Customize unauthorized response to failed resource_owner_from_credentials

[kueda]

When using the Resource Owner Password Credentials flow, it would be helpful if we could customized the JSON response to POST /oauth/token. For example, we might want to tell the client that the password was wrong, or the user has been suspended, or something else unique to the user requesting the token. I don't think the approach described at https://github.com/doorkeeper-gem/doorkeeper/wiki/Customizing-the-response-body-when-unauthorized will work because it just creates a customized response for all failed attempts to retrieve an access token and doesn't allow us to customize the response to explain why a specific request failed. Maybe a configuration block that takes the request as an argument, or the ability to raise an error with some customizable response JSON in the resource_owner_from_credentials config block? It would also be useful to change the response code, e.g. return a 403 Forbidden if the user exists, the credentials are fine, but they've been suspended.

[f3ndot]

#1032 (and its less-good predecessor #1001 available in v4.3.0) allows you to hook into the response for all grant types. You could be able to if guard for the password grant type and customize your response as you see fit.

I've done a similar thing in my own projects.

[nbulaj]

@kueda configurable callbacks for the oauth2 requests (#1032) already accessible in Doorkeeper 4.3.1 and you can use them.

[kueda]

I ended up working around this by subclassing Doorkeeper::TokensController which gave be complete control over the response. I'm not sure #1032 would allow me to do the same thing because

1. It only allows me to hook in when authorization was successful. I'm more interested in customizing error responses to tell the client why authorization failed.
2. Even if I perform an additional check on the authenticated user in after_successful_response, I just get a mostly immutable Doorkeeper::OAuth::TokenResponse (if I'm reading the TokenResponse class correctly, it seems like the only thing I can change is its token attribute). I can't change the body or the headers on that without type casting the response object in some way, which seems messy.

Anyway, I figured out a solution that works for me based on a custom controller. Since this is a pretty niche request, maybe that's the best option. If so, please feel free to close.