doorkeeper 5.2.2 → 5.5.4

data/spec/dummy/config/database.yml

@@ -1,15 +0,0 @@
-development:
-  adapter: sqlite3
-  database: db/development.sqlite3
-  pool: 5
-  timeout: 5000
-
-test:
-  adapter: sqlite3
-  database: ":memory:"
-  timeout: 500
-
-production:
-  adapter: sqlite3
-  database: ":memory:"
-  timeout: 500

data/spec/dummy/config/environment.rb

@@ -1,5 +0,0 @@
-# Load the rails application
-require File.expand_path('application', __dir__)
-
-# Initialize the rails application
-Rails.application.initialize!

data/spec/dummy/config/environments/development.rb

@@ -1,31 +0,0 @@
-# frozen_string_literal: true
-
-Dummy::Application.configure do
-  # Settings specified here will take precedence over those in config/application.rb
-
-  # In the development environment your application's code is reloaded on
-  # every request.  This slows down response time but is perfect for development
-  # since you don't have to restart the web server when you make code changes.
-  config.cache_classes = false
-
-  # Show full error reports and disable caching
-  config.consider_all_requests_local       = true
-  config.action_controller.perform_caching = false
-
-  # Don't care if the mailer can't send
-  # config.action_mailer.raise_delivery_errors = false
-
-  # Print deprecation notices to the Rails logger
-  config.active_support.deprecation = :log
-
-  # Only use best-standards-support built into browsers
-  config.action_dispatch.best_standards_support = :builtin
-
-  # Do not compress assets
-  config.assets.compress = false
-
-  # Expands the lines which load the assets
-  config.assets.debug = true
-
-  config.eager_load = false
-end

data/spec/dummy/config/environments/production.rb

@@ -1,64 +0,0 @@
-# frozen_string_literal: true
-
-Dummy::Application.configure do
-  # Settings specified here will take precedence over those in config/application.rb
-
-  # Code is not reloaded between requests
-  config.cache_classes = true
-
-  # Full error reports are disabled and caching is turned on
-  config.consider_all_requests_local       = false
-  config.action_controller.perform_caching = true
-
-  # Disable Rails's static asset server (Apache or nginx will already do this)
-  config.serve_static_assets = false
-
-  # Compress JavaScripts and CSS
-  config.assets.compress = true
-
-  # Don't fallback to assets pipeline if a precompiled asset is missed
-  config.assets.compile = false
-
-  # Generate digests for assets URLs
-  config.assets.digest = true
-
-  # Defaults to Rails.root.join("public/assets")
-  # config.assets.manifest = YOUR_PATH
-
-  # Specifies the header that your server uses for sending files
-  # config.action_dispatch.x_sendfile_header = "X-Sendfile" # for apache
-  # config.action_dispatch.x_sendfile_header = 'X-Accel-Redirect' # for nginx
-
-  # Force all access to the app over SSL, use Strict-Transport-Security, and use secure cookies.
-  # config.force_ssl = true
-
-  # See everything in the log (default is :info)
-  # config.log_level = :debug
-
-  # Use a different logger for distributed setups
-  # config.logger = SyslogLogger.new
-
-  # Use a different cache store in production
-  # config.cache_store = :mem_cache_store
-
-  # Enable serving of images, stylesheets, and JavaScripts from an asset server
-  # config.action_controller.asset_host = "http://assets.example.com"
-
-  # Precompile additional assets (application.js, application.css, and all non-JS/CSS are already added)
-  # config.assets.precompile += %w( search.js )
-
-  # Disable delivery errors, bad email addresses will be ignored
-  # config.action_mailer.raise_delivery_errors = false
-
-  # Enable threaded mode
-  # config.threadsafe!
-
-  # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
-  # the I18n.default_locale when a translation can not be found)
-  config.i18n.fallbacks = true
-
-  # Send deprecation notices to registered listeners
-  config.active_support.deprecation = :notify
-
-  config.eager_load = true
-end

