super-smart-kit 0.0.1

data/doorkeeper-5.9.3/lib/doorkeeper/oauth/token_introspection.rb

@@ -0,0 +1,220 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    # RFC7662 OAuth 2.0 Token Introspection
+    #
+    # @see https://datatracker.ietf.org/doc/html/rfc7662
+    class TokenIntrospection
+      attr_reader :token, :error, :invalid_request_reason
+
+      def initialize(server, token)
+        @server = server
+        @token = token
+      end
+
+      def authorized?
+        authorize!
+        @error.blank?
+      end
+
+      def error_response
+        return if @error.blank?
+
+        if @error == Errors::InvalidToken
+          OAuth::InvalidTokenResponse.from_access_token(authorized_token)
+        elsif @error == Errors::InvalidRequest
+          OAuth::InvalidRequestResponse.from_request(self)
+        else
+          OAuth::ErrorResponse.from_request(self)
+        end
+      end
+
+      def to_json(*)
+        active? ? success_response : failure_response
+      end
+
+      private
+
+      attr_reader :server
+
+      # If the protected resource uses OAuth 2.0 client credentials to
+      # authenticate to the introspection endpoint and its credentials are
+      # invalid, the authorization server responds with an HTTP 401
+      # (Unauthorized) as described in Section 5.2 of OAuth 2.0 [RFC6749].
+      #
+      # Endpoint must first validate the authentication.
+      # If the authentication is invalid, the endpoint should respond with
+      # an HTTP 401 status code and an invalid_client response.
+      #
+      # @see https://www.oauth.com/oauth2-servers/token-introspection-endpoint/
+      #
+      # To prevent token scanning attacks, the endpoint MUST also require
+      # some form of authorization to access this endpoint, such as client
+      # authentication as described in OAuth 2.0 [RFC6749] or a separate
+      # OAuth 2.0 access token such as the bearer token described in OAuth
+      # 2.0 Bearer Token Usage [RFC6750].
+      #
+      def authorize!
+        # Requested client authorization
+        if server.credentials
+          authorize_using_basic_auth!
+        elsif authorized_token
+          authorize_using_bearer_token!
+        else
+          @error = Errors::InvalidRequest
+          @invalid_request_reason = :request_not_authorized
+        end
+      end
+
+      def authorize_using_basic_auth!
+        # Note that a properly formed and authorized query for an inactive or
+        # otherwise invalid token (or a token the protected resource is not
+        # allowed to know about) is not considered an error response by this
+        # specification. In these cases, the authorization server MUST instead
+        # respond with an introspection response with the "active" field set to
+        # "false" as described in Section 2.2.
+        @error = Errors::InvalidClient unless authorized_client
+      end
+
+      def authorize_using_bearer_token!
+        # Requested bearer token authorization
+        #
+        #  If the protected resource uses an OAuth 2.0 bearer token to authorize
+        #  its call to the introspection endpoint and the token used for
+        #  authorization does not contain sufficient privileges or is otherwise
+        #  invalid for this request, the authorization server responds with an
+        #  HTTP 401 code as described in Section 3 of OAuth 2.0 Bearer Token
+        #  Usage [RFC6750].
+        #
+        @error = Errors::InvalidToken unless valid_authorized_token?
+      end
+
+      # Client Authentication
+      def authorized_client
+        @authorized_client ||= server.credentials && server.client
+      end
+
+      # Bearer Token Authentication
+      def authorized_token
+        @authorized_token ||= Doorkeeper.authenticate(server.context.request)
+      end
+
+      # 2.2. Introspection Response
+      def success_response
+        response = {
+          active: true,
+          scope: @token.scopes_string,
+          client_id: @token.try(:application).try(:uid),
+          token_type: @token.token_type,
+          iat: @token.created_at.to_i,
+        }
+        # `exp` is OPTIONAL per RFC 7662 §2.2; omit it for non-expiring tokens
+        # so clients don't interpret `0` as "expired at 1970-01-01".
+        response[:exp] = @token.expires_at.to_i if @token.expires_at
+
+        customize_response(response)
+      end
+
+      # If the introspection call is properly authorized but the token is not
+      # active, does not exist on this server, or the protected resource is
+      # not allowed to introspect this particular token, then the
+      # authorization server MUST return an introspection response with the
+      # "active" field set to "false".  Note that to avoid disclosing too
+      # much of the authorization server's state to a third party, the
+      # authorization server SHOULD NOT include any additional information
+      # about an inactive token, including why the token is inactive.
+      #
+      # @see https://datatracker.ietf.org/doc/html/rfc7662 2.2. Introspection Response
+      #
+      def failure_response
+        {
+          active: false,
+        }
+      end
+
+      # Boolean indicator of whether or not the presented token
+      # is currently active.  The specifics of a token's "active" state
+      # will vary depending on the implementation of the authorization
+      # server and the information it keeps about its tokens, but a "true"
+      # value return for the "active" property will generally indicate
+      # that a given token has been issued by this authorization server,
+      # has not been revoked by the resource owner, and is within its
+      # given time window of validity (e.g., after its issuance time and
+      # before its expiration time).
