doorkeeper 5.0.0 → 5.1.0.rc1

data/lib/doorkeeper/config.rb

@@ -46,6 +46,7 @@ module Doorkeeper
       end
 
       def build
+        @config.validate
         @config
       end
 
@@ -83,6 +84,13 @@ module Doorkeeper
         @config.instance_variable_set(:@optional_scopes, OAuth::Scopes.from_array(scopes))
       end
 
+      # Define scopes_by_grant_type to limit certain scope to certain grant_type
+      # @param { Hash } with grant_types as keys.
+      # Default set to {} i.e. no limitation on scopes usage
+      def scopes_by_grant_type(hash = {})
+        @config.instance_variable_set(:@scopes_by_grant_type, hash)
+      end
+
       # Change the way client credentials are retrieved from the request object.
       # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
       # falls back to the `:client_id` and `:client_secret` params from the
@@ -107,7 +115,7 @@ module Doorkeeper
       def use_refresh_token(enabled = true, &block)
         @config.instance_variable_set(
           :@refresh_token_enabled,
-          block ? block : enabled
+          block || enabled
         )
       end
 
@@ -136,6 +144,24 @@ module Doorkeeper
       def enforce_content_type
         @config.instance_variable_set(:@enforce_content_type, true)
       end
+
+      # Allow optional hashing of input tokens before persisting them.
+      # Will be used for hashing of input token and grants.
+      def hash_token_secrets
+        @config.instance_variable_set(:@hash_token_secrets, true)
+      end
+
+      # Allow optional hashing of application secrets before persisting them.
+      # Will be used for hashing of input token and grants.
+      def hash_application_secrets
+        @config.instance_variable_set(:@hash_application_secrets, true)
+      end
+
+      # Allow plain value lookup when using +hash_token_secrets+
+      # or +hash_application_secrets+ to avoid disrupting application experience
+      def fallback_to_plain_secrets
+        @config.instance_variable_set(:@fallback_to_plain_secrets, true)
+      end
     end
 
     module Option
@@ -177,7 +203,7 @@ module Doorkeeper
             value = if attribute_builder
                       attribute_builder.new(&block).build
                     else
-                      block ? block : args.first
+                      block || args.first
                     end
 
             @config.instance_variable_set(:"@#{attribute}", value)
@@ -239,6 +265,7 @@ module Doorkeeper
     option :native_redirect_uri,            default: 'urn:ietf:wg:oauth:2.0:oob'
     option :active_record_options,          default: {}
     option :grant_flows,                    default: %w[authorization_code client_credentials]
+    option :handle_auth_errors,             default: :render
 
     # Allows to forbid specific Application redirect URI's by custom rules.
     # Doesn't forbid any URI by default.
@@ -285,9 +312,14 @@ module Doorkeeper
     option :base_controller,
            default: 'ActionController::Base'
 
-    attr_reader :reuse_access_token
-    attr_reader :api_only
-    attr_reader :enforce_content_type
+    attr_reader :api_only,
+                :enforce_content_type,
+                :reuse_access_token
+
+    # Return the valid subset of this configuration
+    def validate
+      validate_reuse_access_token_value
+    end
 
     def api_only
       @api_only ||= false
@@ -306,15 +338,31 @@ module Doorkeeper
     end
 
     def enforce_configured_scopes?
-      !!(defined?(@enforce_configured_scopes) && @enforce_configured_scopes)
+      option_set? :enforce_configured_scopes
     end
 
     def enable_application_owner?
-      !!(defined?(@enable_application_owner) && @enable_application_owner)
+      option_set? :enable_application_owner
     end
 
     def confirm_application_owner?
-      !!(defined?(@confirm_application_owner) && @confirm_application_owner)
+      option_set? :confirm_application_owner
+    end
+
+    def raise_on_errors?
+      handle_auth_errors == :raise
+    end
+
+    def hash_token_secrets?
+      option_set? :hash_token_secrets
+    end
+
+    def hash_application_secrets?
+      option_set? :hash_application_secrets
+    end
+
+    def fallback_to_plain_secrets?
+      option_set? :fallback_to_plain_secrets
     end
 
     def default_scopes
@@ -329,6 +377,10 @@ module Doorkeeper
       @scopes ||= default_scopes + optional_scopes
     end
 
