doorkeeper 5.4.0.rc1 → 5.5.0

data/lib/doorkeeper.rb

@@ -6,8 +6,9 @@ require "doorkeeper/engine"
 # Main Doorkeeper namespace.
 #
 module Doorkeeper
-  autoload :OAuth, "doorkeeper/oauth"
   autoload :Errors, "doorkeeper/errors"
+  autoload :GrantFlow, "doorkeeper/grant_flow"
+  autoload :OAuth, "doorkeeper/oauth"
   autoload :Rake, "doorkeeper/rake"
   autoload :Request, "doorkeeper/request"
   autoload :Server, "doorkeeper/server"
@@ -114,4 +115,8 @@ module Doorkeeper
   def self.authenticate(request, methods = Doorkeeper.config.access_token_methods)
     OAuth::Token.authenticate(request, *methods)
   end
+
+  def self.gem_version
+    ::Gem::Version.new(::Doorkeeper::VERSION::STRING)
+  end
 end

data/lib/doorkeeper/config.rb

@@ -1,7 +1,8 @@
 # frozen_string_literal: true
 
-require "doorkeeper/config/option"
 require "doorkeeper/config/abstract_builder"
+require "doorkeeper/config/option"
+require "doorkeeper/config/validations"
 
 module Doorkeeper
   # Defines a MissingConfiguration error for a missing Doorkeeper configuration
@@ -28,6 +29,8 @@ module Doorkeeper
       @config
     end
 
+    # @return [Doorkeeper::Config] configuration instance
+    #
     def configuration
       @config || (raise MissingConfiguration)
     end
@@ -134,15 +137,6 @@ module Doorkeeper
         @config.instance_variable_set(:@reuse_access_token, true)
       end
 
-      # Sets the token_reuse_limit
-      # It will be used only when reuse_access_token option in enabled
-      # By default it will be 100
-      # It will be used for token reusablity to some threshold percentage
-      # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
-      def token_reuse_limit(percentage)
-        @config.instance_variable_set(:@token_reuse_limit, percentage)
-      end
-
       # TODO: maybe make it more generic for other flows too?
       # Only allow one valid access token obtained via client credentials
       # per client. If a new access token is obtained before the old one
@@ -228,6 +222,7 @@ module Doorkeeper
     mattr_reader(:builder_class) { Builder }
 
     extend Option
+    include Validations
 
     option :resource_owner_authenticator,
            as: :authenticate_resource_owner,
@@ -276,6 +271,23 @@ module Doorkeeper
     option :grant_flows,                    default: %w[authorization_code client_credentials]
     option :handle_auth_errors,             default: :render
     option :token_lookup_batch_size,        default: 10_000
+    # Sets the token_reuse_limit
+    # It will be used only when reuse_access_token option in enabled
+    # By default it will be 100
+    # It will be used for token reusablity to some threshold percentage
+    # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1189
+    option :token_reuse_limit,              default: 100
+
+    # This is discouraged. Spec says that password grants always require a client.
+    #
+    # See https://github.com/doorkeeper-gem/doorkeeper/issues/1412#issuecomment-632750422
+    # and https://github.com/doorkeeper-gem/doorkeeper/pull/1420
+    #
+    # Since many applications use this unsafe behavior in the wild, this is kept as a
+    # not-recommended option. You should be aware that you are not following the OAuth
+    # spec, and understand the security implications of doing so.
+    option :skip_client_authentication_for_password_grant,
+           default: false
 
     option :active_record_options,
            default: {},
@@ -425,21 +437,26 @@ module Doorkeeper
                 :token_secret_fallback_strategy,
                 :application_secret_fallback_strategy
 
-    # Return the valid subset of this configuration
-    def validate
-      validate_reuse_access_token_value
-      validate_token_reuse_limit
-      validate_secret_strategies
-    end
-
+    # Doorkeeper Access Token model class.
+    #
+    # @return [ActiveRecord::Base, Mongoid::Document, Sequel::Model]
+    #
     def access_token_model
       @access_token_model ||= access_token_class.constantize
     end
 
