doorkeeper 5.0.3 → 5.1.0

data/lib/doorkeeper/orm/active_record/application.rb

@@ -1,12 +1,13 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   class Application < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}".to_sym
+    self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}"
 
     include ApplicationMixin
-    include ActiveModel::MassAssignmentSecurity if defined?(::ProtectedAttributes)
 
-    has_many :access_grants, dependent: :delete_all, class_name: 'Doorkeeper::AccessGrant'
-    has_many :access_tokens, dependent: :delete_all, class_name: 'Doorkeeper::AccessToken'
+    has_many :access_grants, dependent: :delete_all, class_name: "Doorkeeper::AccessGrant"
+    has_many :access_tokens, dependent: :delete_all, class_name: "Doorkeeper::AccessToken"
 
     validates :name, :secret, :uid, presence: true
     validates :uid, uniqueness: true
@@ -17,7 +18,7 @@ module Doorkeeper
 
     before_validation :generate_uid, :generate_secret, on: :create
 
-    has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: 'AccessToken'
+    has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: "AccessToken"
     has_many :authorized_applications, through: :authorized_tokens, source: :application
 
     # Returns Applications associated with active (not revoked) Access Tokens
@@ -45,26 +46,17 @@ module Doorkeeper
       AccessGrant.revoke_all_for(id, resource_owner)
     end
 
-    # Represents client as set of it's attributes in JSON format.
-    # This is the right way how we want to override ActiveRecord #to_json.
-    #
-    # Respects privacy settings and serializes minimum set of attributes
-    # for public/private clients and full set for authorized owners.
-    #
-    # @return [Hash] entity attributes for JSON
+    # We keep a volatile copy of the raw secret for initial communication
+    # The stored refresh_token may be mapped and not available in cleartext.
     #
-    def as_json(options = {})
-      # if application belongs to some owner we need to check if it's the same as
-      # the one passed in the options or check if we render the client as an owner
-      if (respond_to?(:owner) && owner && owner == options[:current_resource_owner]) ||
-         options[:as_owner]
-        # Owners can see all the client attributes, fallback to ActiveModel serialization
-        super
+    # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+    # while hashing strategies do not, so you cannot rely on this value
+    # returning a present value for persisted tokens.
+    def plaintext_secret
+      if secret_strategy.allows_restoring_secrets?
+        secret_strategy.restore_secret(self, :secret)
       else
-        # if application has no owner or it's owner doesn't match one from the options
-        # we render only minimum set of attributes that could be exposed to a public
-        only = extract_serializable_attributes(options)
-        super(options.merge(only: only))
+        @raw_secret
       end
     end
 
@@ -75,12 +67,16 @@ module Doorkeeper
     end
 
     def generate_secret
-      self.secret = UniqueToken.generate if secret.blank?
+      return unless secret.blank?
+
+      @raw_secret = UniqueToken.generate
+      secret_strategy.store_secret(self, :secret, @raw_secret)
     end
 
     def scopes_match_configured
       if scopes.present? &&
-         !ScopeChecker.valid?(scopes.to_s, Doorkeeper.configuration.scopes)
+         !ScopeChecker.valid?(scope_str: scopes.to_s,
+                              server_scopes: Doorkeeper.configuration.scopes)
         errors.add(:scopes, :not_match_configured)
       end
     end
@@ -88,37 +84,5 @@ module Doorkeeper
     def enforce_scopes?
       Doorkeeper.configuration.enforce_configured_scopes?
     end
-
-    # Helper method to extract collection of serializable attribute names
-     # considering serialization options (like `only`, `except` and so on).
-     #
-     # @param options [Hash] serialization options
-     #
-     # @return [Array<String>]
-     #   collection of attributes to be serialized using #as_json
-     #
-     def extract_serializable_attributes(options = {})
-       opts = options.try(:dup) || {}
-       only = Array.wrap(opts[:only]).map(&:to_s)
-
-       only = if only.blank?
-                serializable_attributes
-              else
-                only & serializable_attributes
-              end
-
-       only -= Array.wrap(opts[:except]).map(&:to_s) if opts.key?(:except)
-       only.uniq
-     end
-
-     # Collection of attributes that could be serialized for public.
-     # Override this method if you need additional attributes to be serialized.
-     #
-     # @return [Array<String>] collection of serializable attributes
-     def serializable_attributes
-       attributes = %w[id name created_at]
-       attributes << "uid" unless confidential?
-       attributes
-     end
   end
 end

data/lib/doorkeeper/orm/active_record/stale_records_cleaner.rb

@@ -3,22 +3,29 @@
 module Doorkeeper
   module Orm
     module ActiveRecord
+      # Helper class to clear stale and non-active tokens and grants.
+      # Used by Doorkeeper Rake tasks.
+      #
       class StaleRecordsCleaner
         def initialize(base_scope)
           @base_scope = base_scope
         end
 
