doorkeeper 5.0.0 → 5.1.0

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     # RFC7662 OAuth 2.0 Token Introspection
@@ -18,7 +20,17 @@ module Doorkeeper
         @error.blank?
       end
 
-      def to_json
+      def error_response
+        return if @error.blank?
+
+        if @error == :invalid_token
+          OAuth::InvalidTokenResponse.from_access_token(authorized_token)
+        else
+          OAuth::ErrorResponse.new(name: @error)
+        end
+      end
+
+      def to_json(*)
         active? ? success_response : failure_response
       end
 
@@ -35,13 +47,29 @@ module Doorkeeper
       #
       # @see https://www.oauth.com/oauth2-servers/token-introspection-endpoint/
       #
+      # To prevent token scanning attacks, the endpoint MUST also require
+      # some form of authorization to access this endpoint, such as client
+      # authentication as described in OAuth 2.0 [RFC6749] or a separate
+      # OAuth 2.0 access token such as the bearer token described in OAuth
+      # 2.0 Bearer Token Usage [RFC6750].
+      #
       def authorize!
         # Requested client authorization
         if server.credentials
           @error = :invalid_client unless authorized_client
-        else
+        elsif authorized_token
           # Requested bearer token authorization
-          @error = :invalid_request unless authorized_token
+          #
+          #  If the protected resource uses an OAuth 2.0 bearer token to authorize
+          #  its call to the introspection endpoint and the token used for
+          #  authorization does not contain sufficient privileges or is otherwise
+          #  invalid for this request, the authorization server responds with an
+          #  HTTP 401 code as described in Section 3 of OAuth 2.0 Bearer Token
+          #  Usage [RFC6750].
+          #
+          @error = :invalid_token if authorized_token_matches_introspected? || !authorized_token.accessible?
+        else
+          @error = :invalid_request
         end
       end
 
@@ -58,14 +86,14 @@ module Doorkeeper
 
       # 2.2. Introspection Response
       def success_response
-        {
+        customize_response(
           active: true,
           scope: @token.scopes_string,
           client_id: @token.try(:application).try(:uid),
           token_type: @token.token_type,
           exp: @token.expires_at.to_i,
           iat: @token.created_at.to_i
-        }
+        )
       end
 
       # If the introspection call is properly authorized but the token is not
@@ -81,7 +109,7 @@ module Doorkeeper
       #
       def failure_response
         {
-          active: false
+          active: false,
         }
       end
 
@@ -101,6 +129,25 @@ module Doorkeeper
       # * The token expired
       # * The token was issued to a different client than is making this request
       #
+      # Since resource servers using token introspection rely on the
+      # authorization server to determine the state of a token, the
+      # authorization server MUST perform all applicable checks against a
+      # token's state.  For instance, these tests include the following:
+      #
+      #    o  If the token can expire, the authorization server MUST determine
+      #       whether or not the token has expired.
+      #    o  If the token can be issued before it is able to be used, the
+      #       authorization server MUST determine whether or not a token's valid
+      #       period has started yet.
+      #    o  If the token can be revoked after it was issued, the authorization
+      #       server MUST determine whether or not such a revocation has taken
+      #       place.
+      #    o  If the token has been signed, the authorization server MUST
+      #       validate the signature.
+      #    o  If the token can be used only at certain resource servers, the
+      #       authorization server MUST determine whether or not the token can
+      #       be used at the resource server making the introspection call.
+      #
       def active?
         if authorized_client
           valid_token? && authorized_for_client?
@@ -111,18 +158,39 @@ module Doorkeeper
 
       # Token can be valid only if it is not expired or revoked.
       def valid_token?
-        @token.present? && @token.accessible?
+        @token&.accessible?
+      end
+
+      # RFC7662 Section 2.1
+      def authorized_token_matches_introspected?
+        authorized_token.token == @token&.token
       end
 