+    def scopes_by_grant_type
+      @scopes_by_grant_type ||= {}
+    end
+
     def client_credentials_methods
       @client_credentials_methods ||= %i[from_basic from_params]
     end
@@ -347,6 +399,12 @@ module Doorkeeper
 
     private
 
+    # Helper to read boolearized configuration option
+    def option_set?(instance_key)
+      var = instance_variable_get("@#{instance_key}")
+      !!(defined?(var) && var)
+    end
+
     # Determines what values are acceptable for 'response_type' param in
     # authorization request endpoint, and return them as an array of strings.
     #
@@ -365,5 +423,19 @@ module Doorkeeper
       types << 'refresh_token' if refresh_token_enabled?
       types
     end
+
+    # Determine whether +reuse_access_token+ and +hash_token_secrets+
+    # have both been activated.
+    #
+    # In that case, disable reuse_access_token value and warn the user.
+    def validate_reuse_access_token_value
+      return unless hash_token_secrets? && reuse_access_token
+
+      ::Rails.logger.warn(
+        'You are configured both reuse_access_token AND hash_token_secrets. ' \
+        'This combination is unsupported. reuse_access_token will be disabled'
+      )
+      @reuse_access_token = false
+    end
   end
 end

data/lib/doorkeeper/engine.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class Engine < Rails::Engine
     initializer "doorkeeper.params.filter" do |app|

data/lib/doorkeeper/errors.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Errors
     class DoorkeeperError < StandardError
@@ -36,7 +38,22 @@ module Doorkeeper
       end
     end
 
+    class BaseResponseError < DoorkeeperError
+      attr_reader :response
+
+      def initialize(response)
+        @response = response
+      end
+    end
+
     UnableToGenerateToken = Class.new(DoorkeeperError)
     TokenGeneratorNotFound = Class.new(DoorkeeperError)
+    NoOrmCleaner = Class.new(DoorkeeperError)
+
+    InvalidToken = Class.new BaseResponseError
+    TokenExpired = Class.new InvalidToken
+    TokenRevoked = Class.new InvalidToken
+    TokenUnknown = Class.new InvalidToken
+    TokenForbidden = Class.new InvalidToken
   end
 end

data/lib/doorkeeper/grape/authorization_decorator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Grape
     class AuthorizationDecorator < SimpleDelegator

data/lib/doorkeeper/grape/helpers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'doorkeeper/grape/authorization_decorator'
 
 module Doorkeeper

data/lib/doorkeeper/helpers/controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Define methods that can be called in any controller that inherits from
 # Doorkeeper::ApplicationMetalController or Doorkeeper::ApplicationController
 module Doorkeeper
@@ -53,8 +55,9 @@ module Doorkeeper
       end
 
       def enforce_content_type
-        return if request.content_type == 'application/x-www-form-urlencoded'
-        render json: {}, status: :unsupported_media_type
+        if (request.put? || request.post? || request.patch?) && request.content_type != 'application/x-www-form-urlencoded'
+          render json: {}, status: :unsupported_media_type
+        end
       end
     end
   end

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module AccessGrantMixin
     extend ActiveSupport::Concern
@@ -7,6 +9,7 @@ module Doorkeeper
     include Models::Revocable
     include Models::Accessible
     include Models::Orderable
+    include Models::Hashable
     include Models::Scopes
 
     # never uses pkce, if pkce migrations were not generated
@@ -28,7 +31,13 @@ module Doorkeeper
       #   if there is no record with such token
       #
       def by_token(token)
-        find_by(token: token.to_s)
+        find_by_plaintext_token(:token, token)
+      end
+
+      # We want to perform secret hashing whenever the user
+      # enables the configuration option +hash_token_secrets+
+      def perform_secret_hashing?
+        Doorkeeper.configuration.hash_token_secrets?
       end
 
