super-smart-kit 0.0.1

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record/mixins/application.rb

@@ -0,0 +1,223 @@
+# frozen_string_literal: true
+
+module Doorkeeper::Orm::ActiveRecord::Mixins
+  module Application
+    extend ActiveSupport::Concern
+
+    included do
+      self.table_name = compute_doorkeeper_table_name
+      self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
+
+      include ::Doorkeeper::ApplicationMixin
+      # `enable_application_owner?` is read once, at parent-class autoload
+      # time (#1831): with the feature off the model exposes no `:owner`
+      # association — avoiding a misleading reflection on schemas that lack
+      # the owner columns. The flag is therefore a load-time switch; turning
+      # it on later requires defining a fresh model class.
+      include ::Doorkeeper::Models::Ownership if Doorkeeper.config.enable_application_owner?
+
+      has_many :access_grants,
+               foreign_key: :application_id,
+               dependent: :delete_all,
+               class_name: Doorkeeper.config.access_grant_class.to_s
+
+      has_many :access_tokens,
+               foreign_key: :application_id,
+               dependent: :delete_all,
+               class_name: Doorkeeper.config.access_token_class.to_s
+
+      validates :name, :uid, presence: true
+      validates :secret, presence: true, if: -> { secret_required? }
+      validates :uid, uniqueness: { case_sensitive: true }
+      validates :confidential, inclusion: { in: [true, false] }
+
+      validates_with Doorkeeper::RedirectUriValidator, attributes: [:redirect_uri]
+
+      validate :scopes_match_configured, if: :enforce_scopes?
+
+      before_validation :generate_uid, :generate_secret, on: :create
+
+      has_many :authorized_tokens,
+               -> { where(revoked_at: nil) },
+               foreign_key: :application_id,
+               class_name: Doorkeeper.config.access_token_class.to_s
+
+      has_many :authorized_applications,
+               through: :authorized_tokens,
+               source: :application
+
+      # Generates a new secret for this application, intended to be used
+      # for rotating the secret or in case of compromise.
+      #
+      # @return [String] new transformed secret value
+      #
+      def renew_secret
+        @raw_secret = secret_generator.generate
+        secret_strategy.store_secret(self, :secret, @raw_secret)
+      end
+
+      # We keep a volatile copy of the raw secret for initial communication
+      # The stored refresh_token may be mapped and not available in cleartext.
+      #
+      # Some strategies allow restoring stored secrets (e.g. symmetric encryption)
+      # while hashing strategies do not, so you cannot rely on this value
+      # returning a present value for persisted tokens.
+      def plaintext_secret
+        if secret_strategy.allows_restoring_secrets?
+          secret_strategy.restore_secret(self, :secret)
+        else
+          @raw_secret
+        end
+      end
+
+      # Represents client as set of it's attributes in JSON format.
+      # This is the right way how we want to override ActiveRecord #to_json.
+      #
+      # Respects privacy settings and serializes minimum set of attributes
+      # for public/private clients and full set for authorized owners.
+      #
+      # @return [Hash] entity attributes for JSON
+      #
+      def as_json(options = {})
+        # if application belongs to some owner we need to check if it's the same as
+        # the one passed in the options or check if we render the client as an owner
+        if (respond_to?(:owner) && owner && owner == options[:current_resource_owner]) ||
+           options[:as_owner]
+          # Owners can see all the client attributes, fallback to ActiveModel serialization
+          super
+        else
+          # if application has no owner or it's owner doesn't match one from the options
+          # we render only minimum set of attributes that could be exposed to a public
+          only = extract_serializable_attributes(options)
+          super(options.merge(only: only))
+        end
+      end
+
+      def authorized_for_resource_owner?(resource_owner)
+        Doorkeeper.configuration.authorize_resource_owner_for_client.call(self, resource_owner)
+      end
+
+      # We need to hook into this method to allow serializing plan-text secrets
+      # when secrets hashing enabled.
+      #
+      # @param key [String] attribute name
+      #
+      def read_attribute_for_serialization(key)
+        return super unless key.to_s == "secret"
+
+        plaintext_secret || secret
+      end
+
+      private
+
+      def secret_generator
+        generator_name = Doorkeeper.config.application_secret_generator
+        generator = generator_name.constantize
+
+        return generator if generator.respond_to?(:generate)
+
+        raise Errors::UnableToGenerateToken, "#{generator} does not respond to `.generate`."
+      rescue NameError
+        raise Errors::TokenGeneratorNotFound, "#{generator_name} not found"
+      end
+
+      def generate_uid
+        self.uid = Doorkeeper::OAuth::Helpers::UniqueToken.generate if uid.blank?
+      end
+
+      def generate_secret
+        return if secret.present? || !secret_required?
