doorkeeper 5.1.0 → 5.2.0.rc1

data/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -16,7 +16,7 @@ module Doorkeeper
               :redirect_uri,
               presence: true
 
-    validates :token, uniqueness: true
+    validates :token, uniqueness: { case_sensitive: true }
 
     before_validation :generate_token, on: :create
 

data/lib/doorkeeper/orm/active_record/access_token.rb

@@ -9,8 +9,8 @@ module Doorkeeper
     belongs_to :application, class_name: "Doorkeeper::Application",
                              inverse_of: :access_tokens, optional: true
 
-    validates :token, presence: true, uniqueness: true
-    validates :refresh_token, uniqueness: true, if: :use_refresh_token?
+    validates :token, presence: true, uniqueness: { case_sensitive: true }
+    validates :refresh_token, uniqueness: { case_sensitive: true }, if: :use_refresh_token?
 
     # @attr_writer [Boolean, nil] use_refresh_token
     #   indicates the possibility of using refresh token

data/lib/doorkeeper/orm/active_record/application.rb

@@ -10,7 +10,7 @@ module Doorkeeper
     has_many :access_tokens, dependent: :delete_all, class_name: "Doorkeeper::AccessToken"
 
     validates :name, :secret, :uid, presence: true
-    validates :uid, uniqueness: true
+    validates :uid, uniqueness: { case_sensitive: true }
     validates :redirect_uri, redirect_uri: true
     validates :confidential, inclusion: { in: [true, false] }
 
@@ -60,6 +60,12 @@ module Doorkeeper
       end
     end
 
+    def to_json(options)
+      serializable_hash(except: :secret)
+        .merge(secret: plaintext_secret)
+        .to_json(options)
+    end
+
     private
 
     def generate_uid

data/lib/doorkeeper/orm/active_record.rb

@@ -6,6 +6,14 @@ require "doorkeeper/orm/active_record/stale_records_cleaner"
 
 module Doorkeeper
   module Orm
+    # ActiveRecord ORM for Doorkeeper entity models.
+    # Consists of three main OAuth entities:
+    #   * Access Token
+    #   * Access Grant
+    #   * Application (client)
+    #
+    # Do a lazy loading of all the required and configured stuff.
+    #
     module ActiveRecord
       def self.initialize_models!
         lazy_load do
@@ -14,7 +22,7 @@ module Doorkeeper
           require "doorkeeper/orm/active_record/application"
 
           if Doorkeeper.configuration.active_record_options[:establish_connection]
-            [Doorkeeper::AccessGrant, Doorkeeper::AccessToken, Doorkeeper::Application].each do |model|
+            Doorkeeper::Orm::ActiveRecord.models.each do |model|
               options = Doorkeeper.configuration.active_record_options[:establish_connection]
               model.establish_connection(options)
             end
@@ -33,6 +41,14 @@ module Doorkeeper
       def self.lazy_load(&block)
         ActiveSupport.on_load(:active_record, {}, &block)
       end
+
+      def self.models
+        [
+          Doorkeeper::AccessGrant,
+          Doorkeeper::AccessToken,
+          Doorkeeper::Application,
+        ]
+      end
     end
   end
 end

data/lib/doorkeeper/stale_records_cleaner.rb

@@ -5,12 +5,16 @@ module Doorkeeper
     CLEANER_CLASS = "StaleRecordsCleaner"
 
     def self.for(base_scope)
-      orm_adapter = "doorkeeper/orm/#{Doorkeeper.configuration.orm}".classify
+      orm_adapter = "doorkeeper/orm/#{configured_orm}".classify
 
       orm_cleaner = "#{orm_adapter}::#{CLEANER_CLASS}".constantize
       orm_cleaner.new(base_scope)
     rescue NameError
-      raise Doorkeeper::Errors::NoOrmCleaner, "'#{Doorkeeper.configuration.orm}' ORM has no cleaner!"
+      raise Doorkeeper::Errors::NoOrmCleaner, "'#{configured_orm}' ORM has no cleaner!"
+    end
+
+    def self.configured_orm
+      Doorkeeper.configuration.orm
     end
 
     def self.new(base_scope)

data/lib/doorkeeper/version.rb

@@ -8,9 +8,9 @@ module Doorkeeper
   module VERSION
     # Semantic versioning
     MAJOR = 5
-    MINOR = 1
+    MINOR = 2
     TINY = 0
-    PRE = nil
+    PRE = "rc1"
 
