doorkeeper 5.0.2 → 5.1.0

data/lib/doorkeeper/orm/active_record/stale_records_cleaner.rb

@@ -3,22 +3,29 @@
 module Doorkeeper
   module Orm
     module ActiveRecord
+      # Helper class to clear stale and non-active tokens and grants.
+      # Used by Doorkeeper Rake tasks.
+      #
       class StaleRecordsCleaner
         def initialize(base_scope)
           @base_scope = base_scope
         end
 
+        # Clears revoked records
         def clean_revoked
           table = @base_scope.arel_table
+
           @base_scope.where.not(revoked_at: nil)
-                     .where(table[:revoked_at].lt(Time.current))
-                     .delete_all
+            .where(table[:revoked_at].lt(Time.current))
+            .in_batches(&:delete_all)
         end
 
+        # Clears expired records
         def clean_expired(ttl)
           table = @base_scope.arel_table
+
           @base_scope.where(table[:created_at].lt(Time.current - ttl))
-                     .delete_all
+            .in_batches(&:delete_all)
         end
       end
     end

data/lib/doorkeeper/orm/active_record.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
 
-require 'active_support/lazy_load_hooks'
+require "active_support/lazy_load_hooks"
 
-require 'doorkeeper/orm/active_record/stale_records_cleaner'
+require "doorkeeper/orm/active_record/stale_records_cleaner"
 
 module Doorkeeper
   module Orm
     module ActiveRecord
       def self.initialize_models!
         lazy_load do
-          require 'doorkeeper/orm/active_record/access_grant'
-          require 'doorkeeper/orm/active_record/access_token'
-          require 'doorkeeper/orm/active_record/application'
+          require "doorkeeper/orm/active_record/access_grant"
+          require "doorkeeper/orm/active_record/access_token"
+          require "doorkeeper/orm/active_record/application"
 
           if Doorkeeper.configuration.active_record_options[:establish_connection]
             [Doorkeeper::AccessGrant, Doorkeeper::AccessToken, Doorkeeper::Application].each do |model|
@@ -24,7 +24,7 @@ module Doorkeeper
 
       def self.initialize_application_owner!
         lazy_load do
-          require 'doorkeeper/models/concerns/ownership'
+          require "doorkeeper/models/concerns/ownership"
 
           Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
         end

data/lib/doorkeeper/rails/helpers.rb

@@ -14,7 +14,7 @@ module Doorkeeper
       def doorkeeper_forbidden_render_options(**); end
 
       def valid_doorkeeper_token?
-        doorkeeper_token && doorkeeper_token.acceptable?(@_doorkeeper_scopes)
+        doorkeeper_token&.acceptable?(@_doorkeeper_scopes)
       end
 
       private

data/lib/doorkeeper/rails/routes/mapping.rb

@@ -8,17 +8,17 @@ module Doorkeeper
 
         def initialize
           @controllers = {
-            authorizations: 'doorkeeper/authorizations',
-            applications: 'doorkeeper/applications',
-            authorized_applications: 'doorkeeper/authorized_applications',
-            tokens: 'doorkeeper/tokens',
-            token_info: 'doorkeeper/token_info'
+            authorizations: "doorkeeper/authorizations",
+            applications: "doorkeeper/applications",
+            authorized_applications: "doorkeeper/authorized_applications",
+            tokens: "doorkeeper/tokens",
+            token_info: "doorkeeper/token_info",
           }
 
           @as = {
             authorizations: :authorization,
             tokens: :token,
-            token_info: :token_info
+            token_info: :token_info,
           }
 
