doorkeeper 5.0.2 → 5.1.0.rc1

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe Doorkeeper::AccessGrant do
+  let(:clazz) { Doorkeeper::AccessGrant }
   subject { FactoryBot.build(:access_grant) }
 
   it { expect(subject).to be_valid }
@@ -11,6 +12,66 @@ describe Doorkeeper::AccessGrant do
     let(:factory_name) { :access_grant }
   end
 
+  context 'with hashing enabled' do
+    let(:grant) { FactoryBot.create :access_grant }
+    include_context 'with token hashing enabled'
+
+    it 'holds a volatile plaintext token when created' do
+      expect(grant.plaintext_token).to be_a(String)
+      expect(grant.token)
+        .to eq(hashed_or_plain_token_func.call(grant.plaintext_token))
+
+      # Finder method only finds the hashed token
+      loaded = clazz.find_by(token: grant.token)
+      expect(loaded).to eq(grant)
+      expect(loaded.plaintext_token).to be_nil
+      expect(loaded.token).to eq(grant.token)
+    end
+
+    it 'does not find_by plain text tokens' do
+      expect(clazz.find_by(token: grant.plaintext_token)).to be_nil
+    end
+
+    describe 'with having a plain text token' do
+      let(:plain_text_token) { 'plain text token' }
+
+      before do
+        # Assume we have a plain text token from before activating the option
+        grant.update_column(:token, plain_text_token)
+      end
+
+      context 'without fallback lookup' do
+        it 'does not provide lookups with either through by_token' do
+          expect(clazz.by_token(plain_text_token)).to eq(nil)
+          expect(clazz.by_token(grant.token)).to eq(nil)
+
+          # And it does not touch the token
+          grant.reload
+          expect(grant.token).to eq(plain_text_token)
+        end
+      end
+
+      context 'with fallback lookup' do
+        include_context 'with token hashing and fallback lookup enabled'
+
+        it 'upgrades a plain token when falling back to it' do
+          # Side-effect: This will automatically upgrade the token
+          expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+          expect(clazz.by_token(plain_text_token)).to eq(grant)
+
+          # Will find subsequently by hashing the token
+          expect(clazz.by_token(plain_text_token)).to eq(grant)
+
+          # And it modifies the token value
+          grant.reload
+          expect(grant.token).not_to eq(plain_text_token)
+          expect(clazz.find_by(token: plain_text_token)).to eq(nil)
+          expect(clazz.find_by(token: grant.token)).not_to be_nil
+        end
+      end
+    end
+  end
+
   describe 'validations' do
     it 'is invalid without resource_owner_id' do
       subject.resource_owner_id = nil

data/spec/models/doorkeeper/access_token_spec.rb

@@ -2,6 +2,7 @@ require 'spec_helper'
 
 module Doorkeeper
   describe AccessToken do
+    let(:clazz) { Doorkeeper::AccessToken }
     subject { FactoryBot.build(:access_token) }
 
     it { expect(subject).to be_valid }
@@ -24,6 +25,67 @@ module Doorkeeper
         expect(token.token).to be_a(String)
       end
 
