doorkeeper 5.0.3 → 5.1.0

data/lib/doorkeeper.rb

@@ -1,75 +1,84 @@
-require 'doorkeeper/version'
-require 'doorkeeper/engine'
-require 'doorkeeper/config'
+# frozen_string_literal: true
 
-require 'doorkeeper/request/strategy'
-require 'doorkeeper/request/authorization_code'
-require 'doorkeeper/request/client_credentials'
-require 'doorkeeper/request/code'
-require 'doorkeeper/request/password'
-require 'doorkeeper/request/refresh_token'
-require 'doorkeeper/request/token'
+require "doorkeeper/version"
+require "doorkeeper/engine"
+require "doorkeeper/config"
 
-require 'doorkeeper/errors'
-require 'doorkeeper/server'
-require 'doorkeeper/request'
-require 'doorkeeper/validations'
+require "doorkeeper/request/strategy"
+require "doorkeeper/request/authorization_code"
+require "doorkeeper/request/client_credentials"
+require "doorkeeper/request/code"
+require "doorkeeper/request/password"
+require "doorkeeper/request/refresh_token"
+require "doorkeeper/request/token"
 
-require 'doorkeeper/oauth/authorization/code'
-require 'doorkeeper/oauth/authorization/context'
-require 'doorkeeper/oauth/authorization/token'
-require 'doorkeeper/oauth/authorization/uri_builder'
-require 'doorkeeper/oauth/helpers/scope_checker'
-require 'doorkeeper/oauth/helpers/uri_checker'
-require 'doorkeeper/oauth/helpers/unique_token'
+require "doorkeeper/errors"
+require "doorkeeper/server"
+require "doorkeeper/request"
+require "doorkeeper/validations"
 
-require 'doorkeeper/oauth'
-require 'doorkeeper/oauth/scopes'
-require 'doorkeeper/oauth/error'
-require 'doorkeeper/oauth/base_response'
-require 'doorkeeper/oauth/code_response'
-require 'doorkeeper/oauth/token_response'
-require 'doorkeeper/oauth/error_response'
-require 'doorkeeper/oauth/pre_authorization'
-require 'doorkeeper/oauth/base_request'
-require 'doorkeeper/oauth/authorization_code_request'
-require 'doorkeeper/oauth/refresh_token_request'
-require 'doorkeeper/oauth/password_access_token_request'
+require "doorkeeper/oauth/authorization/code"
+require "doorkeeper/oauth/authorization/context"
+require "doorkeeper/oauth/authorization/token"
+require "doorkeeper/oauth/authorization/uri_builder"
+require "doorkeeper/oauth/helpers/scope_checker"
+require "doorkeeper/oauth/helpers/uri_checker"
+require "doorkeeper/oauth/helpers/unique_token"
 
-require 'doorkeeper/oauth/client_credentials/validation'
-require 'doorkeeper/oauth/client_credentials/creator'
-require 'doorkeeper/oauth/client_credentials/issuer'
-require 'doorkeeper/oauth/client_credentials/validation'
-require 'doorkeeper/oauth/client/credentials'
+require "doorkeeper/oauth"
+require "doorkeeper/oauth/scopes"
+require "doorkeeper/oauth/error"
+require "doorkeeper/oauth/base_response"
+require "doorkeeper/oauth/code_response"
+require "doorkeeper/oauth/token_response"
+require "doorkeeper/oauth/error_response"
+require "doorkeeper/oauth/pre_authorization"
+require "doorkeeper/oauth/base_request"
+require "doorkeeper/oauth/authorization_code_request"
+require "doorkeeper/oauth/refresh_token_request"
+require "doorkeeper/oauth/password_access_token_request"
 
-require 'doorkeeper/oauth/client_credentials_request'
-require 'doorkeeper/oauth/code_request'
-require 'doorkeeper/oauth/token_request'
-require 'doorkeeper/oauth/client'
-require 'doorkeeper/oauth/token'
-require 'doorkeeper/oauth/token_introspection'
-require 'doorkeeper/oauth/invalid_token_response'
-require 'doorkeeper/oauth/forbidden_token_response'
+require "doorkeeper/oauth/client_credentials/validation"
+require "doorkeeper/oauth/client_credentials/creator"
+require "doorkeeper/oauth/client_credentials/issuer"
+require "doorkeeper/oauth/client_credentials/validation"
+require "doorkeeper/oauth/client/credentials"
 
