super-smart-kit 0.0.1

data/doorkeeper-5.9.3/lib/doorkeeper/engine.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  class Engine < Rails::Engine
+    initializer "doorkeeper.params.filter", after: :load_config_initializers do |app|
+      app.config.to_prepare do
+        Doorkeeper.setup_filter_parameters
+      end
+    end
+
+    initializer "doorkeeper.routes" do
+      Doorkeeper::Rails::Routes.install!
+    end
+
+    initializer "doorkeeper.helpers" do
+      ActiveSupport.on_load(:action_controller) do
+        include Doorkeeper::Rails::Helpers
+      end
+    end
+
+    config.to_prepare do
+      Doorkeeper.run_orm_hooks
+    end
+
+    if defined?(Sprockets) && Sprockets::VERSION.chr.to_i >= 4
+      initializer "doorkeeper.assets.precompile" do |app|
+        # Force users to use:
+        #    //= link doorkeeper/admin/application.css
+        # in Doorkeeper 5 for Sprockets 4 instead of precompile.
+        # Add note to official docs & Wiki
+        app.config.assets.precompile += %w[
+          doorkeeper/application.css
+          doorkeeper/admin/application.css
+        ]
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/errors.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Errors
+    class DoorkeeperError < StandardError
+      def type
+        message
+      end
+
+      def self.translate_options
+        {}
+      end
+    end
+
+    class InvalidGrantReuse < DoorkeeperError
+      def type
+        :invalid_grant
+      end
+    end
+
+    class InvalidTokenStrategy < DoorkeeperError
+      def type
+        :unsupported_grant_type
+      end
+    end
+
+    class MissingRequiredParameter < DoorkeeperError
+      attr_reader :missing_param
+
+      def initialize(missing_param)
+        super
+        @missing_param = missing_param
+      end
+
+      def type
+        :invalid_request
+      end
+    end
+
+    class BaseResponseError < DoorkeeperError
+      attr_reader :response
+
+      def initialize(response)
+        @response = response
+      end
+
+      def self.name_for_response
+        name.demodulize.underscore.to_sym
+      end
+    end
+
+    class InvalidCodeChallengeMethod < BaseResponseError
+      def self.translate_options
+        challenge_methods = Doorkeeper.config.pkce_code_challenge_methods_supported
+        {
+          challenge_methods: challenge_methods.join(", "),
+          count: challenge_methods.length,
+        }
+      end
+    end
+
+    UnableToGenerateToken = Class.new(DoorkeeperError)
+    TokenGeneratorNotFound = Class.new(DoorkeeperError)
+    NoOrmCleaner = Class.new(DoorkeeperError)
+
+    InvalidRequest = Class.new(BaseResponseError)
+    InvalidToken = Class.new(BaseResponseError)
+    InvalidClient = Class.new(BaseResponseError)
+    InvalidScope = Class.new(BaseResponseError)
+    InvalidRedirectUri = Class.new(BaseResponseError)
+    InvalidGrant = Class.new(BaseResponseError)
+
+    UnauthorizedClient = Class.new(BaseResponseError)
+    UnsupportedResponseType = Class.new(BaseResponseError)
+    UnsupportedResponseMode = Class.new(BaseResponseError)
+
+    AccessDenied = Class.new(BaseResponseError)
+    ServerError = Class.new(BaseResponseError)
+
+    TokenExpired = Class.new(InvalidToken)
+    TokenRevoked = Class.new(InvalidToken)
+    TokenUnknown = Class.new(InvalidToken)
+    TokenForbidden = Class.new(InvalidToken)
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/grant_flow/fallback_flow.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    class FallbackFlow < Flow
+      def handles_grant_type?
+        false
+      end
+
+      def handles_response_type?
+        false
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/grant_flow/flow.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    class Flow
+      attr_reader :name, :grant_type_matches, :grant_type_strategy,
+                  :response_type_matches, :response_type_strategy,
+                  :response_mode_matches
+
+      def initialize(name, **options)
+        @name = name
+        @grant_type_matches = options[:grant_type_matches]
+        @grant_type_strategy = options[:grant_type_strategy]
+        @response_type_matches = options[:response_type_matches]
+        @response_type_strategy = options[:response_type_strategy]
+        @response_mode_matches = options[:response_mode_matches]
+      end
+
+      def handles_grant_type?