+      context 'with hashing enabled' do
+        let(:token) { FactoryBot.create :access_token }
+        include_context 'with token hashing enabled'
+
+        it 'holds a volatile plaintext token when created' do
+          expect(token.plaintext_token).to be_a(String)
+          expect(token.token)
+            .to eq(hashed_or_plain_token_func.call(token.plaintext_token))
+
+          # Finder method only finds the hashed token
+          loaded = clazz.find_by(token: token.token)
+          expect(loaded).to eq(token)
+          expect(loaded.plaintext_token).to be_nil
+          expect(loaded.token).to eq(token.token)
+        end
+
+        it 'does not find_by plain text tokens' do
+          expect(clazz.find_by(token: token.plaintext_token)).to be_nil
+        end
+
+        describe 'with having a plain text token' do
+          let(:plain_text_token) { 'plain text token' }
+          let(:access_token) { FactoryBot.create :access_token }
+
+          before do
+            # Assume we have a plain text token from before activating the option
+            access_token.update_column(:token, plain_text_token)
+          end
+
+          context 'without fallback lookup' do
+            it 'does not provide lookups with either through by_token' do
+              expect(clazz.by_token(plain_text_token)).to eq(nil)
+              expect(clazz.by_token(access_token.token)).to eq(nil)
+
+              # And it does not touch the token
+              access_token.reload
+              expect(access_token.token).to eq(plain_text_token)
+            end
+          end
+
+          context 'with fallback lookup' do
+            include_context 'with token hashing and fallback lookup enabled'
+
+            it 'upgrades a plain token when falling back to it' do
+              # Side-effect: This will automatically upgrade the token
+              expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+              expect(clazz.by_token(plain_text_token)).to eq(access_token)
+
+              # Will find subsequently by hashing the token
+              expect(clazz.by_token(plain_text_token)).to eq(access_token)
+
+              # And it modifies the token value
+              access_token.reload
+              expect(access_token.token).not_to eq(plain_text_token)
+              expect(clazz.find_by(token: plain_text_token)).to eq(nil)
+              expect(clazz.find_by(token: access_token.token)).not_to be_nil
+            end
+          end
+        end
+      end
+
       it 'generates a token using a custom object' do
         eigenclass = class << CustomGeneratorArgs; self; end
         eigenclass.class_eval do
@@ -196,6 +258,67 @@ module Doorkeeper
           token2.save(validate: false)
         end.to raise_error(uniqueness_error)
       end
+
+      context 'with hashing enabled' do
+        include_context 'with token hashing enabled'
+        let(:token) { FactoryBot.create :access_token, use_refresh_token: true }
+
+        it 'holds a volatile refresh token when created' do
+          expect(token.plaintext_refresh_token).to be_a(String)
+          expect(token.refresh_token)
+            .to eq(hashed_or_plain_token_func.call(token.plaintext_refresh_token))
+
+          # Finder method only finds the hashed token
+          loaded = clazz.find_by(refresh_token: token.refresh_token)
+          expect(loaded).to eq(token)
+          expect(loaded.plaintext_refresh_token).to be_nil
+          expect(loaded.refresh_token).to eq(token.refresh_token)
+        end
+
+        it 'does not find_by plain text refresh tokens' do
+          expect(clazz.find_by(refresh_token: token.plaintext_refresh_token)).to be_nil
+        end
+
+        describe 'with having a plain text token' do
+          let(:plain_refresh_token) { 'plain refresh token' }
+          let(:access_token) { FactoryBot.create :access_token }
+
+          before do
+            # Assume we have a plain text token from before activating the option
+            access_token.update_column(:refresh_token, plain_refresh_token)
+          end
+
+          context 'without fallback lookup' do
+            it 'does not provide lookups with either through by_token' do
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(nil)
+              expect(clazz.by_refresh_token(access_token.refresh_token)).to eq(nil)
+
+              # And it does not touch the token
+              access_token.reload
+              expect(access_token.refresh_token).to eq(plain_refresh_token)
+            end
+          end
+
+          context 'with fallback lookup' do
+            include_context 'with token hashing and fallback lookup enabled'
+
+            it 'upgrades a plain token when falling back to it' do
+              # Side-effect: This will automatically upgrade the token
+              expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(access_token)
+
+              # Will find subsequently by hashing the token
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(access_token)
+
+              # And it modifies the token value
+              access_token.reload
+              expect(access_token.refresh_token).not_to eq(plain_refresh_token)
+              expect(clazz.find_by(refresh_token: plain_refresh_token)).to eq(nil)
+              expect(clazz.find_by(refresh_token: access_token.refresh_token)).not_to be_nil
+            end
+          end
+        end
+      end
     end
 
     describe 'validations' do

data/spec/models/doorkeeper/application_spec.rb

@@ -2,6 +2,7 @@ require 'spec_helper'
 
 module Doorkeeper
   describe Application do
+    let(:clazz) { Doorkeeper::Application }
     let(:require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', true) }
     let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', false) }
     let(:new_application) { FactoryBot.build(:application) }
@@ -122,6 +123,42 @@ module Doorkeeper
       expect(new_application).not_to be_valid
     end
 