+
+        renew_secret
+      end
+
+      def scopes_match_configured
+        if scopes.present? && !Doorkeeper::OAuth::Helpers::ScopeChecker.valid?(
+          scope_str: scopes.to_s,
+          server_scopes: Doorkeeper.config.scopes,
+        )
+          errors.add(:scopes, :not_match_configured)
+        end
+      end
+
+      def enforce_scopes?
+        Doorkeeper.config.enforce_configured_scopes?
+      end
+
+      def secret_required?
+        confidential? ||
+          !self.class.columns.detect { |column| column.name == "secret" }&.null
+      end
+
+      # Helper method to extract collection of serializable attribute names
+      # considering serialization options (like `only`, `except` and so on).
+      #
+      # @param options [Hash] serialization options
+      #
+      # @return [Array<String>]
+      #   collection of attributes to be serialized using #as_json
+      #
+      def extract_serializable_attributes(options = {})
+        opts = options.try(:dup) || {}
+        only = Array.wrap(opts[:only]).map(&:to_s)
+
+        only = if only.blank?
+                 client_serializable_attributes
+               else
+                 only & client_serializable_attributes
+               end
+
+        only -= Array.wrap(opts[:except]).map(&:to_s) if opts.key?(:except)
+        only.uniq
+      end
+
+      # Collection of attributes that could be serialized for public.
+      # Override this method if you need additional attributes to be serialized.
+      #
+      # @return [Array<String>] collection of serializable attributes
+      #
+      # NOTE: `serializable_attributes` method already taken by Rails >= 6
+      #
+      def client_serializable_attributes
+        attributes = %w[id name created_at]
+        attributes << "uid" unless confidential?
+        attributes
+      end
+    end
+
+    module ClassMethods
+      # Returns Applications associated with active (not revoked) Access Tokens
+      # that are owned by the specific Resource Owner.
+      #
+      # @param resource_owner [ActiveRecord::Base]
+      #   Resource Owner model instance
+      #
+      # @return [ActiveRecord::Relation]
+      #   Applications authorized for the Resource Owner
+      #
+      def authorized_for(resource_owner)
+        resource_access_tokens = Doorkeeper.config.access_token_model.active_for(resource_owner)
+        where(id: resource_access_tokens.select(:application_id).distinct)
+      end
+
+      # Revokes AccessToken and AccessGrant records that have not been revoked and
+      # associated with the specific Application and Resource Owner.
+      #
+      # @param resource_owner [ActiveRecord::Base]
+      #   instance of the Resource Owner model
+      #
+      def revoke_tokens_and_grants_for(id, resource_owner)
+        Doorkeeper.config.access_token_model.revoke_all_for(id, resource_owner)
+        Doorkeeper.config.access_grant_model.revoke_all_for(id, resource_owner)
+      end
+
+      private
+
+      def compute_doorkeeper_table_name
+        table_name = "oauth_application"
+        table_name = table_name.pluralize if pluralize_table_names
+        "#{table_name_prefix}#{table_name}#{table_name_suffix}"
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Doorkeeper
+  # ActiveModel validator for redirect URI validation in according
+  # to OAuth standards and Doorkeeper configuration.
+  class RedirectUriValidator < ActiveModel::EachValidator
+    def validate_each(record, attribute, value)
+      if value.blank?
+        return if Doorkeeper.config.allow_blank_redirect_uri?(record)
+
+        record.errors.add(attribute, :blank)
+      else
+        value.split.each do |val|
+          next if oob_redirect_uri?(val)
+
+          uri = ::URI.parse(val)
+          record.errors.add(attribute, :forbidden_uri) if forbidden_uri?(uri)
+          record.errors.add(attribute, :fragment_present) unless uri.fragment.nil?
+          record.errors.add(attribute, :unspecified_scheme) if unspecified_scheme?(uri)
+          record.errors.add(attribute, :relative_uri) if relative_uri?(uri)
+          record.errors.add(attribute, :secured_uri) if invalid_ssl_uri?(uri)
+          record.errors.add(attribute, :invalid_uri) if unspecified_host?(uri)
+        end
+      end
+    rescue URI::InvalidURIError
+      record.errors.add(attribute, :invalid_uri)
+    end
+
+    private
+
+    def oob_redirect_uri?(uri)
+      Doorkeeper::OAuth::NonStandard::IETF_WG_OAUTH2_OOB_METHODS.include?(uri)
+    end
+
+    def forbidden_uri?(uri)
+      Doorkeeper.config.forbid_redirect_uri.call(uri)
+    end
+
+    def unspecified_scheme?(uri)
+      return true if uri.opaque.present?
