super-smart-kit 0.0.1

data/doorkeeper-5.9.3/lib/doorkeeper/oauth/pre_authorization.rb

@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    class PreAuthorization
+      include Validations
+
+      validate :client_id, error: Errors::InvalidRequest
+      validate :client, error: Errors::InvalidClient
+      validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
+      validate :resource_owner_authorize_for_client, error: Errors::InvalidClient
+      validate :redirect_uri, error: Errors::InvalidRedirectUri
+      validate :params, error: Errors::InvalidRequest
+      validate :response_type, error: Errors::UnsupportedResponseType
+      validate :response_mode, error: Errors::UnsupportedResponseMode
+      validate :scopes, error: Errors::InvalidScope
+      validate :code_challenge, error: Errors::InvalidRequest
+      validate :code_challenge_method, error: Errors::InvalidCodeChallengeMethod
+
+      attr_reader :client, :code_challenge, :code_challenge_method, :missing_param,
+                  :redirect_uri, :resource_owner, :response_type, :state,
+                  :authorization_response_flow, :response_mode, :custom_access_token_attributes,
+                  :invalid_request_reason
+
+      def initialize(server, parameters = {}, resource_owner = nil)
+        @server = server
+        @client_id = parameters[:client_id]
+        @response_type = parameters[:response_type]
+        @response_mode = parameters[:response_mode]
+        @redirect_uri = parameters[:redirect_uri]
+        @scope = parameters[:scope]
+        @state = parameters[:state]
+        @code_challenge = parameters[:code_challenge]
+        @code_challenge_method = parameters[:code_challenge_method]
+        @resource_owner = resource_owner
+        @custom_access_token_attributes = parameters.slice(*Doorkeeper.config.custom_access_token_attributes).to_h
+      end
+
+      def authorizable?
+        valid?
+      end
+
+      def scopes
+        Scopes.from_string(scope)
+      end
+
+      def scope
+        @scope.presence || (server.default_scopes.presence && build_scopes)
+      end
+
+      def error_response
+        if error == Errors::InvalidRequest
+          OAuth::InvalidRequestResponse.from_request(
+            self,
+            response_on_fragment: response_on_fragment?,
+          )
+        else
+          OAuth::ErrorResponse.from_request(self, response_on_fragment: response_on_fragment?)
+        end
+      end
+
+      def as_json(_options = nil)
+        pre_auth_hash
+      end
+
+      def form_post_response?
+        response_mode == "form_post"
+      end
+
+      private
+
+      attr_reader :client_id, :server
+
+      def build_scopes
+        client_scopes = client.scopes
+        if client_scopes.blank?
+          server.default_scopes.to_s
+        else
+          server.default_scopes.allowed(client_scopes).to_s
+        end
+      end
+
+      def validate_client_id
+        @missing_param = :client_id if client_id.blank?
+        @missing_param.nil?
+      end
+
+      def validate_client
+        @client = OAuth::Client.find(client_id)
+        @client.present?
+      end
+
+      def validate_client_supports_grant_flow
+        Doorkeeper.config.allow_grant_flow_for_client?(grant_type, client.application)
+      end
+
+      def validate_resource_owner_authorize_for_client
+        # The `authorize_resource_owner_for_client` config option is used for this validation
+        client.application.authorized_for_resource_owner?(@resource_owner)
+      end
+
+      def validate_redirect_uri
+        return false if redirect_uri.blank?
+
+        Helpers::URIChecker.valid_for_authorization?(
+          redirect_uri,
+          client.redirect_uri,
+        )
+      end
+
+      def validate_params
+        @missing_param = if response_type.blank?
+                           :response_type
+                         elsif @scope.blank? && server.default_scopes.blank?
+                           :scope
+                         end
+
+        @missing_param.nil?
+      end
+
+      def validate_response_type
+        server.authorization_response_flows.any? do |flow|
+          if flow.matches_response_type?(response_type)
+            @authorization_response_flow = flow
+            true
+          end
+        end
+      end
+
+      def validate_response_mode
+        if response_mode.blank?
+          @response_mode = authorization_response_flow.default_response_mode
+          return true
+        end
+
+        authorization_response_flow.matches_response_mode?(response_mode)
+      end
+
+      def validate_scopes
+        Helpers::ScopeChecker.valid?(
+          scope_str: scope,
+          server_scopes: server.scopes,
+          app_scopes: client.scopes,
+          grant_type: grant_type,
+        )
+      end
+
+      def validate_code_challenge
+        return true unless Doorkeeper.config.force_pkce?
+        return true if client.confidential
+        return true if code_challenge.present?
+
+        @invalid_request_reason = :invalid_code_challenge
+        false
+      end
+
+      def validate_code_challenge_method
+        return true unless Doorkeeper.config.access_grant_model.pkce_supported?
+
+        code_challenge.blank? ||
+          (code_challenge_method.present? && Doorkeeper.config.pkce_code_challenge_methods_supported.include?(code_challenge_method))
+      end
+
+      def response_on_fragment?