data/spec/dummy/config/environments/test.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-Dummy::Application.configure do
-  # Settings specified here will take precedence over those in config/application.rb
-
-  # The test environment is used exclusively to run your application's
-  # test suite.  You never need to work with it otherwise.  Remember that
-  # your test database is "scratch space" for the test suite and is wiped
-  # and recreated between test runs.  Don't rely on the data there!
-  config.cache_classes = true
-
-  config.assets.enabled = true
-  config.assets.version = "1.0"
-  config.assets.digest = false
-
-  # Do not eager load code on boot. This avoids loading your whole application
-  # just for the purpose of running a single test. If you are using a tool that
-  # preloads Rails for running tests, you may have to set it to true.
-  config.eager_load = false
-
-  # Show full error reports and disable caching
-  config.consider_all_requests_local       = true
-  config.action_controller.perform_caching = false
-
-  # Raise exceptions instead of rendering exception templates
-  config.action_dispatch.show_exceptions = false
-
-  # Disable request forgery protection in test environment
-  config.action_controller.allow_forgery_protection = false
-
-  # Tell Action Mailer not to deliver emails to the real world.
-  # The :test delivery method accumulates sent emails in the
-  # ActionMailer::Base.deliveries array.
-  # config.action_mailer.delivery_method = :test
-
-  # Use SQL instead of Active Record's schema dumper when creating the test database.
-  # This is necessary if your schema can't be completely dumped by the schema dumper,
-  # like if you have constraints or database-specific column types
-  # config.active_record.schema_format = :sql
-
-  # Print deprecation notices to the stderr
-  config.active_support.deprecation = :stderr
-
-  config.eager_load = true
-end

data/spec/dummy/config/initializers/backtrace_silencers.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-# Be sure to restart your server when you modify this file.
-
-# You can add backtrace silencers for libraries that you're using but don't wish to see in your backtraces.
-# Rails.backtrace_cleaner.add_silencer { |line| line =~ /my_noisy_library/ }
-
-# You can also remove all the silencers if you're trying to debug a problem that might stem from framework code.
-# Rails.backtrace_cleaner.remove_silencers!