       # If token doesn't belong to some client, then it is public.
       # Otherwise in it required for token to be connected to the same client.
       def authorized_for_client?
-        if @token.application.present?
+        if @token.application
           @token.application == authorized_client.application
         else
           true
         end
       end
+
+      # Allows to customize introspection response.
+      # Provides context (controller) and token for generating developer-specific
+      # response.
+      #
+      # @see https://tools.ietf.org/html/rfc7662#section-2.2
+      #
+      def customize_response(response)
+        customized_response = Doorkeeper.configuration.custom_introspection_response.call(
+          token,
+          server.context
+        )
+        return response if customized_response.blank?
+
+        response.merge(customized_response)
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenRequest

data/lib/doorkeeper/oauth/token_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenResponse
@@ -9,12 +11,12 @@ module Doorkeeper
 
       def body
         {
-          'access_token'  => token.token,
-          'token_type'    => token.token_type,
-          'expires_in'    => token.expires_in_seconds,
-          'refresh_token' => token.refresh_token,
-          'scope'         => token.scopes_string,
-          'created_at'    => token.created_at.to_i
+          "access_token" => token.plaintext_token,
+          "token_type" => token.token_type,
+          "expires_in" => token.expires_in_seconds,
+          "refresh_token" => token.plaintext_refresh_token,
+          "scope" => token.scopes_string,
+          "created_at" => token.created_at.to_i,
         }.reject { |_, value| value.blank? }
       end
 
@@ -24,9 +26,9 @@ module Doorkeeper
 
       def headers
         {
-          'Cache-Control' => 'no-store',
-          'Pragma' => 'no-cache',
-          'Content-Type' => 'application/json; charset=utf-8'
+          "Cache-Control" => "no-store",
+          "Pragma" => "no-cache",
+          "Content-Type" => "application/json; charset=utf-8",
         }
       end
     end

data/lib/doorkeeper/oauth.rb

@@ -3,11 +3,11 @@
 module Doorkeeper
   module OAuth
     GRANT_TYPES = [
-      AUTHORIZATION_CODE = 'authorization_code'.freeze,
-      IMPLICIT = 'implicit'.freeze,
-      PASSWORD = 'password'.freeze,
-      CLIENT_CREDENTIALS = 'client_credentials'.freeze,
-      REFRESH_TOKEN = 'refresh_token'.freeze
+      AUTHORIZATION_CODE = "authorization_code",
+      IMPLICIT = "implicit",
+      PASSWORD = "password",
+      CLIENT_CREDENTIALS = "client_credentials",
+      REFRESH_TOKEN = "refresh_token",
     ].freeze
   end
 end

data/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -1,26 +1,39 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AccessGrant < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}"
 
     include AccessGrantMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    belongs_to_options = {
-      class_name: 'Doorkeeper::Application',
-      inverse_of: :access_grants
-    }
 
-    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
-      belongs_to_options[:optional] = true
-    end
+    belongs_to :application, class_name: "Doorkeeper::Application",
+                             optional: true, inverse_of: :access_grants
 
-    belongs_to :application, belongs_to_options
+    validates :resource_owner_id,
+              :application_id,
+              :token,
+              :expires_in,
+              :redirect_uri,
+              presence: true
 
-    validates :resource_owner_id, :application_id, :token, :expires_in, :redirect_uri, presence: true
     validates :token, uniqueness: true
 
     before_validation :generate_token, on: :create
 
+    # We keep a volatile copy of the raw token for initial communication
+    # The stored refresh_token may be mapped and not available in cleartext.
+    #
+    # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+    # while hashing strategies do not, so you cannot rely on this value
+    # returning a present value for persisted tokens.
+    def plaintext_token
+      if secret_strategy.allows_restoring_secrets?
+        secret_strategy.restore_secret(self, :token)
+      else
+        @raw_token
+      end
+    end
+
     private
 
     # Generates token value with UniqueToken class.
@@ -28,7 +41,8 @@ module Doorkeeper
     # @return [String] token value
     #
     def generate_token
-      self.token = UniqueToken.generate
+      @raw_token = UniqueToken.generate
+      secret_strategy.store_secret(self, :token, @raw_token)
     end
   end
 end

data/lib/doorkeeper/orm/active_record/access_token.rb

@@ -1,20 +1,13 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class AccessToken < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}"
 
     include AccessTokenMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
-
-    belongs_to_options = {
-      class_name: 'Doorkeeper::Application',
-      inverse_of: :access_tokens
-    }
-
-    if defined?(ActiveRecord::Base) && ActiveRecord::VERSION::MAJOR >= 5
-      belongs_to_options[:optional] = true
-    end
 
