doorkeeper 5.2.6 → 5.3.0

data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -8,7 +8,7 @@ module Doorkeeper
   class RedirectUriValidator < ActiveModel::EachValidator
     def validate_each(record, attribute, value)
       if value.blank?
-        return if Doorkeeper.configuration.allow_blank_redirect_uri?(record)
+        return if Doorkeeper.config.allow_blank_redirect_uri?(record)
 
         record.errors.add(attribute, :blank)
       else
@@ -34,7 +34,7 @@ module Doorkeeper
     end
 
     def forbidden_uri?(uri)
-      Doorkeeper.configuration.forbid_redirect_uri.call(uri)
+      Doorkeeper.config.forbid_redirect_uri.call(uri)
     end
 
     def unspecified_scheme?(uri)
@@ -48,7 +48,7 @@ module Doorkeeper
     end
 
     def invalid_ssl_uri?(uri)
-      forces_ssl = Doorkeeper.configuration.force_ssl_in_redirect_uri
+      forces_ssl = Doorkeeper.config.force_ssl_in_redirect_uri
       non_https = uri.try(:scheme) == "http"
 
       if forces_ssl.respond_to?(:call)

data/lib/doorkeeper/rails/helpers.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   module Rails
     module Helpers
       def doorkeeper_authorize!(*scopes)
-        @_doorkeeper_scopes = scopes.presence || Doorkeeper.configuration.default_scopes
+        @_doorkeeper_scopes = scopes.presence || Doorkeeper.config.default_scopes
 
         doorkeeper_render_error unless valid_doorkeeper_token?
       end
@@ -21,7 +21,7 @@ module Doorkeeper
 
       def doorkeeper_render_error
         error = doorkeeper_error
-        error.raise_exception! if Doorkeeper.configuration.raise_on_errors?
+        error.raise_exception! if Doorkeeper.config.raise_on_errors?
 
         headers.merge!(error.headers.reject { |k| k == "Content-Type" })
         doorkeeper_render_error_with(error)
@@ -30,7 +30,7 @@ module Doorkeeper
       def doorkeeper_render_error_with(error)
         options = doorkeeper_render_options(error) || {}
         status = doorkeeper_status_for_error(
-          error, options.delete(:respond_not_found_when_forbidden)
+          error, options.delete(:respond_not_found_when_forbidden),
         )
         if options.blank?
           head status
@@ -72,7 +72,7 @@ module Doorkeeper
       def doorkeeper_token
         @doorkeeper_token ||= OAuth::Token.authenticate(
           request,
-          *Doorkeeper.configuration.access_token_methods
+          *Doorkeeper.config.access_token_methods,
         )
       end
     end

data/lib/doorkeeper/rails/routes.rb

@@ -17,7 +17,7 @@ module Doorkeeper
       end
 
       def self.install!
-        ActionDispatch::Routing::Mapper.send :include, Doorkeeper::Rails::Routes::Helper
+        ActionDispatch::Routing::Mapper.include Doorkeeper::Rails::Routes::Helper
       end
 
       attr_reader :routes
@@ -26,9 +26,7 @@ module Doorkeeper
         @routes = routes
         @mapping = Mapper.new.map(&block)
 
-        if Doorkeeper.configuration.api_only
-          @mapping.skips.push(:applications, :authorized_applications)
-        end
+        @mapping.skips.push(:applications, :authorized_applications) if Doorkeeper.config.api_only
       end
 
       def generate_routes!(options)
@@ -59,7 +57,7 @@ module Doorkeeper
           path: "authorize",
           only: %i[create destroy],
           as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         ) do
           routes.get "/native", action: :show, on: :member
           routes.get "/", action: :new, on: :member
@@ -71,7 +69,7 @@ module Doorkeeper
           :token,
           path: "token",
           only: [:create], as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         )
       end
 
@@ -88,7 +86,7 @@ module Doorkeeper
           :token_info,
           path: "token/info",
           only: [:show], as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         )
       end
 

data/lib/doorkeeper/rake/db.rake

@@ -19,9 +19,9 @@ namespace :doorkeeper do
 
       desc "Removes expired (TTL passed) access tokens"
       task expired_tokens: "doorkeeper:setup" do
-        expirable_tokens = Doorkeeper::AccessToken.where(refresh_token: nil)
+        expirable_tokens = Doorkeeper.config.access_token_model.where(refresh_token: nil)
         cleaner = Doorkeeper::StaleRecordsCleaner.new(expirable_tokens)
-        cleaner.clean_expired(Doorkeeper.configuration.access_token_expires_in)
+        cleaner.clean_expired(Doorkeeper.config.access_token_expires_in)
       end
 
