doorkeeper 5.2.6 → 5.3.0
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of doorkeeper might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/Appraisals +2 -2
- data/CHANGELOG.md +15 -14
- data/Gemfile +2 -2
- data/app/controllers/doorkeeper/application_controller.rb +2 -2
- data/app/controllers/doorkeeper/application_metal_controller.rb +2 -2
- data/app/controllers/doorkeeper/applications_controller.rb +3 -3
- data/app/controllers/doorkeeper/authorizations_controller.rb +2 -2
- data/app/controllers/doorkeeper/authorized_applications_controller.rb +3 -3
- data/gemfiles/rails_5_0.gemfile +2 -2
- data/gemfiles/rails_5_1.gemfile +2 -2
- data/gemfiles/rails_5_2.gemfile +2 -2
- data/gemfiles/rails_6_0.gemfile +2 -2
- data/gemfiles/rails_master.gemfile +2 -2
- data/lib/doorkeeper.rb +2 -3
- data/lib/doorkeeper/config.rb +71 -39
- data/lib/doorkeeper/grape/helpers.rb +1 -1
- data/lib/doorkeeper/helpers/controller.rb +10 -8
- data/lib/doorkeeper/models/access_grant_mixin.rb +7 -6
- data/lib/doorkeeper/models/access_token_mixin.rb +55 -18
- data/lib/doorkeeper/models/application_mixin.rb +3 -3
- data/lib/doorkeeper/models/concerns/ownership.rb +1 -1
- data/lib/doorkeeper/models/concerns/reusable.rb +1 -1
- data/lib/doorkeeper/models/concerns/revocable.rb +0 -27
- data/lib/doorkeeper/oauth/authorization/code.rb +4 -4
- data/lib/doorkeeper/oauth/authorization/token.rb +9 -6
- data/lib/doorkeeper/oauth/authorization_code_request.rb +13 -6
- data/lib/doorkeeper/oauth/base_request.rb +8 -4
- data/lib/doorkeeper/oauth/client.rb +7 -8
- data/lib/doorkeeper/oauth/client_credentials/creator.rb +16 -9
- data/lib/doorkeeper/oauth/client_credentials/issuer.rb +7 -7
- data/lib/doorkeeper/oauth/client_credentials/{validation.rb → validator.rb} +4 -4
- data/lib/doorkeeper/oauth/client_credentials_request.rb +1 -1
- data/lib/doorkeeper/oauth/code_response.rb +2 -2
- data/lib/doorkeeper/oauth/error.rb +1 -1
- data/lib/doorkeeper/oauth/error_response.rb +5 -5
- data/lib/doorkeeper/oauth/helpers/scope_checker.rb +7 -5
- data/lib/doorkeeper/oauth/helpers/unique_token.rb +8 -5
- data/lib/doorkeeper/oauth/helpers/uri_checker.rb +1 -1
- data/lib/doorkeeper/oauth/invalid_request_response.rb +3 -3
- data/lib/doorkeeper/oauth/invalid_token_response.rb +5 -2
- data/lib/doorkeeper/oauth/password_access_token_request.rb +3 -3
- data/lib/doorkeeper/oauth/pre_authorization.rb +7 -5
- data/lib/doorkeeper/oauth/refresh_token_request.rb +5 -5
- data/lib/doorkeeper/oauth/token.rb +2 -2
- data/lib/doorkeeper/oauth/token_introspection.rb +6 -6
- data/lib/doorkeeper/orm/active_record.rb +3 -3
- data/lib/doorkeeper/orm/active_record/access_grant.rb +4 -43
- data/lib/doorkeeper/orm/active_record/access_token.rb +4 -35
- data/lib/doorkeeper/orm/active_record/application.rb +3 -155
- data/lib/doorkeeper/orm/active_record/mixins/access_grant.rb +53 -0
- data/lib/doorkeeper/orm/active_record/mixins/access_token.rb +47 -0
- data/lib/doorkeeper/orm/active_record/mixins/application.rb +128 -0