+    # Doorkeeper Access Grant model class.
+    #
+    # @return [ActiveRecord::Base, Mongoid::Document, Sequel::Model]
+    #
     def access_grant_model
       @access_grant_model ||= access_grant_class.constantize
     end
 
+    # Doorkeeper Application model class.
+    #
+    # @return [ActiveRecord::Base, Mongoid::Document, Sequel::Model]
+    #
     def application_model
       @application_model ||= application_class.constantize
     end
@@ -460,14 +477,6 @@ module Doorkeeper
       end
     end
 
-    def token_reuse_limit
-      @token_reuse_limit ||= 100
-    end
-
-    def revoke_previous_client_credentials_token
-      @revoke_previous_client_credentials_token || false
-    end
-
     def resolve_controller(name)
       config_option = public_send(:"#{name}_controller")
       controller_name = if config_option.respond_to?(:call)
@@ -479,6 +488,10 @@ module Doorkeeper
       controller_name.constantize
     end
 
+    def revoke_previous_client_credentials_token?
+      option_set? :revoke_previous_client_credentials_token
+    end
+
     def enforce_configured_scopes?
       option_set? :enforce_configured_scopes
     end
@@ -539,12 +552,77 @@ module Doorkeeper
       ]
     end
 
+    def enabled_grant_flows
+      @enabled_grant_flows ||= calculate_grant_flows.map { |name| Doorkeeper::GrantFlow.get(name) }.compact
+    end
+
+    def authorization_response_flows
+      @authorization_response_flows ||= enabled_grant_flows.select(&:handles_response_type?) +
+                                        deprecated_authorization_flows
+    end
+
+    def token_grant_flows
+      @token_grant_flows ||= calculate_token_grant_flows
+    end
+
     def authorization_response_types
-      @authorization_response_types ||= calculate_authorization_response_types.freeze
+      authorization_response_flows.map(&:response_type_matches)
     end
 
     def token_grant_types
-      @token_grant_types ||= calculate_token_grant_types.freeze
+      token_grant_flows.map(&:grant_type_matches)
+    end
+
+    # [NOTE]: deprecated and will be removed soon
+    def deprecated_token_grant_types_resolver
+      @deprecated_token_grant_types ||= calculate_token_grant_types
+    end
+
+    # [NOTE]: deprecated and will be removed soon
+    def deprecated_authorization_flows
+      response_types = calculate_authorization_response_types
+
+      if response_types.any?
+        ::Kernel.warn <<~WARNING
+          Please, don't patch Doorkeeper::Config#calculate_authorization_response_types method.
+          Register your custom grant flows using the public API:
+          `Doorkeeper::GrantFlow.register(grant_flow_name, **options)`.
+        WARNING
+      end
+
+      response_types.map do |response_type|
+        Doorkeeper::GrantFlow::FallbackFlow.new(response_type, response_type_matches: response_type)
+      end
+    end
+
+    # [NOTE]: deprecated and will be removed soon
+    def calculate_authorization_response_types
+      []
+    end
+
+    # [NOTE]: deprecated and will be removed soon
+    def calculate_token_grant_types
+      types = grant_flows - ["implicit"]
+      types << "refresh_token" if refresh_token_enabled?
+      types
+    end
+
+    # Calculates grant flows configured by the user in Doorkeeper
+    # configuration considering registered aliases that is exposed
+    # to single or multiple other flows.
+    #
+    def calculate_grant_flows
+      configured_flows = grant_flows.map(&:to_s)
+      aliases = Doorkeeper::GrantFlow.aliases.keys.map(&:to_s)
+
+      flows = configured_flows - aliases
+      aliases.each do |flow_alias|
+        next unless configured_flows.include?(flow_alias)
+
+        flows.concat(Doorkeeper::GrantFlow.expand_alias(flow_alias))
+      end
+
+      flows.flatten.uniq
     end
 
     def allow_blank_redirect_uri?(application = nil)
@@ -573,57 +651,10 @@ module Doorkeeper
       !!(defined?(var) && var)
     end
 