     # Full version number
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/doorkeeper.rb

@@ -52,6 +52,7 @@ require "doorkeeper/oauth/token"
 require "doorkeeper/oauth/token_introspection"
 require "doorkeeper/oauth/invalid_token_response"
 require "doorkeeper/oauth/forbidden_token_response"
+require "doorkeeper/oauth/nonstandard"
 
 require "doorkeeper/secret_storing/base"
 require "doorkeeper/secret_storing/plain"
@@ -80,6 +81,8 @@ require "doorkeeper/stale_records_cleaner"
 
 require "doorkeeper/orm/active_record"
 
+# Main Doorkeeper namespace.
+#
 module Doorkeeper
   def self.authenticate(request, methods = Doorkeeper.configuration.access_token_methods)
     OAuth::Token.authenticate(request, *methods)

data/lib/generators/doorkeeper/previous_refresh_token_generator.rb

@@ -17,12 +17,12 @@ module Doorkeeper
     end
 
     def previous_refresh_token
-      if no_previous_refresh_token_column?
-        migration_template(
-          "add_previous_refresh_token_to_access_tokens.rb.erb",
-          "db/migrate/add_previous_refresh_token_to_access_tokens.rb"
-        )
-      end
+      return unless no_previous_refresh_token_column?
+
+      migration_template(
+        "add_previous_refresh_token_to_access_tokens.rb.erb",
+        "db/migrate/add_previous_refresh_token_to_access_tokens.rb"
+      )
     end
 
     private

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -196,15 +196,6 @@ Doorkeeper.configure do
   #
   # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
 
-  # Change the native redirect uri for client apps
-  # When clients register with the following redirect uri, they won't be redirected to
-  # any server and the authorizationcode will be displayed within the provider
-  # The value can be any string. Use nil to disable this feature. When disabled, clients
-  # must providea valid URL
-  # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi)
-  #
-  # native_redirect_uri 'urn:ietf:wg:oauth:2.0:oob'
-
   # Forces the usage of the HTTPS protocol in non-native redirect uris (enabled
   # by default in non-development environments). OAuth2 delegates security in
   # communication to the HTTPS protocol so it is wise to keep this enabled.
@@ -323,6 +314,47 @@ Doorkeeper.configure do
   #   client.superapp? or resource_owner.admin?
   # end
 
+  # Configure custom constraints for the Token Introspection request. By default
+  # this configuration option allows to introspect the token that belongs to authorized
+  # client (from Bearer token or from authenticated client) OR when token doesn't
+  # belong to any client (public token). Otherwise requester has no access to the
+  # introspection and it will return response as stated in the RFC.
+  #
+  # You can define your custom check:
+  #
+  # allow_token_introspection do |token, authorized_client, _authorized_token|
+  #   if token.application
+  #     # `protected_resource` is a new database boolean column, for example
+  #     token.application == authorized_client || authorized_client.protected_resource?
+  #   else
+  #     true
+  #   end
+  # end
+  #
+  # Block arguments:
+  #
+  # @param token [Doorkeeper::AccessToken]
+  #   token to be introspected
+  #
+  # @param authorized_client [Doorkeeper::Application]
+  #   authorized client (if request is authorized using Basic auth with
+  #   Client Credentials for example)
+  #
+  # @param authorized_token [Doorkeeper::AccessToken]
+  #   Bearer token used to authorize the request
+  #
+  # Keep in mind, that in case the block returns `nil` or `false` introspection response
+  # doesn't have 401 status code and some descriptive body, you'll get 200 with
+  # { "active": false } body as stated in the RFC 7662 section 2.2. Introspection Response.
+  #
+  # You can completely disable any token introspection:
+  #
+  # allow_token_introspection false
+  #
+  # In such case every request for token introspection will get { "active": false } response.
+  # If you need to block the request at all, then configure your routes.rb or web-server
+  # like nginx to forbid the request.
+
   # WWW-Authenticate Realm (default "Doorkeeper").
   #
   # realm "Doorkeeper"

data/lib/generators/doorkeeper/templates/migration.rb.erb

@@ -36,6 +36,9 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
 
     create_table :oauth_access_tokens do |t|
       t.references :resource_owner, index: true
+
+      # Remove `null: false` if you are planning to use Password
+      # Credentials Grant flow that doesn't require an application.
       t.references :application,    null: false
 
