doorkeeper 5.2.6 → 5.3.3

data/lib/doorkeeper/orm/active_record/mixins/application.rb

@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+
+module Doorkeeper::Orm::ActiveRecord::Mixins
+  module Application
+    extend ActiveSupport::Concern
+
+    included do
+      self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}"
+
+      include ::Doorkeeper::ApplicationMixin
+
+      has_many :access_grants,
+               foreign_key: :application_id,
+               dependent: :delete_all,
+               class_name: Doorkeeper.config.access_grant_class.to_s
+
+      has_many :access_tokens,
+               foreign_key: :application_id,
+               dependent: :delete_all,
+               class_name: Doorkeeper.config.access_token_class.to_s
+
+      validates :name, :secret, :uid, presence: true
+      validates :uid, uniqueness: { case_sensitive: true }
+      validates :redirect_uri, "doorkeeper/redirect_uri": true
+      validates :confidential, inclusion: { in: [true, false] }
+
+      validate :scopes_match_configured, if: :enforce_scopes?
+
+      before_validation :generate_uid, :generate_secret, on: :create
+
+      has_many :authorized_tokens,
+               -> { where(revoked_at: nil) },
+               foreign_key: :application_id,
+               class_name: Doorkeeper.config.access_token_class.to_s
+
+      has_many :authorized_applications,
+               through: :authorized_tokens,
+               source: :application
+
+      # Generates a new secret for this application, intended to be used
+      # for rotating the secret or in case of compromise.
+      #
+      # @return [String] new transformed secret value
+      #
+      def renew_secret
+        @raw_secret = Doorkeeper::OAuth::Helpers::UniqueToken.generate
+        secret_strategy.store_secret(self, :secret, @raw_secret)
+      end
+
+      # We keep a volatile copy of the raw secret for initial communication
+      # The stored refresh_token may be mapped and not available in cleartext.
+      #
+      # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+      # while hashing strategies do not, so you cannot rely on this value
+      # returning a present value for persisted tokens.
+      def plaintext_secret
+        if secret_strategy.allows_restoring_secrets?
+          secret_strategy.restore_secret(self, :secret)
+        else
+          @raw_secret
+        end
+      end
+
+      # Represents client as set of it's attributes in JSON format.
+      # This is the right way how we want to override ActiveRecord #to_json.
+      #
+      # Respects privacy settings and serializes minimum set of attributes
+      # for public/private clients and full set for authorized owners.
+      #
+      # @return [Hash] entity attributes for JSON
+      #
+      def as_json(options = {})
+        # if application belongs to some owner we need to check if it's the same as
+        # the one passed in the options or check if we render the client as an owner
+        if (respond_to?(:owner) && owner && owner == options[:current_resource_owner]) ||
+           options[:as_owner]
+          # Owners can see all the client attributes, fallback to ActiveModel serialization
+          super
+        else
+          # if application has no owner or it's owner doesn't match one from the options
+          # we render only minimum set of attributes that could be exposed to a public
+          only = extract_serializable_attributes(options)
+          super(options.merge(only: only))
+        end
+      end
+
+      def authorized_for_resource_owner?(resource_owner)
+        Doorkeeper.configuration.authorize_resource_owner_for_client.call(self, resource_owner)
+      end
+
+      # We need to hook into this method to allow serializing plan-text secrets
+      # when secrets hashing enabled.
+      #
+      # @param key [String] attribute name
+      #
+      def read_attribute_for_serialization(key)
+        return super unless key.to_s == "secret"
+
+        plaintext_secret || secret
+      end
+
+      private
+
+      def generate_uid
+        self.uid = Doorkeeper::OAuth::Helpers::UniqueToken.generate if uid.blank?
+      end
+
+      def generate_secret
+        return if secret.present?
+
+        renew_secret
+      end
+
+      def scopes_match_configured
+        if scopes.present? && !Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
+          scope_str: scopes.to_s,
+          server_scopes: Doorkeeper.config.scopes,
+        )
+          errors.add(:scopes, :not_match_configured)
+        end
+      end
+
+      def enforce_scopes?
+        Doorkeeper.config.enforce_configured_scopes?
+      end
+
+      # Helper method to extract collection of serializable attribute names
+      # considering serialization options (like `only`, `except` and so on).
+      #
+      # @param options [Hash] serialization options
+      #
+      # @return [Array<String>]
+      #   collection of attributes to be serialized using #as_json
+      #
+      def extract_serializable_attributes(options = {})
+        opts = options.try(:dup) || {}
+        only = Array.wrap(opts[:only]).map(&:to_s)
+
+        only = if only.blank?
+                 serializable_attributes
+               else
+                 only & serializable_attributes
+               end
+
+        only -= Array.wrap(opts[:except]).map(&:to_s) if opts.key?(:except)
+        only.uniq
+      end
+
+      # Collection of attributes that could be serialized for public.
+      # Override this method if you need additional attributes to be serialized.
+      #
+      # @return [Array<String>] collection of serializable attributes
+      def serializable_attributes
+        attributes = %w[id name created_at]
+        attributes << "uid" unless confidential?
+        attributes
+      end
+    end
+
+    module ClassMethods
+      # Returns Applications associated with active (not revoked) Access Tokens
+      # that are owned by the specific Resource Owner.
+      #
+      # @param resource_owner [ActiveRecord::Base]
+      #   Resource Owner model instance
+      #
+      # @return [ActiveRecord::Relation]
+      #   Applications authorized for the Resource Owner
+      #
+      def authorized_for(resource_owner)
+        resource_access_tokens = Doorkeeper.config.access_token_model.active_for(resource_owner)
+        where(id: resource_access_tokens.select(:application_id).distinct)
+      end
+
+      # Revokes AccessToken and AccessGrant records that have not been revoked and
+      # associated with the specific Application and Resource Owner.
+      #
+      # @param resource_owner [ActiveRecord::Base]
+      #   instance of the Resource Owner model
+      #
+      def revoke_tokens_and_grants_for(id, resource_owner)
+        Doorkeeper.config.access_token_model.revoke_all_for(id, resource_owner)
+        Doorkeeper.config.access_grant_model.revoke_all_for(id, resource_owner)
+      end
+    end
+  end
+end