- data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb +3 -3
- data/lib/doorkeeper/rails/helpers.rb +4 -4
- data/lib/doorkeeper/rails/routes.rb +5 -7
- data/lib/doorkeeper/rake/db.rake +3 -3
- data/lib/doorkeeper/request.rb +1 -1
- data/lib/doorkeeper/request/authorization_code.rb +3 -3
- data/lib/doorkeeper/request/client_credentials.rb +2 -2
- data/lib/doorkeeper/request/password.rb +2 -2
- data/lib/doorkeeper/request/refresh_token.rb +3 -3
- data/lib/doorkeeper/server.rb +1 -1
- data/lib/doorkeeper/stale_records_cleaner.rb +1 -1
- data/lib/doorkeeper/version.rb +2 -2
- data/lib/generators/doorkeeper/application_owner_generator.rb +1 -1
- data/lib/generators/doorkeeper/confidential_applications_generator.rb +1 -1
- data/lib/generators/doorkeeper/migration_generator.rb +1 -1
- data/lib/generators/doorkeeper/pkce_generator.rb +1 -1
- data/lib/generators/doorkeeper/previous_refresh_token_generator.rb +2 -2
- data/lib/generators/doorkeeper/templates/initializer.rb +39 -8
- data/spec/controllers/application_metal_controller_spec.rb +1 -1
- data/spec/controllers/applications_controller_spec.rb +3 -2
- data/spec/controllers/authorizations_controller_spec.rb +18 -18
- data/spec/controllers/protected_resources_controller_spec.rb +25 -17
- data/spec/controllers/token_info_controller_spec.rb +1 -1
- data/spec/controllers/tokens_controller_spec.rb +1 -1
- data/spec/dummy/db/migrate/20151223192035_create_doorkeeper_tables.rb +3 -3
- data/spec/dummy/db/migrate/20160320211015_add_previous_refresh_token_to_access_tokens.rb +1 -1
- data/spec/dummy/db/migrate/20180210183654_add_confidential_to_applications.rb +1 -1
- data/spec/generators/install_generator_spec.rb +1 -1
- data/spec/generators/previous_refresh_token_generator_spec.rb +2 -2
- data/spec/helpers/doorkeeper/dashboard_helper_spec.rb +1 -1
- data/spec/lib/config_spec.rb +61 -21
- data/spec/lib/doorkeeper_spec.rb +1 -1
- data/spec/lib/models/revocable_spec.rb +3 -3
- data/spec/lib/oauth/authorization_code_request_spec.rb +127 -125
- data/spec/lib/oauth/base_request_spec.rb +160 -158
- data/spec/lib/oauth/base_response_spec.rb +27 -29
- data/spec/lib/oauth/client/credentials_spec.rb +1 -1
- data/spec/lib/oauth/client_credentials/creator_spec.rb +42 -5
- data/spec/lib/oauth/client_credentials/issuer_spec.rb +12 -12
- data/spec/lib/oauth/client_credentials/validation_spec.rb +4 -4
- data/spec/lib/oauth/client_credentials_integration_spec.rb +16 -18
- data/spec/lib/oauth/client_credentials_request_spec.rb +78 -80
- data/spec/lib/oauth/client_spec.rb +26 -26
- data/spec/lib/oauth/code_request_spec.rb +34 -34
- data/spec/lib/oauth/code_response_spec.rb +21 -25
- data/spec/lib/oauth/error_response_spec.rb +42 -44
- data/spec/lib/oauth/error_spec.rb +12 -14
- data/spec/lib/oauth/forbidden_token_response_spec.rb +11 -13
- data/spec/lib/oauth/helpers/scope_checker_spec.rb +30 -18
- data/spec/lib/oauth/invalid_request_response_spec.rb +48 -50
- data/spec/lib/oauth/invalid_token_response_spec.rb +32 -34
