doorkeeper 5.0.2 → 5.1.0.rc2

data/app/views/layouts/doorkeeper/admin.html.erb

@@ -17,9 +17,11 @@
       <li class="nav-item <%= 'active' if request.path == oauth_applications_path %>">
         <%= link_to t('doorkeeper.layouts.admin.nav.applications'), oauth_applications_path, class: 'nav-link' %>
       </li>
-      <li class="nav-item">
-        <%= link_to t('doorkeeper.layouts.admin.nav.home'), root_path, class: 'nav-link' %>
-      </li>
+      <% if respond_to?(:root_path) %>
+        <li class="nav-item">
+          <%= link_to t('doorkeeper.layouts.admin.nav.home'), root_path, class: 'nav-link' %>
+        </li>
+      <% end %>
     </ul>
   </div>
 </nav>

data/bin/console

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+
+require 'bundler/setup'
+require 'rails/all'
+require 'doorkeeper'
+
+# You can add fixtures and/or initialization code here to make experimenting
+# with your gem easier. You can also use a different console, if you like.
+
+# (If you use this, don't forget to add pry to your Gemfile!)
+# require "pry"
+# Pry.start
+
+require 'irb'
+IRB.start(__FILE__)

data/doorkeeper.gemspec

@@ -19,13 +19,14 @@ Gem::Specification.new do |gem|
   gem.add_dependency 'railties', '>= 4.2'
   gem.required_ruby_version = '>= 2.1'
 
-  gem.add_development_dependency 'capybara', '~> 2.18'
+  gem.add_development_dependency 'appraisal'
+  gem.add_development_dependency 'capybara'
   gem.add_development_dependency 'coveralls'
   gem.add_development_dependency 'danger', '~> 5.0'
-  gem.add_development_dependency 'grape'
   gem.add_development_dependency 'database_cleaner', '~> 1.6'
   gem.add_development_dependency 'factory_bot', '~> 4.8'
   gem.add_development_dependency 'generator_spec', '~> 0.9.3'
+  gem.add_development_dependency 'grape'
   gem.add_development_dependency 'rake', '>= 11.3.0'
   gem.add_development_dependency 'rspec-rails'
 end

data/gemfiles/rails_4_2.gemfile

@@ -3,11 +3,15 @@
 source "https://rubygems.org"
 
 gem "rails", "~> 4.2.0"
-gem "appraisal"
+gem "rspec-core", git: "https://github.com/rspec/rspec-core.git"
+gem "rspec-expectations", git: "https://github.com/rspec/rspec-expectations.git"
+gem "rspec-mocks", git: "https://github.com/rspec/rspec-mocks.git"
+gem "rspec-rails", branch: "4-0-dev", git: "https://github.com/rspec/rspec-rails.git"
+gem "rspec-support", git: "https://github.com/rspec/rspec-support.git"
+gem "bcrypt", "~> 3.1", require: false
 gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
-gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "sqlite3", "~> 1.3", "< 1.4", platform: [:ruby, :mswin, :mingw, :x64_mingw]
 gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
-# Older Grape requires Ruby >= 2.2.2
-gem "grape", '~> 0.16', '< 0.19.2'
+gem "grape", "~> 0.16", "< 0.19.2"
 
 gemspec path: "../"

data/gemfiles/rails_5_0.gemfile

@@ -2,11 +2,15 @@
 
 source "https://rubygems.org"
 
-gem "rails", "~> 5.0.0"
-gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
-gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "rails", "~> 5.0.0", ">= 5.0.7.2"
+gem "rspec-core", git: "https://github.com/rspec/rspec-core.git"
+gem "rspec-expectations", git: "https://github.com/rspec/rspec-expectations.git"
+gem "rspec-mocks", git: "https://github.com/rspec/rspec-mocks.git"
+gem "rspec-rails", branch: "4-0-dev", git: "https://github.com/rspec/rspec-rails.git"
+gem "rspec-support", git: "https://github.com/rspec/rspec-support.git"
+gem "bcrypt", "~> 3.1", require: false
+gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
+gem "sqlite3", "~> 1.3", "< 1.4", platform: [:ruby, :mswin, :mingw, :x64_mingw]
 gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
-gem "rspec-rails", "~> 3.5"
 
 gemspec path: "../"

data/gemfiles/rails_5_1.gemfile

@@ -2,11 +2,15 @@
 
 source "https://rubygems.org"
 
