doorkeeper 5.0.3 → 5.1.0

data/spec/lib/oauth/token_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper
   unless defined?(AccessToken)
@@ -12,108 +14,122 @@ module Doorkeeper
         let(:request) { double.as_null_object }
 
         let(:method) do
-          ->(*) { 'token-value' }
+          ->(*) { "token-value" }
         end
 
-        it 'accepts anything that responds to #call' do
+        it "accepts anything that responds to #call" do
           expect(method).to receive(:call).with(request)
           Token.from_request request, method
         end
 
-        it 'delegates methods received as symbols to Token class' do
+        it "delegates methods received as symbols to Token class" do
           expect(Token).to receive(:from_params).with(request)
           Token.from_request request, :from_params
         end
 
-        it 'stops at the first credentials found' do
+        it "stops at the first credentials found" do
           not_called_method = double
           expect(not_called_method).not_to receive(:call)
           Token.from_request request, ->(_r) {}, method, not_called_method
         end
 
-        it 'returns the credential from extractor method' do
+        it "returns the credential from extractor method" do
           credentials = Token.from_request request, method
-          expect(credentials).to eq('token-value')
+          expect(credentials).to eq("token-value")
         end
       end
 
       describe :from_access_token_param do
-        it 'returns token from access_token parameter' do
-          request = double parameters: { access_token: 'some-token' }
+        it "returns token from access_token parameter" do
+          request = double parameters: { access_token: "some-token" }
           token   = Token.from_access_token_param(request)
-          expect(token).to eq('some-token')
+          expect(token).to eq("some-token")
         end
       end
 
       describe :from_bearer_param do
-        it 'returns token from bearer_token parameter' do
-          request = double parameters: { bearer_token: 'some-token' }
+        it "returns token from bearer_token parameter" do
+          request = double parameters: { bearer_token: "some-token" }
           token   = Token.from_bearer_param(request)
-          expect(token).to eq('some-token')
+          expect(token).to eq("some-token")
         end
       end
 
       describe :from_bearer_authorization do
-        it 'returns token from capitalized authorization bearer' do
-          request = double authorization: 'Bearer SomeToken'
+        it "returns token from capitalized authorization bearer" do
+          request = double authorization: "Bearer SomeToken"
           token   = Token.from_bearer_authorization(request)
-          expect(token).to eq('SomeToken')
+          expect(token).to eq("SomeToken")
         end
 
-        it 'returns token from lowercased authorization bearer' do
-          request = double authorization: 'bearer SomeToken'
+        it "returns token from lowercased authorization bearer" do
+          request = double authorization: "bearer SomeToken"
           token   = Token.from_bearer_authorization(request)
-          expect(token).to eq('SomeToken')
+          expect(token).to eq("SomeToken")
         end
 
-        it 'does not return token if authorization is not bearer' do
-          request = double authorization: 'MAC SomeToken'
+        it "does not return token if authorization is not bearer" do
+          request = double authorization: "MAC SomeToken"
           token   = Token.from_bearer_authorization(request)
           expect(token).to be_blank
         end
       end
 
       describe :from_basic_authorization do
-        it 'returns token from capitalized authorization basic' do
-          request = double authorization: "Basic #{Base64.encode64 'SomeToken:'}"
+        it "returns token from capitalized authorization basic" do
+          request = double authorization: "Basic #{Base64.encode64 "SomeToken:"}"
           token   = Token.from_basic_authorization(request)
-          expect(token).to eq('SomeToken')
+          expect(token).to eq("SomeToken")
         end
 
-        it 'returns token from lowercased authorization basic' do
-          request = double authorization: "basic #{Base64.encode64 'SomeToken:'}"
+        it "returns token from lowercased authorization basic" do
+          request = double authorization: "basic #{Base64.encode64 "SomeToken:"}"
           token   = Token.from_basic_authorization(request)
-          expect(token).to eq('SomeToken')
+          expect(token).to eq("SomeToken")
         end
 
-        it 'does not return token if authorization is not basic' do
-          request = double authorization: "MAC #{Base64.encode64 'SomeToken:'}"
+        it "does not return token if authorization is not basic" do
+          request = double authorization: "MAC #{Base64.encode64 "SomeToken:"}"
           token   = Token.from_basic_authorization(request)
           expect(token).to be_blank
         end
       end
 
       describe :authenticate do
-        context 'refresh tokens are disabled (default)' do
-          context 'refresh tokens are enabled' do
-            it 'does not revoke previous refresh_token if token was found' do
-              token = ->(_r) { 'token' }
+        context "refresh tokens are disabled (default)" do
+          context "refresh tokens are enabled" do
+            it "does not revoke previous refresh_token if token was found" do
+              token = ->(_r) { "token" }
               expect(
                 AccessToken
-              ).to receive(:by_token).with('token').and_return(token)
+              ).to receive(:by_token).with("token").and_return(token)
               expect(token).not_to receive(:revoke_previous_refresh_token!)
               Token.authenticate double, token
             end
           end
 
