeeper::ApplicationController
     before_action :authenticate_resource_owner!

data/app/controllers/doorkeeper/token_info_controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class TokenInfoController < Doorkeeper::ApplicationMetalController
     def show

data/app/controllers/doorkeeper/tokens_controller.rb

@@ -1,12 +1,14 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class TokensController < Doorkeeper::ApplicationMetalController
     def create
       response = authorize_response
-      headers.merge! response.headers
+      headers.merge!(response.headers)
       self.response_body = response.body.to_json
       self.status = response.status
-    rescue Errors::DoorkeeperError => e
-      handle_token_exception e
+    rescue Errors::DoorkeeperError => error
+      handle_token_exception(error)
     end
 
     # OAuth 2.0 Token Revocation - http://tools.ietf.org/html/rfc7009
@@ -73,12 +75,12 @@ module Doorkeeper
     end
 
     def token
-      @token ||= AccessToken.by_token(request.POST['token']) ||
-        AccessToken.by_refresh_token(request.POST['token'])
+      @token ||= AccessToken.by_token(params['token']) ||
+        AccessToken.by_refresh_token(params['token'])
     end
 
     def strategy
-      @strategy ||= server.token_request params[:grant_type]
+      @strategy ||= server.token_request(params[:grant_type])
     end
 
     def authorize_response

data/app/helpers/doorkeeper/dashboard_helper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module DashboardHelper
     def doorkeeper_errors_for(object, method)

data/app/validators/redirect_uri_validator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'uri'
 
 class RedirectUriValidator < ActiveModel::EachValidator

data/app/views/doorkeeper/applications/show.html.erb

@@ -8,7 +8,7 @@
     <p><code class="bg-light" id="application_id"><%= @application.uid %></code></p>
 
     <h4><%= t('.secret') %>:</h4>
-    <p><code class="bg-light" id="secret"><%= @application.secret %></code></p>
+    <p><code class="bg-light" id="secret"><%= @application.plaintext_secret %></code></p>
 
     <h4><%= t('.scopes') %>:</h4>
     <p><code class="bg-light" id="scopes"><%= @application.scopes.presence || raw('&nbsp;') %></code></p>

data/app/views/layouts/doorkeeper/admin.html.erb

@@ -17,9 +17,11 @@
       <li class="nav-item <%= 'active' if request.path == oauth_applications_path %>">
         <%= link_to t('doorkeeper.layouts.admin.nav.applications'), oauth_applications_path, class: 'nav-link' %>
       </li>
-      <li class="nav-item">
-        <%= link_to t('doorkeeper.layouts.admin.nav.home'), root_path, class: 'nav-link' %>
-      </li>
+      <% if respond_to?(:root_path) %>
+        <li class="nav-item">
+          <%= link_to t('doorkeeper.layouts.admin.nav.home'), root_path, class: 'nav-link' %>
+        </li>
+      <% end %>
     </ul>
   </div>
 </nav>

data/bin/console

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+require 'bundler/setup'
+require 'rails/all'
+require 'doorkeeper'
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# (If you use this, don't forget to add pry to your Gemfile!)
+# require "pry"
+# Pry.start
+
+require 'irb'
+IRB.start(__FILE__)

data/doorkeeper.gemspec

@@ -2,29 +2,30 @@ $LOAD_PATH.push File.expand_path('../lib', __FILE__)
 
 require 'doorkeeper/version'
 
-Gem::Specification.new do |s|
-  s.name        = 'doorkeeper'
-  s.version     = Doorkeeper.gem_version
-  s.authors     = ['Felipe Elias Philipp', 'Tute Costa', 'Jon Moss', 'Nikita Bulai']
-  s.email       = %w(bulaj.nikita@gmail.com)
-  s.homepage    = 'https://github.com/doorkeeper-gem/doorkeeper'
-  s.summary     = 'OAuth 2 provider for Rails and Grape'
-  s.description = 'Doorkeeper is an OAuth 2 provider for Rails and Grape.'
-  s.license     = 'MIT'
+Gem::Specification.new do |gem|
+  gem.name        = 'doorkeeper'
+  gem.version     = Doorkeeper.gem_version
+  gem.authors     = ['Felipe Elias Philipp', 'Tute Costa', 'Jon Moss', 'Nikita Bulai']
+  gem.email       = %w(bulaj.nikita@gmail.com)
+  gem.homepage    = 'https://github.com/doorkeeper-gem/doorkeeper'
+  gem.summary     = 'OAuth 2 provider for Rails and Grape'
+  gem.description = 'Doorkeeper is an OAuth 2 provider for Rails and Grape.'
+  gem.license     = 'MIT'
 
-  s.files         = `git ls-files`.split("\n")
-  s.test_files    = `git ls-files -- spec/*`.split("\n")
-  s.require_paths = ['lib']
+  gem.files         = `git ls-files`.split("\n")
+  gem.test_files    = `git ls-files -- spec/*`.split("\n")
+  gem.require_paths = ['lib']
 
-  s.add_dependency 'railties', '>= 4.2'
-  s.required_ruby_version = '>= 2.1'
+  gem.add_dependency 'railties', '>= 4.2'
+  gem.required_ruby_version = '>= 2.1'
 
-  s.add_development_dependency 'capybara', '~> 2.18'
-  s.add_development_dependency 'coveralls'
-  s.add_development_dependency 'grape'
-  s.add_development_dependency 'database_cleaner', '~> 1.6'
-  s.add_development_dependency 'factory_bot', '~> 4.8'
-  s.add_development_dependency 'generator_spec', '~> 0.9.3'
-  s.add_development_dependency 'rake', '>= 11.3.0'
-  s.add_development_dependency 'rspec-rails'
+  gem.add_development_dependency 'capybara', '~> 2.18'
+  gem.add_development_dependency 'coveralls'
+  gem.add_development_dependency 'danger', '~> 5.0'
+  gem.add_development_dependency 'grape'
+  gem.add_development_dependency 'database_cleaner', '~> 1.6'
+  gem.add_development_dependency 'factory_bot', '~> 4.8'
+  gem.add_development_dependency 'generator_spec', '~> 0.9.3'
+  gem.add_development_dependency 'rake', '>= 11.3.0'
+  gem.add_development_dependency 'rspec-rails'
 end

data/gemfiles/rails_4_2.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rails", "~> 4.2.0"
+gem "bcrypt", "~> 3.1"
 gem "appraisal"
 gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
 gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]

data/gemfiles/rails_5_0.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rails", "~> 5.0.0"
+gem "bcrypt", "~> 3.1"
 gem "appraisal"
 gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
 gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]

data/gemfiles/rails_5_1.gemfile

@@ -3,6 +3,7 @@
 source "https://rubygems.org"
 
 gem "rails", "~> 5.1.0"
+gem "bcrypt", "~> 3.1"
 gem "appraisal"
 gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
 gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]

data/gemfiles/rails_5_2.gemfile

@@ -2,7 +2,8 @@
 
 source "https://rubygems.org"
 
-gem "rails", "5.2.0"
+gem "rails", "~> 5.2.0"
+gem "bcrypt", "~> 3.1"
 gem "appraisal"
 gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
 gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]

data/gemfiles/rails_master.gemfile

@@ -6,6 +6,7 @@ gem "rails", git: 'https://github.com/rails/rails'
 gem "arel", git: 'https://github.com/rails/arel'
 
 gem "appraisal"
+gem "bcrypt", "~> 3.1"
 gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
 gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
 gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]