           @skips = []
@@ -27,7 +27,7 @@ module Doorkeeper
         def [](routes)
           {
             controllers: @controllers[routes],
-            as: @as[routes]
+            as: @as[routes],
           }
         end
 

data/lib/doorkeeper/rails/routes.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require 'doorkeeper/rails/routes/mapping'
-require 'doorkeeper/rails/routes/mapper'
+require "doorkeeper/rails/routes/mapping"
+require "doorkeeper/rails/routes/mapper"
 
 module Doorkeeper
   module Rails
@@ -32,7 +32,7 @@ module Doorkeeper
       end
 
       def generate_routes!(options)
-        routes.scope options[:scope] || 'oauth', as: 'oauth' do
+        routes.scope options[:scope] || "oauth", as: "oauth" do
           map_route(:authorizations, :authorization_routes)
           map_route(:tokens, :token_routes)
           map_route(:tokens, :revoke_routes)
@@ -56,37 +56,37 @@ module Doorkeeper
       def authorization_routes(mapping)
         routes.resource(
           :authorization,
-          path: 'authorize',
+          path: "authorize",
           only: %i[create destroy],
           as: mapping[:as],
           controller: mapping[:controllers]
         ) do
-          routes.get '/native', action: :show, on: :member
-          routes.get '/', action: :new, on: :member
+          routes.get "/native", action: :show, on: :member
+          routes.get "/", action: :new, on: :member
         end
       end
 
       def token_routes(mapping)
         routes.resource(
           :token,
-          path: 'token',
+          path: "token",
           only: [:create], as: mapping[:as],
           controller: mapping[:controllers]
         )
       end
 
       def revoke_routes(mapping)
-        routes.post 'revoke', controller: mapping[:controllers], action: :revoke
+        routes.post "revoke", controller: mapping[:controllers], action: :revoke
       end
 
       def introspect_routes(mapping)
-        routes.post 'introspect', controller: mapping[:controllers], action: :introspect
+        routes.post "introspect", controller: mapping[:controllers], action: :introspect
       end
 
       def token_info_routes(mapping)
         routes.resource(
           :token_info,
-          path: 'token/info',
+          path: "token/info",
           only: [:show], as: mapping[:as],
           controller: mapping[:controllers]
         )
@@ -96,7 +96,7 @@ module Doorkeeper
         routes.resources :doorkeeper_applications,
                          controller: mapping[:controllers],
                          as: :applications,
-                         path: 'applications'
+                         path: "applications"
       end
 
       def authorized_applications_routes(mapping)

data/lib/doorkeeper/rake/db.rake

@@ -2,36 +2,36 @@
 
 namespace :doorkeeper do
   namespace :db do
-    desc 'Removes stale data from doorkeeper related database tables'
+    desc "Removes stale data from doorkeeper related database tables"
     task cleanup: [
-      'doorkeeper:db:cleanup:revoked_tokens',
-      'doorkeeper:db:cleanup:expired_tokens',
-      'doorkeeper:db:cleanup:revoked_grants',
-      'doorkeeper:db:cleanup:expired_grants'
+      "doorkeeper:db:cleanup:revoked_tokens",
+      "doorkeeper:db:cleanup:expired_tokens",
+      "doorkeeper:db:cleanup:revoked_grants",
+      "doorkeeper:db:cleanup:expired_grants",
     ]
 
     namespace :cleanup do
-      desc 'Removes stale access tokens'
-      task revoked_tokens: 'doorkeeper:setup' do
+      desc "Removes stale access tokens"
+      task revoked_tokens: "doorkeeper:setup" do
         cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessToken)
         cleaner.clean_revoked
       end
 
-      desc 'Removes expired (TTL passed) access tokens'
-      task expired_tokens: 'doorkeeper:setup' do
+      desc "Removes expired (TTL passed) access tokens"
+      task expired_tokens: "doorkeeper:setup" do
         expirable_tokens = Doorkeeper::AccessToken.where(refresh_token: nil)
         cleaner = Doorkeeper::StaleRecordsCleaner.new(expirable_tokens)
         cleaner.clean_expired(Doorkeeper.configuration.access_token_expires_in)
       end
 
-      desc 'Removes stale access grants'
-      task revoked_grants: 'doorkeeper:setup' do
+      desc "Removes stale access grants"
+      task revoked_grants: "doorkeeper:setup" do
         cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
         cleaner.clean_revoked
       end
 