data/spec/dummy/config/initializers/doorkeeper.rb

@@ -1,166 +0,0 @@
-# frozen_string_literal: true
-
-Doorkeeper.configure do
-  # Change the ORM that doorkeeper will use.
-  orm DOORKEEPER_ORM
-
-  # This block will be called to check whether the resource owner is authenticated or not.
-  resource_owner_authenticator do
-    # Put your resource owner authentication logic here.
-    User.where(id: session[:user_id]).first || redirect_to(root_url, alert: "Needs sign in.")
-  end
-
-  # If you didn't skip applications controller from Doorkeeper routes in your application routes.rb
-  # file then you need to declare this block in order to restrict access to the web interface for
-  # adding oauth authorized applications. In other case it will return 403 Forbidden response
-  # every time somebody will try to access the admin web interface.
-  #
-  # admin_authenticator do
-  #   # Put your admin authentication logic here.
-  #   # Example implementation:
-  #   Admin.find_by_id(session[:admin_id]) || redirect_to(new_admin_session_url)
-  # end
-
-  # Authorization Code expiration time (default 10 minutes).
-  # authorization_code_expires_in 10.minutes
-
-  # Access token expiration time (default 2 hours).
-  # If you want to disable expiration, set this to nil.
-  # access_token_expires_in 2.hours
-
-  # Reuse access token for the same resource owner within an application (disabled by default)
-  # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383
-  # reuse_access_token
-
-  # Issue access tokens with refresh token (disabled by default)
-  use_refresh_token
-
-  # Forbids creating/updating applications with arbitrary scopes that are
-  # not in configuration, i.e. `default_scopes` or `optional_scopes`.
-  # (disabled by default)
-  #
-  # enforce_configured_scopes
-
-  # Provide support for an owner to be assigned to each registered application (disabled by default)
-  # Optional parameter confirmation: true (default false) if you want to enforce ownership of
-  # a registered application
-  # Note: you must also run the rails g doorkeeper:application_owner generator to provide the necessary support
-  # enable_application_owner confirmation: false
-
-  # Define access token scopes for your provider
-  # For more information go to
-  # https://github.com/doorkeeper-gem/doorkeeper/wiki/Using-Scopes
-  default_scopes  :public
-  optional_scopes :write, :update
-
-  # Change the way client credentials are retrieved from the request object.
-  # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
-  # falls back to the `:client_id` and `:client_secret` params from the `params` object.
-  # Check out the wiki for more information on customization
-  # client_credentials :from_basic, :from_params
-
-  # Change the way access token is authenticated from the request object.
-  # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
-  # falls back to the `:access_token` or `:bearer_token` params from the `params` object.
-  # Check out the wiki for more information on customization
-  # access_token_methods :from_bearer_authorization, :from_access_token_param, :from_bearer_param
-
-  # Forces the usage of the HTTPS protocol in non-native redirect uris (enabled
-  # by default in non-development environments). OAuth2 delegates security in
-  # communication to the HTTPS protocol so it is wise to keep this enabled.
-  #
-  # force_ssl_in_redirect_uri !Rails.env.development?
-
-  # Specify what grant flows are enabled in array of Strings. The valid
-  # strings and the flows they enable are:
-  #
-  # "authorization_code" => Authorization Code Grant Flow
-  # "implicit"           => Implicit Grant Flow
-  # "password"           => Resource Owner Password Credentials Grant Flow
-  # "client_credentials" => Client Credentials Grant Flow
-  #
-  # If not specified, Doorkeeper enables authorization_code and
-  # client_credentials.
-  #
-  # implicit and password grant flows have risks that you should understand
-  # before enabling:
-  #   http://tools.ietf.org/html/rfc6819#section-4.4.2
-  #   http://tools.ietf.org/html/rfc6819#section-4.4.3
-  #
-  # grant_flows %w[authorization_code client_credentials]
-
-  # Hook into the strategies' request & response life-cycle in case your
-  # application needs advanced customization or logging:
-  #
-  # before_successful_strategy_response do |request|
-  #   puts "BEFORE HOOK FIRED! #{request}"
-  # end
-  #
-  # after_successful_strategy_response do |request, response|
-  #   puts "AFTER HOOK FIRED! #{request}, #{response}"
-  # end
-
-  # Under some circumstances you might want to have applications auto-approved,
-  # so that the user skips the authorization step.
-  # For example if dealing with a trusted application.
-  # skip_authorization do |resource_owner, client|
-  #   client.superapp? or resource_owner.admin?
-  # end
-
-  # Configure custom constraints for the Token Introspection request.
-  # By default this configuration option allows to introspect a token by another
-  # token of the same application, OR to introspect the token that belongs to
-  # authorized client (from authenticated client) OR when token doesn't
-  # belong to any client (public token). Otherwise requester has no access to the
-  # introspection and it will return response as stated in the RFC.
-  #
-  # Block arguments:
-  #
-  # @param token [Doorkeeper::AccessToken]
-  #   token to be introspected
-  #
-  # @param authorized_client [Doorkeeper::Application]
-  #   authorized client (if request is authorized using Basic auth with
-  #   Client Credentials for example)
-  #
-  # @param authorized_token [Doorkeeper::AccessToken]
-  #   Bearer token used to authorize the request
-  #
-  # In case the block returns `nil` or `false` introspection responses with 401 status code
-  # when using authorized token to introspect, or you'll get 200 with { "active": false } body
-  # when using authorized client to introspect as stated in the
-  # RFC 7662 section 2.2. Introspection Response.
-  #
-  # Using with caution:
-  # Keep in mind that these three parameters pass to block can be nil as following case:
-  #  `authorized_client` is nil if and only if `authorized_token` is present, and vice versa.
-  #  `token` will be nil if and only if `authorized_token` is present.
-  # So remember to use `&` or check if it is present before calling method on
-  # them to make sure you doesn't get NoMethodError exception.
-  #
-  # You can define your custom check:
-  #
-  # allow_token_introspection do |token, authorized_client, authorized_token|
-  #   if authorized_token
-  #     # customize: require `introspection` scope
-  #     authorized_token.application == token&.application ||
-  #       authorized_token.scopes.include?("introspection")
-  #   elsif token.application
-  #     # `protected_resource` is a new database boolean column, for example
-  #     authorized_client == token.application || authorized_client.protected_resource?
-  #   else
-  #     # public token (when token.application is nil, token doesn't belong to any application)
-  #     true
-  #   end
-  # end
-  #
-  # Or you can completely disable any token introspection:
-  #
-  # allow_token_introspection false
-  #
-  # If you need to block the request at all, then configure your routes.rb or web-server
-  # like nginx to forbid the request.
-
-  # WWW-Authenticate Realm (default "Doorkeeper").
-  realm "Doorkeeper"
-end