-gem "rails", "~> 5.1.0"
-gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
-gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "rails", "~> 5.1.0", ">= 5.1.6.2"
+gem "rspec-core", git: "https://github.com/rspec/rspec-core.git"
+gem "rspec-expectations", git: "https://github.com/rspec/rspec-expectations.git"
+gem "rspec-mocks", git: "https://github.com/rspec/rspec-mocks.git"
+gem "rspec-rails", branch: "4-0-dev", git: "https://github.com/rspec/rspec-rails.git"
+gem "rspec-support", git: "https://github.com/rspec/rspec-support.git"
+gem "bcrypt", "~> 3.1", require: false
+gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
+gem "sqlite3", "~> 1.3", "< 1.4", platform: [:ruby, :mswin, :mingw, :x64_mingw]
 gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
-gem "rspec-rails", "~> 3.7"
 
 gemspec path: "../"

data/gemfiles/rails_5_2.gemfile

@@ -2,11 +2,15 @@
 
 source "https://rubygems.org"
 
-gem "rails", "5.2.0"
-gem "appraisal"
-gem "activerecord-jdbcsqlite3-adapter", platforms: :jruby
-gem "sqlite3", platforms: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "rails", "~> 5.2.2", ">= 5.2.2.1"
+gem "rspec-core", git: "https://github.com/rspec/rspec-core.git"
+gem "rspec-expectations", git: "https://github.com/rspec/rspec-expectations.git"
+gem "rspec-mocks", git: "https://github.com/rspec/rspec-mocks.git"
+gem "rspec-rails", branch: "4-0-dev", git: "https://github.com/rspec/rspec-rails.git"
+gem "rspec-support", git: "https://github.com/rspec/rspec-support.git"
+gem "bcrypt", "~> 3.1", require: false
+gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
+gem "sqlite3", "~> 1.3", "< 1.4", platform: [:ruby, :mswin, :mingw, :x64_mingw]
 gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
-gem "rspec-rails", "~> 3.7"
 
 gemspec path: "../"

data/gemfiles/rails_6_0.gemfile

@@ -0,0 +1,16 @@
+# This file was generated by Appraisal
+
+source "https://rubygems.org"
+
+gem "rails", "~> 6.0.0.beta3"
+gem "rspec-core", git: "https://github.com/rspec/rspec-core.git"
+gem "rspec-expectations", git: "https://github.com/rspec/rspec-expectations.git"
+gem "rspec-mocks", git: "https://github.com/rspec/rspec-mocks.git"
+gem "rspec-rails", branch: "4-0-dev", git: "https://github.com/rspec/rspec-rails.git"
+gem "rspec-support", git: "https://github.com/rspec/rspec-support.git"
+gem "bcrypt", "~> 3.1", require: false
+gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
+gem "sqlite3", "~> 1.4", platform: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
+
+gemspec path: "../"

data/gemfiles/rails_master.gemfile

@@ -2,16 +2,15 @@
 
 source "https://rubygems.org"
 