       desc "Removes stale access grants"
@@ -33,7 +33,7 @@ namespace :doorkeeper do
       desc "Removes expired (TTL passed) access grants"
       task expired_grants: "doorkeeper:setup" do
         cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
-        cleaner.clean_expired(Doorkeeper.configuration.authorization_code_expires_in)
+        cleaner.clean_expired(Doorkeeper.config.authorization_code_expires_in)
       end
     end
   end

data/lib/doorkeeper/request.rb

@@ -24,7 +24,7 @@ module Doorkeeper
       private
 
       def token_grant_types
-        Doorkeeper.configuration.token_grant_types
+        Doorkeeper.config.token_grant_types
       end
 
       def build_strategy_class(grant_or_request_type)

data/lib/doorkeeper/request/authorization_code.rb

@@ -7,10 +7,10 @@ module Doorkeeper
 
       def request
         @request ||= OAuth::AuthorizationCodeRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           grant,
           client,
-          parameters
+          parameters,
         )
       end
 
@@ -19,7 +19,7 @@ module Doorkeeper
       def grant
         raise Errors::MissingRequiredParameter, :code if parameters[:code].blank?
 
-        AccessGrant.by_token(parameters[:code])
+        Doorkeeper.config.access_grant_model.by_token(parameters[:code])
       end
     end
   end

data/lib/doorkeeper/request/client_credentials.rb

@@ -7,9 +7,9 @@ module Doorkeeper
 
       def request
         @request ||= OAuth::ClientCredentialsRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           client,
-          parameters
+          parameters,
         )
       end
     end

data/lib/doorkeeper/request/password.rb

@@ -7,10 +7,10 @@ module Doorkeeper
 
       def request
         @request ||= OAuth::PasswordAccessTokenRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           client,
           resource_owner,
-          parameters
+          parameters,
         )
       end
     end

data/lib/doorkeeper/request/refresh_token.rb

@@ -6,14 +6,14 @@ module Doorkeeper
       delegate :credentials, :parameters, to: :server
 
       def refresh_token
-        AccessToken.by_refresh_token(parameters[:refresh_token])
+        Doorkeeper.config.access_token_model.by_refresh_token(parameters[:refresh_token])
       end
 
       def request
         @request ||= OAuth::RefreshTokenRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           refresh_token, credentials,
-          parameters
+          parameters,
         )
       end
     end

data/lib/doorkeeper/server.rb

@@ -37,7 +37,7 @@ module Doorkeeper
     end
 
     def credentials
-      methods = Doorkeeper.configuration.client_credentials_methods
+      methods = Doorkeeper.config.client_credentials_methods
       @credentials ||= OAuth::Client::Credentials.from_request(context.request, *methods)
     end
   end

data/lib/doorkeeper/stale_records_cleaner.rb

@@ -14,7 +14,7 @@ module Doorkeeper
     end
 
     def self.configured_orm
-      Doorkeeper.configuration.orm
+      Doorkeeper.config.orm
     end
 
     def self.new(base_scope)

data/lib/doorkeeper/version.rb

@@ -8,8 +8,8 @@ module Doorkeeper
   module VERSION
     # Semantic versioning
     MAJOR = 5
-    MINOR = 2
-    TINY = 6
+    MINOR = 3
+    TINY = 0
     PRE = nil
 
     # Full version number

data/lib/generators/doorkeeper/application_owner_generator.rb

@@ -16,7 +16,7 @@ module Doorkeeper
       migration_template(
         "add_owner_to_application_migration.rb.erb",
         "db/migrate/add_owner_to_application.rb",
-        migration_version: migration_version
+        migration_version: migration_version,
       )
     end
 

data/lib/generators/doorkeeper/confidential_applications_generator.rb

@@ -16,7 +16,7 @@ module Doorkeeper
       migration_template(
         "add_confidential_to_applications.rb.erb",
         "db/migrate/add_confidential_to_applications.rb",
-        migration_version: migration_version
+        migration_version: migration_version,
       )
     end
 

data/lib/generators/doorkeeper/migration_generator.rb

@@ -15,7 +15,7 @@ module Doorkeeper
       migration_template(
         "migration.rb.erb",
         "db/migrate/create_doorkeeper_tables.rb",
-        migration_version: migration_version
+        migration_version: migration_version,
       )
     end
 

data/lib/generators/doorkeeper/pkce_generator.rb

@@ -16,7 +16,7 @@ module Doorkeeper
       migration_template(
         "enable_pkce_migration.rb.erb",
         "db/migrate/enable_pkce.rb",
-        migration_version: migration_version
+        migration_version: migration_version,
       )
     end
 

data/lib/generators/doorkeeper/previous_refresh_token_generator.rb

@@ -21,7 +21,7 @@ module Doorkeeper
 
       migration_template(
         "add_previous_refresh_token_to_access_tokens.rb.erb",
-        "db/migrate/add_previous_refresh_token_to_access_tokens.rb"
+        "db/migrate/add_previous_refresh_token_to_access_tokens.rb",
       )
     end
 