+
+      %w[localhost].include?(uri.try(:scheme))
+    end
+
+    def unspecified_host?(uri)
+      uri.is_a?(URI::HTTP) && uri.host.blank?
+    end
+
+    def relative_uri?(uri)
+      uri.scheme.nil? && uri.host.blank?
+    end
+
+    def invalid_ssl_uri?(uri)
+      forces_ssl = Doorkeeper.config.force_ssl_in_redirect_uri
+      non_https = uri.try(:scheme) == "http"
+
+      if forces_ssl.respond_to?(:call)
+        forces_ssl.call(uri) && non_https
+      else
+        forces_ssl && non_https
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record/stale_records_cleaner.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Orm
+    module ActiveRecord
+      # Helper class to clear stale and non-active tokens and grants.
+      # Used by Doorkeeper Rake tasks.
+      #
+      class StaleRecordsCleaner
+        def initialize(base_scope)
+          @base_scope = base_scope
+        end
+
+        # Clears revoked records
+        def clean_revoked
+          table = @base_scope.arel_table
+
+          @base_scope
+            .where.not(revoked_at: nil)
+            .where(table[:revoked_at].lt(Time.current))
+            .in_batches(&:delete_all)
+        end
+
+        # Clears expired records
+        def clean_expired(ttl)
+          table = @base_scope.arel_table
+          model_class = @base_scope.is_a?(::ActiveRecord::Relation) ? @base_scope.klass : @base_scope
+
+          scope = @base_scope
+            .where.not(expires_in: nil)
+            .where(table[:created_at].lt(Time.current - ttl))
+
+          if model_class.respond_to?(:supports_expiration_time_math?) && model_class.supports_expiration_time_math?
+            scope = scope.where("#{model_class.expiration_time_sql} < ?", Time.current)
+          else
+            ::Kernel.warn(::Doorkeeper::Models::ExpirationTimeSqlMath::WARNING_MESSAGE)
+          end
+
+          scope.in_batches(&:delete_all)
+        end
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/orm/active_record.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  autoload :AccessGrant, "doorkeeper/orm/active_record/access_grant"
+  autoload :AccessToken, "doorkeeper/orm/active_record/access_token"
+  autoload :Application, "doorkeeper/orm/active_record/application"
+  autoload :RedirectUriValidator, "doorkeeper/orm/active_record/redirect_uri_validator"
+
+  module Models
+    autoload :Ownership, "doorkeeper/models/concerns/ownership"
+  end
+
+  # ActiveRecord ORM for Doorkeeper entity models.
+  # Consists of three main OAuth entities:
+  #   * Access Token
+  #   * Access Grant
+  #   * Application (client)
+  #
+  # Do a lazy loading of all the required and configured stuff.
+  #
+  module Orm
+    module ActiveRecord
+      autoload :StaleRecordsCleaner, "doorkeeper/orm/active_record/stale_records_cleaner"
+
+      module Mixins
+        autoload :AccessGrant, "doorkeeper/orm/active_record/mixins/access_grant"
+        autoload :AccessToken, "doorkeeper/orm/active_record/mixins/access_token"
+        autoload :Application, "doorkeeper/orm/active_record/mixins/application"
+      end
+
+      # Kept as a no-op so `Doorkeeper.run_orm_hooks` (and any plugin that
+      # checks `respond_to?(:run_hooks)`) stays quiet. The model concerns
+      # that used to be wired up here are now included from each Mixin's
+      # `included` block, which runs at parent-class autoload time — well
+      # after `Doorkeeper.configure` has applied user settings, and without
+      # touching `ActiveSupport.on_load(:active_record)` (whose re-entrant
+      # firing during `ApplicationRecord` autoload caused #1828).
+      def self.run_hooks; end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/rails/helpers.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Rails
+    module Helpers
+      def doorkeeper_authorize!(*scopes)
+        @_doorkeeper_scopes = scopes.presence || Doorkeeper.config.default_scopes
+
+        doorkeeper_render_error unless valid_doorkeeper_token?
+      end
+
+      def doorkeeper_unauthorized_render_options(**); end
+
+      def doorkeeper_forbidden_render_options(**); end
+
+      def valid_doorkeeper_token?
+        doorkeeper_token&.acceptable?(@_doorkeeper_scopes)
+      end
+
+      private
+
+      def doorkeeper_render_error
+        error = doorkeeper_error
+        error.raise_exception! if Doorkeeper.config.raise_on_errors?
+
+        headers.merge!(error.headers.reject { |k| k == "Content-Type" })
+        doorkeeper_render_error_with(error)
+      end
+
+      def doorkeeper_render_error_with(error)
+        options = doorkeeper_render_options(error) || {}
+        status = doorkeeper_status_for_error(
+          error, options.delete(:respond_not_found_when_forbidden),
+        )
+        if options.blank?