-gem "rails", git: 'https://github.com/rails/rails'
-gem "arel", git: 'https://github.com/rails/arel'
-
-gem "appraisal"
+gem "rails", git: "https://github.com/rails/rails"
+gem "rspec-core", git: "https://github.com/rspec/rspec-core.git"
+gem "rspec-expectations", git: "https://github.com/rspec/rspec-expectations.git"
+gem "rspec-mocks", git: "https://github.com/rspec/rspec-mocks.git"
+gem "rspec-rails", branch: "4-0-dev", git: "https://github.com/rspec/rspec-rails.git"
+gem "rspec-support", git: "https://github.com/rspec/rspec-support.git"
+gem "bcrypt", "~> 3.1", require: false
 gem "activerecord-jdbcsqlite3-adapter", platform: :jruby
-gem "sqlite3", platform: [:ruby, :mswin, :mingw, :x64_mingw]
+gem "sqlite3", "~> 1.4", platform: [:ruby, :mswin, :mingw, :x64_mingw]
 gem "tzinfo-data", platforms: [:mingw, :mswin, :x64_mingw]
 
-%w[rspec-core rspec-expectations rspec-mocks rspec-rails rspec-support].each do |lib|
-  gem lib, git: "https://github.com/rspec/#{lib}.git", branch: 'master'
-end
-
 gemspec path: "../"

data/lib/doorkeeper/config.rb

@@ -46,6 +46,7 @@ module Doorkeeper
       end
 
       def build
+        @config.validate
         @config
       end
 
@@ -83,6 +84,13 @@ module Doorkeeper
         @config.instance_variable_set(:@optional_scopes, OAuth::Scopes.from_array(scopes))
       end
 
+      # Define scopes_by_grant_type to limit certain scope to certain grant_type
+      # @param { Hash } with grant_types as keys.
+      # Default set to {} i.e. no limitation on scopes usage
+      def scopes_by_grant_type(hash = {})
+        @config.instance_variable_set(:@scopes_by_grant_type, hash)
+      end
+
       # Change the way client credentials are retrieved from the request object.
       # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
       # falls back to the `:client_id` and `:client_secret` params from the
@@ -118,6 +126,15 @@ module Doorkeeper
         @config.instance_variable_set(:@reuse_access_token, true)
       end
 
+      # Sets the token_reuse_limit
+      # It will be used only when reuse_access_token option in enabled
+      # By default it will be 100
+      # It will be used for token reusablity to some threshold percentage
+      # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
+      def token_reuse_limit(percentage)
+        @config.instance_variable_set(:@token_reuse_limit, percentage)
+      end
+
       # Use an API mode for applications generated with --api argument
       # It will skip applications controller, disable forgery protection
       def api_only
@@ -136,6 +153,57 @@ module Doorkeeper
       def enforce_content_type
         @config.instance_variable_set(:@enforce_content_type, true)
       end
+
+      # Allow optional hashing of input tokens before persisting them.
+      # Will be used for hashing of input token and grants.
+      #
+      # @param using
+      #   Provide a different secret storage implementation class for tokens
+      # @param fallback
+      #   Provide a fallback secret storage implementation class for tokens
+      #   or use :plain to fallback to plain tokens
+      def hash_token_secrets(using: nil, fallback: nil)
+        default = '::Doorkeeper::SecretStoring::Sha256Hash'
+        configure_secrets_for :token,
+                              using: using || default,
+                              fallback: fallback
+      end
+
+      # Allow optional hashing of application secrets before persisting them.
+      # Will be used for hashing of input token and grants.
+      #
+      # @param using
+      #   Provide a different secret storage implementation for applications
+      # @param fallback
+      #   Provide a fallback secret storage implementation for applications
+      #   or use :plain to fallback to plain application secrets
+      def hash_application_secrets(using: nil, fallback: nil)
+        default = '::Doorkeeper::SecretStoring::Sha256Hash'
+        configure_secrets_for :application,
+                              using: using || default,
+                              fallback: fallback
+      end
+
+      private
+
+      # Configure the secret storing functionality
+      def configure_secrets_for(type, using:, fallback:)
+        unless %i[application token].include?(type)
+          raise ArgumentError, "Invalid type #{type}"
+        end
+
+        @config.instance_variable_set(:"@#{type}_secret_strategy",
+                                      using.constantize)
+
+        if fallback.nil?
+          return
+        elsif fallback.to_sym == :plain
+          fallback = '::Doorkeeper::SecretStoring::Plain'
+        end
+
+        @config.instance_variable_set(:"@#{type}_secret_fallback_strategy",
+                                      fallback.constantize)
+      end
     end
 