+    context 'with hashing enabled' do
+      include_context 'with application hashing enabled'
+      let(:app) { FactoryBot.create :application }
+
+      it 'holds a volatile plaintext and BCrypt secret' do
+        expect(app.plaintext_secret).to be_a(String)
+        expect(app.secret).not_to eq(app.plaintext_secret)
+        expect { BCrypt::Password.create(app.secret) }.not_to raise_error
+      end
+
+      it 'does not fallback to plain lookup by default' do
+        lookup = clazz.by_uid_and_secret(app.uid, app.secret)
+        expect(lookup).to eq(nil)
+
+        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup).to eq(app)
+      end
+
+      context 'with fallback enabled' do
+        include_context 'with token hashing and fallback lookup enabled'
+
+        it 'provides plain and hashed lookup' do
+          lookup = clazz.by_uid_and_secret(app.uid, app.secret)
+          expect(lookup).to eq(app)
+
+          lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+          expect(lookup).to eq(app)
+        end
+      end
+
+      it 'does not provide access to secret after loading' do
+        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup.plaintext_secret).to be_nil
+      end
+    end
+
     describe 'destroy related models on cascade' do
       before(:each) do
         new_application.save

data/spec/requests/flows/authorization_code_spec.rb

@@ -21,6 +21,33 @@ feature 'Authorization Code Flow' do
     url_should_not_have_param('error')
   end
 
+  context 'with grant hashing enabled' do
+    background do
+      config_is_set(:hash_token_secrets) { true }
+    end
+
+    scenario 'Authorization Code Flow with hashing' do
+      @client.redirect_uri = Doorkeeper.configuration.native_redirect_uri
+      @client.save!
+      visit authorization_endpoint_url(client: @client)
+      click_on 'Authorize'
+
+      access_grant_should_exist_for(@client, @resource_owner)
+
+      code = current_params['code']
+      expect(code).not_to be_nil
+
+      hashed_code = Doorkeeper::AccessGrant.hashed_or_plain_token code
+      expect(hashed_code).to eq Doorkeeper::AccessGrant.first.token
+
+      expect(code).not_to eq(hashed_code)
+
+      i_should_see 'Authorization code:'
+      i_should_see code
+      i_should_not_see hashed_code
+    end
+  end
+
   scenario 'resource owner authorizes using test url' do
     @client.redirect_uri = Doorkeeper.configuration.native_redirect_uri
     @client.save!
@@ -71,6 +98,19 @@ feature 'Authorization Code Flow' do
     should_have_json 'error', 'invalid_client'
   end
 
+  scenario 'resource owner requests an access token with authorization code but without client id' do
+    visit authorization_endpoint_url(client: @client)
+    click_on 'Authorize'
+
+    authorization_code = Doorkeeper::AccessGrant.first.token
+    page.driver.post token_endpoint_url(code: authorization_code, client_secret: @client.secret,
+                                        redirect_uri: @client.redirect_uri)
+
+    expect(Doorkeeper::AccessToken.count).to be_zero
+
+    should_have_json 'error', 'invalid_client'
+  end
+
   scenario 'silently authorizes if matching token exists' do
     default_scopes_exist :public, :write
 

data/spec/requests/flows/password_spec.rb

@@ -64,7 +64,8 @@ describe 'Resource Owner Password Credentials Flow' do
               )
             end.not_to(change { Doorkeeper::AccessToken.count })
 
-            expect(response).not_to be_ok
+            expect(response.status).to eq(401)
+            should_have_json 'error', 'invalid_client'
           end
         end
       end
@@ -88,7 +89,8 @@ describe 'Resource Owner Password Credentials Flow' do
             post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
           end.not_to(change { Doorkeeper::AccessToken.count })
 
-          expect(response).not_to be_ok
+          expect(response.status).to eq(401)
+          should_have_json 'error', 'invalid_client'
         end
       end
     end

data/spec/requests/flows/revoke_token_spec.rb

@@ -26,30 +26,28 @@ describe 'Revoke Token Flow' do
       it 'should revoke the access token provided' do
         post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
-        access_token.reload
-
         expect(response).to be_successful
-        expect(access_token.revoked?).to be_truthy
+        expect(access_token.reload.revoked?).to be_truthy
       end
 
       it 'should revoke the refresh token provided' do
         post revocation_token_endpoint_url, params: { token: access_token.refresh_token }, headers: headers
 