       # If you use a custom token generator you may need to change this column

data/spec/controllers/applications_controller_spec.rb

@@ -26,6 +26,10 @@ module Doorkeeper
 
         expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
 
+        application = Application.last
+        secret_from_response = json_response["secret"]
+        expect(application.secret_matches?(secret_from_response)).to be_truthy
+
         expect(json_response["name"]).to eq("Example")
         expect(json_response["redirect_uri"]).to eq("https://example.com")
       end
@@ -44,6 +48,21 @@ module Doorkeeper
         expect(json_response).to include("errors")
       end
 
+      it "returns validations on wrong create params (unspecified scheme)" do
+        expect do
+          post :create, params: {
+            doorkeeper_application: {
+              name: "Example",
+              redirect_uri: "app.com:80",
+            }, format: :json,
+          }
+        end.not_to(change { Doorkeeper::Application.count })
+
+        expect(response).to have_http_status(422)
+
+        expect(json_response).to include("errors")
+      end
+
       it "returns application info" do
         application = FactoryBot.create(:application, name: "Change me")
 
@@ -121,6 +140,72 @@ module Doorkeeper
     end
 
     context "when admin is authenticated" do
+      context "when application secrets are hashed" do
+        before do
+          allow(Doorkeeper.configuration).to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Sha256Hash)
+        end
+
+        it "shows the application secret after creating a new application" do
+          expect do
+            post :create, params: {
+              doorkeeper_application: {
+                name: "Example",
+                redirect_uri: "https://example.com",
+              },
+            }
+          end.to change { Doorkeeper::Application.count }.by(1)
+
+          application = Application.last
+
+          secret_from_flash = flash[:application_secret]
+          expect(secret_from_flash).not_to be_empty
+          expect(application.secret_matches?(secret_from_flash)).to be_truthy
+          expect(response).to redirect_to(controller.main_app.oauth_application_url(application.id))
+
+          get :show, params: { id: application.id, format: :html }
+
+          # We don't know the application secret here (because its hashed) so we can not assert its text on the page
+          # Instead, we read it from the page and then check if it matches the application secret
+          code_element = %r{<code.*id="secret".*>(.*)<\/code>}.match(response.body)
+          secret_from_page = code_element[1]
+
+          expect(response.body).to have_selector("code#application_id", text: application.uid)
+          expect(response.body).to have_selector("code#secret")
+          expect(secret_from_page).not_to be_empty
+          expect(application.secret_matches?(secret_from_page)).to be_truthy
+        end
+
+        it "does not show an application secret when application did already exist" do
+          application = FactoryBot.create(:application)
+          get :show, params: { id: application.id, format: :html }
+
+          expect(response.body).to have_selector("code#application_id", text: application.uid)
+          expect(response.body).to have_selector("code#secret", text: "")
+        end
+
+        it "returns the application details in a json response" do
+          expect do
+            post :create, params: {
+              doorkeeper_application: {
+                name: "Example",
+                redirect_uri: "https://example.com",
+              }, format: :json,
+            }
+          end.to(change { Doorkeeper::Application.count })
+
+          expect(response).to be_successful
+
+          expect(json_response).to include("id", "name", "uid", "secret", "redirect_uri", "scopes")
+
+          application = Application.last
+          secret_from_response = json_response["secret"]
+          expect(application.secret_matches?(secret_from_response)).to be_truthy
+
+          expect(json_response["name"]).to eq("Example")
+          expect(json_response["redirect_uri"]).to eq("https://example.com")
+        end
+      end
+
       render_views
 
       before do
@@ -151,6 +236,14 @@ module Doorkeeper
         expect(response).to be_redirect
       end
 
+      it "shows application details" do
+        application = FactoryBot.create(:application)
+        get :show, params: { id: application.id, format: :html }
+
+        expect(response.body).to have_selector("code#application_id", text: application.uid)
+        expect(response.body).to have_selector("code#secret", text: application.plaintext_secret)
+      end
+
       it "does not allow mass assignment of uid or secret" do
         application = FactoryBot.create(:application)
         put :update, params: {

data/spec/controllers/tokens_controller_spec.rb

@@ -102,10 +102,10 @@ describe Doorkeeper::TokensController do
         let(:some_other_client) { FactoryBot.create(:application, confidential: true) }
         let(:oauth_client) { Doorkeeper::OAuth::Client.new(some_other_client) }
 
-        it "returns 200" do
+        it "returns 403" do
           post :revoke, params: { token: access_token.token }
 
-          expect(response.status).to eq 200
+          expect(response.status).to eq 403
         end
 
         it "does not revoke the access token" do
@@ -147,7 +147,7 @@ describe Doorkeeper::TokensController do
       end
     end
 