data/spec/dummy/config/initializers/secret_token.rb

@@ -1,10 +0,0 @@
-# frozen_string_literal: true
-
-# Be sure to restart your server when you modify this file.
-
-# Your secret key for verifying the integrity of signed cookies.
-# If you change this key, all old signed cookies will become invalid!
-# Make sure the secret is at least 30 characters and all random,
-# no regular words or you'll be exposed to dictionary attacks.
-Dummy::Application.config.secret_key_base =
-  "c00157b5a1bb6181792f0f4a8a080485de7bab9987e6cf159"

data/spec/dummy/config/initializers/session_store.rb

@@ -1,10 +0,0 @@
-# frozen_string_literal: true
-
-# Be sure to restart your server when you modify this file.
-
-Dummy::Application.config.session_store :cookie_store, key: "_dummy_session"
-
-# Use the database for sessions instead of the cookie-based default,
-# which shouldn't be used to store highly confidential information
-# (create the session table with "rails generate session_migration")
-# Dummy::Application.config.session_store :active_record_store

data/spec/dummy/config/initializers/wrap_parameters.rb

@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-# Be sure to restart your server when you modify this file.
-#
-# This file contains settings for ActionController::ParamsWrapper which
-# is enabled by default.
-
-# Enable parameter wrapping for JSON. You can disable this by setting :format to an empty array.
-ActiveSupport.on_load(:action_controller) do
-  wrap_parameters format: [:json]
-end
-
-# Disable root element in JSON by default.
-ActiveSupport.on_load(:active_record) do
-  self.include_root_in_json = false
-end

data/spec/dummy/config/locales/doorkeeper.en.yml

@@ -1,5 +0,0 @@
-en:
-  doorkeeper:
-    scopes:
-      public: "Access your public data"
-      write:  "Update your data"

data/spec/dummy/config/routes.rb

@@ -1,13 +0,0 @@
-Rails.application.routes.draw do
-  use_doorkeeper
-
-  resources :semi_protected_resources
-  resources :full_protected_resources
-
-  get 'metal.json' => 'metal#index'
-
-  get '/callback', to: 'home#callback'
-  get '/sign_in',  to: 'home#sign_in'
-
-  root to: 'home#index'
-end

data/spec/dummy/config.ru

@@ -1,6 +0,0 @@
-# frozen_string_literal: true
-
-# This file is used by Rack-based servers to start the application.
-
-require ::File.expand_path("../config/environment", __FILE__)
-run Dummy::Application

data/spec/dummy/db/migrate/20111122132257_create_users.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-class CreateUsers < ActiveRecord::Migration[4.2]
-  def change
-    create_table :users do |t|
-      t.string :name
-
-      t.timestamps
-    end
-  end
-end

data/spec/dummy/db/migrate/20120312140401_add_password_to_users.rb

@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-class AddPasswordToUsers < ActiveRecord::Migration[4.2]
-  def change
-    add_column :users, :password, :string
-  end
-end