+        grant_type_matches.present?
+      end
+
+      def handles_response_type?
+        response_type_matches.present?
+      end
+
+      def matches_grant_type?(value)
+        grant_type_matches === value
+      end
+
+      def matches_response_type?(value)
+        response_type_matches === value
+      end
+
+      def default_response_mode
+        response_mode_matches[0]
+      end
+
+      def matches_response_mode?(value)
+        response_mode_matches.include?(value)
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/grant_flow/registry.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    module Registry
+      mattr_accessor :flows
+      self.flows = {}
+
+      mattr_accessor :aliases
+      self.aliases = {}
+
+      # Allows to register custom OAuth grant flow so that Doorkeeper
+      # could recognize and process it.
+      #
+      def register(name_or_flow, **options)
+        unless name_or_flow.is_a?(Doorkeeper::GrantFlow::Flow)
+          name_or_flow = Flow.new(name_or_flow, **options)
+        end
+
+        flow_key = name_or_flow.name.to_sym
+
+        if flows.key?(flow_key)
+          ::Kernel.warn <<~WARNING
+            [DOORKEEPER] '#{flow_key}' grant flow already registered and will be overridden
+            in #{caller(1..1).first}
+          WARNING
+        end
+
+        flows[flow_key] = name_or_flow
+      end
+
+      # Allows to register aliases that could be used in `grant_flows`
+      # configuration option. It is possible to have aliases like 1:1 or
+      # 1:N, i.e. "implicit_oidc" => ['token', 'id_token', 'id_token token'].
+      #
+      def register_alias(alias_name, **options)
+        aliases[alias_name.to_sym] = Array.wrap(options.fetch(:as))
+      end
+
+      def expand_alias(alias_name)
+        aliases.fetch(alias_name.to_sym, [])
+      end
+
+      # [NOTE]: make it to use #fetch after removing fallbacks
+      def get(name)
+        flows[name.to_sym]
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/grant_flow.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require "doorkeeper/grant_flow/flow"
+require "doorkeeper/grant_flow/fallback_flow"
+require "doorkeeper/grant_flow/registry"
+
+module Doorkeeper
+  module GrantFlow
+    extend Registry
+
+    register(
+      :implicit,
+      response_type_matches: "token",
+      response_mode_matches: %w[fragment form_post],
+      response_type_strategy: Doorkeeper::Request::Token,
+    )
+
+    register(
+      :authorization_code,
+      response_type_matches: "code",
+      response_mode_matches: %w[query fragment form_post],
+      response_type_strategy: Doorkeeper::Request::Code,
+      grant_type_matches: "authorization_code",
+      grant_type_strategy: Doorkeeper::Request::AuthorizationCode,
+    )
+
+    register(
+      :client_credentials,
+      grant_type_matches: "client_credentials",
+      grant_type_strategy: Doorkeeper::Request::ClientCredentials,
+    )
+
+    register(
+      :password,
+      grant_type_matches: "password",
+      grant_type_strategy: Doorkeeper::Request::Password,
+    )
+
+    register(
+      :refresh_token,
+      grant_type_matches: "refresh_token",
+      grant_type_strategy: Doorkeeper::Request::RefreshToken,
+    )
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/grape/authorization_decorator.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module Grape
+    class AuthorizationDecorator < SimpleDelegator
+      def parameters
+        params
+      end
+
+      def authorization
+        env = __getobj__.env
+        env["HTTP_AUTHORIZATION"] ||
+          env["X-HTTP_AUTHORIZATION"] ||
+          env["X_HTTP_AUTHORIZATION"] ||
+          env["REDIRECT_X_HTTP_AUTHORIZATION"]
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/grape/helpers.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require "doorkeeper/grape/authorization_decorator"
+
+module Doorkeeper
+  module Grape
+    # Doorkeeper helpers for Grape applications.