-require 'doorkeeper/models/concerns/orderable'
-require 'doorkeeper/models/concerns/scopes'
-require 'doorkeeper/models/concerns/expirable'
-require 'doorkeeper/models/concerns/revocable'
-require 'doorkeeper/models/concerns/accessible'
+require "doorkeeper/oauth/client_credentials_request"
+require "doorkeeper/oauth/code_request"
+require "doorkeeper/oauth/token_request"
+require "doorkeeper/oauth/client"
+require "doorkeeper/oauth/token"
+require "doorkeeper/oauth/token_introspection"
+require "doorkeeper/oauth/invalid_token_response"
+require "doorkeeper/oauth/forbidden_token_response"
 
-require 'doorkeeper/models/access_grant_mixin'
-require 'doorkeeper/models/access_token_mixin'
-require 'doorkeeper/models/application_mixin'
+require "doorkeeper/secret_storing/base"
+require "doorkeeper/secret_storing/plain"
+require "doorkeeper/secret_storing/sha256_hash"
+require "doorkeeper/secret_storing/bcrypt"
 
-require 'doorkeeper/helpers/controller'
+require "doorkeeper/models/concerns/orderable"
+require "doorkeeper/models/concerns/scopes"
+require "doorkeeper/models/concerns/expirable"
+require "doorkeeper/models/concerns/reusable"
+require "doorkeeper/models/concerns/revocable"
+require "doorkeeper/models/concerns/accessible"
+require "doorkeeper/models/concerns/secret_storable"
 
-require 'doorkeeper/rails/routes'
-require 'doorkeeper/rails/helpers'
+require "doorkeeper/models/access_grant_mixin"
+require "doorkeeper/models/access_token_mixin"
+require "doorkeeper/models/application_mixin"
 
-require 'doorkeeper/rake'
-require 'doorkeeper/stale_records_cleaner'
+require "doorkeeper/helpers/controller"
 
-require 'doorkeeper/orm/active_record'
+require "doorkeeper/rails/routes"
+require "doorkeeper/rails/helpers"
+
+require "doorkeeper/rake"
+require "doorkeeper/stale_records_cleaner"
+
+require "doorkeeper/orm/active_record"
 
 module Doorkeeper
   def self.authenticate(request, methods = Doorkeeper.configuration.access_token_methods)

data/lib/generators/doorkeeper/application_owner_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration to add reference to owner of the
+  # Doorkeeper application.
+  #
   class ApplicationOwnerGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Provide support for client application ownership.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Provide support for client application ownership."
 
     def application_owner
       migration_template(
-        'add_owner_to_application_migration.rb.erb',
-        'db/migrate/add_owner_to_application.rb',
+        "add_owner_to_application_migration.rb.erb",
+        "db/migrate/add_owner_to_application.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +27,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end

data/lib/generators/doorkeeper/confidential_applications_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration to add confidential column to Doorkeeper
+  # applications table.
+  #
   class ConfidentialApplicationsGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Add confidential column to Doorkeeper applications'
+    source_root File.expand_path("templates", __dir__)
+    desc "Add confidential column to Doorkeeper applications"
 
     def pkce
       migration_template(
-        'add_confidential_to_applications.rb.erb',
-        'db/migrate/add_confidential_to_applications.rb',
+        "add_confidential_to_applications.rb.erb",
+        "db/migrate/add_confidential_to_applications.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +27,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end

data/lib/generators/doorkeeper/install_generator.rb

@@ -1,20 +1,22 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Setup doorkeeper into Rails application: locales, routes, etc.
+  #
   class InstallGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Installs Doorkeeper.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Installs Doorkeeper."
 
     def install
-      template 'initializer.rb', 'config/initializers/doorkeeper.rb'
-      copy_file File.expand_path('../../../config/locales/en.yml', __dir__),
-                'config/locales/doorkeeper.en.yml'
-      route 'use_doorkeeper'
-      readme 'README'
+      template "initializer.rb", "config/initializers/doorkeeper.rb"
+      copy_file File.expand_path("../../../config/locales/en.yml", __dir__),
+                "config/locales/doorkeeper.en.yml"
+      route "use_doorkeeper"
+      readme "README"
     end
   end
 end

data/lib/generators/doorkeeper/migration_generator.rb

@@ -1,18 +1,20 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Copies main Doorkeeper migration into parent Rails application.
+  #
   class MigrationGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Installs Doorkeeper migration file.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Installs Doorkeeper migration file."
 
