doorkeeper 5.0.2 → 5.1.0.rc2

data/spec/lib/secret_storing/base_spec.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe ::Doorkeeper::SecretStoring::Base do
+  let(:instance) { double('instance', token: 'foo') }
+  subject { described_class }
+
+  describe '#transform_secret' do
+    it 'raises' do
+      expect { subject.transform_secret('foo') }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe '#store_secret' do
+    it 'sends to response of #transform_secret to the instance' do
+      expect(described_class)
+        .to receive(:transform_secret).with('bar')
+        .and_return 'bar+transform'
+
+      expect(instance).to receive(:token=).with 'bar+transform'
+      result = subject.store_secret instance, :token, 'bar'
+      expect(result).to eq 'bar+transform'
+    end
+  end
+
+  describe '#restore_secret' do
+    it 'raises' do
+      expect { subject.restore_secret(subject, :token) }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe '#allows_restoring_secrets?' do
+    it 'does not allow it' do
+      expect(subject.allows_restoring_secrets?).to eq false
+    end
+  end
+
+  describe 'validate_for' do
+    it 'allows for valid model' do
+      expect(subject.validate_for(:application)).to eq true
+      expect(subject.validate_for(:token)).to eq true
+    end
+
+    it 'raises for invalid model' do
+      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
+    end
+  end
+
+  describe 'secret_matches?' do
+    before do
+      allow(subject).to receive(:transform_secret) { |input| "transformed: #{input}" }
+    end
+
+    it 'compares input with #transform_secret' do
+      expect(subject.secret_matches?('input', 'input')).to eq false
+      expect(subject.secret_matches?('a', 'transformed: a')).to eq true
+    end
+  end
+end

data/spec/lib/secret_storing/bcrypt_spec.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'bcrypt'
+
+describe ::Doorkeeper::SecretStoring::BCrypt do
+  subject { described_class }
+  let(:instance) { double('instance', token: 'foo') }
+
+  describe '#transform_secret' do
+    it 'creates a bcrypt password' do
+      expect(subject.transform_secret('foo')).to be_a BCrypt::Password
+    end
+  end
+
+  describe '#restore_secret' do
+    it 'raises' do
+      expect { subject.restore_secret(instance, :token) }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe '#allows_restoring_secrets?' do
+    it 'does not allow it' do
+      expect(subject.allows_restoring_secrets?).to eq false
+    end
+  end
+
+  describe 'validate_for' do
+    it 'allows for valid model' do
+      expect(subject.validate_for(:application)).to eq true
+    end
+
+    it 'raises for invalid model' do
+      expect { subject.validate_for(:wat) }
+        .to raise_error(ArgumentError, /can only be used for storing application secrets/)
+      expect { subject.validate_for(:token) }
+        .to raise_error(ArgumentError, /can only be used for storing application secrets/)
+    end
+  end
+
+  describe 'secret_matches?' do
+    it 'compares input with #transform_secret' do
+      expect(subject.secret_matches?('input', 'input')).to eq false
+
+      password = BCrypt::Password.create 'foobar'
+      expect(subject.secret_matches?('foobar', password.to_s)).to eq true
+    end
+  end
+end

data/spec/lib/secret_storing/plain_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe ::Doorkeeper::SecretStoring::Plain do
+  subject { described_class }
+  let(:instance) { double('instance', token: 'foo') }
+
+  describe '#transform_secret' do
+    it 'raises' do
+      expect(subject.transform_secret('foo')).to eq 'foo'
+    end
+  end
+
+  describe '#restore_secret' do
+    it 'raises' do
+      expect(subject.restore_secret(instance, :token)).to eq 'foo'
+    end
+  end
+
+  describe '#allows_restoring_secrets?' do
+    it 'does allow it' do
+      expect(subject.allows_restoring_secrets?).to eq true
+    end
+  end
+
+  describe 'validate_for' do
+    it 'allows for valid model' do
+      expect(subject.validate_for(:application)).to eq true
+      expect(subject.validate_for(:token)).to eq true
+    end
+
+    it 'raises for invalid model' do
+      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
+    end
+  end
+
+  describe 'secret_matches?' do
+    it 'compares input with #transform_secret' do
+      expect(subject.secret_matches?('input', 'input')).to eq true
+      expect(subject.secret_matches?('a', 'b')).to eq false
+    end
+  end
+end