+      #
+      # Any other error is considered an "inactive" token.
+      #
+      # * The token requested does not exist or is invalid
+      # * The token expired
+      # * The token was issued to a different client than is making this request
+      #
+      # Since resource servers using token introspection rely on the
+      # authorization server to determine the state of a token, the
+      # authorization server MUST perform all applicable checks against a
+      # token's state. For instance, these tests include the following:
+      #
+      #    o  If the token can expire, the authorization server MUST determine
+      #       whether or not the token has expired.
+      #    o  If the token can be issued before it is able to be used, the
+      #       authorization server MUST determine whether or not a token's valid
+      #       period has started yet.
+      #    o  If the token can be revoked after it was issued, the authorization
+      #       server MUST determine whether or not such a revocation has taken
+      #       place.
+      #    o  If the token has been signed, the authorization server MUST
+      #       validate the signature.
+      #    o  If the token can be used only at certain resource servers, the
+      #       authorization server MUST determine whether or not the token can
+      #       be used at the resource server making the introspection call.
+      #
+      def active?
+        if authorized_client
+          valid_token? && token_introspection_allowed?(auth_client: authorized_client.application)
+        else
+          valid_token?
+        end
+      end
+
+      # Token can be valid only if it is not expired or revoked.
+      def valid_token?
+        @token&.accessible?
+      end
+
+      def valid_authorized_token?
+        !authorized_token_matches_introspected? &&
+          authorized_token.accessible? &&
+          token_introspection_allowed?(auth_token: authorized_token)
+      end
+
+      # RFC7662 Section 2.1
+      def authorized_token_matches_introspected?
+        authorized_token.token == @token&.token
+      end
+
+      # Config constraints for introspection in Doorkeeper.config.allow_token_introspection
+      def token_introspection_allowed?(auth_client: nil, auth_token: nil)
+        allow_introspection = Doorkeeper.config.allow_token_introspection
+        return allow_introspection unless allow_introspection.respond_to?(:call)
+
+        allow_introspection.call(@token, auth_client, auth_token)
+      end
+
+      # Allows to customize introspection response.
+      # Provides context (controller) and token for generating developer-specific
+      # response.
+      #
+      # @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.2
+      #
+      def customize_response(response)
+        customized_response = Doorkeeper.config.custom_introspection_response.call(
+          token,
+          server.context,
+        )
+        return response if customized_response.blank?
+
+        response.merge(customized_response)
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/oauth/token_request.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    class TokenRequest
+      attr_reader :pre_auth, :resource_owner
+
+      def initialize(pre_auth, resource_owner)
+        @pre_auth = pre_auth
+        @resource_owner = resource_owner
+      end
+
+      def authorize
+        auth = Authorization::Token.new(pre_auth, resource_owner)
+        auth.issue_token!
+        CodeResponse.new(pre_auth, auth, response_on_fragment: true)
+      end
+
+      def deny
+        pre_auth.error = Errors::AccessDenied
+        pre_auth.error_response
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/oauth/token_response.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    class TokenResponse
+      attr_reader :token
+
+      alias issued_token token
+
+      def initialize(token)
+        @token = token
+      end
+
+      def body
+        @body ||= {
+          "access_token" => token.plaintext_token,
+          "token_type" => token.token_type,
+          "expires_in" => token.expires_in_seconds,
+          "refresh_token" => token.plaintext_refresh_token,
+          "scope" => token.scopes_string,
+          "created_at" => token.created_at.to_i,
+        }.reject { |_, value| value.blank? }
+      end
+
+      def status
+        :ok
+      end
+
+      def headers
+        {
+          "Cache-Control" => "no-store, no-cache",
+          "Content-Type" => "application/json; charset=utf-8",
+          "Pragma" => "no-cache",
+        }
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/oauth.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    GRANT_TYPES = [
+      AUTHORIZATION_CODE = "authorization_code",
+      IMPLICIT = "implicit",
+      PASSWORD = "password",
+      CLIENT_CREDENTIALS = "client_credentials",
+      REFRESH_TOKEN = "refresh_token",
+    ].freeze
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require "doorkeeper/orm/active_record/mixins/access_grant"
+
+module Doorkeeper
+  class AccessGrant < ::ActiveRecord::Base
+    include Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record/access_token.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+require "doorkeeper/orm/active_record/mixins/access_token"
+
+module Doorkeeper
+  class AccessToken < ::ActiveRecord::Base
+    include Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record/application.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+require "doorkeeper/orm/active_record/redirect_uri_validator"
+require "doorkeeper/orm/active_record/mixins/application"
+
+module Doorkeeper
+  class Application < ::ActiveRecord::Base
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::Application
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record/mixins/access_grant.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Doorkeeper::Orm::ActiveRecord::Mixins
+  module AccessGrant
+    extend ActiveSupport::Concern
+
+    included do
+      self.table_name = compute_doorkeeper_table_name
+      self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
+
+      include ::Doorkeeper::AccessGrantMixin
+      include ::Doorkeeper::Models::PolymorphicResourceOwner::ForAccessGrant
+
+      belongs_to :application, class_name: Doorkeeper.config.application_class.to_s,
+                               optional: true,
+                               inverse_of: :access_grants
+
+      validates :application_id,
+                :token,
+                :expires_in,
+                :redirect_uri,
+                presence: true
+
+      validates :token, uniqueness: { case_sensitive: true }
+
+      before_validation :generate_token, on: :create
+
+      # We keep a volatile copy of the raw token for initial communication
+      # The stored refresh_token may be mapped and not available in cleartext.