-          it 'calls the finder if token was returned' do
-            token = ->(_r) { 'token' }
-            expect(AccessToken).to receive(:by_token).with('token')
+          it "calls the finder if token was returned" do
+            token = ->(_r) { "token" }
+            expect(AccessToken).to receive(:by_token).with("token")
+            Token.authenticate double, token
+          end
+        end
+
+        context "token hashing is enabled" do
+          include_context "with token hashing enabled"
+
+          let(:hashed_token) { hashed_or_plain_token_func.call("token") }
+          let(:token) { ->(_r) { "token" } }
+
+          it "searches with the hashed token" do
+            expect(
+              AccessToken
+            ).to receive(:find_by).with(token: hashed_token).and_return(token)
             Token.authenticate double, token
           end
         end
 
-        context 'refresh tokens are enabled' do
+        context "refresh tokens are enabled" do
           before do
             Doorkeeper.configure do
               orm DOORKEEPER_ORM
@@ -121,18 +137,18 @@ module Doorkeeper
             end
           end
 
-          it 'revokes previous refresh_token if token was found' do
-            token = ->(_r) { 'token' }
+          it "revokes previous refresh_token if token was found" do
+            token = ->(_r) { "token" }
             expect(
               AccessToken
-            ).to receive(:by_token).with('token').and_return(token)
+            ).to receive(:by_token).with("token").and_return(token)
             expect(token).to receive(:revoke_previous_refresh_token!)
             Token.authenticate double, token
           end
 
-          it 'calls the finder if token was returned' do
-            token = ->(_r) { 'token' }
-            expect(AccessToken).to receive(:by_token).with('token')
+          it "calls the finder if token was returned" do
+            token = ->(_r) { "token" }
+            expect(AccessToken).to receive(:by_token).with("token")
             Token.authenticate double, token
           end
         end

data/spec/lib/request/strategy_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 module Doorkeeper
   module Request

data/spec/lib/secret_storing/base_spec.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+describe ::Doorkeeper::SecretStoring::Base do
+  let(:instance) { double("instance", token: "foo") }
+  subject { described_class }
+
+  describe "#transform_secret" do
+    it "raises" do
+      expect { subject.transform_secret("foo") }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe "#store_secret" do
+    it "sends to response of #transform_secret to the instance" do
+      expect(described_class)
+        .to receive(:transform_secret).with("bar")
+        .and_return "bar+transform"
+
+      expect(instance).to receive(:token=).with "bar+transform"
+      result = subject.store_secret instance, :token, "bar"
+      expect(result).to eq "bar+transform"
+    end
+  end
+
+  describe "#restore_secret" do
+    it "raises" do
+      expect { subject.restore_secret(subject, :token) }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe "#allows_restoring_secrets?" do
+    it "does not allow it" do
+      expect(subject.allows_restoring_secrets?).to eq false
+    end
+  end
+
+  describe "validate_for" do
+    it "allows for valid model" do
+      expect(subject.validate_for(:application)).to eq true
+      expect(subject.validate_for(:token)).to eq true
+    end
+
+    it "raises for invalid model" do
+      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
+    end
+  end
+
+  describe "secret_matches?" do
+    before do
+      allow(subject).to receive(:transform_secret) { |input| "transformed: #{input}" }
+    end
+
+    it "compares input with #transform_secret" do
+      expect(subject.secret_matches?("input", "input")).to eq false
+      expect(subject.secret_matches?("a", "transformed: a")).to eq true
+    end
+  end
+end