     module Option
@@ -226,11 +294,16 @@ module Doorkeeper
 
              nil
            end)
-    option :before_successful_authorization, default: ->(_context) {}
-    option :after_successful_authorization, default: ->(_context) {}
-    option :before_successful_strategy_response, default: ->(_request) {}
-    option :after_successful_strategy_response,
-           default: ->(_request, _response) {}
+
+    # Hooks for authorization
+    option :before_successful_authorization,      default: ->(_context) {}
+    option :after_successful_authorization,       default: ->(_context) {}
+    # Hooks for strategies responses
+    option :before_successful_strategy_response,  default: ->(_request) {}
+    option :after_successful_strategy_response,   default: ->(_request, _response) {}
+    # Allows to customize Token Introspection response
+    option :custom_introspection_response,        default: ->(_token, _context) { {} }
+
     option :skip_authorization,             default: ->(_routes) {}
     option :access_token_expires_in,        default: 7200
     option :custom_access_token_expires_in, default: ->(_context) { nil }
@@ -278,6 +351,15 @@ module Doorkeeper
     option :access_token_generator,
            default: 'Doorkeeper::OAuth::Helpers::UniqueToken'
 
+
+    # Default access token generator is a SecureRandom class from Ruby stdlib.
+    # This option defines which method will be used to generate a unique token value.
+    #
+    # @param access_token_generator [String]
+    #   the name of the access token generator class
+    #
+    option :default_generator_method,  default: :urlsafe_base64
+
     # The controller Doorkeeper::ApplicationController inherits from.
     # Defaults to ActionController::Base.
     # https://github.com/doorkeeper-gem/doorkeeper#custom-base-controller
@@ -286,9 +368,16 @@ module Doorkeeper
     option :base_controller,
            default: 'ActionController::Base'
 
-    attr_reader :reuse_access_token
-    attr_reader :api_only
-    attr_reader :enforce_content_type
+    attr_reader :api_only,
+                :enforce_content_type,
+                :reuse_access_token
+
+    # Return the valid subset of this configuration
+    def validate
+      validate_reuse_access_token_value
+      validate_token_reuse_limit
+      validate_secret_strategies
+    end
 
     def api_only
       @api_only ||= false
@@ -306,22 +395,42 @@ module Doorkeeper
       end
     end
 
+    def token_reuse_limit
+      @token_reuse_limit ||= 100
+    end
+
     def enforce_configured_scopes?
-      !!(defined?(@enforce_configured_scopes) && @enforce_configured_scopes)
+      option_set? :enforce_configured_scopes
     end
 
     def enable_application_owner?
-      !!(defined?(@enable_application_owner) && @enable_application_owner)
+      option_set? :enable_application_owner
     end
 
     def confirm_application_owner?
-      !!(defined?(@confirm_application_owner) && @confirm_application_owner)
+      option_set? :confirm_application_owner
     end
 
     def raise_on_errors?
       handle_auth_errors == :raise
     end
 
+    def token_secret_strategy
+      @token_secret_strategy ||= ::Doorkeeper::SecretStoring::Plain
+    end
+
+    def token_secret_fallback_strategy
+      @token_secret_fallback_strategy
+    end
+
+    def application_secret_strategy
+      @application_secret_strategy ||= ::Doorkeeper::SecretStoring::Plain
+    end
+
+    def application_secret_fallback_strategy
+      @application_secret_fallback_strategy
+    end
+
     def default_scopes
       @default_scopes ||= OAuth::Scopes.new
     end
@@ -334,6 +443,10 @@ module Doorkeeper
       @scopes ||= default_scopes + optional_scopes
     end
 