     def install
       migration_template(
-        'migration.rb.erb',
-        'db/migrate/create_doorkeeper_tables.rb',
+        "migration.rb.erb",
+        "db/migrate/create_doorkeeper_tables.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +26,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end

data/lib/generators/doorkeeper/pkce_generator.rb

@@ -1,18 +1,21 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration with PKCE required database columns for
+  # Doorkeeper tables.
+  #
   class PkceGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Provide support for PKCE.'
+    source_root File.expand_path("templates", __dir__)
+    desc "Provide support for PKCE."
 
     def pkce
       migration_template(
-        'enable_pkce_migration.rb.erb',
-        'db/migrate/enable_pkce.rb',
+        "enable_pkce_migration.rb.erb",
+        "db/migrate/enable_pkce.rb",
         migration_version: migration_version
       )
     end
@@ -24,9 +27,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
   end
 end

data/lib/generators/doorkeeper/previous_refresh_token_generator.rb

@@ -1,13 +1,16 @@
 # frozen_string_literal: true
 
-require 'rails/generators'
-require 'rails/generators/active_record'
+require "rails/generators"
+require "rails/generators/active_record"
 
 module Doorkeeper
+  # Generates migration to add previous refresh token column to the
+  # database for Doorkeeper tables.
+  #
   class PreviousRefreshTokenGenerator < ::Rails::Generators::Base
     include ::Rails::Generators::Migration
-    source_root File.expand_path('templates', __dir__)
-    desc 'Support revoke refresh token on access token use'
+    source_root File.expand_path("templates", __dir__)
+    desc "Support revoke refresh token on access token use"
 
     def self.next_migration_number(path)
       ActiveRecord::Generators::Base.next_migration_number(path)
@@ -16,8 +19,8 @@ module Doorkeeper
     def previous_refresh_token
       if no_previous_refresh_token_column?
         migration_template(
-          'add_previous_refresh_token_to_access_tokens.rb.erb',
-          'db/migrate/add_previous_refresh_token_to_access_tokens.rb'
+          "add_previous_refresh_token_to_access_tokens.rb.erb",
+          "db/migrate/add_previous_refresh_token_to_access_tokens.rb"
         )
       end
     end
@@ -25,9 +28,7 @@ module Doorkeeper
     private
 
     def migration_version
-      if ActiveRecord::VERSION::MAJOR >= 5
-        "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
-      end
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
     end
 
     def no_previous_refresh_token_column?

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 Doorkeeper.configure do
   # Change the ORM that doorkeeper will use (needs plugins)
   orm :active_record
@@ -47,7 +49,12 @@ Doorkeeper.configure do
   # access_token_expires_in 2.hours
 
   # Assign custom TTL for access tokens. Will be used instead of access_token_expires_in
-  # option if defined. `context` has the following properties available
+  # option if defined. In case the block returns `nil` value Doorkeeper fallbacks to
+  # `access_token_expires_in` configuration option value. If you really need to issue a
+  # non-expiring access token (which is not recommended) then you need to return
+  # Float::INFINITY from this block.
+  #
+  # `context` has the following properties available:
   #
   # `client` - the OAuth client application (see Doorkeeper::OAuth::Client)
   # `grant_type` - the grant type of the request (see Doorkeeper::OAuth)
@@ -64,7 +71,7 @@ Doorkeeper.configure do
 
   # The controller Doorkeeper::ApplicationController inherits from.
   # Defaults to ActionController::Base.
-  # See https://github.com/doorkeeper-gem/doorkeeper#custom-base-controller
+  # See https://doorkeeper.gitbook.io/guides/configuration/other-configurations#custom-base-controller
   #
   # base_controller 'ApplicationController'
 
@@ -75,8 +82,63 @@ Doorkeeper.configure do
   # doesn't updates existing token expiration time, it will create a new token instead.
   # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383
   #
+  # You can not enable this option together with +hash_token_secrets+.
+  #
   # reuse_access_token
 