@@ -34,7 +34,7 @@ module Doorkeeper
     def no_previous_refresh_token_column?
       !ActiveRecord::Base.connection.column_exists?(
         :oauth_access_tokens,
-        :previous_refresh_token
+        :previous_refresh_token,
       )
     end
   end

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -29,6 +29,35 @@ Doorkeeper.configure do
   #   end
   # end
 
+  # You can use your own model classes if you need to extend (or even override) default
+  # Doorkeeper models such as `Application`, `AccessToken` and `AccessGrant.
+  #
+  # Be default Doorkeeper ActiveRecord ORM uses it's own classes:
+  #
+  # access_token_class "Doorkeeper::AccessToken"
+  # access_grant_class "Doorkeeper::AccessGrant"
+  # application_class "Doorkeeper::Application"
+  #
+  # Don't forget to include Doorkeeper ORM mixins into your custom models:
+  #
+  #   *  ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken - for access token
+  #   *  ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant - for access grant
+  #   *  ::Doorkeeper::Orm::ActiveRecord::Mixins::Application - for application (OAuth2 clients)
+  #
+  # For example:
+  #
+  # access_token_class "MyAccessToken"
+  #
+  # class MyAccessToken < ApplicationRecord
+  #   include ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken
+  #
+  #   self.table_name = "hey_i_wanna_my_name"
+  #
+  #   def destroy_me!
+  #     destroy
+  #   end
+  # end
+
   # If you are planning to use Doorkeeper in Rails 5 API-only application, then you might
   # want to use API mode that will skip all the views management and change the way how
   # Doorkeeper responds to a requests.
@@ -88,14 +117,6 @@ Doorkeeper.configure do
   #
   # reuse_access_token
 
-  # In case you enabled `reuse_access_token` option Doorkeeper will try to find matching
-  # token using `matching_token_for` Access Token API that searches for valid records
-  # in batches in order not to pollute the memory with all the database records. By default
-  # Doorkeeper uses batch size of 10 000 records. You can increase or decrease this value
-  # depending on your needs and server capabilities.
-  #
-  # token_lookup_batch_size 10_000
-
   # Set a limit for token_reuse if using reuse_access_token option
   #
   # This option limits token_reusability to some extent.
@@ -106,6 +127,16 @@ Doorkeeper.configure do
   #
   # token_reuse_limit 100
 
+  # Only allow one valid access token obtained via client credentials
+  # per client. If a new access token is obtained before the old one
+  # expired, the old one gets revoked (disabled by default)
+  #
+  # When enabling this option, make sure that you do not expect multiple processes
+  # using the same credentials at the same time (e.g. web servers spanning
+  # multiple machines and/or processes).
+  #
+  # revoke_previous_client_credentials_token
+
   # Hash access and refresh tokens before persisting them.
   # This will disable the possibility to use +reuse_access_token+
   # since plain values can no longer be retrieved.

data/spec/controllers/application_metal_controller_spec.rb

@@ -21,7 +21,7 @@ describe Doorkeeper::ApplicationMetalController do
   end
 
   describe "enforce_content_type" do
-    before { allow(Doorkeeper.configuration).to receive(:enforce_content_type).and_return(flag) }
+    before { allow(Doorkeeper.config).to receive(:enforce_content_type).and_return(flag) }
 
     context "enabled" do
       let(:flag) { true }

data/spec/controllers/applications_controller_spec.rb

@@ -117,7 +117,7 @@ module Doorkeeper
 
     context "when admin is not authenticated" do
       before do
-        allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(proc do
+        allow(Doorkeeper.config).to receive(:authenticate_admin).and_return(proc do
           redirect_to main_app.root_url
         end)
       end
@@ -142,7 +142,8 @@ module Doorkeeper
     context "when admin is authenticated" do
       context "when application secrets are hashed" do
         before do
-          allow(Doorkeeper.configuration).to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Sha256Hash)
+          allow(Doorkeeper.configuration)
+            .to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Sha256Hash)
         end
 
         it "shows the application secret after creating a new application" do

data/spec/controllers/authorizations_controller_spec.rb

@@ -27,8 +27,8 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       end)
     end
 