- data/spec/lib/oauth/password_access_token_request_spec.rb +145 -147
- data/spec/lib/oauth/pre_authorization_spec.rb +159 -161
- data/spec/lib/oauth/refresh_token_request_spec.rb +138 -139
- data/spec/lib/oauth/scopes_spec.rb +104 -106
- data/spec/lib/oauth/token_request_spec.rb +115 -111
- data/spec/lib/oauth/token_response_spec.rb +71 -73
- data/spec/lib/oauth/token_spec.rb +121 -123
- data/spec/models/doorkeeper/access_grant_spec.rb +3 -5
- data/spec/models/doorkeeper/access_token_spec.rb +7 -7
- data/spec/models/doorkeeper/application_spec.rb +295 -373
- data/spec/requests/applications/applications_request_spec.rb +1 -1
- data/spec/requests/endpoints/authorization_spec.rb +5 -3
- data/spec/requests/flows/authorization_code_spec.rb +34 -22
- data/spec/requests/flows/client_credentials_spec.rb +1 -1
- data/spec/requests/flows/password_spec.rb +32 -12
- data/spec/requests/flows/refresh_token_spec.rb +19 -19
- data/spec/requests/flows/revoke_token_spec.rb +18 -12
- data/spec/spec_helper.rb +1 -4
- data/spec/support/shared/controllers_shared_context.rb +33 -23
- data/spec/validators/redirect_uri_validator_spec.rb +1 -1
- metadata +6 -5
- data/spec/support/http_method_shim.rb +0 -29
@@ -2,220 +2,222 @@
|
|
2
2
|
|
3
3
|
require "spec_helper"
|
4
4
|
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
|
9
|
-
|
10
|
-
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
|
15
|
-
|
16
|
-
end
|
5
|
+
describe Doorkeeper::OAuth::BaseRequest do
|
6
|
+
let(:access_token) do
|
7
|
+
double :access_token,
|
8
|
+
plaintext_token: "some-token",
|
9
|
+
expires_in: "3600",
|
10
|
+
expires_in_seconds: "300",
|
11
|
+
scopes_string: "two scopes",
|
12
|
+
plaintext_refresh_token: "some-refresh-token",
|
13
|
+
token_type: "bearer",
|
14
|
+
created_at: 0
|
15
|
+
end
|
17
16
|
|
18
|
-
|
17
|
+
let(:client) { double :client, id: "1" }
|
19
18
|
|
20
|
-
|
19
|
+
let(:scopes_array) { %w[public write] }
|
21
20
|
|
22
|
-
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
|
27
|
-
|
21
|
+
let(:server) do
|
22
|
+
double :server,
|
23
|
+
access_token_expires_in: 100,
|
24
|
+
custom_access_token_expires_in: ->(_context) { nil },
|
25
|
+
refresh_token_enabled?: false
|
26
|
+
end
|
27
|
+
|
28
|
+
before do
|
29
|
+
allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
|
30
|
+
end
|
31
|
+
|
32
|
+
subject do
|
33
|
+
described_class.new
|
34
|
+
end
|
28
35
|
|
36
|
+
describe "#authorize" do
|
29
37
|
before do
|
30
|
-
allow(
|
38
|
+
allow(subject).to receive(:access_token).and_return(access_token)
|
31
39
|
end
|
32
40
|
|
33
|
-
|
34
|
-
|
41
|
+
it "validates itself" do
|
42
|
+
expect(subject).to receive(:validate).once
|
43
|
+
subject.authorize
|
35
44
|
end
|
36
45
|
|
37
|
-
|
46
|
+
context "valid" do
|
38
47
|
before do
|
39
|
-
allow(subject).to receive(:
|
48
|
+
allow(subject).to receive(:valid?).and_return(true)
|
40
49
|
end
|
41
50
|
|
42
|
-
it "
|
43
|
-
expect(subject).to receive(:
|
51
|
+
it "calls callback methods" do
|
52
|
+