+        # Clears revoked records
         def clean_revoked
           table = @base_scope.arel_table
+
           @base_scope.where.not(revoked_at: nil)
-                     .where(table[:revoked_at].lt(Time.current))
-                     .delete_all
+            .where(table[:revoked_at].lt(Time.current))
+            .in_batches(&:delete_all)
         end
 
+        # Clears expired records
         def clean_expired(ttl)
           table = @base_scope.arel_table
+
           @base_scope.where(table[:created_at].lt(Time.current - ttl))
-                     .delete_all
+            .in_batches(&:delete_all)
         end
       end
     end

data/lib/doorkeeper/orm/active_record.rb

@@ -1,17 +1,17 @@
 # frozen_string_literal: true
 
-require 'active_support/lazy_load_hooks'
+require "active_support/lazy_load_hooks"
 
-require 'doorkeeper/orm/active_record/stale_records_cleaner'
+require "doorkeeper/orm/active_record/stale_records_cleaner"
 
 module Doorkeeper
   module Orm
     module ActiveRecord
       def self.initialize_models!
         lazy_load do
-          require 'doorkeeper/orm/active_record/access_grant'
-          require 'doorkeeper/orm/active_record/access_token'
-          require 'doorkeeper/orm/active_record/application'
+          require "doorkeeper/orm/active_record/access_grant"
+          require "doorkeeper/orm/active_record/access_token"
+          require "doorkeeper/orm/active_record/application"
 
           if Doorkeeper.configuration.active_record_options[:establish_connection]
             [Doorkeeper::AccessGrant, Doorkeeper::AccessToken, Doorkeeper::Application].each do |model|
@@ -24,7 +24,7 @@ module Doorkeeper
 
       def self.initialize_application_owner!
         lazy_load do
-          require 'doorkeeper/models/concerns/ownership'
+          require "doorkeeper/models/concerns/ownership"
 
           Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
         end

data/lib/doorkeeper/rails/helpers.rb

@@ -14,7 +14,7 @@ module Doorkeeper
       def doorkeeper_forbidden_render_options(**); end
 
       def valid_doorkeeper_token?
-        doorkeeper_token && doorkeeper_token.acceptable?(@_doorkeeper_scopes)
+        doorkeeper_token&.acceptable?(@_doorkeeper_scopes)
       end
 
       private

data/lib/doorkeeper/rails/routes/mapping.rb

@@ -8,17 +8,17 @@ module Doorkeeper
 
         def initialize
           @controllers = {
-            authorizations: 'doorkeeper/authorizations',
-            applications: 'doorkeeper/applications',
-            authorized_applications: 'doorkeeper/authorized_applications',
-            tokens: 'doorkeeper/tokens',
-            token_info: 'doorkeeper/token_info'
+            authorizations: "doorkeeper/authorizations",
+            applications: "doorkeeper/applications",
+            authorized_applications: "doorkeeper/authorized_applications",
+            tokens: "doorkeeper/tokens",
+            token_info: "doorkeeper/token_info",
           }
 
           @as = {
             authorizations: :authorization,
             tokens: :token,
-            token_info: :token_info
+            token_info: :token_info,
           }
 
           @skips = []
@@ -27,7 +27,7 @@ module Doorkeeper
         def [](routes)
           {
             controllers: @controllers[routes],
-            as: @as[routes]
+            as: @as[routes],
           }
         end
 

data/lib/doorkeeper/rails/routes.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require 'doorkeeper/rails/routes/mapping'
-require 'doorkeeper/rails/routes/mapper'
+require "doorkeeper/rails/routes/mapping"
+require "doorkeeper/rails/routes/mapper"
 
 module Doorkeeper
   module Rails
@@ -32,7 +32,7 @@ module Doorkeeper
       end
 
       def generate_routes!(options)
-        routes.scope options[:scope] || 'oauth', as: 'oauth' do
+        routes.scope options[:scope] || "oauth", as: "oauth" do
           map_route(:authorizations, :authorization_routes)
           map_route(:tokens, :token_routes)
           map_route(:tokens, :revoke_routes)
@@ -56,37 +56,37 @@ module Doorkeeper
       def authorization_routes(mapping)
         routes.resource(
           :authorization,
-          path: 'authorize',
+          path: "authorize",
           only: %i[create destroy],
           as: mapping[:as],
           controller: mapping[:controllers]
         ) do
-          routes.get '/native', action: :show, on: :member
-          routes.get '/', action: :new, on: :member
+          routes.get "/native", action: :show, on: :member
+          routes.get "/", action: :new, on: :member
         end
       end
 