+    def scopes_by_grant_type
+      @scopes_by_grant_type ||= {}
+    end
+
     def client_credentials_methods
       @client_credentials_methods ||= %i[from_basic from_params]
     end
@@ -352,6 +465,12 @@ module Doorkeeper
 
     private
 
+    # Helper to read boolearized configuration option
+    def option_set?(instance_key)
+      var = instance_variable_get("@#{instance_key}")
+      !!(defined?(var) && var)
+    end
+
     # Determines what values are acceptable for 'response_type' param in
     # authorization request endpoint, and return them as an array of strings.
     #
@@ -370,5 +489,39 @@ module Doorkeeper
       types << 'refresh_token' if refresh_token_enabled?
       types
     end
+
+    # Determine whether +reuse_access_token+ and a non-restorable
+    # +token_secret_strategy+ have both been activated.
+    #
+    # In that case, disable reuse_access_token value and warn the user.
+    def validate_reuse_access_token_value
+      strategy = token_secret_strategy
+      return if !reuse_access_token || strategy.allows_restoring_secrets?
+
+      ::Rails.logger.warn(
+        "You have configured both reuse_access_token " \
+        "AND strategy strategy '#{strategy}' that cannot restore tokens. " \
+        "This combination is unsupported. reuse_access_token will be disabled"
+      )
+      @reuse_access_token = false
+    end
+
+    # Validate that the provided strategies are valid for
+    # tokens and applications
+    def validate_secret_strategies
+      token_secret_strategy.validate_for :token
+      application_secret_strategy.validate_for :application
+    end
+
+    def validate_token_reuse_limit
+      return if !reuse_access_token ||
+                (token_reuse_limit > 0 && token_reuse_limit <= 100)
+
+      ::Rails.logger.warn(
+        'You have configured an invalid value for token_reuse_limit option. ' \
+        'It will be set to default 100'
+      )
+      @token_reuse_limit = 100
+    end
   end
 end

data/lib/doorkeeper/helpers/controller.rb

@@ -55,8 +55,9 @@ module Doorkeeper
       end
 
       def enforce_content_type
-        return if request.content_type == 'application/x-www-form-urlencoded'
-        render json: {}, status: :unsupported_media_type
+        if (request.put? || request.post? || request.patch?) && request.content_type != 'application/x-www-form-urlencoded'
+          render json: {}, status: :unsupported_media_type
+        end
       end
     end
   end

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -9,6 +9,7 @@ module Doorkeeper
     include Models::Revocable
     include Models::Accessible
     include Models::Orderable
+    include Models::SecretStorable
     include Models::Scopes
 
     # never uses pkce, if pkce migrations were not generated
@@ -30,7 +31,7 @@ module Doorkeeper
       #   if there is no record with such token
       #
       def by_token(token)
-        find_by(token: token.to_s)
+        find_by_plaintext_token(:token, token)
       end
 
       # Revokes AccessGrant records that have not been revoked and associated
@@ -94,6 +95,20 @@ module Doorkeeper
       def pkce_supported?
         new.pkce_supported?
       end
+
+      ##
+      # Determines the secret storing transformer
+      # Unless configured otherwise, uses the plain secret strategy
+      def secret_strategy
+        ::Doorkeeper.configuration.token_secret_strategy
+      end
+
+      ##
+      # Determine the fallback storing strategy
+      # Unless configured, there will be no fallback
+      def fallback_secret_strategy
+        ::Doorkeeper.configuration.token_secret_fallback_strategy
+      end
     end
   end
 end

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -6,23 +6,25 @@ module Doorkeeper
 
     include OAuth::Helpers
     include Models::Expirable
+    include Models::Reusable
     include Models::Revocable
     include Models::Accessible
     include Models::Orderable
+    include Models::SecretStorable
     include Models::Scopes
 
     module ClassMethods
       # Returns an instance of the Doorkeeper::AccessToken with
-      # specific token value.
+      # specific plain text token value.
       #
       # @param token [#to_s]
-      #   token value (any object that responds to `#to_s`)
+      #   Plain text token value (any object that responds to `#to_s`)
       #
       # @return [Doorkeeper::AccessToken, nil] AccessToken object or nil
       #   if there is no record with such token
       #
       def by_token(token)
-        find_by(token: token.to_s)
+        find_by_plaintext_token(:token, token)
       end
 
