doorkeeper 5.0.0 → 5.1.0

data/lib/doorkeeper/request/client_credentials.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class ClientCredentials < Strategy

data/lib/doorkeeper/request/code.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Code < Strategy

data/lib/doorkeeper/request/password.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Password < Strategy

data/lib/doorkeeper/request/refresh_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class RefreshToken < Strategy

data/lib/doorkeeper/request/strategy.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Strategy

data/lib/doorkeeper/request/token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class Token < Strategy

data/lib/doorkeeper/request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Request
     class << self
@@ -31,7 +33,7 @@ module Doorkeeper
       end
 
       def build_strategy_class(grant_or_request_type)
-        strategy_class_name = grant_or_request_type.to_s.tr(' ', '_').camelize
+        strategy_class_name = grant_or_request_type.to_s.tr(" ", "_").camelize
         "Doorkeeper::Request::#{strategy_class_name}".constantize
       end
     end

data/lib/doorkeeper/secret_storing/base.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Base class for secret storing, including common helpers
+    class Base
+      ##
+      # Return the value to be stored by the database
+      # used for looking up a database value.
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(_plain_secret)
+        raise NotImplementedError
+      end
+
+      ##
+      # Transform and store the given secret attribute => value
+      # pair used for safely storing the attribute
+      # @param resource The model instance being modified
+      # @param attribute The secret attribute
+      # @param plain_secret The plain secret input / generated
+      def self.store_secret(resource, attribute, plain_secret)
+        transformed_value = transform_secret(plain_secret)
+        resource.public_send(:"#{attribute}=", transformed_value)
+
+        transformed_value
+      end
+
+      ##
+      # Return the restored value from the database
+      # @param resource The resource instance to act on
+      # @param attribute The secret attribute to restore
+      # as retrieved from the database.
+      def self.restore_secret(_resource, _attribute)
+        raise NotImplementedError
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+
+      ##
+      # Determines what secrets this strategy is applicable for
+      def self.validate_for(model)
+        valid = %i[token application]
+        return true if valid.include?(model.to_sym)
+
+        raise ArgumentError, "'#{name}' can not be used for #{model}."
+      end
+
+      ##
+      # Securely compare the given +input+ value with a +stored+ value
+      # processed by +transform_secret+.
+      def self.secret_matches?(input, stored)
+        transformed_input = transform_secret(input)
+        ActiveSupport::SecurityUtils.secure_compare transformed_input, stored
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/bcrypt.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class BCrypt < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        ::BCrypt::Password.create(plain_secret.to_s)
+      end
+
+      ##
+      # Securely compare the given +input+ value with a +stored+ value
+      # processed by +transform_secret+.
+      def self.secret_matches?(input, stored)
+        ::BCrypt::Password.new(stored.to_s) == input.to_s
+      rescue ::BCrypt::Errors::InvalidHash
+        false
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+
+      ##
+      # Determines what secrets this strategy is applicable for
+      def self.validate_for(model)
+        unless model.to_sym == :application
+          raise ArgumentError,
+                "'#{name}' can only be used for storing application secrets."
+        end
+
+        unless bcrypt_present?
+          raise ArgumentError,
+                "'#{name}' requires the 'bcrypt' gem being loaded."
+        end
+
+        true
+      end
+
+      ##
+      # Test if we can require the BCrypt gem
+      def self.bcrypt_present?
+        require "bcrypt"
+        true
+      rescue LoadError
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/plain.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class Plain < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        plain_secret
+      end
+
+      ##
+      # Return the restored value from the database
+      # @param resource The resource instance to act on
+      # @param attribute The secret attribute to restore
+      # as retrieved from the database.
+      def self.restore_secret(resource, attribute)
+        resource.public_send(attribute)
+      end
+
+      ##
+      # Plain values obviously allow restoring
+      def self.allows_restoring_secrets?
+        true
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/sha256_hash.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class Sha256Hash < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        ::Digest::SHA256.hexdigest plain_secret
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/server.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class Server
     attr_accessor :context

data/lib/doorkeeper/stale_records_cleaner.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  class StaleRecordsCleaner
+    CLEANER_CLASS = "StaleRecordsCleaner"
+
+    def self.for(base_scope)
+      orm_adapter = "doorkeeper/orm/#{Doorkeeper.configuration.orm}".classify
+
+      orm_cleaner = "#{orm_adapter}::#{CLEANER_CLASS}".constantize
+      orm_cleaner.new(base_scope)
+    rescue NameError
+      raise Doorkeeper::Errors::NoOrmCleaner, "'#{Doorkeeper.configuration.orm}' ORM has no cleaner!"
+    end
+
+    def self.new(base_scope)
+      self.for(base_scope)
+    end
+  end
+end

data/lib/doorkeeper/validations.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module Validations
     extend ActiveSupport::Concern

data/lib/doorkeeper/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   def self.gem_version
     Gem::Version.new VERSION::STRING
@@ -6,11 +8,11 @@ module Doorkeeper
   module VERSION
     # Semantic versioning
     MAJOR = 5
-    MINOR = 0
+    MINOR = 1
     TINY = 0
     PRE = nil
 