       def token_routes(mapping)
         routes.resource(
           :token,
-          path: 'token',
+          path: "token",
           only: [:create], as: mapping[:as],
           controller: mapping[:controllers]
         )
       end
 
       def revoke_routes(mapping)
-        routes.post 'revoke', controller: mapping[:controllers], action: :revoke
+        routes.post "revoke", controller: mapping[:controllers], action: :revoke
       end
 
       def introspect_routes(mapping)
-        routes.post 'introspect', controller: mapping[:controllers], action: :introspect
+        routes.post "introspect", controller: mapping[:controllers], action: :introspect
       end
 
       def token_info_routes(mapping)
         routes.resource(
           :token_info,
-          path: 'token/info',
+          path: "token/info",
           only: [:show], as: mapping[:as],
           controller: mapping[:controllers]
         )
@@ -96,7 +96,7 @@ module Doorkeeper
         routes.resources :doorkeeper_applications,
                          controller: mapping[:controllers],
                          as: :applications,
-                         path: 'applications'
+                         path: "applications"
       end
 
       def authorized_applications_routes(mapping)

data/lib/doorkeeper/rake/db.rake

@@ -2,36 +2,36 @@
 
 namespace :doorkeeper do
   namespace :db do
-    desc 'Removes stale data from doorkeeper related database tables'
+    desc "Removes stale data from doorkeeper related database tables"
     task cleanup: [
-      'doorkeeper:db:cleanup:revoked_tokens',
-      'doorkeeper:db:cleanup:expired_tokens',
-      'doorkeeper:db:cleanup:revoked_grants',
-      'doorkeeper:db:cleanup:expired_grants'
+      "doorkeeper:db:cleanup:revoked_tokens",
+      "doorkeeper:db:cleanup:expired_tokens",
+      "doorkeeper:db:cleanup:revoked_grants",
+      "doorkeeper:db:cleanup:expired_grants",
     ]
 
     namespace :cleanup do
-      desc 'Removes stale access tokens'
-      task revoked_tokens: 'doorkeeper:setup' do
+      desc "Removes stale access tokens"
+      task revoked_tokens: "doorkeeper:setup" do
         cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessToken)
         cleaner.clean_revoked
       end
 
-      desc 'Removes expired (TTL passed) access tokens'
-      task expired_tokens: 'doorkeeper:setup' do
+      desc "Removes expired (TTL passed) access tokens"
+      task expired_tokens: "doorkeeper:setup" do
         expirable_tokens = Doorkeeper::AccessToken.where(refresh_token: nil)
         cleaner = Doorkeeper::StaleRecordsCleaner.new(expirable_tokens)
         cleaner.clean_expired(Doorkeeper.configuration.access_token_expires_in)
       end
 
-      desc 'Removes stale access grants'
-      task revoked_grants: 'doorkeeper:setup' do
+      desc "Removes stale access grants"
+      task revoked_grants: "doorkeeper:setup" do
         cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
         cleaner.clean_revoked
       end
 
-      desc 'Removes expired (TTL passed) access grants'
-      task expired_grants: 'doorkeeper:setup' do
+      desc "Removes expired (TTL passed) access grants"
+      task expired_grants: "doorkeeper:setup" do
         cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
         cleaner.clean_expired(Doorkeeper.configuration.authorization_code_expires_in)
       end

data/lib/doorkeeper/rake.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   module Rake
     class << self
       def load_tasks
-        glob = File.join(File.absolute_path(__dir__), 'rake', '*.rake')
+        glob = File.join(File.absolute_path(__dir__), "rake", "*.rake")
         Dir[glob].each do |rake_file|
           load rake_file
         end

data/lib/doorkeeper/request.rb

@@ -33,7 +33,7 @@ module Doorkeeper
       end
 
       def build_strategy_class(grant_or_request_type)
-        strategy_class_name = grant_or_request_type.to_s.tr(' ', '_').camelize
+        strategy_class_name = grant_or_request_type.to_s.tr(" ", "_").camelize
         "Doorkeeper::Request::#{strategy_class_name}".constantize
       end
     end