-    # Determines what values are acceptable for 'response_type' param in
-    # authorization request endpoint, and return them as an array of strings.
-    #
-    def calculate_authorization_response_types
-      types = []
-      types << "code"  if grant_flows.include? "authorization_code"
-      types << "token" if grant_flows.include? "implicit"
-      types
-    end
-
-    # Determines what values are acceptable for 'grant_type' param token
-    # request endpoint, and return them in array.
-    #
-    def calculate_token_grant_types
-      types = grant_flows - ["implicit"]
-      types << "refresh_token" if refresh_token_enabled?
-      types
-    end
-
-    # Determine whether +reuse_access_token+ and a non-restorable
-    # +token_secret_strategy+ have both been activated.
-    #
-    # In that case, disable reuse_access_token value and warn the user.
-    def validate_reuse_access_token_value
-      strategy = token_secret_strategy
-      return if !reuse_access_token || strategy.allows_restoring_secrets?
-
-      ::Rails.logger.warn(
-        "You have configured both reuse_access_token " \
-        "AND strategy strategy '#{strategy}' that cannot restore tokens. " \
-        "This combination is unsupported. reuse_access_token will be disabled",
-      )
-      @reuse_access_token = false
-    end
-
-    # Validate that the provided strategies are valid for
-    # tokens and applications
-    def validate_secret_strategies
-      token_secret_strategy.validate_for :token
-      application_secret_strategy.validate_for :application
-    end
-
-    def validate_token_reuse_limit
-      return if !reuse_access_token ||
-                (token_reuse_limit > 0 && token_reuse_limit <= 100)
-
-      ::Rails.logger.warn(
-        "You have configured an invalid value for token_reuse_limit option. " \
-        "It will be set to default 100",
-      )
-      @token_reuse_limit = 100
+    def calculate_token_grant_flows
+      flows = enabled_grant_flows.select(&:handles_grant_type?)
+      flows << Doorkeeper::GrantFlow.get("refresh_token") if refresh_token_enabled?
+      flows
     end
   end
 end

data/lib/doorkeeper/config/abstract_builder.rb

@@ -20,7 +20,7 @@ module Doorkeeper
       # @return [Doorkeeper::Config] config instance
       #
       def build
-        @config.validate if @config.respond_to?(:validate)
+        @config.validate! if @config.respond_to?(:validate!)
         @config
       end
     end

data/lib/doorkeeper/config/option.rb

@@ -45,9 +45,7 @@ module Doorkeeper
           define_method name do |*args, &block|
             if (deprecation_opts = options[:deprecated])
               warning = "[DOORKEEPER] #{name} has been deprecated and will soon be removed"
-              if deprecation_opts.is_a?(Hash)
-                warning = "#{warning}\n#{deprecation_opts.fetch(:message)}"
-              end
+              warning = "#{warning}\n#{deprecation_opts.fetch(:message)}" if deprecation_opts.is_a?(Hash)
 