+    # Provides helpers for endpoints authorization based on defined set of scopes.
+    module Helpers
+      # These helpers are for grape >= 0.10
+      extend ::Grape::API::Helpers
+      include Doorkeeper::Rails::Helpers
+
+      # endpoint specific scopes > parameter scopes > default scopes
+      def doorkeeper_authorize!(*scopes)
+        endpoint_scopes = endpoint.route_setting(:scopes) ||
+                          endpoint.options[:route_options][:scopes]
+
+        scopes = if endpoint_scopes
+                   Doorkeeper::OAuth::Scopes.from_array(endpoint_scopes)
+                 elsif scopes.present?
+                   Doorkeeper::OAuth::Scopes.from_array(scopes)
+                 end
+
+        super(*scopes)
+      end
+
+      def doorkeeper_render_error_with(error)
+        status_code = error_status_codes[error.status]
+        error!({ error: error.description }, status_code, error.headers)
+      end
+
+      private
+
+      def endpoint
+        env["api.endpoint"]
+      end
+
+      def doorkeeper_token
+        @doorkeeper_token ||= OAuth::Token.authenticate(
+          decorated_request,
+          *Doorkeeper.config.access_token_methods,
+        )
+      end
+
+      def decorated_request
+        AuthorizationDecorator.new(request)
+      end
+
+      def error_status_codes
+        {
+          unauthorized: 401,
+          forbidden: 403,
+        }
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/helpers/controller.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+
+# Define methods that can be called in any controller that inherits from
+# Doorkeeper::ApplicationMetalController or Doorkeeper::ApplicationController
+module Doorkeeper
+  module Helpers
+    # Rails controller helpers.
+    #
+    module Controller
+      def self.included(base)
+        base.helper_method :current_resource_owner if base.respond_to?(:helper_method)
+      end
+
+      private
+
+      # :doc:
+      def authenticate_resource_owner!
+        current_resource_owner
+      end
+
+      # :doc:
+      def current_resource_owner
+        return @current_resource_owner if defined?(@current_resource_owner)
+
+        @current_resource_owner ||= instance_eval(&Doorkeeper.config.authenticate_resource_owner)
+      end
+
+      def resource_owner_from_credentials
+        instance_eval(&Doorkeeper.config.resource_owner_from_credentials)
+      end
+
+      # :doc:
+      def authenticate_admin!
+        instance_eval(&Doorkeeper.config.authenticate_admin)
+      end
+
+      def server
+        @server ||= Server.new(self)
+      end
+
+      # :doc:
+      def doorkeeper_token
+        return @doorkeeper_token if defined?(@doorkeeper_token)
+
+        @doorkeeper_token ||= OAuth::Token.authenticate(request, *config_methods)
+      end
+
+      def config_methods
+        @config_methods ||= Doorkeeper.config.access_token_methods
+      end
+
+      def get_error_response_from_exception(exception)
+        if exception.respond_to?(:response)
+          exception.response
+        elsif exception.type == :invalid_request
+          OAuth::InvalidRequestResponse.new(
+            name: exception.type,
+            state: params[:state],
+            missing_param: exception.missing_param,
+          )
+        else
+          OAuth::ErrorResponse.new(name: exception.type, state: params[:state])
+        end
+      end
+
+      def handle_token_exception(exception)
+        error = get_error_response_from_exception(exception)
+        headers.merge!(error.headers)
+        self.response_body = error.body.to_json
+        self.status = error.status
+      end
+
+      def skip_authorization?
+        !!instance_exec(
+          [server.current_resource_owner, @pre_auth.client],
+          &Doorkeeper.config.skip_authorization
+        )
+      end
+
+      def enforce_content_type
+        if (request.put? || request.post? || request.patch?) && !x_www_form_urlencoded?
+          render json: {}, status: :unsupported_media_type
+        end
+      end
+
+      def x_www_form_urlencoded?