-    context "authorized using valid Client Authentication" do
+    context "authorized using Client Credentials of the client that token is issued to" do
       it "responds with full token introspection" do
         request.headers["Authorization"] = basic_auth_header_for_client(client)
 
@@ -159,6 +159,24 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context "configured token introspection disabled" do
+      before do
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          allow_token_introspection false
+        end
+      end
+
+      it "responds with just active: false response" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", false
+        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
+      end
+    end
+
     context "using custom introspection response" do
       before do
         Doorkeeper.configure do
@@ -212,6 +230,56 @@ describe Doorkeeper::TokensController do
       end
     end
 
+    context "introspection request authorized by a client and allow_token_introspection is true" do
+      let(:different_client) { FactoryBot.create(:application) }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do
+          true
+        end)
+      end
+
+      it "responds with full token introspection" do
+        request.headers["Authorization"] = basic_auth_header_for_client(different_client)
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+        should_have_json "client_id", client.uid
+      end
+    end
+
+    context "allow_token_introspection requires authorized token with special scope" do
+      let(:access_token) { FactoryBot.create(:access_token, scopes: "introspection") }
+
+      before do
+        allow(Doorkeeper.configuration).to receive(:allow_token_introspection).and_return(proc do |_token, _client, authorized_token|
+          authorized_token.scopes.include?("introspection")
+        end)
+      end
+
+      it "responds with full token introspection if authorized token has introspection scope" do
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", true
+        expect(json_response).to include("client_id", "token_type", "exp", "iat")
+      end
+
+      it "responds with just active status if authorized token doesn't have introspection scope" do
+        access_token.update(scopes: "read write")
+
+        request.headers["Authorization"] = "Bearer #{access_token.token}"
+
+        post :introspect, params: { token: token_for_introspection.token }
+
+        should_have_json "active", false
+        expect(json_response).not_to include("client_id", "token_type", "exp", "iat")
+      end
+    end
+
     context "authorized using invalid Bearer token" do
       let(:access_token) do
         FactoryBot.create(:access_token, application: client, revoked_at: 1.day.ago)

data/spec/dummy/config/application.rb

@@ -5,11 +5,13 @@ require "rails"
 %w[
   action_controller/railtie
   action_view/railtie
+  action_cable/engine
   sprockets/railtie
 ].each do |railtie|
   begin
     require railtie
-  rescue LoadError
+  rescue LoadError => e
+    puts "Error loading '#{railtie}' (#{e.message})"
   end
 end
 

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -65,15 +65,6 @@ Doorkeeper.configure do
   # Check out the wiki for more information on customization
   # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
 
-  # Change the native redirect uri for client apps
-  # When clients register with the following redirect uri, they won't be redirected to any server and
-  # the authorization code will be displayed within the provider
-  # The value can be any string. Use nil to disable this feature.
-  # When disabled, clients must provide a valid URL
-  # (Similar behaviour: https://developers.google.com/accounts/docs/OAuth2InstalledApp#choosingredirecturi)
-  #
-  # native_redirect_uri 'urn:ietf:wg:oauth:2.0:oob'
-
   # Forces the usage of the HTTPS protocol in non-native redirect uris (enabled
   # by default in non-development environments). OAuth2 delegates security in
   # communication to the HTTPS protocol so it is wise to keep this enabled.
@@ -116,6 +107,33 @@ Doorkeeper.configure do
   #   client.superapp? or resource_owner.admin?
   # end
 
+  # Implement constraints in case you use Client Credentials to authenticate
+  # the introspection endpoint.
+  # By default allow introspection if the introspected token belongs to authorized client,
+  # OR token doesn't belong to any client (public token). Otherwise disallow.
+  #
+  # Params:
+  # `token` - the token to be introspected (see Doorkeeper::AccessToken)
+  # `client` - the client application authorized for the endpoint (see Doorkeeper::Application)
+  #
+  # You can completely ignore it:
+  # allow_token_introspection do |_token, _client|
+  #   false
+  # end
+  #
+  # Or you can define your custom check:
+  #   Adding `protected_resource` boolean column to applications table
+  #   to allow protected_resource client introspect the token of normal client.
+  #   In this case, protected resource client must be confidential.
+  #
+  # allow_token_introspection do |token, client|
+  #   if token.application
+  #     token.application == client || client.protected_resource?
+  #   else
+  #     true
+  #   end
+  # end
+
   # WWW-Authenticate Realm (default "Doorkeeper").
   realm "Doorkeeper"
 end