data/spec/lib/secret_storing/bcrypt_spec.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+require "bcrypt"
+
+describe ::Doorkeeper::SecretStoring::BCrypt do
+  subject { described_class }
+  let(:instance) { double("instance", token: "foo") }
+
+  describe "#transform_secret" do
+    it "creates a bcrypt password" do
+      expect(subject.transform_secret("foo")).to be_a BCrypt::Password
+    end
+  end
+
+  describe "#restore_secret" do
+    it "raises" do
+      expect { subject.restore_secret(instance, :token) }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe "#allows_restoring_secrets?" do
+    it "does not allow it" do
+      expect(subject.allows_restoring_secrets?).to eq false
+    end
+  end
+
+  describe "validate_for" do
+    it "allows for valid model" do
+      expect(subject.validate_for(:application)).to eq true
+    end
+
+    it "raises for invalid model" do
+      expect { subject.validate_for(:wat) }
+        .to raise_error(ArgumentError, /can only be used for storing application secrets/)
+      expect { subject.validate_for(:token) }
+        .to raise_error(ArgumentError, /can only be used for storing application secrets/)
+    end
+  end
+
+  describe "secret_matches?" do
+    it "compares input with #transform_secret" do
+      expect(subject.secret_matches?("input", "input")).to eq false
+
+      password = BCrypt::Password.create "foobar"
+      expect(subject.secret_matches?("foobar", password.to_s)).to eq true
+    end
+  end
+end

data/spec/lib/secret_storing/plain_spec.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+describe ::Doorkeeper::SecretStoring::Plain do
+  subject { described_class }
+  let(:instance) { double("instance", token: "foo") }
+
+  describe "#transform_secret" do
+    it "raises" do
+      expect(subject.transform_secret("foo")).to eq "foo"
+    end
+  end
+
+  describe "#restore_secret" do
+    it "raises" do
+      expect(subject.restore_secret(instance, :token)).to eq "foo"
+    end
+  end
+
+  describe "#allows_restoring_secrets?" do
+    it "does allow it" do
+      expect(subject.allows_restoring_secrets?).to eq true
+    end
+  end
+
+  describe "validate_for" do
+    it "allows for valid model" do
+      expect(subject.validate_for(:application)).to eq true
+      expect(subject.validate_for(:token)).to eq true
+    end
+
+    it "raises for invalid model" do
+      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
+    end
+  end
+
+  describe "secret_matches?" do
+    it "compares input with #transform_secret" do
+      expect(subject.secret_matches?("input", "input")).to eq true
+      expect(subject.secret_matches?("a", "b")).to eq false
+    end
+  end
+end

data/spec/lib/secret_storing/sha256_hash_spec.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+describe ::Doorkeeper::SecretStoring::Sha256Hash do
+  subject { described_class }
+  let(:instance) { double("instance") }
+
+  let(:hash_function) do
+    ->(input) { ::Digest::SHA256.hexdigest(input) }
+  end
+
+  describe "#transform_secret" do
+    it "raises" do
+      expect(subject.transform_secret("foo")).to eq hash_function.call("foo")
+    end
+  end
+
+  describe "#restore_secret" do
+    it "raises" do
+      expect { subject.restore_secret(instance, :token) }.to raise_error(NotImplementedError)
+    end
+  end
+
+  describe "#allows_restoring_secrets?" do
+    it "does not allow it" do
+      expect(subject.allows_restoring_secrets?).to eq false
+    end
+  end
+
+  describe "validate_for" do
+    it "allows for valid model" do
+      expect(subject.validate_for(:application)).to eq true
+      expect(subject.validate_for(:token)).to eq true
+    end
+
+    it "raises for invalid model" do
+      expect { subject.validate_for(:wat) }.to raise_error(ArgumentError, /can not be used for wat/)
+    end
+  end
+
+  describe "secret_matches?" do
+    it "compares input with #transform_secret" do
+      expect(subject.secret_matches?("input", "input")).to eq false
+      expect(subject.secret_matches?("a", hash_function.call("a"))).to eq true
+    end
+  end
+end

data/spec/lib/server_spec.rb

@@ -1,4 +1,6 @@
-require 'spec_helper'
+# frozen_string_literal: true
+
+require "spec_helper"
 
 describe Doorkeeper::Server do
   let(:fake_class) { double :fake_class }
@@ -7,53 +9,53 @@ describe Doorkeeper::Server do
     described_class.new
   end
 
-  describe '.authorization_request' do
-    it 'raises error when strategy does not exist' do
+  describe ".authorization_request" do
+    it "raises error when strategy does not exist" do
       expect do
         subject.authorization_request(:duh)
       end.to raise_error(Doorkeeper::Errors::InvalidAuthorizationStrategy)
     end
 
-    it 'raises error when strategy does not match phase' do
+    it "raises error when strategy does not match phase" do
       expect do
         subject.token_request(:code)
       end.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
     end
 
-    context 'when only Authorization Code strategy is enabled' do
+    context "when only Authorization Code strategy is enabled" do
       before do
         allow(Doorkeeper.configuration)
           .to receive(:grant_flows)
-          .and_return(['authorization_code'])
+          .and_return(["authorization_code"])
       end
 