-      desc 'Removes expired (TTL passed) access grants'
-      task expired_grants: 'doorkeeper:setup' do
+      desc "Removes expired (TTL passed) access grants"
+      task expired_grants: "doorkeeper:setup" do
         cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
         cleaner.clean_expired(Doorkeeper.configuration.authorization_code_expires_in)
       end

data/lib/doorkeeper/rake.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   module Rake
     class << self
       def load_tasks
-        glob = File.join(File.absolute_path(__dir__), 'rake', '*.rake')
+        glob = File.join(File.absolute_path(__dir__), "rake", "*.rake")
         Dir[glob].each do |rake_file|
           load rake_file
         end

data/lib/doorkeeper/request.rb

@@ -33,7 +33,7 @@ module Doorkeeper
       end
 
       def build_strategy_class(grant_or_request_type)
-        strategy_class_name = grant_or_request_type.to_s.tr(' ', '_').camelize
+        strategy_class_name = grant_or_request_type.to_s.tr(" ", "_").camelize
         "Doorkeeper::Request::#{strategy_class_name}".constantize
       end
     end

data/lib/doorkeeper/secret_storing/base.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Base class for secret storing, including common helpers
+    class Base
+      ##
+      # Return the value to be stored by the database
+      # used for looking up a database value.
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(_plain_secret)
+        raise NotImplementedError
+      end
+
+      ##
+      # Transform and store the given secret attribute => value
+      # pair used for safely storing the attribute
+      # @param resource The model instance being modified
+      # @param attribute The secret attribute
+      # @param plain_secret The plain secret input / generated
+      def self.store_secret(resource, attribute, plain_secret)
+        transformed_value = transform_secret(plain_secret)
+        resource.public_send(:"#{attribute}=", transformed_value)
+
+        transformed_value
+      end
+
+      ##
+      # Return the restored value from the database
+      # @param resource The resource instance to act on
+      # @param attribute The secret attribute to restore
+      # as retrieved from the database.
+      def self.restore_secret(_resource, _attribute)
+        raise NotImplementedError
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+
+      ##
+      # Determines what secrets this strategy is applicable for
+      def self.validate_for(model)
+        valid = %i[token application]
+        return true if valid.include?(model.to_sym)
+
+        raise ArgumentError, "'#{name}' can not be used for #{model}."
+      end
+
+      ##
+      # Securely compare the given +input+ value with a +stored+ value
+      # processed by +transform_secret+.
+      def self.secret_matches?(input, stored)
+        transformed_input = transform_secret(input)
+        ActiveSupport::SecurityUtils.secure_compare transformed_input, stored
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/bcrypt.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class BCrypt < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        ::BCrypt::Password.create(plain_secret.to_s)
+      end
+
+      ##
+      # Securely compare the given +input+ value with a +stored+ value
+      # processed by +transform_secret+.
+      def self.secret_matches?(input, stored)
+        ::BCrypt::Password.new(stored.to_s) == input.to_s
+      rescue ::BCrypt::Errors::InvalidHash
+        false
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+
+      ##
+      # Determines what secrets this strategy is applicable for
+      def self.validate_for(model)
+        unless model.to_sym == :application
+          raise ArgumentError,
+                "'#{name}' can only be used for storing application secrets."
+        end
+
+        unless bcrypt_present?
+          raise ArgumentError,
+                "'#{name}' requires the 'bcrypt' gem being loaded."
+        end
+
+        true
+      end
+
+      ##
+      # Test if we can require the BCrypt gem
+      def self.bcrypt_present?
+        require "bcrypt"
+        true
+      rescue LoadError
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/plain.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class Plain < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        plain_secret
+      end
+
+      ##
+      # Return the restored value from the database
+      # @param resource The resource instance to act on
+      # @param attribute The secret attribute to restore
+      # as retrieved from the database.
+      def self.restore_secret(resource, attribute)
+        resource.public_send(attribute)
+      end
+
+      ##
+      # Plain values obviously allow restoring
+      def self.allows_restoring_secrets?
+        true
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/sha256_hash.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class Sha256Hash < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        ::Digest::SHA256.hexdigest plain_secret
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/stale_records_cleaner.rb