expect(subject).to receive(:before_successful_response).once
|
53
|
+
expect(subject).to receive(:after_successful_response).once
|
44
54
|
subject.authorize
|
45
55
|
end
|
46
56
|
|
47
|
-
|
48
|
-
|
49
|
-
allow(subject).to receive(:valid?).and_return(true)
|
50
|
-
end
|
57
|
+
it "returns a TokenResponse object" do
|
58
|
+
result = subject.authorize
|
51
59
|
|
52
|
-
|
53
|
-
|
54
|
-
|
55
|
-
|
60
|
+
expect(result).to be_an_instance_of(Doorkeeper::OAuth::TokenResponse)
|
61
|
+
expect(result.body).to eq(
|
62
|
+
Doorkeeper::OAuth::TokenResponse.new(access_token).body,
|
63
|
+
)
|
64
|
+
end
|
65
|
+
end
|
66
|
+
|
67
|
+
context "invalid" do
|
68
|
+
context "with error other than invalid_request" do
|
69
|
+
before do
|
70
|
+
allow(subject).to receive(:valid?).and_return(false)
|
71
|
+
allow(subject).to receive(:error).and_return(:server_error)
|
72
|
+
allow(subject).to receive(:state).and_return("hello")
|
56
73
|
end
|
57
74
|
|
58
|
-
it "returns
|
75
|
+
it "returns an ErrorResponse object" do
|
59
76
|
result = subject.authorize
|
60
77
|
|
61
|
-
expect(result).to be_an_instance_of(
|
78
|
+
expect(result).to be_an_instance_of(Doorkeeper::OAuth::ErrorResponse)
|
79
|
+
|
62
80
|
expect(result.body).to eq(
|
63
|
-
|
81
|
+
error: :server_error,
|
82
|
+
error_description: translated_error_message(:server_error),
|
83
|
+
state: "hello",
|
64
84
|
)
|
65
85
|
end
|
66
86
|
end
|
67
87
|
|
68
|
-
context "
|
69
|
-
|
70
|
-
|
71
|
-
|
72
|
-
|
73
|
-
allow(subject).to receive(:state).and_return("hello")
|
74
|
-
end
|
75
|
-
|
76
|
-
it "returns an ErrorResponse object" do
|
77
|
-
result = subject.authorize
|
78
|
-
|
79
|
-
expect(result).to be_an_instance_of(ErrorResponse)
|
80
|
-
|
81
|
-
expect(result.body).to eq(
|
82
|
-
error: :server_error,
|
83
|
-
error_description: translated_error_message(:server_error),
|
84
|
-
state: "hello"
|
85
|
-
)
|
86
|
-
end
|
88
|
+
context "with invalid_request error" do
|
89
|
+
before do
|
90
|
+
allow(subject).to receive(:valid?).and_return(false)
|
91
|
+
allow(subject).to receive(:error).and_return(:invalid_request)
|
92
|
+
allow(subject).to receive(:state).and_return("hello")
|
87
93
|
end
|
88
94
|
|
89
|
-
|
90
|
-
|
91
|
-
allow(subject).to receive(:valid?).and_return(false)
|
92
|
-
allow(subject).to receive(:error).and_return(:invalid_request)
|
93
|
-
allow(subject).to receive(:state).and_return("hello")
|
94
|
-
end
|
95
|
-
|
96
|
-
it "returns an InvalidRequestResponse object" do
|
97
|
-
result = subject.authorize
|
95
|
+
it "returns an InvalidRequestResponse object" do
|
96
|
+
result = subject.authorize
|
98
97
|
|
99
|
-
|
98
|
+
expect(result).to be_an_instance_of(Doorkeeper::OAuth::InvalidRequestResponse)
|
100
99
|
|
101
|
-
|
102
|
-
|
103
|
-
|
104
|
-
|
105
|
-
|
106
|
-
end
|
100
|
+
expect(result.body).to eq(
|
101
|
+
error: :invalid_request,
|
102
|
+
error_description: translated_invalid_request_error_message(:unknown, :unknown),
|
103
|
+
state: "hello",
|
104
|
+
)
