doorkeeper 5.0.0 → 5.1.0.rc1

data/lib/doorkeeper/oauth/authorization/context.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     module Authorization

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     module Authorization
@@ -60,7 +62,7 @@ module Doorkeeper
           {
             controller: controller,
             action: :show,
-            access_token: token.token
+            access_token: token.plaintext_token
           }
         end
 

data/lib/doorkeeper/oauth/authorization/uri_builder.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'rack/utils'
 
 module Doorkeeper

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class AuthorizationCodeRequest < BaseRequest
@@ -47,7 +49,7 @@ module Doorkeeper
       end
 
       def validate_client
-        !client.nil?
+        client.present?
       end
 
       def validate_grant

data/lib/doorkeeper/oauth/base_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class BaseRequest

data/lib/doorkeeper/oauth/base_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class BaseResponse

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class Client

data/lib/doorkeeper/oauth/client.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class Client
@@ -16,7 +18,7 @@ module Doorkeeper
       end
 
       def self.authenticate(credentials, method = Application.method(:by_uid_and_secret))
-        return false if credentials.blank?
+        return if credentials.blank?
 
         if (application = method.call(credentials.uid, credentials.secret))
           new(application)

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class ClientCredentialsRequest < BaseRequest

data/lib/doorkeeper/oauth/client_credentials/issuer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class ClientCredentialsRequest < BaseRequest

data/lib/doorkeeper/oauth/client_credentials/validation.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class ClientCredentialsRequest < BaseRequest
@@ -32,9 +34,10 @@ module Doorkeeper
                                end
 
           ScopeChecker.valid?(
-            @request.scopes.to_s,
-            @server.scopes,
-            application_scopes
+            scope_str: @request.scopes.to_s,
+            server_scopes: @server.scopes,
+            app_scopes: application_scopes,
+            grant_type: Doorkeeper::OAuth::CLIENT_CREDENTIALS
           )
         end
       end

data/lib/doorkeeper/oauth/client_credentials_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class ClientCredentialsRequest < BaseRequest

data/lib/doorkeeper/oauth/code_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class CodeRequest

data/lib/doorkeeper/oauth/code_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class CodeResponse < BaseResponse
@@ -21,7 +23,7 @@ module Doorkeeper
         elsif response_on_fragment
           Authorization::URIBuilder.uri_with_fragment(
             pre_auth.redirect_uri,
-            access_token: auth.token.token,
+            access_token: auth.token.plaintext_token,
             token_type: auth.token.token_type,
             expires_in: auth.token.expires_in_seconds,
             state: pre_auth.state
@@ -29,7 +31,7 @@ module Doorkeeper
         else
           Authorization::URIBuilder.uri_with_query(
             pre_auth.redirect_uri,
-            code: auth.token.token,
+            code: auth.token.plaintext_token,
             state: pre_auth.state
           )
         end

data/lib/doorkeeper/oauth/error.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     Error = Struct.new(:name, :state) do

data/lib/doorkeeper/oauth/error_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class ErrorResponse < BaseResponse
@@ -55,6 +57,10 @@ module Doorkeeper
         }
       end
 
+      def raise_exception!
+        raise exception_class.new(self), description
+      end
+
       protected
 
       delegate :realm, to: :configuration
@@ -63,6 +69,10 @@ module Doorkeeper
         Doorkeeper.configuration
       end
 
+      def exception_class
+        raise NotImplementedError, "error response must define #exception_class"
+      end
+
       private
 
       def authenticate_info

data/lib/doorkeeper/oauth/forbidden_token_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class ForbiddenTokenResponse < ErrorResponse
@@ -21,8 +23,13 @@ module Doorkeeper
       end
 
       def description
-        scope = { scope: %i[doorkeeper scopes] }
-        @description ||= @scopes.map { |r| I18n.translate r, scope }.join('\n')
+        @description ||= @scopes.map { |s| I18n.t(s, scope: %i[doorkeeper scopes]) }.join("\n")
+      end
+
+      protected
+
+      def exception_class
+        Doorkeeper::Errors::TokenForbidden
       end
     end
   end

data/lib/doorkeeper/oauth/helpers/scope_checker.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     module Helpers
@@ -5,31 +7,46 @@ module Doorkeeper
         class Validator
           attr_reader :parsed_scopes, :scope_str
 