+        request.media_type == "application/x-www-form-urlencoded"
+      end
+    end
+  end
+end

data/doorkeeper-5.9.3/lib/doorkeeper/models/access_grant_mixin.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module AccessGrantMixin
+    extend ActiveSupport::Concern
+
+    include OAuth::Helpers
+    include Models::Expirable
+    include Models::Revocable
+    include Models::Accessible
+    include Models::Orderable
+    include Models::SecretStorable
+    include Models::Scopes
+    include Models::ResourceOwnerable
+    include Models::Concerns::WriteToPrimary
+    include Models::ExpirationTimeSqlMath
+
+    # Never uses PKCE if PKCE migrations were not generated
+    def uses_pkce?
+      self.class.pkce_supported? && code_challenge.present?
+    end
+
+    module ClassMethods
+      # Searches for Doorkeeper::AccessGrant record with the
+      # specific token value.
+      #
+      # @param token [#to_s] token value (any object that responds to `#to_s`)
+      #
+      # @return [Doorkeeper::AccessGrant, nil]
+      #   AccessGrant object or nil if there is no record with such token
+      #
+      def by_token(token)
+        find_by_plaintext_token(:token, token)
+      end
+
+      # Revokes AccessGrant records that have not been revoked and associated
+      # with the specific Application and Resource Owner.
+      #
+      # @param application_id [Integer]
+      #   ID of the Application
+      # @param resource_owner [ActiveRecord::Base, Integer]
+      #   instance of the Resource Owner model or it's ID
+      #
+      def revoke_all_for(application_id, resource_owner, clock = Time)
+        with_primary_role do
+          by_resource_owner(resource_owner)
+            .where(
+              application_id: application_id,
+              revoked_at: nil,
+            )
+            .update_all(revoked_at: clock.now.utc)
+        end
+      end
+
+      # Implements PKCE code_challenge encoding without base64 padding as described in the spec.
+      # https://datatracker.ietf.org/doc/html/rfc7636#appendix-A
+      #   Appendix A.  Notes on Implementing Base64url Encoding without Padding
+      #
+      #   This appendix describes how to implement a base64url-encoding
+      #   function without padding, based upon the standard base64-encoding
+      #   function that uses padding.
+      #
+      #       To be concrete, example C# code implementing these functions is shown
+      #   below.  Similar code could be used in other languages.
+      #
+      #   static string base64urlencode(byte [] arg)
+      #   {
+      #       string s = Convert.ToBase64String(arg); // Regular base64 encoder
+      #       s = s.Split('=')[0]; // Remove any trailing '='s
+      #       s = s.Replace('+', '-'); // 62nd char of encoding
+      #       s = s.Replace('/', '_'); // 63rd char of encoding
+      #       return s;
+      #   }
+      #
+      #   An example correspondence between unencoded and encoded values
+      #   follows.  The octet sequence below encodes into the string below,
+      #   which when decoded, reproduces the octet sequence.
+      #
+      #   3 236 255 224 193
+      #
+      #   A-z_4ME
+      #
+      # https://ruby-doc.org/stdlib-2.1.3/libdoc/base64/rdoc/Base64.html#method-i-urlsafe_encode64
+      #
+      # urlsafe_encode64(bin)
+      # Returns the Base64-encoded version of bin. This method complies with
+      # "Base 64 Encoding with URL and Filename Safe Alphabet" in RFC 4648.
+      # The alphabet uses '-' instead of '+' and '_' instead of '/'.
+
+      # @param code_verifier [#to_s] a one time use value (any object that responds to `#to_s`)
+      #
+      # @return [#to_s] An encoded code challenge based on the provided verifier
+      # suitable for PKCE validation
+      #
+      def generate_code_challenge(code_verifier)
+        Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
+      end
+
+      def pkce_supported?
+        column_names.include?("code_challenge")
+      end
+
+      ##
+      # Determines the secret storing transformer
+      # Unless configured otherwise, uses the plain secret strategy
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
+      def secret_strategy
+        ::Doorkeeper.config.token_secret_strategy
+      end
+
+      ##
+      # Determine the fallback storing strategy
+      # Unless configured, there will be no fallback
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
+      def fallback_secret_strategy
+        ::Doorkeeper.config.token_secret_fallback_strategy
+      end
+    end
+  end
+end