Merge pull request #1144 from pakwfoley/pakwfoley/make_breaking_api_change_optional

Make breaking api change to native authorization code route optional

Author: nbulaj

NEWS.md

@@ -4,6 +4,11 @@ User-visible changes worth mentioning.
 
 ## master
 
+## 4.4.3
+- [#1143] Adds a config option opt_out_native_route_change to opt out of the
+  breaking api changed introduced in
+  https://github.com/doorkeeper-gem/doorkeeper/pull/1003
+
 ## 4.4.2
 - [#1130] Backport fix for native redirect_uri from 5.x.
 

lib/doorkeeper/config.rb

@@ -114,6 +114,15 @@ def use_refresh_token
       def reuse_access_token
         @config.instance_variable_set(:@reuse_access_token, true)
       end
+
+      # Opt out of breaking api change to the native authorization code flow.
+      # Opting out sets the authorization code response route for native
+      # redirect uris to oauth/authorize/<code>. The default is
+      # oauth/authorize/native?code=<code>.
+      # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1143
+      def opt_out_native_route_change
+        @config.instance_variable_set(:@opt_out_native_route_change, true)
+      end
     end
 
     module Option
@@ -295,6 +304,11 @@ def token_grant_types
       @token_grant_types ||= calculate_token_grant_types
     end
 
+    def native_authorization_code_route
+      @opt_out_native_route_change ||= false
+      @opt_out_native_route_change ? '/:code' : '/native'
+    end
+
     private
 
     # Determines what values are acceptable for 'response_type' param in

lib/doorkeeper/rails/routes.rb

@@ -47,7 +47,7 @@ def authorization_routes(mapping)
           as: mapping[:as],
           controller: mapping[:controllers]
         ) do
-          routes.get '/native', action: :show, on: :member
+          routes.get native_authorization_code_route, action: :show, on: :member
           routes.get '/', action: :new, on: :member
         end
       end
@@ -85,6 +85,10 @@ def application_routes(mapping)
       def authorized_applications_routes(mapping)
         routes.resources :authorized_applications, only: %i[index destroy], controller: mapping[:controllers]
       end
+
+      def native_authorization_code_route
+        Doorkeeper.configuration.native_authorization_code_route
+      end
     end
   end
 end

lib/doorkeeper/version.rb

@@ -28,7 +28,7 @@ module VERSION
     # Semantic versioning
     MAJOR = 4
     MINOR = 4
-    TINY = 2
+    TINY = 3
 
     # Full version number
     STRING = [MAJOR, MINOR, TINY].compact.join('.')

spec/controllers/authorizations_controller_spec.rb

@@ -164,6 +164,38 @@ def translated_error_message(key)
     it 'should not issue a token' do
       expect(Doorkeeper::AccessToken.count).to be 0
     end
+
+    context 'with opt_out_native_route_change' do
+      around(:each) do |example|
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+          opt_out_native_route_change
+        end
+
+        Rails.application.reload_routes!
+
+        example.run
+
+        Doorkeeper.configure do
+          orm DOORKEEPER_ORM
+        end
+
+        Rails.application.reload_routes!
+      end
+
+      it 'should redirect immediately' do
+        expect(response).to be_redirect
+        expect(response.location).to match(/oauth\/authorize\/#{Doorkeeper::AccessGrant.first.token}/)
+      end
+
+      it 'should issue a grant' do
+        expect(Doorkeeper::AccessGrant.count).to be 1
+      end
+
+      it 'should not issue a token' do
+        expect(Doorkeeper::AccessToken.count).to be 0
+      end
+    end
   end
 
   describe 'GET #new with skip_authorization true' do

spec/dummy/config/initializers/doorkeeper.rb

@@ -29,6 +29,11 @@
   # Issue access tokens with refresh token (disabled by default)
   use_refresh_token
 
+  # Opt out of breaking api change to the native authorization code flow. Opting out sets the authorization
+  # code response route for native redirect uris to oauth/authorize/<code>. The default is oauth/authorize/native?code=<code>.
+  # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1143
+  # opt_out_native_route_change
+
   # Provide support for an owner to be assigned to each registered application (disabled by default)
   # Optional parameter confirmation: true (default false) if you want to enforce ownership of
   # a registered application

spec/lib/config_spec.rb

@@ -162,6 +162,31 @@
     end
   end
 
+  describe 'opt_out_native_route_change' do
+    around(:each) do |example|
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+        opt_out_native_route_change
+      end
+
+      Rails.application.reload_routes!
+
+      subject { Doorkeeper.configuration }
+
+      example.run
+
+      Doorkeeper.configure do
+        orm DOORKEEPER_ORM
+      end
+
+      Rails.application.reload_routes!
+    end
+
+    it 'sets the native authorization code route /:code' do
+      expect(subject.native_authorization_code_route).to eq('/:code')
+    end
+  end
+
   describe 'client_credentials' do
     it 'has defaults order' do
       expect(subject.client_credentials_methods).to eq([:from_basic, :from_params])