-          def initialize(scope_str, server_scopes, application_scopes)
+          def initialize(scope_str, server_scopes, app_scopes, grant_type)
             @parsed_scopes = OAuth::Scopes.from_string(scope_str)
             @scope_str = scope_str
-            @valid_scopes = valid_scopes(server_scopes, application_scopes)
+            @valid_scopes = valid_scopes(server_scopes, app_scopes)
+
+            if grant_type
+              @scopes_by_grant_type = Doorkeeper.configuration.scopes_by_grant_type[grant_type.to_sym]
+            end
           end
 
           def valid?
             scope_str.present? &&
               scope_str !~ /[\n\r\t]/ &&
-              @valid_scopes.has_scopes?(parsed_scopes)
+              @valid_scopes.has_scopes?(parsed_scopes) &&
+              permitted_to_grant_type?
           end
 
           private
 
-          def valid_scopes(server_scopes, application_scopes)
-            if application_scopes.present?
-              application_scopes
+          def valid_scopes(server_scopes, app_scopes)
+            if app_scopes.present?
+              app_scopes
             else
               server_scopes
             end
           end
+
+          def permitted_to_grant_type?
+            return true unless @scopes_by_grant_type
+
+            OAuth::Scopes.from_array(@scopes_by_grant_type)
+                         .has_scopes?(parsed_scopes)
+          end
         end
 
-        def self.valid?(scope_str, server_scopes, application_scopes = nil)
-          Validator.new(scope_str, server_scopes, application_scopes).valid?
+        def self.valid?(scope_str:, server_scopes:, app_scopes: nil, grant_type: nil)
+          Validator.new(scope_str,
+                        server_scopes,
+                        app_scopes,
+                        grant_type).valid?
         end
       end
     end

data/lib/doorkeeper/oauth/helpers/unique_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     module Helpers

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -1,4 +1,25 @@
+# frozen_string_literal: true
+require 'ipaddr'
+
 module Doorkeeper
+  module IPAddrLoopback
+    def loopback?
+      case @family
+      when Socket::AF_INET
+        @addr & 0xff000000 == 0x7f000000
+      when Socket::AF_INET6
+        @addr == 1
+      else
+        raise AddressFamilyError, "unsupported address family"
+      end
+    end
+  end
+
+  # For backward compatibility with old rubies
+  if Gem::Version.new(RUBY_VERSION) < Gem::Version.new("2.5.0")
+    IPAddr.send(:include, Doorkeeper::IPAddrLoopback)
+  end
+
   module OAuth
     module Helpers
       module URIChecker
@@ -14,16 +35,30 @@ module Doorkeeper
           url = as_uri(url)
           client_url = as_uri(client_url)
 
-          if client_url.query.present?
+          unless client_url.query.nil?
             return false unless query_matches?(url.query, client_url.query)
             # Clear out queries so rest of URI can be tested. This allows query
             # params to be in the request but order not mattering.
             client_url.query = nil
           end
+
+          # RFC8252, Paragraph 7.3
+          # @see https://tools.ietf.org/html/rfc8252#section-7.3
+          if loopback_uri?(url) && loopback_uri?(client_url)
+            url.port = nil
+            client_url.port = nil
+          end
+
           url.query = nil
           url == client_url
         end
 
