doorkeeper 5.0.0 → 5.1.0

data/lib/doorkeeper/config.rb

@@ -1,9 +1,13 @@
+# frozen_string_literal: true
+
+require "doorkeeper/config/option"
+
 module Doorkeeper
   class MissingConfiguration < StandardError
     # Defines a MissingConfiguration error for a missing Doorkeeper
     # configuration
     def initialize
-      super('Configuration for doorkeeper missing. Do you have doorkeeper initializer?')
+      super("Configuration for doorkeeper missing. Do you have doorkeeper initializer?")
     end
   end
 
@@ -12,6 +16,7 @@ module Doorkeeper
     setup_orm_adapter
     setup_orm_models
     setup_application_owner if @config.enable_application_owner?
+    @config
   end
 
   def self.configuration
@@ -46,6 +51,7 @@ module Doorkeeper
       end
 
       def build
+        @config.validate
         @config
       end
 
@@ -83,6 +89,13 @@ module Doorkeeper
         @config.instance_variable_set(:@optional_scopes, OAuth::Scopes.from_array(scopes))
       end
 
+      # Define scopes_by_grant_type to limit certain scope to certain grant_type
+      # @param { Hash } with grant_types as keys.
+      # Default set to {} i.e. no limitation on scopes usage
+      def scopes_by_grant_type(hash = {})
+        @config.instance_variable_set(:@scopes_by_grant_type, hash)
+      end
+
       # Change the way client credentials are retrieved from the request object.
       # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
       # falls back to the `:client_id` and `:client_secret` params from the
@@ -107,7 +120,7 @@ module Doorkeeper
       def use_refresh_token(enabled = true, &block)
         @config.instance_variable_set(
           :@refresh_token_enabled,
-          block ? block : enabled
+          block || enabled
         )
       end
 
@@ -118,6 +131,15 @@ module Doorkeeper
         @config.instance_variable_set(:@reuse_access_token, true)
       end
 
+      # Sets the token_reuse_limit
+      # It will be used only when reuse_access_token option in enabled
+      # By default it will be 100
+      # It will be used for token reusablity to some threshold percentage
+      # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
+      def token_reuse_limit(percentage)
+        @config.instance_variable_set(:@token_reuse_limit, percentage)
+      end
+
       # Use an API mode for applications generated with --api argument
       # It will skip applications controller, disable forgery protection
       def api_only
@@ -136,63 +158,54 @@ module Doorkeeper
       def enforce_content_type
         @config.instance_variable_set(:@enforce_content_type, true)
       end
-    end
 
-    module Option
-      # Defines configuration option
-      #
-      # When you call option, it defines two methods. One method will take place
-      # in the +Config+ class and the other method will take place in the
-      # +Builder+ class.
+      # Allow optional hashing of input tokens before persisting them.
+      # Will be used for hashing of input token and grants.
       #
-      # The +name+ parameter will set both builder method and config attribute.
-      # If the +:as+ option is defined, the builder method will be the specified
-      # option while the config attribute will be the +name+ parameter.
-      #
-      # If you want to introduce another level of config DSL you can
-      # define +builder_class+ parameter.
-      # Builder should take a block as the initializer parameter and respond to function +build+
-      # that returns the value of the config attribute.
-      #
-      # ==== Options
-      #
-      # * [:+as+] Set the builder method that goes inside +configure+ block
-      # * [+:default+] The default value in case no option was set
-      #
-      # ==== Examples
-      #
-      #    option :name
-      #    option :name, as: :set_name
-      #    option :name, default: 'My Name'
-      #    option :scopes builder_class: ScopesBuilder
+      # @param using
+      #   Provide a different secret storage implementation class for tokens
+      # @param fallback
+      #   Provide a fallback secret storage implementation class for tokens
+      #   or use :plain to fallback to plain tokens
+      def hash_token_secrets(using: nil, fallback: nil)
+        default = "::Doorkeeper::SecretStoring::Sha256Hash"
+        configure_secrets_for :token,
+                              using: using || default,
+                              fallback: fallback
+      end
+
+      # Allow optional hashing of application secrets before persisting them.
+      # Will be used for hashing of input token and grants.
       #
-      def option(name, options = {})
-        attribute = options[:as] || name
-        attribute_builder = options[:builder_class]
-
-        Builder.instance_eval do
-          remove_method name if method_defined?(name)
-          define_method name do |*args, &block|
-            # TODO: is builder_class option being used?
-            value = if attribute_builder
-                      attribute_builder.new(&block).build
-                    else
-                      block ? block : args.first
-                    end
-
-            @config.instance_variable_set(:"@#{attribute}", value)
-          end
-        end
+      # @param using
+      #   Provide a different secret storage implementation for applications
+      # @param fallback
+      #   Provide a fallback secret storage implementation for applications
+      #   or use :plain to fallback to plain application secrets
+      def hash_application_secrets(using: nil, fallback: nil)
+        default = "::Doorkeeper::SecretStoring::Sha256Hash"
+        configure_secrets_for :application,
+                              using: using || default,
+                              fallback: fallback
+      end
+
+      private
+
+      # Configure the secret storing functionality
+      def configure_secrets_for(type, using:, fallback:)
+        raise ArgumentError, "Invalid type #{type}" if %i[application token].exclude?(type)
 