       # Returns an instance of the Doorkeeper::AccessToken
@@ -35,7 +37,7 @@ module Doorkeeper
       #   if there is no record with such refresh token
       #
       def by_refresh_token(refresh_token)
-        find_by(refresh_token: refresh_token.to_s)
+        find_by_plaintext_token(:refresh_token, refresh_token)
       end
 
       # Revokes AccessToken records that have not been revoked and associated
@@ -98,9 +100,9 @@ module Doorkeeper
 
         (token_scopes.sort == param_scopes.sort) &&
           Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
-            param_scopes.to_s,
-            Doorkeeper.configuration.scopes,
-            app_scopes
+            scope_str: param_scopes.to_s,
+            server_scopes: Doorkeeper.configuration.scopes,
+            app_scopes: app_scopes
           )
       end
 
@@ -125,7 +127,7 @@ module Doorkeeper
         if Doorkeeper.configuration.reuse_access_token
           access_token = matching_token_for(application, resource_owner_id, scopes)
 
-          return access_token if access_token && !access_token.expired?
+          return access_token if access_token && access_token.reusable?
         end
 
         create!(
@@ -168,6 +170,20 @@ module Doorkeeper
       def last_authorized_token_for(application_id, resource_owner_id)
         authorized_tokens_for(application_id, resource_owner_id).first
       end
+
+      ##
+      # Determines the secret storing transformer
+      # Unless configured otherwise, uses the plain secret strategy
+      def secret_strategy
+        ::Doorkeeper.configuration.token_secret_strategy
+      end
+
+      ##
+      # Determine the fallback storing strategy
+      # Unless configured, there will be no fallback
+      def fallback_secret_strategy
+        ::Doorkeeper.configuration.token_secret_fallback_strategy
+      end
     end
 
     # Access Token type: Bearer.
@@ -219,6 +235,30 @@ module Doorkeeper
       accessible? && includes_scope?(*scopes)
     end
 
+    # We keep a volatile copy of the raw refresh token for initial communication
+    # The stored refresh_token may be mapped and not available in cleartext.
+    def plaintext_refresh_token
+      if secret_strategy.allows_restoring_secrets?
+        secret_strategy.restore_secret(self, :refresh_token)
+      else
+        @raw_refresh_token
+      end
+    end
+
+    # We keep a volatile copy of the raw token for initial communication
+    # The stored refresh_token may be mapped and not available in cleartext.
+    #
+    # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+    # while hashing strategies do not, so you cannot rely on this value
+    # returning a present value for persisted tokens.
+    def plaintext_token
+      if secret_strategy.allows_restoring_secrets?
+        secret_strategy.restore_secret(self, :token)
+      else
+        @raw_token
+      end
+    end
+
     private
 
     # Generates refresh token with UniqueToken generator.
@@ -226,7 +266,8 @@ module Doorkeeper
     # @return [String] refresh token value
     #
     def generate_refresh_token
-      self.refresh_token = UniqueToken.generate
+      @raw_refresh_token = UniqueToken.generate
+      secret_strategy.store_secret(self, :refresh_token, @raw_refresh_token)
     end
 
     # Generates and sets the token value with the
@@ -242,13 +283,16 @@ module Doorkeeper
     def generate_token
       self.created_at ||= Time.now.utc
 
-      self.token = token_generator.generate(
+      @raw_token = token_generator.generate(
         resource_owner_id: resource_owner_id,
         scopes: scopes,
         application: application,
         expires_in: expires_in,
         created_at: created_at
       )
+
+      secret_strategy.store_secret(self, :token, @raw_token)
+      @raw_token
     end
 
     def token_generator