+  # Set a limit for token_reuse if using reuse_access_token option
+  #
+  # This option limits token_reusability to some extent.
+  # If not set then access_token will be reused unless it expires.
+  # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
+  #
+  # This option should be a percentage(i.e. (0,100])
+  #
+  # token_reuse_limit 100
+
+  # Hash access and refresh tokens before persisting them.
+  # This will disable the possibility to use +reuse_access_token+
+  # since plain values can no longer be retrieved.
+  #
+  # Note: If you are already a user of doorkeeper and have existing tokens
+  # in your installation, they will be invalid without enabling the additional
+  # setting `fallback_to_plain_secrets` below.
+  #
+  # hash_token_secrets
+  # By default, token secrets will be hashed using the
+  # +Doorkeeper::Hashing::SHA256+ strategy.
+  #
+  # If you wish to use another hashing implementation, you can override
+  # this strategy as follows:
+  #
+  # hash_token_secrets using: '::Doorkeeper::Hashing::MyCustomHashImpl'
+  #
+  # Keep in mind that changing the hashing function will invalidate all existing
+  # secrets, if there are any.
+
+  # Hash application secrets before persisting them.
+  #
+  # hash_application_secrets
+  #
+  # By default, applications will be hashed
+  # with the +Doorkeeper::SecretStoring::SHA256+ strategy.
+  #
+  # If you wish to use bcrypt for application secret hashing, uncomment
+  # this line instead:
+  #
+  # hash_application_secrets using: '::Doorkeeper::SecretStoring::BCrypt'
+
+  # When the above option is enabled,
+  # and a hashed token or secret is not found,
+  # you can allow to fall back to another strategy.
+  # For users upgrading doorkeeper and wishing to enable hashing,
+  # you will probably want to enable the fallback to plain tokens.
+  #
+  # This will ensure that old access tokens and secrets
+  # will remain valid even if the hashing above is enabled.
+  #
+  # fallback_to_plain_secrets
+
   # Issue access tokens with refresh token (disabled by default), you may also
   # pass a block which accepts `context` to customize when to give a refresh
   # token or not. Similar to `custom_access_token_expires_in`, `context` has
@@ -88,16 +150,11 @@ Doorkeeper.configure do
   #
   # use_refresh_token
 
-  # Forbids creating/updating applications with arbitrary scopes that are
-  # not in configuration, i.e. `default_scopes` or `optional_scopes`.
-  # (disabled by default)
-  #
-  # enforce_configured_scopes
-
   # Provide support for an owner to be assigned to each registered application (disabled by default)
   # Optional parameter confirmation: true (default false) if you want to enforce ownership of
   # a registered application
-  # Note: you must also run the rails g doorkeeper:application_owner generator to provide the necessary support
+  # NOTE: you must also run the rails g doorkeeper:application_owner generator
+  # to provide the necessary support
   #
   # enable_application_owner confirmation: false
 
@@ -108,6 +165,21 @@ Doorkeeper.configure do
   # default_scopes  :public
   # optional_scopes :write, :update
 
+  # Define scopes_by_grant_type to restrict only certain scopes for grant_type
+  # By default, all the scopes will be available for all the grant types.
+  #
+  # Keys to this hash should be the name of grant_type and
+  # values should be the array of scopes for that grant type.
+  # Note: scopes should be from configured_scopes(i.e. deafult or optional)
+  #
+  # scopes_by_grant_type password: [:write], client_credentials: [:update]
+
+  # Forbids creating/updating applications with arbitrary scopes that are
+  # not in configuration, i.e. `default_scopes` or `optional_scopes`.
+  # (disabled by default)
+  #
+  # enforce_configured_scopes
+
   # Change the way client credentials are retrieved from the request object.
   # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
   # falls back to the `:client_id` and `:client_secret` params from the `params` object.
@@ -125,9 +197,10 @@ Doorkeeper.configure do
   # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
 
   # Change the native redirect uri for client apps
-  # When clients register with the following redirect uri, they won't be redirected to any server and
-  # the authorizationcode will be displayed within the provider
-  # The value can be any string. Use nil to disable this feature. When disabled, clients must provide a valid URL
+  # When clients register with the following redirect uri, they won't be redirected to
+  # any server and the authorizationcode will be displayed within the provider
+  # The value can be any string. Use nil to disable this feature. When disabled, clients
+  # must providea valid URL
   # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi)
   #
   # native_redirect_uri 'urn:ietf:wg:oauth:2.0:oob'
@@ -152,6 +225,22 @@ Doorkeeper.configure do
   #
   # forbid_redirect_uri { |uri| uri.scheme.to_s.downcase == 'javascript' }
 