-        define_method attribute do |*_args|
-          if instance_variable_defined?(:"@#{attribute}")
-            instance_variable_get(:"@#{attribute}")
-          else
-            options[:default]
-          end
+        @config.instance_variable_set(:"@#{type}_secret_strategy",
+                                      using.constantize)
+
+        if fallback.nil?
+          return
+        elsif fallback.to_sym == :plain
+          fallback = "::Doorkeeper::SecretStoring::Plain"
         end
 
-        public attribute
+        @config.instance_variable_set(:"@#{type}_secret_fallback_strategy",
+                                      fallback.constantize)
       end
     end
 
@@ -202,7 +215,7 @@ module Doorkeeper
            as: :authenticate_resource_owner,
            default: (lambda do |_routes|
              ::Rails.logger.warn(
-               I18n.t('doorkeeper.errors.messages.resource_owner_authenticator_not_configured')
+               I18n.t("doorkeeper.errors.messages.resource_owner_authenticator_not_configured")
              )
 
              nil
@@ -212,7 +225,7 @@ module Doorkeeper
            as: :authenticate_admin,
            default: (lambda do |_routes|
              ::Rails.logger.warn(
-               I18n.t('doorkeeper.errors.messages.admin_authenticator_not_configured')
+               I18n.t("doorkeeper.errors.messages.admin_authenticator_not_configured")
              )
 
              head :forbidden
@@ -221,24 +234,30 @@ module Doorkeeper
     option :resource_owner_from_credentials,
            default: (lambda do |_routes|
              ::Rails.logger.warn(
-               I18n.t('doorkeeper.errors.messages.credential_flow_not_configured')
+               I18n.t("doorkeeper.errors.messages.credential_flow_not_configured")
              )
 
              nil
            end)
-    option :before_successful_authorization, default: ->(_context) {}
-    option :after_successful_authorization, default: ->(_context) {}
-    option :before_successful_strategy_response, default: ->(_request) {}
-    option :after_successful_strategy_response,
-           default: ->(_request, _response) {}
+
+    # Hooks for authorization
+    option :before_successful_authorization,      default: ->(_context) {}
+    option :after_successful_authorization,       default: ->(_context) {}
+    # Hooks for strategies responses
+    option :before_successful_strategy_response,  default: ->(_request) {}
+    option :after_successful_strategy_response,   default: ->(_request, _response) {}
+    # Allows to customize Token Introspection response
+    option :custom_introspection_response,        default: ->(_token, _context) { {} }
+
     option :skip_authorization,             default: ->(_routes) {}
     option :access_token_expires_in,        default: 7200
     option :custom_access_token_expires_in, default: ->(_context) { nil }
     option :authorization_code_expires_in,  default: 600
     option :orm,                            default: :active_record
-    option :native_redirect_uri,            default: 'urn:ietf:wg:oauth:2.0:oob'
+    option :native_redirect_uri,            default: "urn:ietf:wg:oauth:2.0:oob"
     option :active_record_options,          default: {}
     option :grant_flows,                    default: %w[authorization_code client_credentials]
+    option :handle_auth_errors,             default: :render
 