data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -8,7 +8,7 @@ module Doorkeeper
   class RedirectUriValidator < ActiveModel::EachValidator
     def validate_each(record, attribute, value)
       if value.blank?
-        return if Doorkeeper.configuration.allow_blank_redirect_uri?(record)
+        return if Doorkeeper.config.allow_blank_redirect_uri?(record)
 
         record.errors.add(attribute, :blank)
       else
@@ -34,7 +34,7 @@ module Doorkeeper
     end
 
     def forbidden_uri?(uri)
-      Doorkeeper.configuration.forbid_redirect_uri.call(uri)
+      Doorkeeper.config.forbid_redirect_uri.call(uri)
     end
 
     def unspecified_scheme?(uri)
@@ -48,7 +48,7 @@ module Doorkeeper
     end
 
     def invalid_ssl_uri?(uri)
-      forces_ssl = Doorkeeper.configuration.force_ssl_in_redirect_uri
+      forces_ssl = Doorkeeper.config.force_ssl_in_redirect_uri
       non_https = uri.try(:scheme) == "http"
 
       if forces_ssl.respond_to?(:call)

data/lib/doorkeeper/orm/active_record.rb

@@ -20,9 +20,9 @@ module Doorkeeper
           require "doorkeeper/orm/active_record/access_token"
           require "doorkeeper/orm/active_record/application"
 
-          if Doorkeeper.configuration.active_record_options[:establish_connection]
+          if Doorkeeper.config.active_record_options[:establish_connection]
             Doorkeeper::Orm::ActiveRecord.models.each do |model|
-              options = Doorkeeper.configuration.active_record_options[:establish_connection]
+              options = Doorkeeper.config.active_record_options[:establish_connection]
               model.establish_connection(options)
             end
           end
@@ -33,7 +33,7 @@ module Doorkeeper
         lazy_load do
           require "doorkeeper/models/concerns/ownership"
 
-          Doorkeeper::Application.send :include, Doorkeeper::Models::Ownership
+          Doorkeeper.config.application_model.send :include, Doorkeeper::Models::Ownership
         end
       end
 

data/lib/doorkeeper/rails/helpers.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   module Rails
     module Helpers
       def doorkeeper_authorize!(*scopes)
-        @_doorkeeper_scopes = scopes.presence || Doorkeeper.configuration.default_scopes
+        @_doorkeeper_scopes = scopes.presence || Doorkeeper.config.default_scopes
 
         doorkeeper_render_error unless valid_doorkeeper_token?
       end
@@ -21,7 +21,7 @@ module Doorkeeper
 
       def doorkeeper_render_error
         error = doorkeeper_error
-        error.raise_exception! if Doorkeeper.configuration.raise_on_errors?
+        error.raise_exception! if Doorkeeper.config.raise_on_errors?
 