data/spec/lib/secret_storing/sha256_hash_spec.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe ::Doorkeeper::SecretStoring::Sha256Hash do
+  subject { described_class }
+  let(:instance) { double('instance') }
+
+  let(:hash_function) do
+    ->(input) { ::Digest::SHA256.hexdigest(input) }
+  end
+
+  describe '#transform_secret' do
+    it 'raises' do
+      expect(subject.transform_secret('foo')).to eq hash_function.call('foo')
+    end
+  end
+
+  describe '#restore_secret' do
+    it 'raises' do
+      expect { subject.restore_secret(instance, :token) }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe '#allows_restoring_secrets?' do
+    it 'does not allow it' do
+      expect(subject.allows_restoring_secrets?).to eq false
+    end
+  end
+
+  describe 'validate_for' do
+    it 'allows for valid model' do
+      expect(subject.validate_for(:application)).to eq true
+      expect(subject.validate_for(:token)).to eq true
+    end
+
+    it 'raises for invalid model' do
+      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
+    end
+  end
+
+  describe 'secret_matches?' do
+    it 'compares input with #transform_secret' do
+      expect(subject.secret_matches?('input', 'input')).to eq false
+      expect(subject.secret_matches?('a', hash_function.call('a'))).to eq true
+    end
+  end
+end

data/spec/models/doorkeeper/access_grant_spec.rb

@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe Doorkeeper::AccessGrant do
+  let(:clazz) { Doorkeeper::AccessGrant }
   subject { FactoryBot.build(:access_grant) }
 
   it { expect(subject).to be_valid }
@@ -11,6 +12,66 @@ describe Doorkeeper::AccessGrant do
     let(:factory_name) { :access_grant }
   end
 
+  context 'with hashing enabled' do
+    let(:grant) { FactoryBot.create :access_grant }
+    include_context 'with token hashing enabled'
+
+    it 'holds a volatile plaintext token when created' do
+      expect(grant.plaintext_token).to be_a(String)
+      expect(grant.token)
+        .to eq(hashed_or_plain_token_func.call(grant.plaintext_token))
+
+      # Finder method only finds the hashed token
+      loaded = clazz.find_by(token: grant.token)
+      expect(loaded).to eq(grant)
+      expect(loaded.plaintext_token).to be_nil
+      expect(loaded.token).to eq(grant.token)
+    end
+
+    it 'does not find_by plain text tokens' do
+      expect(clazz.find_by(token: grant.plaintext_token)).to be_nil
+    end
+
+    describe 'with having a plain text token' do
+      let(:plain_text_token) { 'plain text token' }
+
+      before do
+        # Assume we have a plain text token from before activating the option
+        grant.update_column(:token, plain_text_token)
+      end
+
+      context 'without fallback lookup' do
+        it 'does not provide lookups with either through by_token' do
+          expect(clazz.by_token(plain_text_token)).to eq(nil)
+          expect(clazz.by_token(grant.token)).to eq(nil)
+
+          # And it does not touch the token
+          grant.reload
+          expect(grant.token).to eq(plain_text_token)
+        end
+      end
+
+      context 'with fallback lookup' do
+        include_context 'with token hashing and fallback lookup enabled'
+
+        it 'upgrades a plain token when falling back to it' do
+          # Side-effect: This will automatically upgrade the token
+          expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+          expect(clazz.by_token(plain_text_token)).to eq(grant)
+
+          # Will find subsequently by hashing the token
+          expect(clazz.by_token(plain_text_token)).to eq(grant)
+
+          # And it modifies the token value
+          grant.reload
+          expect(grant.token).not_to eq(plain_text_token)
+          expect(clazz.find_by(token: plain_text_token)).to eq(nil)
+          expect(clazz.find_by(token: grant.token)).not_to be_nil
+        end
+      end
+    end
+  end
+
   describe 'validations' do
     it 'is invalid without resource_owner_id' do
       subject.resource_owner_id = nil

data/spec/models/doorkeeper/access_token_spec.rb

@@ -2,6 +2,7 @@ require 'spec_helper'
 
 module Doorkeeper
   describe AccessToken do
+    let(:clazz) { Doorkeeper::AccessToken }
     subject { FactoryBot.build(:access_token) }
 
     it { expect(subject).to be_valid }
@@ -24,6 +25,67 @@ module Doorkeeper
         expect(token.token).to be_a(String)
       end
 