@@ -2,7 +2,7 @@
 
 module Doorkeeper
   class StaleRecordsCleaner
-    CLEANER_CLASS = 'StaleRecordsCleaner'.freeze
+    CLEANER_CLASS = "StaleRecordsCleaner"
 
     def self.for(base_scope)
       orm_adapter = "doorkeeper/orm/#{Doorkeeper.configuration.orm}".classify

data/lib/doorkeeper/version.rb

@@ -8,11 +8,11 @@ module Doorkeeper
   module VERSION
     # Semantic versioning
     MAJOR = 5
-    MINOR = 0
-    TINY = 2
+    MINOR = 1
+    TINY = 0
     PRE = nil
 
     # Full version number
-    STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
+    STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
 end

data/lib/doorkeeper.rb

@@ -1,75 +1,84 @@
-require 'doorkeeper/version'
-require 'doorkeeper/engine'
-require 'doorkeeper/config'
+# frozen_string_literal: true
 
-require 'doorkeeper/request/strategy'
-require 'doorkeeper/request/authorization_code'
-require 'doorkeeper/request/client_credentials'
-require 'doorkeeper/request/code'
-require 'doorkeeper/request/password'
-require 'doorkeeper/request/refresh_token'
-require 'doorkeeper/request/token'
+require "doorkeeper/version"
+require "doorkeeper/engine"
+require "doorkeeper/config"
 
-require 'doorkeeper/errors'
-require 'doorkeeper/server'
-require 'doorkeeper/request'
-require 'doorkeeper/validations'
+require "doorkeeper/request/strategy"
+require "doorkeeper/request/authorization_code"
+require "doorkeeper/request/client_credentials"
+require "doorkeeper/request/code"
+require "doorkeeper/request/password"
+require "doorkeeper/request/refresh_token"
+require "doorkeeper/request/token"
 
-require 'doorkeeper/oauth/authorization/code'
-require 'doorkeeper/oauth/authorization/context'
-require 'doorkeeper/oauth/authorization/token'
-require 'doorkeeper/oauth/authorization/uri_builder'
-require 'doorkeeper/oauth/helpers/scope_checker'
-require 'doorkeeper/oauth/helpers/uri_checker'
-require 'doorkeeper/oauth/helpers/unique_token'
+require "doorkeeper/errors"
+require "doorkeeper/server"
+require "doorkeeper/request"
+require "doorkeeper/validations"
 
-require 'doorkeeper/oauth'
-require 'doorkeeper/oauth/scopes'
-require 'doorkeeper/oauth/error'
-require 'doorkeeper/oauth/base_response'
-require 'doorkeeper/oauth/code_response'
-require 'doorkeeper/oauth/token_response'
-require 'doorkeeper/oauth/error_response'
-require 'doorkeeper/oauth/pre_authorization'
-require 'doorkeeper/oauth/base_request'
-require 'doorkeeper/oauth/authorization_code_request'
-require 'doorkeeper/oauth/refresh_token_request'
-require 'doorkeeper/oauth/password_access_token_request'
+require "doorkeeper/oauth/authorization/code"
+require "doorkeeper/oauth/authorization/context"
+require "doorkeeper/oauth/authorization/token"
+require "doorkeeper/oauth/authorization/uri_builder"
+require "doorkeeper/oauth/helpers/scope_checker"
+require "doorkeeper/oauth/helpers/uri_checker"
+require "doorkeeper/oauth/helpers/unique_token"
 
