add required option for oauth2 middleware

CHANGELOG.md

@@ -3,6 +3,7 @@ Next Release
 
 #### Features
 * [#510](https://github.com/intridea/grape/pull/510): Support lambda-based default values for params - [@myitcv](https://github.com/myitcv).
+* [#511](https://github.com/intridea/grape/pull/511): Add `required` option for OAuth2 middleware - [@bcm](https://github.com/bcm).
 * Your contribution here.
 
 #### Fixes

lib/grape/middleware/auth/oauth2.rb

@@ -7,7 +7,8 @@ def default_options
         realm: 'OAuth API',
         parameter: %w(bearer_token oauth_token),
         accepted_headers: %w(HTTP_AUTHORIZATION X_HTTP_AUTHORIZATION X-HTTP_AUTHORIZATION REDIRECT_X_HTTP_AUTHORIZATION),
-        header: [/Bearer (.*)/i, /OAuth (.*)/i]
+        header: [/Bearer (.*)/i, /OAuth (.*)/i],
+        required: true
       }
     end
 
@@ -53,7 +54,7 @@ def verify_token(token)
             error_out(403, 'insufficient_scope')
           end
         end
-      else
+      elsif !!options[:required]
         error_out(401, 'invalid_token')
       end
     end

spec/grape/middleware/auth/oauth2_spec.rb

@@ -5,7 +5,7 @@ class FakeToken
     attr_accessor :token
 
     def self.verify(token)
-      FakeToken.new(token) if %w(g e).include?(token[0..0])
+      FakeToken.new(token) if !!token && %w(g e).include?(token[0..0])
     end
 
     def initialize(token)
@@ -87,4 +87,29 @@ def app
     it { @err[:headers]['WWW-Authenticate'].should == "OAuth realm='OAuth API', error='insufficient_scope'" }
     it { @err[:status].should == 403 }
   end
+
+  context 'when authorization is not required' do
+    def app
+      Rack::Builder.app do
+        use Grape::Middleware::Auth::OAuth2, token_class: 'FakeToken', required: false
+        run lambda { |env| [200, {}, [(env['api.token'].token if env['api.token'])]] }
+      end
+    end
+
+    context 'with no token' do
+      before { post '/awesome' }
+
+      it 'succeeds anyway' do
+        last_response.status.should == 200
+      end
+    end
+
+    context 'with a valid token' do
+      before { get '/awesome?oauth_token=g123' }
+
+      it 'sets env["api.token"]' do
+        last_response.body.should == 'g123'
+      end
+    end
+  end
 end