doorkeeper-jwt 0.4.4 → 0.4.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3ce5cf8224951ed71ef293afd6c863ad606300ec2082f4f9c821228890ae384c
-  data.tar.gz: 92f97889cb72c6a6d5fc17cabeeb54fa934f30c2f23296ca24f1e5fe4490a574
+  metadata.gz: 51843843df19db6ed75ac9500ba810ab9e5ccde882386ced00d0746933ccd4c7
+  data.tar.gz: 982167d24d8e64f959fde2a1b89ffa11a513a02136a4147dd64ecacca2536ffb
 SHA512:
-  metadata.gz: 27d14827f9e9a5c9b5dcacf85f7a30c3d4714c95017dade01e85b27c8232883cf2f9a79dd9975b94db2ba904d3097307f5b05167eb94d7961cb61dc0ed93ea6e
-  data.tar.gz: 6847396d8b1a00f7c5abd9f4955e978bc148d559dc7de15a438f1df25790237b5e200a67bee6429eb5f25a1b986379f27557d692f34161797ec7515d08c73abc
+  metadata.gz: 2dad7626a80e34c5cea0cfd69c1b48d94db47a2748eccefa9d4e3f462a054865e28e518af1da1836008d7cecbaa16ebf2c122d934f3d75f7762879300fad3e40
+  data.tar.gz: d191d7577852ae158b2c54fb4cfe530e3e0f383dea8b1bde0ccdf528dc2489b9458811709ed2e09a3e818eaeaf5ec773d192e50296d88918e9e43bb2dfb0e506

data/.github/dependabot.yml

@@ -5,3 +5,8 @@ updates:
   schedule:
     interval: daily
   open-pull-requests-limit: 10
+- package-ecosystem: github-actions
+  directory: "/"
+  schedule:
+    interval: weekly
+  open-pull-requests-limit: 10

data/.github/workflows/changelog.yml

@@ -16,10 +16,10 @@ jobs:
   changelog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Check changed paths
         id: changes
-        uses: dorny/paths-filter@v4
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         with:
           filters: |
             gem_changes:
@@ -34,7 +34,7 @@ jobs:
       - name: Enforce changelog
         if: |
           steps.changes.outputs.gem_changes == 'true'
-        uses: dangoslen/changelog-enforcer@v3
+        uses: dangoslen/changelog-enforcer@8b5e9dc3121363bb7c0115f8533404d92af382de # v3.7.0
         with:
           changeLogPath: CHANGELOG.md
           skipLabels: "dependencies"

data/.github/workflows/ci.yml

@@ -23,8 +23,10 @@ jobs:
         experimental: [false]
         os: [ ubuntu-latest ]
         ruby:
-          - '3.0'
-          - '3.1'
+          - '3.2'
+          - '3.3'
+          - '3.4'
+          - '4.0'
         # The minimum declared in the gemspec and the latest release. 5.4 is the oldest
         # version whose options DSL resolves against our own config builder.
         doorkeeper:
@@ -32,10 +34,10 @@ jobs:
           - 'latest'
     steps:
       - name: Repo checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
@@ -45,3 +47,22 @@ jobs:
       - name: Run tests
         timeout-minutes: 10
         run: bundle exec rake test
+
+      - name: Upload coverage to Coveralls
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
+        with:
+          file: coverage/.resultset.json
+          format: simplecov
+          flag-name: ruby-${{ matrix.ruby }}-doorkeeper-${{ matrix.doorkeeper }}
+          parallel: true
+
+  coverage:
+    name: Coveralls Finished
+    needs: build
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Coveralls Finished
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
+        with:
+          parallel-finished: true

data/.rubocop.yml

@@ -6,7 +6,7 @@ AllCops:
   DisplayCopNames: true
   DisplayStyleGuide: false
   ExtraDetails: true
-  TargetRubyVersion: 2.5
+  TargetRubyVersion: 3.2
 
 Metrics/LineLength:
   Exclude:

data/CHANGELOG.md

@@ -8,6 +8,13 @@ project adheres to [Semantic Versioning](http://semver.org/).
 
 - Add your entry here
 
+# [0.4.5] - 2026-09-16
+
+- **Security**: Raise `Doorkeeper::JWT::SigningMethodMissing` instead of issuing an unsigned (`alg: none`) JWT when a signing key is configured but `signing_method` is not. Issuing unsigned tokens with no signing key at all now warns and will become an error in a future release
+- Add `required_ruby_version >= 3.2` to the gemspec and update the CI matrix to 3.2, 3.3, 3.4 and 4.0, aligning with doorkeeper core
+- Allow `signing_method`, `secret_key` and `secret_key_path` to be configured with a block evaluated per token [#66](https://github.com/doorkeeper-gem/doorkeeper-jwt/pull/66)
+- Fix broken Coveralls tests coverage [#67](https://github.com/doorkeeper-gem/doorkeeper-jwt/pull/67)
+
 # [0.4.4] - 2026-08-21
 
 - Fix `[DOORKEEPER] Option ... already defined and will be overridden` warnings on gem load [#61](https://github.com/doorkeeper-gem/doorkeeper-jwt/pull/61)

data/Gemfile

@@ -11,6 +11,6 @@ gemspec
 doorkeeper_version = ENV.fetch("DOORKEEPER_VERSION", "latest")
 gem "doorkeeper", doorkeeper_version unless doorkeeper_version == "latest"
 