-        access_token.reload
-
         expect(response).to be_successful
-        expect(access_token.revoked?).to be_truthy
+        expect(access_token.reload.revoked?).to be_truthy
       end
 
       context 'with invalid token to revoke' do
         it 'should not revoke any tokens and respond successfully' do
-          num_prev_revoked_tokens = Doorkeeper::AccessToken.where(revoked_at: nil).count
-          post revocation_token_endpoint_url, params: { token: 'I_AM_AN_INVALID_TOKEN' }, headers: headers
+          expect do
+            post revocation_token_endpoint_url,
+              params: { token: 'I_AM_AN_INVALID_TOKEN' },
+              headers: headers
+            end.not_to(change { Doorkeeper::AccessToken.where(revoked_at: nil).count })
 
           # The authorization server responds with HTTP status code 200 even if
           # token is invalid
           expect(response).to be_successful
-          expect(Doorkeeper::AccessToken.where(revoked_at: nil).count).to eq(num_prev_revoked_tokens)
         end
       end
 
@@ -62,10 +60,8 @@ describe 'Revoke Token Flow' do
         it 'should not revoke any tokens and respond successfully' do
           post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
-          access_token.reload
-
           expect(response).to be_successful
-          expect(access_token.revoked?).to be_falsey
+          expect(access_token.reload.revoked?).to be_falsey
         end
       end
 
@@ -73,10 +69,8 @@ describe 'Revoke Token Flow' do
         it 'should not revoke any tokens and respond successfully' do
           post revocation_token_endpoint_url, params: { token: access_token.token }
 
-          access_token.reload
-
           expect(response).to be_successful
-          expect(access_token.revoked?).to be_falsey
+          expect(access_token.reload.revoked?).to be_falsey
         end
       end
 
@@ -92,10 +86,8 @@ describe 'Revoke Token Flow' do
         it 'should not revoke the token as its unauthorized' do
           post revocation_token_endpoint_url, params: { token: access_token.token }, headers: headers
 
-          access_token.reload
-
           expect(response).to be_successful
-          expect(access_token.revoked?).to be_falsey
+          expect(access_token.reload.revoked?).to be_falsey
         end
       end
     end
@@ -111,19 +103,15 @@ describe 'Revoke Token Flow' do
       it 'should revoke the access token provided' do
         post revocation_token_endpoint_url, params: { token: access_token.token }
 
-        access_token.reload
-
         expect(response).to be_successful
-        expect(access_token.revoked?).to be_truthy
+        expect(access_token.reload.revoked?).to be_truthy
       end
 
       it 'should revoke the refresh token provided' do
         post revocation_token_endpoint_url, params: { token: access_token.refresh_token }
 
-        access_token.reload
-
         expect(response).to be_successful
-        expect(access_token.revoked?).to be_truthy
+        expect(access_token.reload.revoked?).to be_truthy
       end
 
       context 'with a valid token issued for a confidential client' do
@@ -137,19 +125,15 @@ describe 'Revoke Token Flow' do
         it 'should not revoke the access token provided' do
           post revocation_token_endpoint_url, params: { token: access_token.token }
 
-          access_token.reload
-
           expect(response).to be_successful
-          expect(access_token.revoked?).to be_falsey
+          expect(access_token.reload.revoked?).to be_falsey
         end
 
         it 'should not revoke the refresh token provided' do
           post revocation_token_endpoint_url, params: { token: access_token.token }
 
-          access_token.reload
-
           expect(response).to be_successful
-          expect(access_token.revoked?).to be_falsey
+          expect(access_token.reload.revoked?).to be_falsey
         end
       end
     end

data/spec/spec_helper.rb

@@ -28,7 +28,8 @@ end
 Doorkeeper::RSpec.print_configuration_info
 
 # Remove after dropping support of Rails 4.2
-require "#{File.dirname(__FILE__)}/support/http_method_shim.rb"
+require "#{File.dirname(__FILE__)}/support/http_method_shim"
+require "#{File.dirname(__FILE__)}/support/ruby_2_6_rails_4_2_patch"
 
 require "support/orm/#{DOORKEEPER_ORM}"
 

data/spec/support/ruby_2_6_rails_4_2_patch.rb

@@ -0,0 +1,14 @@
+if RUBY_VERSION >= '2.6.0'
+  if Rails::VERSION::MAJOR < 5
+    class ActionController::TestResponse < ActionDispatch::TestResponse
+      def recycle!
+        # hack to avoid MonitorMixin double-initialize error:
+        @mon_mutex_owner_object_id = nil
+        @mon_mutex = nil
+        initialize
+      end
+    end
+  else
+    puts "Monkeypatch for ActionController::TestResponse no longer needed"
+  end
+end