     # Allows to forbid specific Application redirect URI's by custom rules.
     # Doesn't forbid any URI by default.
@@ -251,7 +270,7 @@ module Doorkeeper
     #
     # @param realm [String] ("Doorkeeper") Authentication realm
     #
-    option :realm,                          default: 'Doorkeeper'
+    option :realm,                          default: "Doorkeeper"
 
     # Forces the usage of the HTTPS protocol in non-native redirect uris
     # (enabled by default in non-development environments). OAuth2
@@ -275,7 +294,15 @@ module Doorkeeper
     #   the name of the access token generator class
     #
     option :access_token_generator,
-           default: 'Doorkeeper::OAuth::Helpers::UniqueToken'
+           default: "Doorkeeper::OAuth::Helpers::UniqueToken"
+
+    # Default access token generator is a SecureRandom class from Ruby stdlib.
+    # This option defines which method will be used to generate a unique token value.
+    #
+    # @param access_token_generator [String]
+    #   the name of the access token generator class
+    #
+    option :default_generator_method, default: :urlsafe_base64
 
     # The controller Doorkeeper::ApplicationController inherits from.
     # Defaults to ActionController::Base.
@@ -283,11 +310,29 @@ module Doorkeeper
     #
     # @param base_controller [String] the name of the base controller
     option :base_controller,
-           default: 'ActionController::Base'
+           default: "ActionController::Base"
 
-    attr_reader :reuse_access_token
-    attr_reader :api_only
-    attr_reader :enforce_content_type
+    # Allows to set blank redirect URIs for Applications in case
+    # server configured to use URI-less grant flows.
+    #
+    option :allow_blank_redirect_uri,
+           default: (lambda do |grant_flows, _application|
+             grant_flows.exclude?("authorization_code") &&
+               grant_flows.exclude?("implicit")
+           end)
+
+    attr_reader :api_only,
+                :enforce_content_type,
+                :reuse_access_token,
+                :token_secret_fallback_strategy,
+                :application_secret_fallback_strategy
+
+    # Return the valid subset of this configuration
+    def validate
+      validate_reuse_access_token_value
+      validate_token_reuse_limit
+      validate_secret_strategies
+    end
 
     def api_only
       @api_only ||= false
@@ -305,16 +350,32 @@ module Doorkeeper
       end
     end
 
+    def token_reuse_limit
+      @token_reuse_limit ||= 100
+    end
+
     def enforce_configured_scopes?
-      !!(defined?(@enforce_configured_scopes) && @enforce_configured_scopes)
+      option_set? :enforce_configured_scopes
     end
 
     def enable_application_owner?
-      !!(defined?(@enable_application_owner) && @enable_application_owner)
+      option_set? :enable_application_owner
     end
 
     def confirm_application_owner?
-      !!(defined?(@confirm_application_owner) && @confirm_application_owner)
+      option_set? :confirm_application_owner
+    end
+
+    def raise_on_errors?
+      handle_auth_errors == :raise
+    end
+
+    def token_secret_strategy
+      @token_secret_strategy ||= ::Doorkeeper::SecretStoring::Plain
+    end
+
+    def application_secret_strategy
+      @application_secret_strategy ||= ::Doorkeeper::SecretStoring::Plain
     end
 
     def default_scopes
@@ -329,12 +390,20 @@ module Doorkeeper
       @scopes ||= default_scopes + optional_scopes
     end
 
+    def scopes_by_grant_type
+      @scopes_by_grant_type ||= {}
+    end
+
     def client_credentials_methods
       @client_credentials_methods ||= %i[from_basic from_params]
     end
 
     def access_token_methods
-      @access_token_methods ||= %i[from_bearer_authorization from_access_token_param from_bearer_param]
+      @access_token_methods ||= %i[
+        from_bearer_authorization
+        from_access_token_param
+        from_bearer_param
+      ]
     end
 
     def authorization_response_types
@@ -345,15 +414,33 @@ module Doorkeeper
       @token_grant_types ||= calculate_token_grant_types.freeze
     end
 