       # Revokes AccessGrant records that have not been revoked and associated
@@ -42,8 +51,8 @@ module Doorkeeper
       def revoke_all_for(application_id, resource_owner, clock = Time)
         where(application_id: application_id,
               resource_owner_id: resource_owner.id,
-              revoked_at: nil).
-          update_all(revoked_at: clock.now.utc)
+              revoked_at: nil)
+          .update_all(revoked_at: clock.now.utc)
       end
 
       # Implements PKCE code_challenge encoding without base64 padding as described in the spec.
@@ -78,7 +87,7 @@ module Doorkeeper
       #
       # urlsafe_encode64(bin)
       # Returns the Base64-encoded version of bin. This method complies with
-      # “Base 64 Encoding with URL and Filename Safe Alphabet” in RFC 4648.
+      # "Base 64 Encoding with URL and Filename Safe Alphabet" in RFC 4648.
       # The alphabet uses '-' instead of '+' and '_' instead of '/'.
 
       # @param code_verifier [#to_s] a one time use value (any object that responds to `#to_s`)

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module AccessTokenMixin
     extend ActiveSupport::Concern
@@ -7,20 +9,21 @@ module Doorkeeper
     include Models::Revocable
     include Models::Accessible
     include Models::Orderable
+    include Models::Hashable
     include Models::Scopes
 
     module ClassMethods
       # Returns an instance of the Doorkeeper::AccessToken with
-      # specific token value.
+      # specific plain text token value.
       #
       # @param token [#to_s]
-      #   token value (any object that responds to `#to_s`)
+      #   Plain text token value (any object that responds to `#to_s`)
       #
       # @return [Doorkeeper::AccessToken, nil] AccessToken object or nil
       #   if there is no record with such token
       #
       def by_token(token)
-        find_by(token: token.to_s)
+        find_by_plaintext_token(:token, token)
       end
 
       # Returns an instance of the Doorkeeper::AccessToken
@@ -33,7 +36,13 @@ module Doorkeeper
       #   if there is no record with such refresh token
       #
       def by_refresh_token(refresh_token)
-        find_by(refresh_token: refresh_token.to_s)
+        find_by_plaintext_token(:refresh_token, refresh_token)
+      end
+
+      # We want to perform secret hashing whenever the user
+      # enables the configuration option +hash_token_secrets+
+      def perform_secret_hashing?
+        Doorkeeper.configuration.hash_token_secrets?
       end
 
       # Revokes AccessToken records that have not been revoked and associated
@@ -47,11 +56,11 @@ module Doorkeeper
       def revoke_all_for(application_id, resource_owner, clock = Time)
         where(application_id: application_id,
               resource_owner_id: resource_owner.id,
-              revoked_at: nil).
-          update_all(revoked_at: clock.now.utc)
+              revoked_at: nil)
+          .update_all(revoked_at: clock.now.utc)
       end
 
-      # Looking for not expired Access Token with a matching set of scopes
+      # Looking for not revoked Access Token with a matching set of scopes
       # that belongs to specific Application and Resource Owner.
       #
       # @param application [Doorkeeper::Application]
@@ -96,9 +105,9 @@ module Doorkeeper
 
         (token_scopes.sort == param_scopes.sort) &&
           Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
-            param_scopes.to_s,
-            Doorkeeper.configuration.scopes,
-            app_scopes
+            scope_str: param_scopes.to_s,
+            server_scopes: Doorkeeper.configuration.scopes,
+            app_scopes: app_scopes
           )
       end
 
@@ -217,6 +226,26 @@ module Doorkeeper
       accessible? && includes_scope?(*scopes)
     end
 
+    # We keep a volatile copy of the raw refresh token for initial communication
+    # The stored refresh_token may be mapped and not available in cleartext.
+    def plaintext_refresh_token
+      if perform_secret_hashing?
+        @raw_refresh_token
+      else
+        refresh_token
+      end
+    end
+
+    # We keep a volatile copy of the raw token for initial communication
+    # The stored refresh_token may be mapped and not available in cleartext.
+    def plaintext_token
+      if perform_secret_hashing?
+        @raw_token
+      else
+        token
+      end
+    end
+
     private
 