+      context 'with hashing enabled' do
+        let(:token) { FactoryBot.create :access_token }
+        include_context 'with token hashing enabled'
+
+        it 'holds a volatile plaintext token when created' do
+          expect(token.plaintext_token).to be_a(String)
+          expect(token.token)
+            .to eq(hashed_or_plain_token_func.call(token.plaintext_token))
+
+          # Finder method only finds the hashed token
+          loaded = clazz.find_by(token: token.token)
+          expect(loaded).to eq(token)
+          expect(loaded.plaintext_token).to be_nil
+          expect(loaded.token).to eq(token.token)
+        end
+
+        it 'does not find_by plain text tokens' do
+          expect(clazz.find_by(token: token.plaintext_token)).to be_nil
+        end
+
+        describe 'with having a plain text token' do
+          let(:plain_text_token) { 'plain text token' }
+          let(:access_token) { FactoryBot.create :access_token }
+
+          before do
+            # Assume we have a plain text token from before activating the option
+            access_token.update_column(:token, plain_text_token)
+          end
+
+          context 'without fallback lookup' do
+            it 'does not provide lookups with either through by_token' do
+              expect(clazz.by_token(plain_text_token)).to eq(nil)
+              expect(clazz.by_token(access_token.token)).to eq(nil)
+
+              # And it does not touch the token
+              access_token.reload
+              expect(access_token.token).to eq(plain_text_token)
+            end
+          end
+
+          context 'with fallback lookup' do
+            include_context 'with token hashing and fallback lookup enabled'
+
+            it 'upgrades a plain token when falling back to it' do
+              # Side-effect: This will automatically upgrade the token
+              expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+              expect(clazz.by_token(plain_text_token)).to eq(access_token)
+
+              # Will find subsequently by hashing the token
+              expect(clazz.by_token(plain_text_token)).to eq(access_token)
+
+              # And it modifies the token value
+              access_token.reload
+              expect(access_token.token).not_to eq(plain_text_token)
+              expect(clazz.find_by(token: plain_text_token)).to eq(nil)
+              expect(clazz.find_by(token: access_token.token)).not_to be_nil
+            end
+          end
+        end
+      end
+
       it 'generates a token using a custom object' do
         eigenclass = class << CustomGeneratorArgs; self; end
         eigenclass.class_eval do
@@ -196,6 +258,67 @@ module Doorkeeper
           token2.save(validate: false)
         end.to raise_error(uniqueness_error)
       end
+
+      context 'with hashing enabled' do
+        include_context 'with token hashing enabled'
+        let(:token) { FactoryBot.create :access_token, use_refresh_token: true }
+
+        it 'holds a volatile refresh token when created' do
+          expect(token.plaintext_refresh_token).to be_a(String)
+          expect(token.refresh_token)
+            .to eq(hashed_or_plain_token_func.call(token.plaintext_refresh_token))
+
+          # Finder method only finds the hashed token
+          loaded = clazz.find_by(refresh_token: token.refresh_token)
+          expect(loaded).to eq(token)
+          expect(loaded.plaintext_refresh_token).to be_nil
+          expect(loaded.refresh_token).to eq(token.refresh_token)
+        end
+
+        it 'does not find_by plain text refresh tokens' do
+          expect(clazz.find_by(refresh_token: token.plaintext_refresh_token)).to be_nil
+        end
+
+        describe 'with having a plain text token' do
+          let(:plain_refresh_token) { 'plain refresh token' }
+          let(:access_token) { FactoryBot.create :access_token }
+
+          before do
+            # Assume we have a plain text token from before activating the option
+            access_token.update_column(:refresh_token, plain_refresh_token)
+          end
+
+          context 'without fallback lookup' do
+            it 'does not provide lookups with either through by_token' do
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(nil)
+              expect(clazz.by_refresh_token(access_token.refresh_token)).to eq(nil)
+
+              # And it does not touch the token
+              access_token.reload
+              expect(access_token.refresh_token).to eq(plain_refresh_token)
+            end
+          end
+
+          context 'with fallback lookup' do
+            include_context 'with token hashing and fallback lookup enabled'
+
+            it 'upgrades a plain token when falling back to it' do
+              # Side-effect: This will automatically upgrade the token
+              expect(clazz).to receive(:upgrade_fallback_value).and_call_original
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(access_token)
+
+              # Will find subsequently by hashing the token
+              expect(clazz.by_refresh_token(plain_refresh_token)).to eq(access_token)
+
+              # And it modifies the token value
+              access_token.reload
+              expect(access_token.refresh_token).not_to eq(plain_refresh_token)
+              expect(clazz.find_by(refresh_token: plain_refresh_token)).to eq(nil)
+              expect(clazz.find_by(refresh_token: access_token.refresh_token)).not_to be_nil
+            end
+          end
+        end
+      end
     end
 