data/spec/lib/config_spec.rb

@@ -694,4 +694,15 @@ describe Doorkeeper, "configuration" do
       end
     end
   end
+
+  describe "options deprecation" do
+    it "prints a warning message when an option is deprecated" do
+      expect(Kernel).to receive(:warn).with(
+        "[DOORKEEPER] native_redirect_uri has been deprecated and will soon be removed"
+      )
+      Doorkeeper.configure do
+        native_redirect_uri "urn:ietf:wg:oauth:2.0:oob"
+      end
+    end
+  end
 end

data/spec/lib/oauth/helpers/uri_checker_spec.rb

@@ -40,13 +40,28 @@ module Doorkeeper::OAuth::Helpers
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
+      it "is invalid if localhost is resolved as as scheme (no scheme specified)" do
+        uri = "localhost:8080"
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
+      it "is invalid if scheme is missing #2" do
+        uri = "app.co:80"
+        expect(URIChecker.valid?(uri)).to be_falsey
+      end
+
       it "is invalid if is not an uri" do
         uri = "   "
         expect(URIChecker.valid?(uri)).to be_falsey
       end
 
-      it "is valid for native uris" do
-        uri = "urn:ietf:wg:oauth:2.0:oob"
+      it "is valid for custom schemes" do
+        uri = "com.example.app:/test"
+        expect(URIChecker.valid?(uri)).to be_truthy
+      end
+
+      it "is valid for custom schemes with authority marker (common misconfiguration)" do
+        uri = "com.example.app://test"
         expect(URIChecker.valid?(uri)).to be_truthy
       end
     end

data/spec/lib/oauth/pre_authorization_spec.rb

@@ -149,21 +149,6 @@ module Doorkeeper::OAuth
       expect(subject.scopes).to eq(Scopes.from_string("default"))
     end
 
-    context "with native redirect uri" do
-      let(:native_redirect_uri) { "urn:ietf:wg:oauth:2.0:oob" }
-
-      it "accepts redirect_uri when it matches with the client" do
-        subject.redirect_uri = native_redirect_uri
-        allow(subject.client).to receive(:redirect_uri) { native_redirect_uri }
-        expect(subject).to be_authorizable
-      end
-
-      it "invalidates redirect_uri when it does'n match with the client" do
-        subject.redirect_uri = "urn:ietf:wg:oauth:2.0:oob"
-        expect(subject).not_to be_authorizable
-      end
-    end
-
     it "matches the redirect uri against client's one" do
       subject.redirect_uri = "http://nothesame.com"
       expect(subject).not_to be_authorizable

data/spec/requests/flows/authorization_code_spec.rb

@@ -28,8 +28,8 @@ feature "Authorization Code Flow" do
       config_is_set(:token_secret_strategy, ::Doorkeeper::SecretStoring::Sha256Hash)
     end
 
-    scenario "Authorization Code Flow with hashing" do
-      @client.redirect_uri = Doorkeeper.configuration.native_redirect_uri
+    def authorize(redirect_url)
+      @client.redirect_uri = redirect_url
       @client.save!
       visit authorization_endpoint_url(client: @client)
       click_on "Authorize"
@@ -42,16 +42,28 @@ feature "Authorization Code Flow" do
       hashed_code = Doorkeeper::AccessGrant.secret_strategy.transform_secret code
       expect(hashed_code).to eq Doorkeeper::AccessGrant.first.token
 
+      [code, hashed_code]
+    end
+
+    scenario "using redirect_url urn:ietf:wg:oauth:2.0:oob" do
+      code, hashed_code = authorize("urn:ietf:wg:oauth:2.0:oob")
       expect(code).not_to eq(hashed_code)
+      i_should_see "Authorization code:"
+      i_should_see code
+      i_should_not_see hashed_code
+    end
 
+    scenario "using redirect_url urn:ietf:wg:oauth:2.0:oob:auto" do
+      code, hashed_code = authorize("urn:ietf:wg:oauth:2.0:oob:auto")
+      expect(code).not_to eq(hashed_code)
       i_should_see "Authorization code:"
       i_should_see code
       i_should_not_see hashed_code
     end
   end
 
-  scenario "resource owner authorizes using test url" do
-    @client.redirect_uri = Doorkeeper.configuration.native_redirect_uri
+  scenario "resource owner authorizes using oob url" do
+    @client.redirect_uri = "urn:ietf:wg:oauth:2.0:oob"
     @client.save!
     visit authorization_endpoint_url(client: @client)
     click_on "Authorize"