data/lib/doorkeeper/secret_storing/base.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Base class for secret storing, including common helpers
+    class Base
+      ##
+      # Return the value to be stored by the database
+      # used for looking up a database value.
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(_plain_secret)
+        raise NotImplementedError
+      end
+
+      ##
+      # Transform and store the given secret attribute => value
+      # pair used for safely storing the attribute
+      # @param resource The model instance being modified
+      # @param attribute The secret attribute
+      # @param plain_secret The plain secret input / generated
+      def self.store_secret(resource, attribute, plain_secret)
+        transformed_value = transform_secret(plain_secret)
+        resource.public_send(:"#{attribute}=", transformed_value)
+
+        transformed_value
+      end
+
+      ##
+      # Return the restored value from the database
+      # @param resource The resource instance to act on
+      # @param attribute The secret attribute to restore
+      # as retrieved from the database.
+      def self.restore_secret(_resource, _attribute)
+        raise NotImplementedError
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+
+      ##
+      # Determines what secrets this strategy is applicable for
+      def self.validate_for(model)
+        valid = %i[token application]
+        return true if valid.include?(model.to_sym)
+
+        raise ArgumentError, "'#{name}' can not be used for #{model}."
+      end
+
+      ##
+      # Securely compare the given +input+ value with a +stored+ value
+      # processed by +transform_secret+.
+      def self.secret_matches?(input, stored)
+        transformed_input = transform_secret(input)
+        ActiveSupport::SecurityUtils.secure_compare transformed_input, stored
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/bcrypt.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class BCrypt < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        ::BCrypt::Password.create(plain_secret.to_s)
+      end
+
+      ##
+      # Securely compare the given +input+ value with a +stored+ value
+      # processed by +transform_secret+.
+      def self.secret_matches?(input, stored)
+        ::BCrypt::Password.new(stored.to_s) == input.to_s
+      rescue ::BCrypt::Errors::InvalidHash
+        false
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+
+      ##
+      # Determines what secrets this strategy is applicable for
+      def self.validate_for(model)
+        unless model.to_sym == :application
+          raise ArgumentError,
+                "'#{name}' can only be used for storing application secrets."
+        end
+
+        unless bcrypt_present?
+          raise ArgumentError,
+                "'#{name}' requires the 'bcrypt' gem being loaded."
+        end
+
+        true
+      end
+
+      ##
+      # Test if we can require the BCrypt gem
+      def self.bcrypt_present?
+        require "bcrypt"
+        true
+      rescue LoadError
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/plain.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class Plain < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        plain_secret
+      end
+
+      ##
+      # Return the restored value from the database
+      # @param resource The resource instance to act on
+      # @param attribute The secret attribute to restore
+      # as retrieved from the database.
+      def self.restore_secret(resource, attribute)
+        resource.public_send(attribute)
+      end
+
+      ##
+      # Plain values obviously allow restoring
+      def self.allows_restoring_secrets?
+        true
+      end
+    end
+  end
+end

data/lib/doorkeeper/secret_storing/sha256_hash.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module SecretStoring
+    ##
+    # Plain text secret storing, which is the default
+    # but also provides fallback lookup if
+    # other secret storing mechanisms are enabled.
+    class Sha256Hash < Base
+      ##
+      # Return the value to be stored by the database
+      # @param plain_secret The plain secret input / generated
+      def self.transform_secret(plain_secret)
+        ::Digest::SHA256.hexdigest plain_secret
+      end
+
+      ##
+      # Determines whether this strategy supports restoring
+      # secrets from the database. This allows detecting users
+      # trying to use a non-restorable strategy with +reuse_access_tokens+.
+      def self.allows_restoring_secrets?
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/stale_records_cleaner.rb

@@ -2,7 +2,7 @@
 
 module Doorkeeper
   class StaleRecordsCleaner
-    CLEANER_CLASS = 'StaleRecordsCleaner'.freeze
+    CLEANER_CLASS = "StaleRecordsCleaner"
 
     def self.for(base_scope)
       orm_adapter = "doorkeeper/orm/#{Doorkeeper.configuration.orm}".classify

data/lib/doorkeeper/version.rb

@@ -8,11 +8,11 @@ module Doorkeeper
   module VERSION
     # Semantic versioning
     MAJOR = 5
-    MINOR = 0
-    TINY = 3
+    MINOR = 1
+    TINY = 0
     PRE = nil
 
     # Full version number
-    STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')
+    STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end
 end