+    def allow_blank_redirect_uri?(application = nil)
+      if allow_blank_redirect_uri.respond_to?(:call)
+        allow_blank_redirect_uri.call(grant_flows, application)
+      else
+        allow_blank_redirect_uri
+      end
+    end
+
+    def option_defined?(name)
+      instance_variable_defined?("@#{name}")
+    end
+
     private
 
+    # Helper to read boolearized configuration option
+    def option_set?(instance_key)
+      var = instance_variable_get("@#{instance_key}")
+      !!(defined?(var) && var)
+    end
+
     # Determines what values are acceptable for 'response_type' param in
     # authorization request endpoint, and return them as an array of strings.
     #
     def calculate_authorization_response_types
       types = []
-      types << 'code'  if grant_flows.include? 'authorization_code'
-      types << 'token' if grant_flows.include? 'implicit'
+      types << "code"  if grant_flows.include? "authorization_code"
+      types << "token" if grant_flows.include? "implicit"
       types
     end
 
@@ -361,9 +448,43 @@ module Doorkeeper
     # request endpoint, and return them in array.
     #
     def calculate_token_grant_types
-      types = grant_flows - ['implicit']
-      types << 'refresh_token' if refresh_token_enabled?
+      types = grant_flows - ["implicit"]
+      types << "refresh_token" if refresh_token_enabled?
       types
     end
+
+    # Determine whether +reuse_access_token+ and a non-restorable
+    # +token_secret_strategy+ have both been activated.
+    #
+    # In that case, disable reuse_access_token value and warn the user.
+    def validate_reuse_access_token_value
+      strategy = token_secret_strategy
+      return if !reuse_access_token || strategy.allows_restoring_secrets?
+
+      ::Rails.logger.warn(
+        "You have configured both reuse_access_token " \
+        "AND strategy strategy '#{strategy}' that cannot restore tokens. " \
+        "This combination is unsupported. reuse_access_token will be disabled"
+      )
+      @reuse_access_token = false
+    end
+
+    # Validate that the provided strategies are valid for
+    # tokens and applications
+    def validate_secret_strategies
+      token_secret_strategy.validate_for :token
+      application_secret_strategy.validate_for :application
+    end
+
+    def validate_token_reuse_limit
+      return if !reuse_access_token ||
+                (token_reuse_limit > 0 && token_reuse_limit <= 100)
+
+      ::Rails.logger.warn(
+        "You have configured an invalid value for token_reuse_limit option. " \
+        "It will be set to default 100"
+      )
+      @token_reuse_limit = 100
+    end
   end
 end

data/lib/doorkeeper/engine.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class Engine < Rails::Engine
     initializer "doorkeeper.params.filter" do |app|
@@ -16,7 +18,7 @@ module Doorkeeper
     end
 
     if defined?(Sprockets) && Sprockets::VERSION.chr.to_i >= 4
-      initializer 'doorkeeper.assets.precompile' do |app|
+      initializer "doorkeeper.assets.precompile" do |app|
         # Force users to use:
         #    //= link doorkeeper/admin/application.css
         # in Doorkeeper 5 for Sprockets 4 instead of precompile.

data/lib/doorkeeper/errors.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Errors
     class DoorkeeperError < StandardError
@@ -36,7 +38,22 @@ module Doorkeeper
       end
     end
 
+    class BaseResponseError < DoorkeeperError
+      attr_reader :response
+
+      def initialize(response)
+        @response = response
+      end
+    end
+
     UnableToGenerateToken = Class.new(DoorkeeperError)
     TokenGeneratorNotFound = Class.new(DoorkeeperError)
+    NoOrmCleaner = Class.new(DoorkeeperError)
+
+    InvalidToken = Class.new BaseResponseError
+    TokenExpired = Class.new InvalidToken
+    TokenRevoked = Class.new InvalidToken
+    TokenUnknown = Class.new InvalidToken
+    TokenForbidden = Class.new InvalidToken
   end
 end

data/lib/doorkeeper/grape/authorization_decorator.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Grape
     class AuthorizationDecorator < SimpleDelegator
@@ -7,10 +9,10 @@ module Doorkeeper
 