     describe 'validations' do

data/spec/models/doorkeeper/application_spec.rb

@@ -1,7 +1,9 @@
 require 'spec_helper'
+require 'bcrypt'
 
 module Doorkeeper
   describe Application do
+    let(:clazz) { Doorkeeper::Application }
     let(:require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', true) }
     let(:unset_require_owner) { Doorkeeper.configuration.instance_variable_set('@confirm_application_owner', false) }
     let(:new_application) { FactoryBot.build(:application) }
@@ -122,6 +124,60 @@ module Doorkeeper
       expect(new_application).not_to be_valid
     end
 
+    context 'with hashing enabled' do
+      include_context 'with application hashing enabled'
+      let(:app) { FactoryBot.create :application }
+      let(:default_strategy) { Doorkeeper::SecretStoring::Sha256Hash }
+
+      it 'uses SHA256 to avoid additional dependencies' do
+        # Ensure token was generated
+        app.validate
+        expect(app.secret).to eq(default_strategy.transform_secret(app.plaintext_secret))
+      end
+
+      context 'when bcrypt strategy is configured' do
+        # In this text context, we have bcrypt loaded so `bcrypt_present?`
+        # will always be true
+        before do
+          Doorkeeper.configure do
+            hash_application_secrets using: 'Doorkeeper::SecretStoring::BCrypt'
+          end
+        end
+
+        it 'holds a volatile plaintext and BCrypt secret' do
+          expect(app.secret_strategy).to eq Doorkeeper::SecretStoring::BCrypt
+          expect(app.plaintext_secret).to be_a(String)
+          expect(app.secret).not_to eq(app.plaintext_secret)
+          expect { ::BCrypt::Password.create(app.secret) }.not_to raise_error
+        end
+      end
+
+      it 'does not fallback to plain lookup by default' do
+        lookup = clazz.by_uid_and_secret(app.uid, app.secret)
+        expect(lookup).to eq(nil)
+
+        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup).to eq(app)
+      end
+
+      context 'with fallback enabled' do
+        include_context 'with token hashing and fallback lookup enabled'
+
+        it 'provides plain and hashed lookup' do
+          lookup = clazz.by_uid_and_secret(app.uid, app.secret)
+          expect(lookup).to eq(app)
+
+          lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+          expect(lookup).to eq(app)
+        end
+      end
+
+      it 'does not provide access to secret after loading' do
+        lookup = clazz.by_uid_and_secret(app.uid, app.plaintext_secret)
+        expect(lookup.plaintext_secret).to be_nil
+      end
+    end
+
     describe 'destroy related models on cascade' do
       before(:each) do
         new_application.save

data/spec/requests/flows/authorization_code_spec.rb

@@ -21,6 +21,33 @@ feature 'Authorization Code Flow' do
     url_should_not_have_param('error')
   end
 
+  context 'with grant hashing enabled' do
+    background do
+      config_is_set(:token_secret_strategy, ::Doorkeeper::SecretStoring::Sha256Hash)
+    end
+
+    scenario 'Authorization Code Flow with hashing' do
+      @client.redirect_uri = Doorkeeper.configuration.native_redirect_uri
+      @client.save!
+      visit authorization_endpoint_url(client: @client)
+      click_on 'Authorize'
+
+      access_grant_should_exist_for(@client, @resource_owner)
+
+      code = current_params['code']
+      expect(code).not_to be_nil
+
+      hashed_code = Doorkeeper::AccessGrant.secret_strategy.transform_secret code
+      expect(hashed_code).to eq Doorkeeper::AccessGrant.first.token
+
+      expect(code).not_to eq(hashed_code)
+
+      i_should_see 'Authorization code:'
+      i_should_see code
+      i_should_not_see hashed_code
+    end
+  end
+
   scenario 'resource owner authorizes using test url' do
     @client.redirect_uri = Doorkeeper.configuration.native_redirect_uri
     @client.save!
@@ -71,6 +98,19 @@ feature 'Authorization Code Flow' do
     should_have_json 'error', 'invalid_client'
   end
 