data/spec/support/shared/hashing_shared_context.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+shared_context 'with token hashing enabled' do
+  let(:hashed_or_plain_token_func) { Doorkeeper::AccessToken.method(:hashed_or_plain_token) }
+  before do
+    Doorkeeper.configure do
+      hash_token_secrets
+    end
+  end
+end
+
+shared_context 'with token hashing and fallback lookup enabled' do
+  let(:hashed_or_plain_token_func) { Doorkeeper::AccessToken.method(:hashed_or_plain_token) }
+  before do
+    Doorkeeper.configure do
+      hash_token_secrets
+      fallback_to_plain_secrets
+    end
+  end
+end
+
+shared_context 'with application hashing enabled' do
+  let(:hashed_or_plain_token_func) { Doorkeeper::Application.method(:hashed_or_plain_token) }
+  before do
+    Doorkeeper.configure do
+      hash_application_secrets
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.0.2
+  version: 5.1.0.rc1
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-10-25 00:00:00.000000000 Z
+date: 2019-01-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -205,6 +205,7 @@ files:
 - app/views/doorkeeper/authorized_applications/index.html.erb
 - app/views/layouts/doorkeeper/admin.html.erb
 - app/views/layouts/doorkeeper/application.html.erb
+- bin/console
 - config/locales/en.yml
 - doorkeeper.gemspec
 - gemfiles/rails_4_2.gemfile
@@ -224,6 +225,7 @@ files:
 - lib/doorkeeper/models/application_mixin.rb
 - lib/doorkeeper/models/concerns/accessible.rb
 - lib/doorkeeper/models/concerns/expirable.rb
+- lib/doorkeeper/models/concerns/hashable.rb
 - lib/doorkeeper/models/concerns/orderable.rb
 - lib/doorkeeper/models/concerns/ownership.rb
 - lib/doorkeeper/models/concerns/revocable.rb
@@ -358,6 +360,7 @@ files:
 - spec/lib/config_spec.rb
 - spec/lib/doorkeeper_spec.rb
 - spec/lib/models/expirable_spec.rb
+- spec/lib/models/hashable_spec.rb
 - spec/lib/models/revocable_spec.rb
 - spec/lib/models/scopes_spec.rb
 - spec/lib/oauth/authorization/uri_builder_spec.rb
@@ -423,7 +426,9 @@ files:
 - spec/support/helpers/url_helper.rb
 - spec/support/http_method_shim.rb
 - spec/support/orm/active_record.rb
+- spec/support/ruby_2_6_rails_4_2_patch.rb
 - spec/support/shared/controllers_shared_context.rb
+- spec/support/shared/hashing_shared_context.rb
 - spec/support/shared/models_shared_examples.rb
 - spec/validators/redirect_uri_validator_spec.rb
 - spec/version/version_spec.rb
@@ -443,12 +448,11 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '2.1'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">="
+  - - ">"
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 1.3.1
 requirements: []
-rubyforge_project: 
-rubygems_version: 2.6.11
+rubygems_version: 3.0.2
 signing_key: 
 specification_version: 4
 summary: OAuth 2 provider for Rails and Grape
@@ -514,6 +518,7 @@ test_files:
 - spec/lib/config_spec.rb
 - spec/lib/doorkeeper_spec.rb
 - spec/lib/models/expirable_spec.rb
+- spec/lib/models/hashable_spec.rb
 - spec/lib/models/revocable_spec.rb
 - spec/lib/models/scopes_spec.rb
 - spec/lib/oauth/authorization/uri_builder_spec.rb
@@ -579,7 +584,9 @@ test_files:
 - spec/support/helpers/url_helper.rb
 - spec/support/http_method_shim.rb
 - spec/support/orm/active_record.rb
+- spec/support/ruby_2_6_rails_4_2_patch.rb
 - spec/support/shared/controllers_shared_context.rb
+- spec/support/shared/hashing_shared_context.rb
 - spec/support/shared/models_shared_examples.rb
 - spec/validators/redirect_uri_validator_spec.rb
 - spec/version/version_spec.rb