       def authorization
         env = __getobj__.env
-        env['HTTP_AUTHORIZATION'] ||
-          env['X-HTTP_AUTHORIZATION'] ||
-          env['X_HTTP_AUTHORIZATION'] ||
-          env['REDIRECT_X_HTTP_AUTHORIZATION']
+        env["HTTP_AUTHORIZATION"] ||
+          env["X-HTTP_AUTHORIZATION"] ||
+          env["X_HTTP_AUTHORIZATION"] ||
+          env["REDIRECT_X_HTTP_AUTHORIZATION"]
       end
     end
   end

data/lib/doorkeeper/grape/helpers.rb

@@ -1,4 +1,6 @@
-require 'doorkeeper/grape/authorization_decorator'
+# frozen_string_literal: true
+
+require "doorkeeper/grape/authorization_decorator"
 
 module Doorkeeper
   module Grape
@@ -27,7 +29,7 @@ module Doorkeeper
       private
 
       def endpoint
-        env['api.endpoint']
+        env["api.endpoint"]
       end
 
       def doorkeeper_token
@@ -44,7 +46,7 @@ module Doorkeeper
       def error_status_codes
         {
           unauthorized: 401,
-          forbidden: 403
+          forbidden: 403,
         }
       end
     end

data/lib/doorkeeper/helpers/controller.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 # Define methods that can be called in any controller that inherits from
 # Doorkeeper::ApplicationMetalController or Doorkeeper::ApplicationController
 module Doorkeeper
@@ -53,8 +55,9 @@ module Doorkeeper
       end
 
       def enforce_content_type
-        return if request.content_type == 'application/x-www-form-urlencoded'
-        render json: {}, status: :unsupported_media_type
+        if (request.put? || request.post? || request.patch?) && request.content_type != "application/x-www-form-urlencoded"
+          render json: {}, status: :unsupported_media_type
+        end
       end
     end
   end

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module AccessGrantMixin
     extend ActiveSupport::Concern
@@ -7,6 +9,7 @@ module Doorkeeper
     include Models::Revocable
     include Models::Accessible
     include Models::Orderable
+    include Models::SecretStorable
     include Models::Scopes
 
     # never uses pkce, if pkce migrations were not generated
@@ -28,7 +31,7 @@ module Doorkeeper
       #   if there is no record with such token
       #
       def by_token(token)
-        find_by(token: token.to_s)
+        find_by_plaintext_token(:token, token)
       end
 
       # Revokes AccessGrant records that have not been revoked and associated
@@ -42,8 +45,8 @@ module Doorkeeper
       def revoke_all_for(application_id, resource_owner, clock = Time)
         where(application_id: application_id,
               resource_owner_id: resource_owner.id,
-              revoked_at: nil).
-          update_all(revoked_at: clock.now.utc)
+              revoked_at: nil)
+          .update_all(revoked_at: clock.now.utc)
       end
 
       # Implements PKCE code_challenge encoding without base64 padding as described in the spec.
@@ -78,20 +81,36 @@ module Doorkeeper
       #
       # urlsafe_encode64(bin)
       # Returns the Base64-encoded version of bin. This method complies with
-      # “Base 64 Encoding with URL and Filename Safe Alphabet” in RFC 4648.
+      # "Base 64 Encoding with URL and Filename Safe Alphabet" in RFC 4648.
       # The alphabet uses '-' instead of '+' and '_' instead of '/'.
 
       # @param code_verifier [#to_s] a one time use value (any object that responds to `#to_s`)
       #
-      # @return [#to_s] An encoded code challenge based on the provided verifier suitable for PKCE validation
+      # @return [#to_s] An encoded code challenge based on the provided verifier
+      # suitable for PKCE validation
+      #
       def generate_code_challenge(code_verifier)
         padded_result = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier))
-        padded_result.split('=')[0] # Remove any trailing '='
+        padded_result.split("=")[0] # Remove any trailing '='
       end
 
       def pkce_supported?
         new.pkce_supported?
       end
+
+      ##
+      # Determines the secret storing transformer
+      # Unless configured otherwise, uses the plain secret strategy
+      def secret_strategy
+        ::Doorkeeper.configuration.token_secret_strategy
+      end
+
+      ##
+      # Determine the fallback storing strategy
+      # Unless configured, there will be no fallback
+      def fallback_secret_strategy
+        ::Doorkeeper.configuration.token_secret_fallback_strategy
+      end
     end
   end
 end