+      #
+      # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+      # while hashing strategies do not, so you cannot rely on this value
+      # returning a present value for persisted tokens.
+      def plaintext_token
+        if secret_strategy.allows_restoring_secrets?
+          secret_strategy.restore_secret(self, :token)
+        else
+          @raw_token
+        end
+      end
+
+      private
+
+      # Generates token value with UniqueToken class.
+      #
+      # @return [String] token value
+      #
+      def generate_token
+        @raw_token = Doorkeeper::OAuth::Helpers::UniqueToken.generate
+        secret_strategy.store_secret(self, :token, @raw_token)
+      end
+    end
+
+    module ClassMethods
+      private
+
+      def compute_doorkeeper_table_name
+        table_name = "oauth_access_grant"
+        table_name = table_name.pluralize if pluralize_table_names
+        "#{table_name_prefix}#{table_name}#{table_name_suffix}"
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record/mixins/access_token.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module Doorkeeper::Orm::ActiveRecord::Mixins
+  module AccessToken
+    extend ActiveSupport::Concern
+
+    included do
+      self.table_name = compute_doorkeeper_table_name
+      self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
+
+      include ::Doorkeeper::AccessTokenMixin
+      include ::Doorkeeper::Models::PolymorphicResourceOwner::ForAccessToken
+
+      belongs_to :application, class_name: Doorkeeper.config.application_class.to_s,
+                               inverse_of: :access_tokens,
+                               optional: true
+
+      validates :token, presence: true, uniqueness: { case_sensitive: true }
+      validates :refresh_token, uniqueness: { case_sensitive: true }, if: :use_refresh_token?
+
+      # @attr_writer [Boolean, nil] use_refresh_token
+      #   indicates the possibility of using refresh token
+      attr_writer :use_refresh_token
+
+      before_validation :generate_token, on: :create
+      before_validation :generate_refresh_token,
+                        on: :create, if: :use_refresh_token?
+    end
+
+    module ClassMethods
+      # Searches for not revoked Access Tokens associated with the
+      # specific Resource Owner.
+      #
+      # @param resource_owner [ActiveRecord::Base]
+      #   Resource Owner model instance
+      #
+      # @return [ActiveRecord::Relation]
+      #   active Access Tokens for Resource Owner
+      #
+      def active_for(resource_owner)
+        by_resource_owner(resource_owner).where(revoked_at: nil)
+      end
+
+      # Determines if refresh tokens should be revoked only when the new access token is used,
+      # rather than immediately upon refresh. This is based on the presence of the
+      # `previous_refresh_token` column in the database.
+      #
+      # When true (column exists):
+      # - Refresh tokens are NOT immediately revoked
+      # - New access token stores the old refresh token value in `previous_refresh_token`
+      # - Old refresh token is revoked later when the new access token is first used
+      # - Multiple concurrent refresh requests can succeed (no database locks)
+      # - Better database performance and lower latency
+      #
+      # When false (column does not exist):
+      # - Refresh tokens are immediately revoked using database locks
+      # - Only one concurrent refresh request can succeed
+      # - May experience database lock contention under high load
+      #
+      # To enable the revoke-on-use feature and improve performance:
+      #   rails generate doorkeeper:previous_refresh_token
+      #   rails db:migrate
+      #
+      # @return [Boolean] true if previous_refresh_token column exists
+      #
+      def refresh_token_revoked_on_use?
+        column_names.include?("previous_refresh_token")
+      end
+
+      # Returns non-expired and non-revoked access tokens
+      def not_expired
+        relation = where(revoked_at: nil)
+
+        if supports_expiration_time_math?
+          # have not reached the expiration time or it never expires
+          relation.where("#{expiration_time_sql} > ?", Time.now.utc).or(
+            relation.where(expires_in: nil),
+          )
+        else
+          ::Kernel.warn(::Doorkeeper::Models::ExpirationTimeSqlMath::WARNING_MESSAGE)
+
+          relation
+        end
+      end
+
+      private
+
+      def compute_doorkeeper_table_name
+        table_name = "oauth_access_token"
+        table_name = table_name.pluralize if pluralize_table_names
+        "#{table_name_prefix}#{table_name}#{table_name_suffix}"
+      end
+    end
+  end
+end