         headers.merge!(error.headers.reject { |k| k == "Content-Type" })
         doorkeeper_render_error_with(error)
@@ -30,7 +30,7 @@ module Doorkeeper
       def doorkeeper_render_error_with(error)
         options = doorkeeper_render_options(error) || {}
         status = doorkeeper_status_for_error(
-          error, options.delete(:respond_not_found_when_forbidden)
+          error, options.delete(:respond_not_found_when_forbidden),
         )
         if options.blank?
           head status
@@ -72,7 +72,7 @@ module Doorkeeper
       def doorkeeper_token
         @doorkeeper_token ||= OAuth::Token.authenticate(
           request,
-          *Doorkeeper.configuration.access_token_methods
+          *Doorkeeper.config.access_token_methods,
         )
       end
     end

data/lib/doorkeeper/rails/routes.rb

@@ -17,7 +17,7 @@ module Doorkeeper
       end
 
       def self.install!
-        ActionDispatch::Routing::Mapper.send :include, Doorkeeper::Rails::Routes::Helper
+        ActionDispatch::Routing::Mapper.include Doorkeeper::Rails::Routes::Helper
       end
 
       attr_reader :routes
@@ -26,9 +26,7 @@ module Doorkeeper
         @routes = routes
         @mapping = Mapper.new.map(&block)
 
-        if Doorkeeper.configuration.api_only
-          @mapping.skips.push(:applications, :authorized_applications)
-        end
+        @mapping.skips.push(:applications, :authorized_applications) if Doorkeeper.config.api_only
       end
 
       def generate_routes!(options)
@@ -59,7 +57,7 @@ module Doorkeeper
           path: "authorize",
           only: %i[create destroy],
           as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         ) do
           routes.get "/native", action: :show, on: :member
           routes.get "/", action: :new, on: :member
@@ -71,7 +69,7 @@ module Doorkeeper
           :token,
           path: "token",
           only: [:create], as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         )
       end
 
@@ -88,7 +86,7 @@ module Doorkeeper
           :token_info,
           path: "token/info",
           only: [:show], as: mapping[:as],
-          controller: mapping[:controllers]
+          controller: mapping[:controllers],
         )
       end
 

data/lib/doorkeeper/rake/db.rake

@@ -19,9 +19,9 @@ namespace :doorkeeper do
 
       desc "Removes expired (TTL passed) access tokens"
       task expired_tokens: "doorkeeper:setup" do
-        expirable_tokens = Doorkeeper::AccessToken.where(refresh_token: nil)
+        expirable_tokens = Doorkeeper.config.access_token_model.where(refresh_token: nil)
         cleaner = Doorkeeper::StaleRecordsCleaner.new(expirable_tokens)
-        cleaner.clean_expired(Doorkeeper.configuration.access_token_expires_in)
+        cleaner.clean_expired(Doorkeeper.config.access_token_expires_in)
       end
 
       desc "Removes stale access grants"
@@ -33,7 +33,7 @@ namespace :doorkeeper do
       desc "Removes expired (TTL passed) access grants"
       task expired_grants: "doorkeeper:setup" do
         cleaner = Doorkeeper::StaleRecordsCleaner.new(Doorkeeper::AccessGrant)
-        cleaner.clean_expired(Doorkeeper.configuration.authorization_code_expires_in)
+        cleaner.clean_expired(Doorkeeper.config.authorization_code_expires_in)
       end
     end
   end

data/lib/doorkeeper/request/authorization_code.rb

@@ -7,10 +7,10 @@ module Doorkeeper
 
       def request
         @request ||= OAuth::AuthorizationCodeRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           grant,
           client,
-          parameters
+          parameters,
         )
       end
 
@@ -19,7 +19,7 @@ module Doorkeeper
       def grant
         raise Errors::MissingRequiredParameter, :code if parameters[:code].blank?
 
