Merge pull request #96 from doorkeeper-gem/copilot/fix-non-confidential-client-secret

Fix: non-confidential apps should not generate a client secret

Author: nbulaj

Gemfile

@@ -14,7 +14,7 @@ gem "rake"
 gem "rspec-core"
 gem "rspec-expectations"
 gem "rspec-mocks"
-gem "rspec-rails", "~> 6.0.0"
+gem "rspec-rails"
 gem "rspec-support"
 gem "rubocop", "~> 1.29.1"
 gem "rubocop-performance", require: false

doorkeeper

@@ -12,7 +12,7 @@
 gem "rspec-core"
 gem "rspec-expectations"
 gem "rspec-mocks"
-gem "rspec-rails", "~> 6.0.0"
+gem "rspec-rails"
 gem "rspec-support"
 gem "sprockets-rails"
 gem "timecop"

gemfiles/Gemfile.common.rb

@@ -36,7 +36,8 @@ module ApplicationMixin
           has_many :access_grants, has_many_options.merge(class_name: access_grants_class_name)
           has_many :access_tokens, has_many_options.merge(class_name: access_tokens_class_name)
 
-          validates_presence_of :name, :secret, :uid
+          validates_presence_of :name, :uid
+          validates_presence_of :secret, if: :secret_required?
           validates_uniqueness_of :uid
 
           # Before Doorkeeper 5.2.3
@@ -243,11 +244,16 @@ def generate_uid
 
         def generate_secret
           return if secret.present?
+          return unless secret_required?
 
           @raw_secret = UniqueToken.generate
           secret_strategy.store_secret(self, :secret, @raw_secret)
         end
 
+        def secret_required?
+          confidential?
+        end
+
         def scopes_match_configured
           if scopes.present? &&
              !ScopeChecker.valid?(scope_str: scopes.to_s,