applicake/doorkeeper — pull request #295 by chitsaou (2013-10-08 12:48:15+00:00)
Title: Only enable specific grant flows.

I'd like to disable some unused grant flows in my API design, such as Resource Owner Password Credentials Grant and Client Credentials Grant. I found there is no way to disable it, so I implemented it.

In practice, the Authorization Endpoint and Token Endpoint would check for available response / grant types (the "strategies") according to the grant flows enabled. For example, if `:implicit` is not enabled, then Authorization Endpoint will return "Unsupported Response Type" error when `response_type` is set to `token`.

By default it enables all the four grant flows. I've also modified initializer file:

```ruby
# Change what grant flows are enabled
# By default it enables all the four grant flows. Remove any of them from
# the array to disable.
#
# grant_flows [
# :authorization_code,
# :implicit,
# :resource_owner_password_credentials,
# :client_credentials
# ]
```

Notes:

1. I don't know whether the commit chitsaou/doorkeeper@110c0d01be8afd8a7713a302333f5c0abb7bad85 is necessary, since the "Unsupported Response Type" is filtered in Doorkeeper::Request. I can remove this commit if you think this is not necessary.
* Instead of RSpec tests, I've tested this feature with my demo app, and it seems work.
* How do you think about the config values in my commit? In fact I feel that `:resource_owner_password_credentials` is too long.
* Token refreshing on Token Endpoint is currently always-enabled. I think it would make more sense if it is enabled only when `use_refresh_token` is enabled.
* `server_spec.rb` cannot be run standalone, it would raise some exceptions. I instead tested this spec with `rake spec`.