+        def self.loopback_uri?(uri)
+          IPAddr.new(uri.host).loopback?
+        rescue IPAddr::Error
+          false
+        end
+
         def self.valid_for_authorization?(url, client_url)
           valid?(url) && client_url.split.any? { |other_url| matches?(url, other_url) }
         end
@@ -33,7 +68,7 @@ module Doorkeeper
         end
 
         def self.query_matches?(query, client_query)
-          return true if client_query.nil? && query.nil?
+          return true if client_query.blank? && query.blank?
           return false if client_query.nil? || query.nil?
           # Will return true independent of query order
           client_query.split('&').sort == query.split('&').sort

data/lib/doorkeeper/oauth/invalid_token_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class InvalidTokenResponse < ErrorResponse
@@ -24,6 +26,22 @@ module Doorkeeper
         scope = { scope: %i[doorkeeper errors messages invalid_token] }
         @description ||= I18n.translate @reason, scope
       end
+
+      protected
+
+      def exception_class
+        errors_mapping.fetch(reason)
+      end
+
+      private
+
+      def errors_mapping
+        {
+          expired: Doorkeeper::Errors::TokenExpired,
+          revoked: Doorkeeper::Errors::TokenRevoked,
+          unknown: Doorkeeper::Errors::TokenUnknown
+        }
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class PasswordAccessTokenRequest < BaseRequest
@@ -30,7 +32,12 @@ module Doorkeeper
         client_scopes = client.try(:scopes)
         return true if scopes.blank?
 
-        ScopeChecker.valid?(scopes.to_s, server.scopes, client_scopes)
+        ScopeChecker.valid?(
+          scope_str: scopes.to_s,
+          server_scopes: server.scopes,
+          app_scopes: client_scopes,
+          grant_type: grant_type
+        )
       end
 
       def validate_resource_owner
@@ -38,7 +45,7 @@ module Doorkeeper
       end
 
       def validate_client
-        !parameters[:client_id] || !client.nil?
+        !parameters[:client_id] || client.present?
       end
     end
   end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class PreAuthorization
@@ -75,12 +77,17 @@ module Doorkeeper
         return true if scope.blank?
 
         Helpers::ScopeChecker.valid?(
-          scope,
-          server.scopes,
-          client.application.scopes
+          scope_str: scope,
+          server_scopes: server.scopes,
+          app_scopes: client.application.scopes,
+          grant_type: grant_type
         )
       end
 
+      def grant_type
+        response_type == 'code' ? AUTHORIZATION_CODE : IMPLICIT
+      end
+
       def validate_redirect_uri
         return false if redirect_uri.blank?
 

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class RefreshTokenRequest < BaseRequest
@@ -82,16 +84,25 @@ module Doorkeeper
       end
 
       def validate_client
-        !credentials || !!client
+        return true if credentials.blank?
+
+        client.present?
       end
 
+      # @see https://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-1.5
+      #
       def validate_client_match
-        !client || refresh_token.application_id == client.id
+        return true if refresh_token.application_id.blank?
+
+        client && refresh_token.application_id == client.id
       end
 
       def validate_scope
         if @original_scopes.present?
-          ScopeChecker.valid?(@original_scopes, refresh_token.scopes)
+          ScopeChecker.valid?(
+            scope_str: @original_scopes,
+            server_scopes: refresh_token.scopes
+          )
         else
           true
         end

data/lib/doorkeeper/oauth/scopes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class Scopes

data/lib/doorkeeper/oauth/token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class Token

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     # RFC7662 OAuth 2.0 Token Introspection

data/lib/doorkeeper/oauth/token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenRequest

data/lib/doorkeeper/oauth/token_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenResponse
@@ -9,10 +11,10 @@ module Doorkeeper
 
       def body
         {
-          'access_token'  => token.token,
+          'access_token'  => token.plaintext_token,
           'token_type'    => token.token_type,
           'expires_in'    => token.expires_in_seconds,
-          'refresh_token' => token.refresh_token,
+          'refresh_token' => token.plaintext_refresh_token,
           'scope'         => token.scopes_string,
           'created_at'    => token.created_at.to_i
         }.reject { |_, value| value.blank? }