     # Generates refresh token with UniqueToken generator.
@@ -224,7 +253,8 @@ module Doorkeeper
     # @return [String] refresh token value
     #
     def generate_refresh_token
-      self.refresh_token = UniqueToken.generate
+      @raw_refresh_token = UniqueToken.generate
+      self.refresh_token = hashed_or_plain_token(@raw_refresh_token)
     end
 
     # Generates and sets the token value with the
@@ -240,13 +270,16 @@ module Doorkeeper
     def generate_token
       self.created_at ||= Time.now.utc
 
-      self.token = token_generator.generate(
+      @raw_token = token_generator.generate(
         resource_owner_id: resource_owner_id,
         scopes: scopes,
         application: application,
         expires_in: expires_in,
         created_at: created_at
       )
+
+      self.token = hashed_or_plain_token(@raw_token)
+      @raw_token
     end
 
     def token_generator

data/lib/doorkeeper/models/application_mixin.rb

@@ -1,12 +1,40 @@
+# frozen_string_literal: true
+
+require 'bcrypt'
+
 module Doorkeeper
   module ApplicationMixin
     extend ActiveSupport::Concern
 
     include OAuth::Helpers
     include Models::Orderable
+    include Models::Hashable
     include Models::Scopes
 
+    included do
+      # Use BCrypt as the hashing function for applications
+      self.secret_hash_function = lambda do |plain_token|
+        BCrypt::Password.create(plain_token.to_s)
+      end
+
+      # Also need to override the comparer function for BCrypt
+      self.secret_comparer = lambda do |plain, secret|
+        begin
+          BCrypt::Password.new(secret.to_s) == plain.to_s
+        rescue BCrypt::Errors::InvalidHash
+          false
+        end
+      end
+    end
+
+    # :nodoc
     module ClassMethods
+      # We want to perform secret hashing whenever the user
+      # enables the configuration option +hash_application_secrets+
+      def perform_secret_hashing?
+        Doorkeeper.configuration.hash_application_secrets?
+      end
+
       # Returns an instance of the Doorkeeper::Application with
       # specific UID and secret.
       #
@@ -23,7 +51,7 @@ module Doorkeeper
         app = by_uid(uid)
         return unless app
         return app if secret.blank? && !app.confidential?
-        return unless app.secret == secret
+        return unless app.secret_matches?(secret)
         app
       end
 
@@ -47,5 +75,30 @@ module Doorkeeper
     def redirect_uri=(uris)
       super(uris.is_a?(Array) ? uris.join("\n") : uris)
     end
+
+    # Check whether the given plain text secret matches our stored secret
+    #
+    # @param input [#to_s] Plain secret provided by user
+    #        (any object that responds to `#to_s`)
+    #
+    # @return [true] Whether the given secret matches the stored secret
+    #                of this application.
+    #
+    def secret_matches?(input)
+      # return false if either is nil, since secure_compare depends on strings
+      # but Application secrets MAY be nil depending on confidentiality.
+      return false if input.nil? || secret.nil?
+
+      # When matching the secret by comparer function, all is well.
+      return true if self.class.secret_matches?(input, secret)
+
+      # When fallback lookup is enabled, ensure applications
+      # with plain secrets can still be found
+      if Doorkeeper.configuration.fallback_to_plain_secrets?
+        ActiveSupport::SecurityUtils.secure_compare(input, secret)
+      else
+        false
+      end
+    end
   end
 end

data/lib/doorkeeper/models/concerns/accessible.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Models
     module Accessible

data/lib/doorkeeper/models/concerns/expirable.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Models
     module Expirable