+        return response_type == "token" if response_mode.nil?
+
+        response_mode == "fragment"
+      end
+
+      def grant_type
+        response_type == "code" ? AUTHORIZATION_CODE : IMPLICIT
+      end
+
+      def pre_auth_hash
+        {
+          client_id: client.uid,
+          redirect_uri: redirect_uri,
+          state: state,
+          response_type: response_type,
+          scope: scope,
+          client_name: client.name,
+          status: I18n.t("doorkeeper.pre_authorization.status"),
+        }
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -0,0 +1,144 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    class RefreshTokenRequest < BaseRequest
+      include OAuth::Helpers
+
+      validate :token_presence, error: Errors::InvalidRequest
+      validate :token,        error: Errors::InvalidGrant
+      validate :client,       error: Errors::InvalidClient
+      validate :client_match, error: Errors::InvalidGrant
+      validate :scope,        error: Errors::InvalidScope
+
+      attr_reader :access_token, :client, :credentials, :refresh_token
+      attr_reader :missing_param
+
+      def initialize(server, refresh_token, credentials, parameters = {})
+        @server = server
+        @refresh_token = refresh_token
+        @credentials = credentials
+        @grant_type = Doorkeeper::OAuth::REFRESH_TOKEN
+        @original_scopes = parameters[:scope] || parameters[:scopes]
+        @refresh_token_parameter = parameters[:refresh_token]
+        @client = load_client(credentials) if credentials
+      end
+
+      private
+
+      def load_client(credentials)
+        Doorkeeper.config.application_model.by_uid_and_secret(credentials.uid, credentials.secret)
+      end
+
+      def before_successful_response
+        if refresh_token_revoked_on_use?
+          # No locking needed when refresh tokens are revoked on use
+          # because the old token is revoked later when the new token is used.
+          # This allows multiple concurrent refresh requests to succeed during the
+          # transition period, after which the old refresh token will be revoked.
+          raise Errors::InvalidGrantReuse if refresh_token.revoked?
+
+          create_access_token
+        else
+          # Use locking when refresh tokens are revoked immediately
+          # to prevent race conditions where multiple tokens could be created
+          refresh_token.with_lock do
+            raise Errors::InvalidGrantReuse if refresh_token.revoked?
+
+            refresh_token.revoke
+            create_access_token
+          end
+        end
+        super
+      end
+
+      def refresh_token_revoked_on_use?
+        Doorkeeper.config.access_token_model.refresh_token_revoked_on_use?
+      end
+
+      def default_scopes
+        refresh_token.scopes
+      end
+
+      def create_access_token
+        attributes = {}.merge(custom_token_attributes_with_data)
+
+        resource_owner =
+          if Doorkeeper.config.polymorphic_resource_owner?
+            refresh_token.resource_owner
+          else
+            refresh_token.resource_owner_id
+          end
+
+        if refresh_token_revoked_on_use?
+          attributes[:previous_refresh_token] = refresh_token.refresh_token
+        end
+
+        # RFC6749
+        # 1.5.  Refresh Token
+        #
+        # Refresh tokens are issued to the client by the authorization server and are
+        # used to obtain a new access token when the current access token
+        # becomes invalid or expires, or to obtain additional access tokens
+        # with identical or narrower scope (access tokens may have a shorter
+        # lifetime and fewer permissions than authorized by the resource
+        # owner).
+        #
+        # Here we assume that TTL of the token received after refreshing should be
+        # the same as that of the original token.
+        #
+        @access_token = Doorkeeper.config.access_token_model.create_for(
+          application: refresh_token.application,
+          resource_owner: resource_owner,
+          scopes: scopes,
+          expires_in: refresh_token.expires_in,
+          use_refresh_token: true,
+          **attributes,
+        )
+      end
+
+      def validate_token_presence
+        @missing_param = :refresh_token if refresh_token.blank? && @refresh_token_parameter.blank?
+
+        @missing_param.nil?
+      end
+
+      def validate_token
+        refresh_token.present? && !refresh_token.revoked?
+      end
+
+      def validate_client
+        return true if credentials.blank?
+
+        client.present?
+      end
+
+      # @see https://datatracker.ietf.org/doc/html/rfc6749#section-1.5
+      #
+      def validate_client_match
+        return true if refresh_token.application_id.blank?
+
+        client && refresh_token.application_id == client.id
+      end
+
+      def validate_scope
+        if @original_scopes.present?