|
107
105
|
end
|
108
106
|
end
|
109
107
|
end
|
108
|
+
end
|
110
109
|
|
111
|
-
|
112
|
-
|
113
|
-
|
114
|
-
|
110
|
+
describe "#default_scopes" do
|
111
|
+
it "delegates to the server" do
|
112
|
+
expect(subject).to receive(:server).and_return(server).once
|
113
|
+
expect(server).to receive(:default_scopes).once
|
115
114
|
|
116
|
-
|
117
|
-
end
|
115
|
+
subject.default_scopes
|
118
116
|
end
|
117
|
+
end
|
119
118
|
|
120
|
-
|
121
|
-
|
122
|
-
|
123
|
-
|
124
|
-
|
125
|
-
|
126
|
-
|
127
|
-
|
119
|
+
describe "#find_or_create_access_token" do
|
120
|
+
it "returns an instance of AccessToken" do
|
121
|
+
result = subject.find_or_create_access_token(
|
122
|
+
client,
|
123
|
+
"1",
|
124
|
+
"public",
|
125
|
+
server,
|
126
|
+
)
|
128
127
|
|
129
|
-
|
130
|
-
|
128
|
+
expect(result).to be_an_instance_of(Doorkeeper::AccessToken)
|
129
|
+
end
|
131
130
|
|
132
|
-
|
133
|
-
|
134
|
-
|
135
|
-
|
136
|
-
|
131
|
+
it "respects custom_access_token_expires_in" do
|
132
|
+
server = double(
|
133
|
+
:server,
|
134
|
+
access_token_expires_in: 100,
|
135
|
+
custom_access_token_expires_in: ->(context) { context.scopes == "public" ? 500 : nil },
|
136
|
+
refresh_token_enabled?: false,
|
137
|
+
)
|
137
138
|
|
138
|
-
|
139
|
+
allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
|
139
140
|
|
140
|
-
|
141
|
-
|
142
|
-
|
143
|
-
|
144
|
-
|
145
|
-
|
146
|
-
|
147
|
-
|
141
|
+
result = subject.find_or_create_access_token(
|
142
|
+
client,
|
143
|
+
"1",
|
144
|
+
"public",
|
145
|
+
server,
|
146
|
+
)
|
147
|
+
expect(result.expires_in).to eql(500)
|
148
|
+
end
|
148
149
|
|
149
|
-
|
150
|
-
|
151
|
-
|
152
|
-
|
153
|
-
|
154
|
-
|
155
|
-
|
156
|
-
|
157
|
-
|
158
|
-
|
159
|
-
result = subject.find_or_create_access_token(
|
160
|
-
client,
|
161
|
-
"1",
|
162
|
-
"public",
|
163
|
-
server
|
164
|
-
)
|
165
|
-
expect(result.refresh_token).to_not be_nil
|
150
|
+
it "respects use_refresh_token with a block" do
|
151
|
+
server = double(
|
152
|
+
:server,
|
153
|
+
access_token_expires_in: 100,
|
154
|
+
custom_access_token_expires_in: ->(_context) { nil },
|
155
|
+
refresh_token_enabled?: lambda { |context|
|
156
|
+
context.scopes == "public"
|
157
|
+
},
|
158
|
+
)
|
166
159
|
|
167
|
-
|
168
|
-
|
169
|
-
|
170
|
-
|
171
|
-
|
172
|
-
|
173
|
-
|
174
|
-
|
160
|
+
allow(server).to receive(:option_defined?).with(:custom_access_token_expires_in).and_return(true)
|
161
|
+
|
162
|
+
result = subject.find_or_create_access_token(
|
163
|
+
client,
|
164
|
+
"1",
|
165
|
+
"public",
|
166
|
+
server,
|
167
|
+
)
|
168
|
+
expect(result.refresh_token).to_not be_nil
|
169
|
+
|
170
|
+
result = subject.find_or_create_access_token(
|
171
|
+
client,
|
172
|
+
"1",
|
173
|
+
"private",
|
174
|
+
server,
|
175
|
+
)
|
176
|
+
expect(result.refresh_token).to be_nil
|
175
177
|
end
|
178
|
+
end
|
176
179
|
|
177
|
-
|
178
|
-
|
179
|
-
|
180
|
-
|
181
|
-
|
180
|
+
describe "#scopes" do
|
181
|
+
context "@original_scopes is present" do