data/lib/doorkeeper/models/concerns/hashable.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Models
+    ##
+    # Hashable finder to provide lookups for input plaintext values which are
+    # mapped to their hashes before lookup.
+    module Hashable
+      extend ActiveSupport::Concern
+
+      delegate :perform_secret_hashing?,
+               :hashed_or_plain_token,
+               to: :class
+
+      # :nodoc
+      module ClassMethods
+        # Allow to override the hashing method by the including module
+        attr_accessor :secret_hash_function, :secret_comparer
+
+        # Compare the given plaintext with the secret
+        #
+        # @param input [String]
+        #   The plain input to compare.
+        #
+        # @param secret [String]
+        #   The secret value to compare with.
+        #
+        # @return [Boolean]
+        #   If hashing is enabled: Whether the secret equals hashed input
+        #   If hashing is disabled: Whether input matches secret
+        #
+        def secret_matches?(input, secret)
+          unless perform_secret_hashing?
+            return ActiveSupport::SecurityUtils.secure_compare input, secret
+          end
+
+          (secret_comparer || method(:default_comparer))
+            .call(input, secret)
+        end
+
+        # Returns an instance of the Doorkeeper::AccessToken with
+        # specific token value.
+        #
+        # @param attr [Symbol]
+        #   The token attribute we're looking with.
+        #
+        # @param token [#to_s]
+        #   token value (any object that responds to `#to_s`)
+        #
+        # @return [Doorkeeper::AccessToken, nil] AccessToken object or nil
+        #   if there is no record with such token
+        #
+        def find_by_plaintext_token(attr, token)
+          token = token.to_s
+
+          find_by(attr => hashed_or_plain_token(token)) ||
+            find_by_fallback_token(attr, token)
+        end
+
+        # Allow looking up previously plain tokens as a fallback
+        # IFF respective options are enabled
+        #
+        # @param attr [Symbol]
+        #   The token attribute we're looking with.
+        #
+        # @param token [#to_s]
+        #   token value (any object that responds to `#to_s`)
+        #
+        # @return [Doorkeeper::AccessToken, nil] AccessToken object or nil
+        #   if there is no record with such token
+        #
+        def find_by_fallback_token(attr, token)
+          return nil unless perform_secret_hashing?
+          return nil unless Doorkeeper.configuration.fallback_to_plain_secrets?
+
+          find_by(attr => token).tap do |fallback|
+            upgrade_fallback_value fallback, attr
+          end
+        end
+
+        # Hash the given input token
+        #
+        # @param plain_token [String]
+        #   The plain text token to hash.
+        #
+        # @return [String]
+        #   IFF secret hashing enabled, the hashed token,
+        #   otherwise returns the plain token.
+        def hashed_or_plain_token(plain_token)
+          if perform_secret_hashing?
+            (secret_hash_function || method(:default_hash_function))
+              .call plain_token
+          else
+            plain_token
+          end
+        end
+
+        # Allow implementations in ORMs to replace a plain
+        # value falling back to to avoid it remaining as plain text.
+        #
+        # @param instance
+        #   An instance of this model with a plain value token.
+        #
+        # @param attr
+        #   The token attribute to upgrade
+        #
+        def upgrade_fallback_value(instance, attr)
+          plain_token = instance.public_send attr
+          instance.update_column(attr, hashed_or_plain_token(plain_token))
+        end
+
+        # Including classes can override this function to
+        # disable or enable secret hashing dynamically
+        def perform_secret_hashing?
+          true
+        end
+
+        # Return a default hashing function to be used when including
+        # module or user does not specify what to use
+        # @param plain_token [String]
+        #   The plain text token to hash.
+        #
+        # @return [String] Hashed plain text token
+        #
+        def default_hash_function(plain_token)
+          ::Digest::SHA256.hexdigest plain_token
+        end
+
+        # Return a default comparer for the given hash function
+        def default_comparer(plain, secret)
+          hashed = hashed_or_plain_token(plain)
+          ActiveSupport::SecurityUtils.secure_compare hashed, secret
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/models/concerns/orderable.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Models
     module Orderable

data/lib/doorkeeper/models/concerns/ownership.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Models
     module Ownership

data/lib/doorkeeper/models/concerns/revocable.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Models
     module Revocable

data/lib/doorkeeper/models/concerns/scopes.rb

@@ -1,8 +1,10 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Models
     module Scopes
       def scopes
-        OAuth::Scopes.from_string(self[:scopes])
+        OAuth::Scopes.from_string(scopes_string)
       end
 
       def scopes_string

data/lib/doorkeeper/oauth/authorization/code.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     module Authorization
@@ -14,7 +16,7 @@ module Doorkeeper
         end
 
         def native_redirect
-          { action: :show, code: token.token }
+          { action: :show, code: token.plaintext_token }
         end
 
         def configuration