data/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -16,11 +16,30 @@ module Doorkeeper
 
     belongs_to :application, belongs_to_options
 
-    validates :resource_owner_id, :application_id, :token, :expires_in, :redirect_uri, presence: true
+    validates :resource_owner_id,
+              :application_id,
+              :token,
+              :expires_in,
+              :redirect_uri,
+              presence: true
+
     validates :token, uniqueness: true
 
     before_validation :generate_token, on: :create
 
+    # Keep a reference to the generated token during generation
+    # of this access grant. The actual token may be mapped by
+    # the configuration hasher and may not be available in plaintext.
+    #
+    # If hash tokens are enabled, this will return nil on fetched tokens
+    def plaintext_token
+      if perform_secret_hashing?
+        @raw_token
+      else
+        token
+      end
+    end
+
     private
 
     # Generates token value with UniqueToken class.
@@ -28,7 +47,8 @@ module Doorkeeper
     # @return [String] token value
     #
     def generate_token
-      self.token = UniqueToken.generate
+      @raw_token = UniqueToken.generate
+      self.token = hashed_or_plain_token(@raw_token)
     end
   end
 end

data/lib/doorkeeper/orm/active_record/application.rb

@@ -45,6 +45,16 @@ module Doorkeeper
       AccessGrant.revoke_all_for(id, resource_owner)
     end
 
+    # We keep a volatile copy of the raw client_secret for initial communication
+    # The stored secret may be mapped and not available in cleartext.
+    def plaintext_secret
+      if perform_secret_hashing?
+        @raw_secret
+      else
+        secret
+      end
+    end
+
     private
 
     def generate_uid
@@ -52,12 +62,16 @@ module Doorkeeper
     end
 
     def generate_secret
-      self.secret = UniqueToken.generate if secret.blank?
+      return unless secret.blank?
+
+      @raw_secret = UniqueToken.generate
+      self.secret = hashed_or_plain_token(@raw_secret)
     end
 
     def scopes_match_configured
       if scopes.present? &&
-         !ScopeChecker.valid?(scopes.to_s, Doorkeeper.configuration.scopes)
+         !ScopeChecker.valid?(scope_str: scopes.to_s,
+                              server_scopes: Doorkeeper.configuration.scopes)
         errors.add(:scopes, :not_match_configured)
       end
     end

data/lib/doorkeeper/orm/active_record.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'active_support/lazy_load_hooks'
 
 require 'doorkeeper/orm/active_record/stale_records_cleaner'

data/lib/doorkeeper/rails/helpers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     module Helpers
@@ -19,6 +21,8 @@ module Doorkeeper
 
       def doorkeeper_render_error
         error = doorkeeper_error
+        error.raise_exception! if Doorkeeper.configuration.raise_on_errors?
+
         headers.merge!(error.headers.reject { |k| k == "Content-Type" })
         doorkeeper_render_error_with(error)
       end

data/lib/doorkeeper/rails/routes/mapper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     class Routes # :nodoc:

data/lib/doorkeeper/rails/routes/mapping.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     class Routes # :nodoc:

data/lib/doorkeeper/rails/routes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'doorkeeper/rails/routes/mapping'
 require 'doorkeeper/rails/routes/mapper'
 
@@ -91,11 +93,16 @@ module Doorkeeper
       end
 
       def application_routes(mapping)
-        routes.resources :doorkeeper_applications, controller: mapping[:controllers], as: :applications, path: 'applications'
+        routes.resources :doorkeeper_applications,
+                         controller: mapping[:controllers],
+                         as: :applications,
+                         path: 'applications'
       end
 
       def authorized_applications_routes(mapping)
-        routes.resources :authorized_applications, only: %i[index destroy], controller: mapping[:controllers]
+        routes.resources :authorized_applications,
+                         only: %i[index destroy],
+                         controller: mapping[:controllers]
       end
     end
   end