-      it 'raises error when using the disabled Implicit strategy' do
+      it "raises error when using the disabled Implicit strategy" do
         expect do
           subject.authorization_request(:token)
         end.to raise_error(Doorkeeper::Errors::InvalidAuthorizationStrategy)
       end
 
-      it 'raises error when using the disabled Client Credentials strategy' do
+      it "raises error when using the disabled Client Credentials strategy" do
         expect do
           subject.token_request(:client_credentials)
         end.to raise_error(Doorkeeper::Errors::InvalidTokenStrategy)
       end
     end
 
-    it 'builds the request with selected strategy' do
-      stub_const 'Doorkeeper::Request::Code', fake_class
+    it "builds the request with selected strategy" do
+      stub_const "Doorkeeper::Request::Code", fake_class
       expect(fake_class).to receive(:new).with(subject)
       subject.authorization_request :code
     end
 
-    it 'builds the request with composite strategy name' do
+    it "builds the request with composite strategy name" do
       allow(Doorkeeper.configuration)
         .to receive(:authorization_response_types)
-        .and_return(['id_token token'])
+        .and_return(["id_token token"])
 
-      stub_const 'Doorkeeper::Request::IdTokenToken', fake_class
+      stub_const "Doorkeeper::Request::IdTokenToken", fake_class
       expect(fake_class).to receive(:new).with(subject)
-      subject.authorization_request 'id_token token'
+      subject.authorization_request "id_token token"
     end
   end
 end

data/spec/lib/stale_records_cleaner_spec.rb

@@ -1,19 +1,19 @@
 # frozen_string_literal: true
 
-require 'spec_helper'
+require "spec_helper"
 
 describe Doorkeeper::StaleRecordsCleaner do
   let(:cleaner) { described_class.new(model) }
   let(:models_by_name) do
     {
       access_token: Doorkeeper::AccessToken,
-      access_grant: Doorkeeper::AccessGrant
+      access_grant: Doorkeeper::AccessGrant,
     }
   end
 
-  context 'when ORM has no cleaner class' do
-    it 'raises an error' do
-      allow_any_instance_of(Doorkeeper::Config).to receive(:orm).and_return('hibernate')
+  context "when ORM has no cleaner class" do
+    it "raises an error" do
+      allow_any_instance_of(Doorkeeper::Config).to receive(:orm).and_return("hibernate")
 
       expect do
         described_class.for(Doorkeeper::AccessToken)
@@ -25,61 +25,61 @@ describe Doorkeeper::StaleRecordsCleaner do
     context "(#{model_name})" do
       let(:model) { models_by_name.fetch(model_name) }
 
-      describe '#clean_revoked' do
+      describe "#clean_revoked" do
         subject { cleaner.clean_revoked }
 
-        context 'with revoked record' do
+        context "with revoked record" do
           before do
             FactoryBot.create model_name, revoked_at: Time.current - 1.minute
           end
 
-          it 'removes the record' do
+          it "removes the record" do
             expect { subject }.to change { model.count }.to(0)
           end
         end
 
-        context 'with record revoked in the future' do
+        context "with record revoked in the future" do
           before do
             FactoryBot.create model_name, revoked_at: Time.current + 1.minute
           end
 
-          it 'keeps the record' do
+          it "keeps the record" do
             expect { subject }.not_to(change { model.count })
           end
         end
 
-        context 'with unrevoked record' do
+        context "with unrevoked record" do
           before do
             FactoryBot.create model_name, revoked_at: nil
           end
 
-          it 'keeps the record' do
+          it "keeps the record" do
             expect { subject }.not_to(change { model.count })
           end
         end
       end
 
-      describe '#clean_expired' do
+      describe "#clean_expired" do
         subject { cleaner.clean_expired(ttl) }
         let(:ttl) { 500 }
         let(:expiry_border) { ttl.seconds.ago }
 
-        context 'with record that is expired' do
+        context "with record that is expired" do
           before do
             FactoryBot.create model_name, created_at: expiry_border - 1.minute
           end
 
-          it 'removes the record' do
+          it "removes the record" do
             expect { subject }.to change { model.count }.to(0)
           end
         end
 
-        context 'with record that is not expired' do
+        context "with record that is not expired" do
           before do
             FactoryBot.create model_name, created_at: expiry_border + 1.minute
           end
 
-          it 'keeps the record' do
+          it "keeps the record" do
             expect { subject }.not_to(change { model.count })
           end
         end