-        AccessGrant.by_token(parameters[:code])
+        Doorkeeper.config.access_grant_model.by_token(parameters[:code])
       end
     end
   end

data/lib/doorkeeper/request/client_credentials.rb

@@ -7,9 +7,9 @@ module Doorkeeper
 
       def request
         @request ||= OAuth::ClientCredentialsRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           client,
-          parameters
+          parameters,
         )
       end
     end

data/lib/doorkeeper/request/password.rb

@@ -7,10 +7,10 @@ module Doorkeeper
 
       def request
         @request ||= OAuth::PasswordAccessTokenRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           client,
           resource_owner,
-          parameters
+          parameters,
         )
       end
     end

data/lib/doorkeeper/request/refresh_token.rb

@@ -6,14 +6,14 @@ module Doorkeeper
       delegate :credentials, :parameters, to: :server
 
       def refresh_token
-        AccessToken.by_refresh_token(parameters[:refresh_token])
+        Doorkeeper.config.access_token_model.by_refresh_token(parameters[:refresh_token])
       end
 
       def request
         @request ||= OAuth::RefreshTokenRequest.new(
-          Doorkeeper.configuration,
+          Doorkeeper.config,
           refresh_token, credentials,
-          parameters
+          parameters,
         )
       end
     end

data/lib/doorkeeper/request.rb

@@ -24,7 +24,7 @@ module Doorkeeper
       private
 
       def token_grant_types
-        Doorkeeper.configuration.token_grant_types
+        Doorkeeper.config.token_grant_types
       end
 
       def build_strategy_class(grant_or_request_type)

data/lib/doorkeeper/server.rb

@@ -37,7 +37,7 @@ module Doorkeeper
     end
 
     def credentials
-      methods = Doorkeeper.configuration.client_credentials_methods
+      methods = Doorkeeper.config.client_credentials_methods
       @credentials ||= OAuth::Client::Credentials.from_request(context.request, *methods)
     end
   end

data/lib/doorkeeper/stale_records_cleaner.rb

@@ -14,7 +14,7 @@ module Doorkeeper
     end
 
     def self.configured_orm
-      Doorkeeper.configuration.orm
+      Doorkeeper.config.orm
     end
 
     def self.new(base_scope)

data/lib/doorkeeper/version.rb

@@ -8,8 +8,8 @@ module Doorkeeper
   module VERSION
     # Semantic versioning
     MAJOR = 5
-    MINOR = 2
-    TINY = 6
+    MINOR = 3
+    TINY = 3
     PRE = nil
 
     # Full version number

data/lib/doorkeeper.rb

@@ -38,10 +38,9 @@ require "doorkeeper/oauth/authorization_code_request"
 require "doorkeeper/oauth/refresh_token_request"
 require "doorkeeper/oauth/password_access_token_request"
 
-require "doorkeeper/oauth/client_credentials/validation"
+require "doorkeeper/oauth/client_credentials/validator"
 require "doorkeeper/oauth/client_credentials/creator"
 require "doorkeeper/oauth/client_credentials/issuer"
-require "doorkeeper/oauth/client_credentials/validation"
 require "doorkeeper/oauth/client/credentials"
 
 require "doorkeeper/oauth/client_credentials_request"
@@ -85,7 +84,7 @@ require "doorkeeper/orm/active_record"
 # Main Doorkeeper namespace.
 #
 module Doorkeeper
-  def self.authenticate(request, methods = Doorkeeper.configuration.access_token_methods)
+  def self.authenticate(request, methods = Doorkeeper.config.access_token_methods)
     OAuth::Token.authenticate(request, *methods)
   end
 end

data/lib/generators/doorkeeper/application_owner_generator.rb

@@ -16,7 +16,7 @@ module Doorkeeper
       migration_template(
         "add_owner_to_application_migration.rb.erb",
         "db/migrate/add_owner_to_application.rb",
-        migration_version: migration_version
+        migration_version: migration_version,
       )
     end
 

data/lib/generators/doorkeeper/confidential_applications_generator.rb

@@ -16,7 +16,7 @@ module Doorkeeper
       migration_template(
         "add_confidential_to_applications.rb.erb",
         "db/migrate/add_confidential_to_applications.rb",
-        migration_version: migration_version
+        migration_version: migration_version,
       )
     end
 

data/lib/generators/doorkeeper/migration_generator.rb

@@ -15,7 +15,7 @@ module Doorkeeper
       migration_template(
         "migration.rb.erb",
         "db/migrate/create_doorkeeper_tables.rb",
-        migration_version: migration_version
+        migration_version: migration_version,
       )
     end
 