-require 'doorkeeper/oauth/client_credentials/validation'
-require 'doorkeeper/oauth/client_credentials/creator'
-require 'doorkeeper/oauth/client_credentials/issuer'
-require 'doorkeeper/oauth/client_credentials/validation'
-require 'doorkeeper/oauth/client/credentials'
+require "doorkeeper/oauth"
+require "doorkeeper/oauth/scopes"
+require "doorkeeper/oauth/error"
+require "doorkeeper/oauth/base_response"
+require "doorkeeper/oauth/code_response"
+require "doorkeeper/oauth/token_response"
+require "doorkeeper/oauth/error_response"
+require "doorkeeper/oauth/pre_authorization"
+require "doorkeeper/oauth/base_request"
+require "doorkeeper/oauth/authorization_code_request"
+require "doorkeeper/oauth/refresh_token_request"
+require "doorkeeper/oauth/password_access_token_request"
 
-require 'doorkeeper/oauth/client_credentials_request'
-require 'doorkeeper/oauth/code_request'
-require 'doorkeeper/oauth/token_request'
-require 'doorkeeper/oauth/client'
-require 'doorkeeper/oauth/token'
-require 'doorkeeper/oauth/token_introspection'
-require 'doorkeeper/oauth/invalid_token_response'
-require 'doorkeeper/oauth/forbidden_token_response'
+require "doorkeeper/oauth/client_credentials/validation"
+require "doorkeeper/oauth/client_credentials/creator"
+require "doorkeeper/oauth/client_credentials/issuer"
+require "doorkeeper/oauth/client_credentials/validation"
+require "doorkeeper/oauth/client/credentials"
 
-require 'doorkeeper/models/concerns/orderable'
-require 'doorkeeper/models/concerns/scopes'
-require 'doorkeeper/models/concerns/expirable'
-require 'doorkeeper/models/concerns/revocable'
-require 'doorkeeper/models/concerns/accessible'
+require "doorkeeper/oauth/client_credentials_request"
+require "doorkeeper/oauth/code_request"
+require "doorkeeper/oauth/token_request"
+require "doorkeeper/oauth/client"
+require "doorkeeper/oauth/token"
+require "doorkeeper/oauth/token_introspection"
+require "doorkeeper/oauth/invalid_token_response"
+require "doorkeeper/oauth/forbidden_token_response"
 
-require 'doorkeeper/models/access_grant_mixin'
-require 'doorkeeper/models/access_token_mixin'
-require 'doorkeeper/models/application_mixin'
+require "doorkeeper/secret_storing/base"
+require "doorkeeper/secret_storing/plain"
+require "doorkeeper/secret_storing/sha256_hash"
+require "doorkeeper/secret_storing/bcrypt"
 
-require 'doorkeeper/helpers/controller'
+require "doorkeeper/models/concerns/orderable"
+require "doorkeeper/models/concerns/scopes"
+require "doorkeeper/models/concerns/expirable"
+require "doorkeeper/models/concerns/reusable"
+require "doorkeeper/models/concerns/revocable"
+require "doorkeeper/models/concerns/accessible"
+require "doorkeeper/models/concerns/secret_storable"
 
-require 'doorkeeper/rails/routes'
-require 'doorkeeper/rails/helpers'
+require "doorkeeper/models/access_grant_mixin"
+require "doorkeeper/models/access_token_mixin"
+require "doorkeeper/models/application_mixin"
 
-require 'doorkeeper/rake'
-require 'doorkeeper/stale_records_cleaner'
+require "doorkeeper/helpers/controller"
 
-require 'doorkeeper/orm/active_record'
+require "doorkeeper/rails/routes"
+require "doorkeeper/rails/helpers"
+
+require "doorkeeper/rake"
+require "doorkeeper/stale_records_cleaner"
+
+require "doorkeeper/orm/active_record"
 
 module Doorkeeper
   def self.authenticate(request, methods = Doorkeeper.configuration.access_token_methods)

data/lib/generators/doorkeeper/application_owner_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration to add reference to owner of the
+  # Doorkeeper application.
+  #
   class ApplicationOwnerGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Provide support for client application ownership.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Provide support for client application ownership."
 
     def application_owner
       migration_template(
-        'add_owner_to_application_migration.rb.erb',
-        'db/migrate/add_owner_to_application.rb',
+        "add_owner_to_application_migration.rb.erb",
+        "db/migrate/add_owner_to_application.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +27,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end