+  scenario 'resource owner requests an access token with authorization code but without client id' do
+    visit authorization_endpoint_url(client: @client)
+    click_on 'Authorize'
+
+    authorization_code = Doorkeeper::AccessGrant.first.token
+    page.driver.post token_endpoint_url(code: authorization_code, client_secret: @client.secret,
+                                        redirect_uri: @client.redirect_uri)
+
+    expect(Doorkeeper::AccessToken.count).to be_zero
+
+    should_have_json 'error', 'invalid_client'
+  end
+
   scenario 'silently authorizes if matching token exists' do
     default_scopes_exist :public, :write
 
@@ -290,7 +330,7 @@ feature 'Authorization Code Flow' do
 
   context 'when application scopes are present and no scope is passed' do
     background do
-      @client.update_attributes(scopes: 'public write read')
+      @client.update(scopes: 'public write read')
     end
 
     scenario 'access grant has no scope' do

data/spec/requests/flows/client_credentials_spec.rb

@@ -58,7 +58,7 @@ describe 'Client Credentials Request' do
           should_have_json 'error_description', translated_error_message(:invalid_scope)
           should_not_have_json 'access_token'
 
-          expect(response.status).to eq(401)
+          expect(response.status).to eq(400)
         end
       end
     end
@@ -66,7 +66,7 @@ describe 'Client Credentials Request' do
 
   context 'when application scopes contain some of the default scopes and no scope is passed' do
     before do
-      client.update_attributes(scopes: 'read write public')
+      client.update(scopes: 'read write public')
     end
 
     it 'issues new token with one default scope that are present in application scopes' do

data/spec/requests/flows/implicit_grant_spec.rb

@@ -20,7 +20,7 @@ feature 'Implicit Grant Flow (feature spec)' do
 
   context 'when application scopes are present and no scope is passed' do
     background do
-      @client.update_attributes(scopes: 'public write read')
+      @client.update(scopes: 'public write read')
     end
 
     scenario 'access token has no scopes' do

data/spec/requests/flows/password_spec.rb

@@ -64,7 +64,8 @@ describe 'Resource Owner Password Credentials Flow' do
               )
             end.not_to(change { Doorkeeper::AccessToken.count })
 
-            expect(response).not_to be_ok
+            expect(response.status).to eq(401)
+            should_have_json 'error', 'invalid_client'
           end
         end
       end
@@ -88,7 +89,8 @@ describe 'Resource Owner Password Credentials Flow' do
             post password_token_endpoint_url(client_id: @client.uid, resource_owner: @resource_owner)
           end.not_to(change { Doorkeeper::AccessToken.count })
 
-          expect(response).not_to be_ok
+          expect(response.status).to eq(401)
+          should_have_json 'error', 'invalid_client'
         end
       end
     end
@@ -147,7 +149,7 @@ describe 'Resource Owner Password Credentials Flow' do
   context 'when application scopes are present and differs from configured default scopes and no scope is passed' do
     before do
       default_scopes_exist :public
-      @client.update_attributes(scopes: 'abc')
+      @client.update(scopes: 'abc')
     end
 
     it 'issues new token without any scope' do
@@ -166,7 +168,7 @@ describe 'Resource Owner Password Credentials Flow' do
 
   context 'when application scopes contain some of the default scopes and no scope is passed' do
     before do
-      @client.update_attributes(scopes: 'read write public')
+      @client.update(scopes: 'read write public')
     end
 
     it 'issues new token with one default scope that are present in application scopes' do
@@ -215,7 +217,7 @@ describe 'Resource Owner Password Credentials Flow' do
       should_have_json 'error_description', translated_error_message(:invalid_scope)
       should_not_have_json 'access_token'
 
-      expect(response.status).to eq(401)
+      expect(response.status).to eq(400)
     end
   end