     # Full version number
-    STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
+    STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
 end

data/lib/doorkeeper.rb

@@ -1,74 +1,84 @@
-require 'doorkeeper/version'
-require 'doorkeeper/engine'
-require 'doorkeeper/config'
+# frozen_string_literal: true
 
-require 'doorkeeper/request/strategy'
-require 'doorkeeper/request/authorization_code'
-require 'doorkeeper/request/client_credentials'
-require 'doorkeeper/request/code'
-require 'doorkeeper/request/password'
-require 'doorkeeper/request/refresh_token'
-require 'doorkeeper/request/token'
+require "doorkeeper/version"
+require "doorkeeper/engine"
+require "doorkeeper/config"
 
-require 'doorkeeper/errors'
-require 'doorkeeper/server'
-require 'doorkeeper/request'
-require 'doorkeeper/validations'
+require "doorkeeper/request/strategy"
+require "doorkeeper/request/authorization_code"
+require "doorkeeper/request/client_credentials"
+require "doorkeeper/request/code"
+require "doorkeeper/request/password"
+require "doorkeeper/request/refresh_token"
+require "doorkeeper/request/token"
 
-require 'doorkeeper/oauth/authorization/code'
-require 'doorkeeper/oauth/authorization/context'
-require 'doorkeeper/oauth/authorization/token'
-require 'doorkeeper/oauth/authorization/uri_builder'
-require 'doorkeeper/oauth/helpers/scope_checker'
-require 'doorkeeper/oauth/helpers/uri_checker'
-require 'doorkeeper/oauth/helpers/unique_token'
+require "doorkeeper/errors"
+require "doorkeeper/server"
+require "doorkeeper/request"
+require "doorkeeper/validations"
 
-require 'doorkeeper/oauth'
-require 'doorkeeper/oauth/scopes'
-require 'doorkeeper/oauth/error'
-require 'doorkeeper/oauth/base_response'
-require 'doorkeeper/oauth/code_response'
-require 'doorkeeper/oauth/token_response'
-require 'doorkeeper/oauth/error_response'
-require 'doorkeeper/oauth/pre_authorization'
-require 'doorkeeper/oauth/base_request'
-require 'doorkeeper/oauth/authorization_code_request'
-require 'doorkeeper/oauth/refresh_token_request'
-require 'doorkeeper/oauth/password_access_token_request'
+require "doorkeeper/oauth/authorization/code"
+require "doorkeeper/oauth/authorization/context"
+require "doorkeeper/oauth/authorization/token"
+require "doorkeeper/oauth/authorization/uri_builder"
+require "doorkeeper/oauth/helpers/scope_checker"
+require "doorkeeper/oauth/helpers/uri_checker"
+require "doorkeeper/oauth/helpers/unique_token"
 
-require 'doorkeeper/oauth/client_credentials/validation'
-require 'doorkeeper/oauth/client_credentials/creator'
-require 'doorkeeper/oauth/client_credentials/issuer'
-require 'doorkeeper/oauth/client_credentials/validation'
-require 'doorkeeper/oauth/client/credentials'
+require "doorkeeper/oauth"
+require "doorkeeper/oauth/scopes"
+require "doorkeeper/oauth/error"
+require "doorkeeper/oauth/base_response"
+require "doorkeeper/oauth/code_response"
+require "doorkeeper/oauth/token_response"
+require "doorkeeper/oauth/error_response"
+require "doorkeeper/oauth/pre_authorization"
+require "doorkeeper/oauth/base_request"
+require "doorkeeper/oauth/authorization_code_request"
+require "doorkeeper/oauth/refresh_token_request"
+require "doorkeeper/oauth/password_access_token_request"
 
-require 'doorkeeper/oauth/client_credentials_request'
-require 'doorkeeper/oauth/code_request'
-require 'doorkeeper/oauth/token_request'
-require 'doorkeeper/oauth/client'
-require 'doorkeeper/oauth/token'
-require 'doorkeeper/oauth/token_introspection'
-require 'doorkeeper/oauth/invalid_token_response'
-require 'doorkeeper/oauth/forbidden_token_response'
+require "doorkeeper/oauth/client_credentials/validation"
+require "doorkeeper/oauth/client_credentials/creator"
+require "doorkeeper/oauth/client_credentials/issuer"
+require "doorkeeper/oauth/client_credentials/validation"
+require "doorkeeper/oauth/client/credentials"
 