-    belongs_to :application, belongs_to_options
+    belongs_to :application, class_name: "Doorkeeper::Application",
+                             inverse_of: :access_tokens, optional: true
 
     validates :token, presence: true, uniqueness: true
     validates :refresh_token, uniqueness: true, if: :use_refresh_token?
@@ -41,7 +34,7 @@ module Doorkeeper
     end
 
     def self.refresh_token_revoked_on_use?
-      column_names.include?('previous_refresh_token')
+      column_names.include?("previous_refresh_token")
     end
   end
 end

data/lib/doorkeeper/orm/active_record/application.rb

@@ -1,12 +1,13 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class Application < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}"
 
     include ApplicationMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
 
-    has_many :access_grants, dependent: :delete_all, class_name: 'Doorkeeper::AccessGrant'
-    has_many :access_tokens, dependent: :delete_all, class_name: 'Doorkeeper::AccessToken'
+    has_many :access_grants, dependent: :delete_all, class_name: "Doorkeeper::AccessGrant"
+    has_many :access_tokens, dependent: :delete_all, class_name: "Doorkeeper::AccessToken"
 
     validates :name, :secret, :uid, presence: true
     validates :uid, uniqueness: true
@@ -17,7 +18,7 @@ module Doorkeeper
 
     before_validation :generate_uid, :generate_secret, on: :create
 
-    has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: 'AccessToken'
+    has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: "AccessToken"
     has_many :authorized_applications, through: :authorized_tokens, source: :application
 
     # Returns Applications associated with active (not revoked) Access Tokens
@@ -45,6 +46,20 @@ module Doorkeeper
       AccessGrant.revoke_all_for(id, resource_owner)
     end
 
+    # We keep a volatile copy of the raw secret for initial communication
+    # The stored refresh_token may be mapped and not available in cleartext.
+    #
+    # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+    # while hashing strategies do not, so you cannot rely on this value
+    # returning a present value for persisted tokens.
+    def plaintext_secret
+      if secret_strategy.allows_restoring_secrets?
+        secret_strategy.restore_secret(self, :secret)
+      else
+        @raw_secret
+      end
+    end
+
     private
 
     def generate_uid
@@ -52,12 +67,16 @@ module Doorkeeper
     end
 
     def generate_secret
-      self.secret = UniqueToken.generate if secret.blank?
+      return unless secret.blank?
+
+      @raw_secret = UniqueToken.generate
+      secret_strategy.store_secret(self, :secret, @raw_secret)
     end
 
     def scopes_match_configured
       if scopes.present? &&
-         !ScopeChecker.valid?(scopes.to_s, Doorkeeper.configuration.scopes)
+         !ScopeChecker.valid?(scope_str: scopes.to_s,
+                              server_scopes: Doorkeeper.configuration.scopes)
         errors.add(:scopes, :not_match_configured)
       end
     end

data/lib/doorkeeper/orm/active_record/stale_records_cleaner.rb

@@ -3,22 +3,29 @@
 module Doorkeeper
   module Orm
     module ActiveRecord
+      # Helper class to clear stale and non-active tokens and grants.
+      # Used by Doorkeeper Rake tasks.
+      #
       class StaleRecordsCleaner
         def initialize(base_scope)
           @base_scope = base_scope
         end
 
+        # Clears revoked records
         def clean_revoked
           table = @base_scope.arel_table
+
           @base_scope.where.not(revoked_at: nil)
-                     .where(table[:revoked_at].lt(Time.current))
-                     .delete_all
+            .where(table[:revoked_at].lt(Time.current))
+            .in_batches(&:delete_all)
         end
 
+        # Clears expired records
         def clean_expired(ttl)
           table = @base_scope.arel_table
+
           @base_scope.where(table[:created_at].lt(Time.current - ttl))
-                     .delete_all
+            .in_batches(&:delete_all)
         end
       end
     end

data/lib/doorkeeper/orm/active_record.rb

@@ -1,15 +1,17 @@
-require 'active_support/lazy_load_hooks'
+# frozen_string_literal: true
 