               Kernel.warn(warning)
             end

data/lib/doorkeeper/config/validations.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  class Config
+    # Doorkeeper configuration validator.
+    #
+    module Validations
+      # Validates configuration options to be set properly.
+      #
+      def validate!
+        validate_reuse_access_token_value
+        validate_token_reuse_limit
+        validate_secret_strategies
+      end
+
+      private
+
+      # Determine whether +reuse_access_token+ and a non-restorable
+      # +token_secret_strategy+ have both been activated.
+      #
+      # In that case, disable reuse_access_token value and warn the user.
+      def validate_reuse_access_token_value
+        strategy = token_secret_strategy
+        return if !reuse_access_token || strategy.allows_restoring_secrets?
+
+        ::Rails.logger.warn(
+          "You have configured both reuse_access_token " \
+          "AND strategy strategy '#{strategy}' that cannot restore tokens. " \
+          "This combination is unsupported. reuse_access_token will be disabled",
+        )
+        @reuse_access_token = false
+      end
+
+      # Validate that the provided strategies are valid for
+      # tokens and applications
+      def validate_secret_strategies
+        token_secret_strategy.validate_for(:token)
+        application_secret_strategy.validate_for(:application)
+      end
+
+      def validate_token_reuse_limit
+        return if !reuse_access_token ||
+                  (token_reuse_limit > 0 && token_reuse_limit <= 100)
+
+        ::Rails.logger.warn(
+          "You have configured an invalid value for token_reuse_limit option. " \
+          "It will be set to default 100",
+        )
+        @token_reuse_limit = 100
+      end
+    end
+  end
+end

data/lib/doorkeeper/engine.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   class Engine < Rails::Engine
     initializer "doorkeeper.params.filter" do |app|
       parameters = %w[client_secret code authentication_token access_token refresh_token]
-      app.config.filter_parameters << /^(#{Regexp.union parameters})$/
+      app.config.filter_parameters << /^(#{Regexp.union(parameters)})$/
     end
 
     initializer "doorkeeper.routes" do

data/lib/doorkeeper/grant_flow.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require "doorkeeper/grant_flow/flow"
+require "doorkeeper/grant_flow/fallback_flow"
+require "doorkeeper/grant_flow/registry"
+
+module Doorkeeper
+  module GrantFlow
+    extend Registry
+
+    register(
+      :implicit,
+      response_type_matches: "token",
+      response_mode_matches: %w[fragment form_post],
+      response_type_strategy: Doorkeeper::Request::Token,
+    )
+
+    register(
+      :authorization_code,
+      response_type_matches: "code",
+      response_mode_matches: %w[query fragment form_post],
+      response_type_strategy: Doorkeeper::Request::Code,
+      grant_type_matches: "authorization_code",
+      grant_type_strategy: Doorkeeper::Request::AuthorizationCode,
+    )
+
+    register(
+      :client_credentials,
+      grant_type_matches: "client_credentials",
+      grant_type_strategy: Doorkeeper::Request::ClientCredentials,
+    )
+
+    register(
+      :password,
+      grant_type_matches: "password",
+      grant_type_strategy: Doorkeeper::Request::Password,
+    )
+
+    register(
+      :refresh_token,
+      grant_type_matches: "refresh_token",
+      grant_type_strategy: Doorkeeper::Request::RefreshToken,
+    )
+  end
+end

data/lib/doorkeeper/grant_flow/fallback_flow.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    class FallbackFlow < Flow
+      def handles_grant_type?
+        false
+      end
+
+      def handles_response_type?
+        false
+      end
+    end
+  end
+end

data/lib/doorkeeper/grant_flow/flow.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    class Flow
+      attr_reader :name, :grant_type_matches, :grant_type_strategy,
+                  :response_type_matches, :response_type_strategy,
+                  :response_mode_matches
+
+      def initialize(name, **options)
+        @name = name
+        @grant_type_matches = options[:grant_type_matches]
+        @grant_type_strategy = options[:grant_type_strategy]
+        @response_type_matches = options[:response_type_matches]
+        @response_type_strategy = options[:response_type_strategy]
+        @response_mode_matches = options[:response_mode_matches]
+      end
+
+      def handles_grant_type?
+        grant_type_matches.present?
+      end
+
+      def handles_response_type?
+        response_type_matches.present?
+      end
+
+      def matches_grant_type?(value)
+        grant_type_matches === value
+      end
+
+      def matches_response_type?(value)
+        response_type_matches === value
+      end
+
+      def default_response_mode
+        response_mode_matches[0]
+      end
+
+      def matches_response_mode?(value)
+        response_mode_matches.include?(value)
+      end
+    end
+  end
+end