-require 'doorkeeper/models/concerns/orderable'
-require 'doorkeeper/models/concerns/scopes'
-require 'doorkeeper/models/concerns/expirable'
-require 'doorkeeper/models/concerns/revocable'
-require 'doorkeeper/models/concerns/accessible'
+require "doorkeeper/oauth/client_credentials_request"
+require "doorkeeper/oauth/code_request"
+require "doorkeeper/oauth/token_request"
+require "doorkeeper/oauth/client"
+require "doorkeeper/oauth/token"
+require "doorkeeper/oauth/token_introspection"
+require "doorkeeper/oauth/invalid_token_response"
+require "doorkeeper/oauth/forbidden_token_response"
 
-require 'doorkeeper/models/access_grant_mixin'
-require 'doorkeeper/models/access_token_mixin'
-require 'doorkeeper/models/application_mixin'
+require "doorkeeper/secret_storing/base"
+require "doorkeeper/secret_storing/plain"
+require "doorkeeper/secret_storing/sha256_hash"
+require "doorkeeper/secret_storing/bcrypt"
 
-require 'doorkeeper/helpers/controller'
+require "doorkeeper/models/concerns/orderable"
+require "doorkeeper/models/concerns/scopes"
+require "doorkeeper/models/concerns/expirable"
+require "doorkeeper/models/concerns/reusable"
+require "doorkeeper/models/concerns/revocable"
+require "doorkeeper/models/concerns/accessible"
+require "doorkeeper/models/concerns/secret_storable"
 
-require 'doorkeeper/rails/routes'
-require 'doorkeeper/rails/helpers'
+require "doorkeeper/models/access_grant_mixin"
+require "doorkeeper/models/access_token_mixin"
+require "doorkeeper/models/application_mixin"
 
-require 'doorkeeper/rake'
+require "doorkeeper/helpers/controller"
 
-require 'doorkeeper/orm/active_record'
+require "doorkeeper/rails/routes"
+require "doorkeeper/rails/helpers"
+
+require "doorkeeper/rake"
+require "doorkeeper/stale_records_cleaner"
+
+require "doorkeeper/orm/active_record"
 
 module Doorkeeper
   def self.authenticate(request, methods = Doorkeeper.configuration.access_token_methods)

data/lib/generators/doorkeeper/application_owner_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration to add reference to owner of the
+  # Doorkeeper application.
+  #
   class ApplicationOwnerGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Provide support for client application ownership.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Provide support for client application ownership."
 
     def application_owner
       migration_template(
-        'add_owner_to_application_migration.rb.erb',
-        'db/migrate/add_owner_to_application.rb',
+        "add_owner_to_application_migration.rb.erb",
+        "db/migrate/add_owner_to_application.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +27,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end

data/lib/generators/doorkeeper/confidential_applications_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration to add confidential column to Doorkeeper
+  # applications table.
+  #
   class ConfidentialApplicationsGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Add confidential column to Doorkeeper applications'
+    source_root File.expand_path("templates", __dir__)
+    desc "Add confidential column to Doorkeeper applications"
 
     def pkce
       migration_template(
-        'add_confidential_to_applications.rb.erb',
-        'db/migrate/add_confidential_to_applications.rb',
+        "add_confidential_to_applications.rb.erb",
+        "db/migrate/add_confidential_to_applications.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +27,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end

data/lib/generators/doorkeeper/install_generator.rb

@@ -1,20 +1,22 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Setup doorkeeper into Rails application: locales, routes, etc.
+  #
   class InstallGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Installs Doorkeeper.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Installs Doorkeeper."
 
     def install
-      template 'initializer.rb', 'config/initializers/doorkeeper.rb'
-      copy_file File.expand_path('../../../config/locales/en.yml', __dir__),
-                'config/locales/doorkeeper.en.yml'
-      route 'use_doorkeeper'
-      readme 'README'
+      template "initializer.rb", "config/initializers/doorkeeper.rb"
+      copy_file File.expand_path("../../../config/locales/en.yml", __dir__),
+                "config/locales/doorkeeper.en.yml"
+      route "use_doorkeeper"
+      readme "README"
     end
   end
 end

data/lib/generators/doorkeeper/migration_generator.rb

@@ -1,18 +1,20 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Copies main Doorkeeper migration into parent Rails application.
+  #
   class MigrationGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Installs Doorkeeper migration file.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Installs Doorkeeper migration file."
 
     def install
       migration_template(
-        'migration.rb.erb',
-        'db/migrate/create_doorkeeper_tables.rb',
+        "migration.rb.erb",
+        "db/migrate/create_doorkeeper_tables.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +26,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end

data/lib/generators/doorkeeper/pkce_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration with PKCE required database columns for
+  # Doorkeeper tables.
+  #
   class PkceGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Provide support for PKCE.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Provide support for PKCE."
 
     def pkce
       migration_template(
-        'enable_pkce_migration.rb.erb',
-        'db/migrate/enable_pkce.rb',
+        "enable_pkce_migration.rb.erb",
+        "db/migrate/enable_pkce.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +27,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end