-require 'doorkeeper/orm/active_record/stale_records_cleaner'
+require "active_support/lazy_load_hooks"
+
+require "doorkeeper/orm/active_record/stale_records_cleaner"
 
 module Doorkeeper
   module Orm
     module ActiveRecord
       def self.initialize_models!
         lazy_load do
-          require 'doorkeeper/orm/active_record/access_grant'
-          require 'doorkeeper/orm/active_record/access_token'
-          require 'doorkeeper/orm/active_record/application'
+          require "doorkeeper/orm/active_record/access_grant"
+          require "doorkeeper/orm/active_record/access_token"
+          require "doorkeeper/orm/active_record/application"
 
           if Doorkeeper.configuration.active_record_options[:establish_connection]
             [Doorkeeper::AccessGrant, Doorkeeper::AccessToken, Doorkeeper::Application].each do |model|
@@ -22,7 +24,7 @@ module Doorkeeper
 
       def self.initialize_application_owner!
         lazy_load do
-          require 'doorkeeper/models/concerns/ownership'
+          require "doorkeeper/models/concerns/ownership"
 
           Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
         end

data/lib/doorkeeper/rails/helpers.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     module Helpers
@@ -12,13 +14,15 @@ module Doorkeeper
       def doorkeeper_forbidden_render_options(**); end
 
       def valid_doorkeeper_token?
-        doorkeeper_token && doorkeeper_token.acceptable?(@_doorkeeper_scopes)
+        doorkeeper_token&.acceptable?(@_doorkeeper_scopes)
       end
 
       private
 
       def doorkeeper_render_error
         error = doorkeeper_error
+        error.raise_exception! if Doorkeeper.configuration.raise_on_errors?
+
         headers.merge!(error.headers.reject { |k| k == "Content-Type" })
         doorkeeper_render_error_with(error)
       end

data/lib/doorkeeper/rails/routes/mapper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     class Routes # :nodoc:

data/lib/doorkeeper/rails/routes/mapping.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Rails
     class Routes # :nodoc:
@@ -6,17 +8,17 @@ module Doorkeeper
 
         def initialize
           @controllers = {
-            authorizations: 'doorkeeper/authorizations',
-            applications: 'doorkeeper/applications',
-            authorized_applications: 'doorkeeper/authorized_applications',
-            tokens: 'doorkeeper/tokens',
-            token_info: 'doorkeeper/token_info'
+            authorizations: "doorkeeper/authorizations",
+            applications: "doorkeeper/applications",
+            authorized_applications: "doorkeeper/authorized_applications",
+            tokens: "doorkeeper/tokens",
+            token_info: "doorkeeper/token_info",
           }
 
           @as = {
             authorizations: :authorization,
             tokens: :token,
-            token_info: :token_info
+            token_info: :token_info,
           }
 
           @skips = []
@@ -25,7 +27,7 @@ module Doorkeeper
         def [](routes)
           {
             controllers: @controllers[routes],
-            as: @as[routes]
+            as: @as[routes],
           }
         end
 

data/lib/doorkeeper/rails/routes.rb

@@ -1,5 +1,7 @@
-require 'doorkeeper/rails/routes/mapping'
-require 'doorkeeper/rails/routes/mapper'
+# frozen_string_literal: true
+
+require "doorkeeper/rails/routes/mapping"
+require "doorkeeper/rails/routes/mapper"
 
 module Doorkeeper
   module Rails
@@ -30,7 +32,7 @@ module Doorkeeper
       end
 
       def generate_routes!(options)
-        routes.scope options[:scope] || 'oauth', as: 'oauth' do
+        routes.scope options[:scope] || "oauth", as: "oauth" do
           map_route(:authorizations, :authorization_routes)
           map_route(:tokens, :token_routes)
           map_route(:tokens, :revoke_routes)
@@ -54,48 +56,53 @@ module Doorkeeper
       def authorization_routes(mapping)
         routes.resource(
           :authorization,
-          path: 'authorize',
+          path: "authorize",
           only: %i[create destroy],
           as: mapping[:as],
           controller: mapping[:controllers]
         ) do
-          routes.get '/native', action: :show, on: :member
-          routes.get '/', action: :new, on: :member
+          routes.get "/native", action: :show, on: :member
+          routes.get "/", action: :new, on: :member
         end
       end
 