|
182
|
+
before do
|
183
|
+
subject.instance_variable_set(:@original_scopes, "public write")
|
184
|
+
end
|
182
185
|
|
183
|
-
|
184
|
-
|
186
|
+
it "returns array of @original_scopes" do
|
187
|
+
result = subject.scopes
|
185
188
|
|
186
|
-
|
187
|
-
end
|
189
|
+
expect(result).to eq(scopes_array)
|
188
190
|
end
|
191
|
+
end
|
189
192
|
|
190
|
-
|
191
|
-
|
192
|
-
|
193
|
-
|
193
|
+
context "@original_scopes is not present" do
|
194
|
+
before do
|
195
|
+
subject.instance_variable_set(:@original_scopes, "")
|
196
|
+
end
|
194
197
|
|
195
|
-
|
196
|
-
|
197
|
-
|
198
|
+
it "calls #default_scopes" do
|
199
|
+
allow(subject).to receive(:server).and_return(server).once
|
200
|
+
allow(server).to receive(:default_scopes).and_return(scopes_array).once
|
198
201
|
|
199
|
-
|
202
|
+
result = subject.scopes
|
200
203
|
|
201
|
-
|
202
|
-
end
|
204
|
+
expect(result).to eq(scopes_array)
|
203
205
|
end
|
204
206
|
end
|
207
|
+
end
|
205
208
|
|
206
|
-
|
207
|
-
|
208
|
-
|
209
|
-
|
210
|
-
|
211
|
-
end
|
209
|
+
describe "#valid?" do
|
210
|
+
context "error is nil" do
|
211
|
+
it "returns true" do
|
212
|
+
allow(subject).to receive(:error).and_return(nil).once
|
213
|
+
expect(subject.valid?).to eq(true)
|
212
214
|
end
|
215
|
+
end
|
213
216
|
|
214
|
-
|
215
|
-
|
216
|
-
|
217
|
-
|
218
|
-
end
|
217
|
+
context "error is not nil" do
|
218
|
+
it "returns false" do
|
219
|
+
allow(subject).to receive(:error).and_return(Object.new).once
|
220
|
+
expect(subject.valid?).to eq(false)
|
219
221
|
end
|
220
222
|
end
|
221
223
|
end
|
@@ -2,46 +2,44 @@
|
|
2
2
|
|
3
3
|
require "spec_helper"
|
4
4
|
|
5
|
-
|
6
|
-
|
7
|
-
|
8
|
-
|
9
|
-
end
|
5
|
+
describe Doorkeeper::OAuth::BaseResponse do
|
6
|
+
subject do
|
7
|
+
Doorkeeper::OAuth::BaseResponse.new
|
8
|
+
end
|
10
9
|
|
11
|
-
|
12
|
-
|
13
|
-
|
14
|
-
end
|
10
|
+
describe "#body" do
|
11
|
+
it "returns an empty Hash" do
|
12
|
+
expect(subject.body).to eq({})
|
15
13
|
end
|
14
|
+
end
|
16
15
|
|
17
|
-
|
18
|
-
|
19
|
-
|
20
|
-
end
|
16
|
+
describe "#description" do
|
17
|
+
it "returns an empty String" do
|
18
|
+
expect(subject.description).to eq("")
|
21
19
|
end
|
20
|
+
end
|
22
21
|
|
23
|
-
|
24
|
-
|
25
|
-
|
26
|
-
end
|
22
|
+
describe "#headers" do
|
23
|
+
it "returns an empty Hash" do
|
24
|
+
expect(subject.headers).to eq({})
|
27
25
|
end
|
26
|
+
end
|
28
27
|
|
29
|
-
|
30
|
-
|
31
|
-
|
32
|
-
end
|
28
|
+
describe "#redirectable?" do
|
29
|
+
it "returns false" do
|
30
|
+
expect(subject.redirectable?).to eq(false)
|
33
31
|
end
|
32
|
+
end
|
34
33
|
|
35
|
-
|
36
|
-
|
37
|
-
|
38
|
-
end
|
34
|
+
describe "#redirect_uri" do
|
35
|
+
it "returns an empty String" do
|
36
|
+
expect(subject.redirect_uri).to eq("")
|
39
37
|
end
|
38
|
+
end
|
40
39
|
|
41
|
-
|
42
|
-
|
43
|
-
|
44
|
-
end
|
40
|
+
describe "#status" do
|
41
|
+
it "returns :ok" do
|
42
|
+
expect(subject.status).to eq(:ok)
|
45
43
|
end
|
46
44
|
end
|
47
45
|
end
|