-    allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(["implicit"])
-    allow(Doorkeeper.configuration).to receive(:authenticate_resource_owner).and_return(->(_) { authenticator_method })
+    allow(Doorkeeper.config).to receive(:grant_flows).and_return(["implicit"])
+    allow(Doorkeeper.config).to receive(:authenticate_resource_owner).and_return(->(_) { authenticator_method })
     allow(controller).to receive(:authenticator_method).and_return(user)
     expect(controller).to receive(:authenticator_method).at_most(:once)
   end
@@ -69,7 +69,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "POST #create in API mode" do
     before do
-      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+      allow(Doorkeeper.config).to receive(:api_only).and_return(true)
       post :create, params: { client_id: client.uid, response_type: "token", redirect_uri: client.redirect_uri }
     end
 
@@ -127,7 +127,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
       it "includes error description" do
         expect(response_json_body["error_description"]).to eq(
-          translated_invalid_request_error_message(:missing_param, :client_id)
+          translated_invalid_request_error_message(:missing_param, :client_id),
         )
       end
 
@@ -177,7 +177,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
   describe "POST #create in API mode with errors" do
     context "when missing client_id" do
       before do
-        allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+        allow(Doorkeeper.config).to receive(:api_only).and_return(true)
 
         post :create, params: {
           client_id: "",
@@ -198,7 +198,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
       it "includes error description" do
         expect(response_json_body["error_description"]).to eq(
-          translated_invalid_request_error_message(:missing_param, :client_id)
+          translated_invalid_request_error_message(:missing_param, :client_id),
         )
       end
 
@@ -209,7 +209,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
     context "when other error happens" do
       before do
-        allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+        allow(Doorkeeper.config).to receive(:api_only).and_return(true)
         default_scopes_exist :public
 
         post :create, params: {
@@ -251,7 +251,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "POST #create with application already authorized" do
     before do
-      allow(Doorkeeper.configuration).to receive(:reuse_access_token).and_return(true)
+      allow(Doorkeeper.config).to receive(:reuse_access_token).and_return(true)
 
       access_token.save!
 
@@ -286,12 +286,12 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       end
 
       it "should call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
+        expect(Doorkeeper.config)
           .to receive_message_chain(:before_successful_authorization, :call).with(instance_of(described_class))
       end
 
       it "should call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration)
+        expect(Doorkeeper.config)
           .to receive_message_chain(:after_successful_authorization, :call).with(instance_of(described_class))
       end
     end
@@ -302,18 +302,18 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       end
 
       it "should not call :before_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:before_successful_authorization)
+        expect(Doorkeeper.config).not_to receive(:before_successful_authorization)
       end
 
       it "should not call :after_successful_authorization callback" do
-        expect(Doorkeeper.configuration).not_to receive(:after_successful_authorization)
+        expect(Doorkeeper.config).not_to receive(:after_successful_authorization)
       end
     end
   end
 
   describe "GET #new token request with native url and skip_authorization true" do
     before do
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
+      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
         true
       end)
 
@@ -342,8 +342,8 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "GET #new code request with native url and skip_authorization true" do
     before do
-      allow(Doorkeeper.configuration).to receive(:grant_flows).and_return(%w[authorization_code])
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
+      allow(Doorkeeper.config).to receive(:grant_flows).and_return(%w[authorization_code])
+      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
         true
       end)
 
@@ -373,7 +373,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "GET #new with skip_authorization true" do
     before do
-      allow(Doorkeeper.configuration).to receive(:skip_authorization).and_return(proc do
+      allow(Doorkeeper.config).to receive(:skip_authorization).and_return(proc do
         true
       end)
 
@@ -412,7 +412,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
 
   describe "GET #new in API mode" do
     before do
-      allow(Doorkeeper.configuration).to receive(:api_only).and_return(true)
+      allow(Doorkeeper.config).to receive(:api_only).and_return(true)
 
       get :new, params: {
         client_id: client.uid,
@@ -468,7 +468,7 @@ describe Doorkeeper::AuthorizationsController, "implicit grant flow" do
       expect(redirect_uri.match(/token_type=(\w+)&?/)[1]).to eq "Bearer"
       expect(redirect_uri.match(/expires_in=(\d+)&?/)[1].to_i).to eq 1234
       expect(
-        redirect_uri.match(/access_token=([a-zA-Z0-9\-_]+)&?/)[1]
+        redirect_uri.match(/access_token=([a-zA-Z0-9\-_]+)&?/)[1],
       ).to eq Doorkeeper::AccessToken.first.token
     end