       def token_routes(mapping)
         routes.resource(
           :token,
-          path: 'token',
+          path: "token",
           only: [:create], as: mapping[:as],
           controller: mapping[:controllers]
         )
       end
 
       def revoke_routes(mapping)
-        routes.post 'revoke', controller: mapping[:controllers], action: :revoke
+        routes.post "revoke", controller: mapping[:controllers], action: :revoke
       end
 
       def introspect_routes(mapping)
-        routes.post 'introspect', controller: mapping[:controllers], action: :introspect
+        routes.post "introspect", controller: mapping[:controllers], action: :introspect
       end
 
       def token_info_routes(mapping)
         routes.resource(
           :token_info,
-          path: 'token/info',
+          path: "token/info",
           only: [:show], as: mapping[:as],
           controller: mapping[:controllers]
         )
       end
 
       def application_routes(mapping)
-        routes.resources :doorkeeper_applications, controller: mapping[:controllers], as: :applications, path: 'applications'
+        routes.resources :doorkeeper_applications,
+                         controller: mapping[:controllers],
+                         as: :applications,
+                         path: "applications"
       end
 
       def authorized_applications_routes(mapping)
-        routes.resources :authorized_applications, only: %i[index destroy], controller: mapping[:controllers]
+        routes.resources :authorized_applications,
+                         only: %i[index destroy],
+                         controller: mapping[:controllers]
       end
     end
   end

data/lib/doorkeeper/rake/db.rake

@@ -2,37 +2,37 @@
 
 namespace :doorkeeper do
   namespace :db do
-    desc 'Removes stale data from doorkeeper related database tables'
+    desc "Removes stale data from doorkeeper related database tables"
     task cleanup: [
-      'doorkeeper:db:cleanup:revoked_tokens',
-      'doorkeeper:db:cleanup:expired_tokens',
-      'doorkeeper:db:cleanup:revoked_grants',
-      'doorkeeper:db:cleanup:expired_grants'
+      "doorkeeper:db:cleanup:revoked_tokens",
+      "doorkeeper:db:cleanup:expired_tokens",
+      "doorkeeper:db:cleanup:revoked_grants",
+      "doorkeeper:db:cleanup:expired_grants",
     ]
 
     namespace :cleanup do
-      desc 'Removes stale access tokens'
-      task revoked_tokens: 'doorkeeper:setup' do
-        cleaner = Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner.new(Doorkeeper::AccessToken)
+      desc "Removes stale access tokens"
+      task revoked_tokens: "doorkeeper:setup" do
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessToken)
         cleaner.clean_revoked
       end
 
-      desc 'Removes expired (TTL passed) access tokens'
-      task expired_tokens: 'doorkeeper:setup' do
+      desc "Removes expired (TTL passed) access tokens"
+      task expired_tokens: "doorkeeper:setup" do
         expirable_tokens = Doorkeeper::AccessToken.where(refresh_token: nil)
-        cleaner = Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner.new(expirable_tokens)
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(expirable_tokens)
         cleaner.clean_expired(Doorkeeper.configuration.access_token_expires_in)
       end
 
-      desc 'Removes stale access grants'
-      task revoked_grants: 'doorkeeper:setup' do
-        cleaner = Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
+      desc "Removes stale access grants"
+      task revoked_grants: "doorkeeper:setup" do
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
         cleaner.clean_revoked
       end
 
-      desc 'Removes expired (TTL passed) access grants'
-      task expired_grants: 'doorkeeper:setup' do
-        cleaner = Doorkeeper::Orm::ActiveRecord::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
+      desc "Removes expired (TTL passed) access grants"
+      task expired_grants: "doorkeeper:setup" do
+        cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
         cleaner.clean_expired(Doorkeeper.configuration.authorization_code_expires_in)
       end
     end

data/lib/doorkeeper/rake.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   module Rake
     class << self
       def load_tasks
-        glob = File.join(File.absolute_path(__dir__), 'rake', '*.rake')
+        glob = File.join(File.absolute_path(__dir__), "rake", "*.rake")
         Dir[glob].each do |rake_file|
           load rake_file
         end

data/lib/doorkeeper/request/authorization_code.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class AuthorizationCode < Strategy