+  # Allows to set blank redirect URIs for Applications in case Doorkeeper configured
+  # to use URI-less OAuth grant flows like Client Credentials or Resource Owner
+  # Password Credentials. The option is on by default and checks configured grant
+  # types, but you **need** to manually drop `NOT NULL` constraint from `redirect_uri`
+  # column for `oauth_applications` database table.
+  #
+  # You can completely disable this feature with:
+  #
+  # allow_blank_redirect_uri false
+  #
+  # Or you can define your custom check:
+  #
+  # allow_blank_redirect_uri do |grant_flows, client|
+  #   client.superapp?
+  # end
+
   # Specify how authorization errors should be handled.
   # By default, doorkeeper renders json errors when access token
   # is invalid, expired, revoked or has invalid scopes.
@@ -165,6 +254,24 @@ Doorkeeper.configure do
   #
   # handle_auth_errors :raise
 
+  # Customize token introspection response.
+  # Allows to add your own fields to default one that are required by the OAuth spec
+  # for the introspection response. It could be `sub`, `aud` and so on.
+  # This configuration option can be a proc, lambda or any Ruby object responds
+  # to `.call` method and result of it's invocation must be a Hash.
+  #
+  # custom_introspection_response do |token, context|
+  #   {
+  #     "sub": "Z5O3upPC88QrAjx00dis",
+  #     "aud": "https://protected.example.net/resource",
+  #     "username": User.find(token.resource_owner_id).username
+  #   }
+  # end
+  #
+  # or
+  #
+  # custom_introspection_response CustomIntrospectionResponder
+
   # Specify what grant flows are enabled in array of Strings. The valid
   # strings and the flows they enable are:
   #
@@ -195,7 +302,7 @@ Doorkeeper.configure do
   # end
 
   # Hook into Authorization flow in order to implement Single Sign Out
-  # or add ny other functionality.
+  # or add any other functionality.
   #
   # before_successful_authorization do |controller|
   #   Rails.logger.info(params.inspect)

data/lib/generators/doorkeeper/templates/migration.rb.erb

@@ -1,9 +1,13 @@
 class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
   def change
     create_table :oauth_applications do |t|
-      t.string  :name,         null: false
-      t.string  :uid,          null: false
-      t.string  :secret,       null: false
+      t.string  :name,    null: false
+      t.string  :uid,     null: false
+      t.string  :secret,  null: false
+
+      # Remove `null: false` if you are planning to use grant flows
+      # that doesn't require redirect URI to be used during authorization
+      # like Client Credentials flow or Resource Owner Password.
       t.text    :redirect_uri, null: false
       t.string  :scopes,       null: false, default: ''
       t.boolean :confidential, null: false, default: true
@@ -32,20 +36,20 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
 
     create_table :oauth_access_tokens do |t|
       t.references :resource_owner, index: true
-      t.references :application
+      t.references :application,    null: false
 
       # If you use a custom token generator you may need to change this column
       # from string to text, so that it accepts tokens larger than 255
       # characters. More info on custom token generators in:
       # https://github.com/doorkeeper-gem/doorkeeper/tree/v3.0.0.rc1#custom-access-token-generator
       #
-      # t.text     :token,             null: false
-      t.string   :token,                  null: false
+      # t.text :token, null: false
+      t.string :token, null: false
 
       t.string   :refresh_token
       t.integer  :expires_in
       t.datetime :revoked_at
-      t.datetime :created_at,             null: false
+      t.datetime :created_at, null: false
       t.string   :scopes
 
       # If there is a previous_refresh_token column,
@@ -64,5 +68,9 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
       :oauth_applications,
       column: :application_id
     )
+
+    # Uncomment below to ensure a valid reference to the resource owner's table
+    # add_foreign_key :oauth_access_grants, <model>, column: :resource_owner_id
+    # add_foreign_key :oauth_access_tokens, <model>, column: :resource_owner_id
   end
 end

data/lib/generators/doorkeeper/views_generator.rb

@@ -2,14 +2,16 @@
 
 module Doorkeeper
   module Generators
+    # Generates doorkeeper views for Rails application
+    #
     class ViewsGenerator < ::Rails::Generators::Base
-      source_root File.expand_path('../../../app/views', __dir__)
+      source_root File.expand_path("../../../app/views", __dir__)
 
-      desc 'Copies default Doorkeeper views and layouts to your application.'
+      desc "Copies default Doorkeeper views and layouts to your application."
 
       def manifest
-        directory 'doorkeeper', 'app/views/doorkeeper'
-        directory 'layouts/doorkeeper', 'app/views/layouts/doorkeeper'
+        directory "doorkeeper", "app/views/doorkeeper"
+        directory "layouts/doorkeeper", "app/views/layouts/doorkeeper"
       end
     end
   end