+          ScopeChecker.valid?(
+            scope_str: @original_scopes,
+            server_scopes: refresh_token.scopes,
+          )
+        else
+          true
+        end
+      end
+
+      def custom_token_attributes_with_data
+        refresh_token
+          .attributes
+          .with_indifferent_access
+          .slice(*Doorkeeper.config.custom_access_token_attributes)
+          .symbolize_keys
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/oauth/scopes.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    class Scopes
+      include Enumerable
+      include Comparable
+
+      DYNAMIC_SCOPE_WILDCARD = "*"
+
+      def self.from_string(string)
+        string ||= ""
+        new.tap do |scope|
+          scope.add(*string.split)
+        end
+      end
+
+      def self.from_array(array)
+        new.tap do |scope|
+          scope.add(*array)
+        end
+      end
+
+      delegate :each, :empty?, to: :@scopes
+
+      def initialize
+        @scopes = []
+      end
+
+      def exists?(scope)
+        scope = scope.to_s
+
+        @scopes.any? do |allowed_scope|
+          if dynamic_scopes_enabled? && dynamic_scopes_present?(allowed_scope, scope)
+            dynamic_scope_match?(allowed_scope, scope)
+          else
+            allowed_scope == scope
+          end
+        end
+      end
+
+      def add(*scopes)
+        @scopes.push(*scopes.map(&:to_s))
+        @scopes.uniq!
+      end
+
+      def all
+        @scopes
+      end
+
+      def to_s
+        @scopes.join(" ")
+      end
+
+      def scopes?(scopes)
+        scopes.all? { |scope| exists?(scope) }
+      end
+
+      alias has_scopes? scopes?
+
+      def +(other)
+        self.class.from_array(all + to_array(other))
+      end
+
+      def <=>(other)
+        if other.respond_to?(:map)
+          map(&:to_s).sort <=> other.map(&:to_s).sort
+        else
+          super
+        end
+      end
+
+      # DEPRECATED: With dynamic scopes, #allowed should be called because
+      # A & B doesn't really make sense with dynamic scopes.
+      #
+      # For example, if A = user:* and B is user:1, A & B = [].
+      # If we modified this method to take dynamic scopes into an account, then order
+      # becomes important, and this would violate the principle that A & B = B & A.
+      def &(other)
+        return allowed(other) if dynamic_scopes_enabled?
+
+        self.class.from_array(all & to_array(other))
+      end
+
+      # Returns a set of scopes that are allowed, taking dynamic
+      # scopes into account. This instance's scopes is taken as the allowed set,
+      # and the passed value is the set to filter.
+      #
+      # @param other The set of scopes to filter
+      def allowed(other)
+        filtered_scopes = other.select { |scope| exists?(scope) }
+        self.class.from_array(filtered_scopes)
+      end
+
+      private
+
+      def dynamic_scopes_enabled?
+        Doorkeeper.config.enable_dynamic_scopes?
+      end
+
+      def dynamic_scope_delimiter
+        return unless dynamic_scopes_enabled?
+
+        @dynamic_scope_delimiter ||= Doorkeeper.config.dynamic_scopes_delimiter
+      end
+
+      def dynamic_scopes_present?(allowed, requested)
+        allowed.include?(dynamic_scope_delimiter) && requested.include?(dynamic_scope_delimiter)
+      end
+
+      def dynamic_scope_match?(allowed, requested)
+        allowed_pattern = allowed.split(dynamic_scope_delimiter, 2)
+        request_pattern = requested.split(dynamic_scope_delimiter, 2)
+
+        return false if allowed_pattern[0] != request_pattern[0]
+        return false if allowed_pattern[1].blank?
+        return false if request_pattern[1].blank?
+
+        return true if allowed_pattern[1] == DYNAMIC_SCOPE_WILDCARD
+
+        allowed_pattern[1] == request_pattern[1]
+      end
+
+      def to_array(other)
+        case other
+        when Scopes
+          other.all
+        else
+          other.to_a
+        end
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/oauth/token.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    class Token
+      class << self
+        def from_request(request, *methods)
+          methods.inject(nil) do |_, method|
+            method = self.method(method) if method.is_a?(Symbol)
+            credentials = method.call(request)
+            break credentials if credentials.present?
+          end
+        end
+
+        def authenticate(request, *methods)
+          if (token = from_request(request, *methods))
+            access_token = Doorkeeper.config.access_token_model.by_token(token)
+            if access_token.present? && Doorkeeper.config.refresh_token_enabled?
+              access_token.revoke_previous_refresh_token!
+            end
+            access_token
+          end
+        end
+
+        def from_access_token_param(request)
+          request.parameters[:access_token]
+        end
+
+        def from_bearer_param(request)
+          request.parameters[:bearer_token]
+        end
+
+        def from_bearer_authorization(request)
+          pattern = /^Bearer /i
+          header = request.authorization
+          token_from_header(header, pattern) if match?(header, pattern)
+        end
+
+        def from_basic_authorization(request)
+          pattern = /^Basic /i
+          header = request.authorization
+          token_from_basic_header(header, pattern) if match?(header, pattern)
+        end
+
+        private
+
+        def token_from_basic_header(header, pattern)
+          encoded_header = token_from_header(header, pattern)
+          decode_basic_credentials_token(encoded_header)
+        end
+
+        def decode_basic_credentials_token(encoded_header)
+          Base64.decode64(encoded_header).split(/:/, 2).first
+        end
+
+        def token_from_header(header, pattern)
+          header.gsub(pattern, "")
+        end
+
+        def match?(header, pattern)
+          header&.match(pattern)
+        end
+      end
+    end
+  end
+end