data/spec/dummy/db/migrate/20151223192035_create_doorkeeper_tables.rb

@@ -1,69 +0,0 @@
-# frozen_string_literal: true
-
-class CreateDoorkeeperTables < ActiveRecord::Migration[4.2]
-  def change
-    create_table :oauth_applications do |t|
-      t.string  :name,    null: false
-      t.string  :uid,     null: false
-      t.string  :secret,  null: false
-
-      # Remove `null: false` if you are planning to use grant flows
-      # that doesn't require redirect URI to be used during authorization
-      # like Client Credentials flow or Resource Owner Password.
-      t.text    :redirect_uri, null: false
-      t.string  :scopes,       null: false, default: ""
-      t.timestamps             null: false
-    end
-
-    add_index :oauth_applications, :uid, unique: true
-
-    create_table :oauth_access_grants do |t|
-      t.references :resource_owner,  null: false
-      t.references :application,     null: false
-      t.string   :token,             null: false
-      t.integer  :expires_in,        null: false
-      t.text     :redirect_uri,      null: false
-      t.datetime :created_at,        null: false
-      t.datetime :revoked_at
-      t.string   :scopes,            null: false, default: ""
-    end
-
-    add_index :oauth_access_grants, :token, unique: true
-    add_foreign_key(
-      :oauth_access_grants,
-      :oauth_applications,
-      column: :application_id
-    )
-
-    create_table :oauth_access_tokens do |t|
-      t.references :resource_owner, index: true
-      t.references :application,    null: false
-
-      # If you use a custom token generator you may need to change this column
-      # from string to text, so that it accepts tokens larger than 255
-      # characters. More info on custom token generators in:
-      # https://github.com/doorkeeper-gem/doorkeeper/tree/v3.0.0.rc1#custom-access-token-generator
-      #
-      # t.text :token, null: false
-      t.string :token, null: false
-
-      t.string   :refresh_token
-      t.integer  :expires_in
-      t.datetime :revoked_at
-      t.datetime :created_at, null: false
-      t.string   :scopes
-    end
-
-    add_index :oauth_access_tokens, :token, unique: true
-    add_index :oauth_access_tokens, :refresh_token, unique: true
-    add_foreign_key(
-      :oauth_access_tokens,
-      :oauth_applications,
-      column: :application_id
-    )
-
-    # Uncomment below to ensure a valid reference to the resource owner's table
-    add_foreign_key :oauth_access_grants, :users, column: :resource_owner_id
-    add_foreign_key :oauth_access_tokens, :users, column: :resource_owner_id
-  end
-end

data/spec/dummy/db/migrate/20151223200000_add_owner_to_application.rb

@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-class AddOwnerToApplication < ActiveRecord::Migration[4.2]
-  def change
-    add_column :oauth_applications, :owner_id, :integer, null: true
-    add_column :oauth_applications, :owner_type, :string, null: true
-    add_index :oauth_applications, %i[owner_id owner_type]
-  end
-end

data/spec/dummy/db/migrate/20160320211015_add_previous_refresh_token_to_access_tokens.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-class AddPreviousRefreshTokenToAccessTokens < ActiveRecord::Migration[4.2]
-  def change
-    add_column(
-      :oauth_access_tokens,
-      :previous_refresh_token,
-      :string,
-      default: "",
-      null: false
-    )
-  end
-end

data/spec/dummy/db/migrate/20170822064514_enable_pkce.rb

@@ -1,8 +0,0 @@
-# frozen_string_literal: true
-
-class EnablePkce < ActiveRecord::Migration[4.2]
-  def change
-    add_column :oauth_access_grants, :code_challenge, :string, null: true
-    add_column :oauth_access_grants, :code_challenge_method, :string, null: true
-  end
-end