data/lib/generators/doorkeeper/pkce_generator.rb

@@ -16,7 +16,7 @@ module Doorkeeper
       migration_template(
         "enable_pkce_migration.rb.erb",
         "db/migrate/enable_pkce.rb",
-        migration_version: migration_version
+        migration_version: migration_version,
       )
     end
 

data/lib/generators/doorkeeper/previous_refresh_token_generator.rb

@@ -21,7 +21,7 @@ module Doorkeeper
 
       migration_template(
         "add_previous_refresh_token_to_access_tokens.rb.erb",
-        "db/migrate/add_previous_refresh_token_to_access_tokens.rb"
+        "db/migrate/add_previous_refresh_token_to_access_tokens.rb",
       )
     end
 
@@ -34,7 +34,7 @@ module Doorkeeper
     def no_previous_refresh_token_column?
       !ActiveRecord::Base.connection.column_exists?(
         :oauth_access_tokens,
-        :previous_refresh_token
+        :previous_refresh_token,
       )
     end
   end

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -29,6 +29,35 @@ Doorkeeper.configure do
   #   end
   # end
 
+  # You can use your own model classes if you need to extend (or even override) default
+  # Doorkeeper models such as `Application`, `AccessToken` and `AccessGrant.
+  #
+  # Be default Doorkeeper ActiveRecord ORM uses it's own classes:
+  #
+  # access_token_class "Doorkeeper::AccessToken"
+  # access_grant_class "Doorkeeper::AccessGrant"
+  # application_class "Doorkeeper::Application"
+  #
+  # Don't forget to include Doorkeeper ORM mixins into your custom models:
+  #
+  #   *  ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken - for access token
+  #   *  ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant - for access grant
+  #   *  ::Doorkeeper::Orm::ActiveRecord::Mixins::Application - for application (OAuth2 clients)
+  #
+  # For example:
+  #
+  # access_token_class "MyAccessToken"
+  #
+  # class MyAccessToken < ApplicationRecord
+  #   include ::Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken
+  #
+  #   self.table_name = "hey_i_wanna_my_name"
+  #
+  #   def destroy_me!
+  #     destroy
+  #   end
+  # end
+
   # If you are planning to use Doorkeeper in Rails 5 API-only application, then you might
   # want to use API mode that will skip all the views management and change the way how
   # Doorkeeper responds to a requests.
@@ -106,6 +135,16 @@ Doorkeeper.configure do
   #
   # token_reuse_limit 100
 
+  # Only allow one valid access token obtained via client credentials
+  # per client. If a new access token is obtained before the old one
+  # expired, the old one gets revoked (disabled by default)
+  #
+  # When enabling this option, make sure that you do not expect multiple processes
+  # using the same credentials at the same time (e.g. web servers spanning
+  # multiple machines and/or processes).
+  #
+  # revoke_previous_client_credentials_token
+
   # Hash access and refresh tokens before persisting them.
   # This will disable the possibility to use +reuse_access_token+
   # since plain values can no longer be retrieved.

data/spec/controllers/application_metal_controller_spec.rb

@@ -21,7 +21,7 @@ describe Doorkeeper::ApplicationMetalController do
   end
 
   describe "enforce_content_type" do
-    before { allow(Doorkeeper.configuration).to receive(:enforce_content_type).and_return(flag) }
+    before { allow(Doorkeeper.config).to receive(:enforce_content_type).and_return(flag) }
 
     context "enabled" do
       let(:flag) { true }

data/spec/controllers/applications_controller_spec.rb

@@ -117,7 +117,7 @@ module Doorkeeper
 
     context "when admin is not authenticated" do
       before do
-        allow(Doorkeeper.configuration).to receive(:authenticate_admin).and_return(proc do
+        allow(Doorkeeper.config).to receive(:authenticate_admin).and_return(proc do
           redirect_to main_app.root_url
         end)
       end
@@ -142,7 +142,8 @@ module Doorkeeper
     context "when admin is authenticated" do
       context "when application secrets are hashed" do
         before do
-          allow(Doorkeeper.configuration).to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Sha256Hash)
+          allow(Doorkeeper.configuration)
+            .to receive(:application_secret_strategy).and_return(Doorkeeper::SecretStoring::Sha256Hash)
         end
 
         it "shows the application secret after creating a new application" do