+          head status
+        else
+          options[:status] = status
+          options[:layout] = false if options[:layout].nil?
+          render options
+        end
+      end
+
+      def doorkeeper_error
+        if doorkeeper_invalid_token_response?
+          OAuth::InvalidTokenResponse.from_access_token(doorkeeper_token)
+        else
+          OAuth::ForbiddenTokenResponse.from_scopes(@_doorkeeper_scopes)
+        end
+      end
+
+      def doorkeeper_render_options(error)
+        if doorkeeper_invalid_token_response?
+          doorkeeper_unauthorized_render_options(error: error)
+        else
+          doorkeeper_forbidden_render_options(error: error)
+        end
+      end
+
+      def doorkeeper_status_for_error(error, respond_not_found_when_forbidden)
+        if respond_not_found_when_forbidden && error.status == :forbidden
+          :not_found
+        else
+          error.status
+        end
+      end
+
+      def doorkeeper_invalid_token_response?
+        !doorkeeper_token || !doorkeeper_token.accessible?
+      end
+
+      def doorkeeper_token
+        return @doorkeeper_token if defined?(@doorkeeper_token)
+
+        @doorkeeper_token = OAuth::Token.authenticate(
+          request,
+          *Doorkeeper.config.access_token_methods,
+        )
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/rails/routes/abstract_router.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Rails
+    # Abstract router module that implements base behavior
+    # for generating and mapping Rails routes.
+    #
+    # Could be reused in Doorkeeper extensions.
+    #
+    module AbstractRouter
+      extend ActiveSupport::Concern
+
+      attr_reader :routes
+
+      def initialize(routes, mapper = Mapper.new, &block)
+        @routes = routes
+        @mapping = mapper.map(&block)
+      end
+
+      def generate_routes!(**_options)
+        raise NotImplementedError, "must be redefined for #{self.class.name}!"
+      end
+
+      private
+
+      def map_route(name, method)
+        return if @mapping.skipped?(name)
+
+        send(method, @mapping[name])
+
+        mapping[name] = @mapping[name]
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/rails/routes/mapper.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Rails
+    class Routes # :nodoc:
+      class Mapper
+        def initialize(mapping = Mapping.new)
+          @mapping = mapping
+        end
+
+        def map(&block)
+          instance_eval(&block) if block
+          @mapping
+        end
+
+        def controllers(controller_names = {})
+          @mapping.controllers.merge!(controller_names)
+        end
+
+        def skip_controllers(*controller_names)
+          @mapping.skips = controller_names
+        end
+
+        def as(alias_names = {})
+          @mapping.as.merge!(alias_names)
+        end
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/rails/routes/mapping.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Rails
+    class Routes # :nodoc:
+      class Mapping
+        attr_accessor :controllers, :as, :skips
+
+        def initialize
+          @controllers = {
+            authorizations: "doorkeeper/authorizations",
+            applications: "doorkeeper/applications",
+            authorized_applications: "doorkeeper/authorized_applications",
+            tokens: "doorkeeper/tokens",
+            token_info: "doorkeeper/token_info",
+          }
+
+          @as = {
+            authorizations: :authorization,
+            tokens: :token,
+            token_info: :token_info,
+          }
+
+          @skips = []
+        end
+
+        def [](routes)
+          {
+            controllers: @controllers[routes],
+            as: @as[routes],
+          }
+        end
+
+        def skipped?(controller)
+          @skips.include?(controller)
+        end
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/rails/routes/registry.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Rails
+    class Routes
+      # Thread-safe registry of any Doorkeeper additional routes.
+      # Used to allow implementing of Doorkeeper extensions that must
+      # use their own routes.
+      #
+      module Registry
+        ROUTES_ACCESS_LOCK = Mutex.new
+        ROUTES_DEFINITION_LOCK = Mutex.new
+
+        InvalidRouterClass = Class.new(StandardError)
+
+        # Collection of additional registered routes for Doorkeeper.
+        #
+        # @return [Array<Object>] set of registered routes
+        #
+        def registered_routes
+          ROUTES_DEFINITION_LOCK.synchronize do
+            @registered_routes ||= Set.new
+          end
+        end
+
+        # Registers additional routes in the Doorkeeper registry
+        #
+        # @param [Object] routes
+        #   routes class
+        #
+        def register_routes(routes)
+          if !routes.is_a?(Module) || !(routes < AbstractRouter)
+            raise InvalidRouterClass, "routes class must include Doorkeeper::Rails::AbstractRouter"
+          end
+
+          ROUTES_ACCESS_LOCK.synchronize do
+            registered_routes << routes
+          end
+        end
+
+        alias register register_routes
+      end
+    end
+  end
+end