data/spec/dummy/db/migrate/20180210183654_add_confidential_to_applications.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-class AddConfidentialToApplications < ActiveRecord::Migration[5.1]
-  def change
-    add_column(
-      :oauth_applications,
-      :confidential,
-      :boolean,
-      null: false,
-      default: true # maintaining backwards compatibility: require secrets
-    )
-  end
-end

data/spec/dummy/db/schema.rb

@@ -1,68 +0,0 @@
-# This file is auto-generated from the current state of the database. Instead
-# of editing this file, please use the migrations feature of Active Record to
-# incrementally modify your database, and then regenerate this schema definition.
-#
-# Note that this schema.rb definition is the authoritative source for your
-# database schema. If you need to create the application database on another
-# system, you should be using db:schema:load, not running all the migrations
-# from scratch. The latter is a flawed and unsustainable approach (the more migrations
-# you'll amass, the slower it'll run and the greater likelihood for issues).
-#
-# It's strongly recommended that you check this file into your version control system.
-
-ActiveRecord::Schema.define(version: 20180210183654) do
-
-  create_table "oauth_access_grants", force: :cascade do |t|
-    t.integer "resource_owner_id", null: false
-    t.integer "application_id", null: false
-    t.string "token", null: false
-    t.integer "expires_in", null: false
-    t.text "redirect_uri", null: false
-    t.datetime "created_at", null: false
-    t.datetime "revoked_at"
-    t.string "scopes"
-    unless ENV['WITHOUT_PKCE']
-      t.string   "code_challenge"
-      t.string   "code_challenge_method"
-    end
-    t.index ["token"], name: "index_oauth_access_grants_on_token", unique: true
-  end
-
-  create_table "oauth_access_tokens", force: :cascade do |t|
-    t.integer "resource_owner_id"
-    t.integer "application_id"
-    t.string "token", null: false
-    t.string "refresh_token"
-    t.integer "expires_in"
-    t.datetime "revoked_at"
-    t.datetime "created_at", null: false
-    t.string "scopes"
-    t.string "previous_refresh_token", default: "", null: false
-    t.index ["refresh_token"], name: "index_oauth_access_tokens_on_refresh_token", unique: true
-    t.index ["resource_owner_id"], name: "index_oauth_access_tokens_on_resource_owner_id"
-    t.index ["token"], name: "index_oauth_access_tokens_on_token", unique: true
-  end
-
-  create_table "oauth_applications", force: :cascade do |t|
-    t.string "name", null: false
-    t.string "uid", null: false
-    t.string "secret", null: false
-    t.text "redirect_uri"
-    t.string "scopes", default: "", null: false
-    t.datetime "created_at", null: false
-    t.datetime "updated_at", null: false
-    t.integer "owner_id"
-    t.string "owner_type"
-    t.boolean "confidential", default: true, null: false
-    t.index ["owner_id", "owner_type"], name: "index_oauth_applications_on_owner_id_and_owner_type"
-    t.index ["uid"], name: "index_oauth_applications_on_uid", unique: true
-  end
-
-  create_table "users", force: :cascade do |t|
-    t.string "name"
-    t.datetime "created_at"
-    t.datetime "updated_at"
-    t.string "password"
-  end
-
-end

data/spec/dummy/public/404.html

@@ -1,26 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <title>The page you were looking for doesn't exist (404)</title>
-  <style type="text/css">
-    body { background-color: #fff; color: #666; text-align: center; font-family: arial, sans-serif; }
-    div.dialog {
-      width: 25em;
-      padding: 0 4em;
-      margin: 4em auto 0 auto;
-      border: 1px solid #ccc;
-      border-right-color: #999;
-      border-bottom-color: #999;
-    }
-    h1 { font-size: 100%; color: #f00; line-height: 1.5em; }
-  </style>
-</head>
-
-<body>
-  <!-- This file lives in public/404.html -->
-  <div class="dialog">
-    <h1>The page you were looking for doesn't exist.</h1>
-    <p>You may have mistyped the address or the page may have moved.</p>
-  </div>
-</body>
-</html>