-gem "coveralls_reborn", require: false
+gem "simplecov", "~> 1.1", require: false
 gem "rubocop", "~> 1.8", require: false
 gem "rubocop-rspec", "~> 3.0", require: false

data/README.md

@@ -1,7 +1,7 @@
 [![Gem Version](https://badge.fury.io/rb/doorkeeper-jwt.svg)](https://rubygems.org/gems/doorkeeper-jwt)
 [![Coverage Status](https://coveralls.io/repos/github/doorkeeper-gem/doorkeeper-jwt/badge.svg?branch=master)](https://coveralls.io/github/doorkeeper-gem/doorkeeper-jwt?branch=master)
 [![CI](https://github.com/doorkeeper-gem/doorkeeper-jwt/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/doorkeeper-gem/doorkeeper-jwt/actions/workflows/ci.yml)
-[![Maintainability](https://api.codeclimate.com/v1/badges/ca4d81b49acabda27e0c/maintainability)](https://codeclimate.com/github/doorkeeper-gem/doorkeeper-jwt/maintainability)
+[![Maintainability](https://qlty.sh/gh/doorkeeper-gem/projects/doorkeeper-jwt/maintainability.svg)](https://qlty.sh/gh/doorkeeper-gem/projects/doorkeeper-jwt)
 
 # Doorkeeper::JWT
 
@@ -103,6 +103,87 @@ Doorkeeper::JWT.configure do
 end
 ```
 
+### Authenticating more than one model
+
+`opts[:resource_owner_id]` alone does not tell the payload block which model the token belongs to, so an application
+with several resource owner models (say, `Driver` and `Client`) cannot look the owner up from the id.
+
+Doorkeeper 5.4 and newer can hand the owner record itself to the generator. Run the generator, which enables
+`use_polymorphic_resource_owner` in the `Doorkeeper.configure` block and creates the migration that adds the
+`resource_owner_type` columns, then apply the migration:
+
+    $ rails generate doorkeeper:enable_polymorphic_resource_owner
+    $ rails db:migrate
+
+The payload block then receives the record as `opts[:resource_owner]`, so the payload can branch on its class:
+
+```ruby
+Doorkeeper::JWT.configure do
+  token_payload do |opts|
+    owner = opts[:resource_owner]
+
+    # client credentials tokens have no resource owner
+    next { sub: opts[:application]&.uid } unless owner
+
+    # ids are only unique per model, so include the model name in `sub`
+    {
+      sub: "#{owner.class.name.underscore}:#{owner.id}",
+      owner_type: owner.class.name,
+      email: owner.email
+    }
+  end
+end
+```
+
+Tokens issued by the client credentials flow have no resource owner, so `opts[:resource_owner]` is `nil` there.
+
+### Using more than one signing method
+
+`signing_method`, `secret_key` and `secret_key_path` also accept a block. The block receives the same
+options hash as `token_payload` (`resource_owner_id`, `application`, `scopes`, ...) and is evaluated
+whenever the option is needed for the token being generated, so you can pick the algorithm and the key
+per request — for example an RSA-signed token for clients with an `admin` scope and an HMAC-signed token
+for everyone else:
+
+```ruby
+Doorkeeper::JWT.configure do
+  signing_method do |opts|
+    opts[:scopes].exists?('admin') ? :rs512 : :hs256
+  end
+
+  secret_key do |opts|
+    opts[:scopes].exists?('admin') ? ENV['JWT_RSA_PRIVATE_KEY'] : ENV['JWT_HMAC_SECRET']
+  end
+end
+```
+
+Doorkeeper hands `opts[:scopes]` over as a `Doorkeeper::OAuth::Scopes`, so match a single scope with
+`exists?` rather than with a substring check: `opts[:scopes].to_s.include?('admin')` would also be true for
+an unrelated `superadmin` or `admin_readonly` scope, and picking a signing key that way is easy to get wrong.
+
+The blocks are independent of each other, so make sure `secret_key` (or `secret_key_path`) returns a key that
+matches the algorithm returned by `signing_method` for the same options.
+
+Note that the key options are only resolved when they are actually used: `secret_key_path` is read for
+`RS*` and `ES*` algorithms only, and both `secret_key` and `secret_key_path` are skipped entirely when
+`use_application_secret` is enabled. When a path is configured for an asymmetric algorithm it takes
+precedence, and the `secret_key` block is not evaluated at all.
+
+Whoever verifies these tokens now has more than one key to choose from, so tell them which one was used:
+`token_headers` receives the same options hash and is evaluated per token as well, which lets you emit a
+matching `kid` header.
+
+```ruby
+Doorkeeper::JWT.configure do
+  token_headers do |opts|
+    { kid: opts[:scopes].exists?('admin') ? 'rsa-2026' : 'hmac-2026' }
+  end
+end
+```
+
+See the `token_headers` entry in the configuration above for deriving the `kid` of an `RS*` key with
+`JWT::JWK` instead of labelling it by hand.
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `bin/console` for an interactive prompt

data/doorkeeper-jwt.gemspec

@@ -13,7 +13,7 @@ Gem::Specification.new do |spec|
 
   spec.summary = "JWT token generator for Doorkeeper"
   spec.description = "JWT token generator extension for Doorkeeper"
-  spec.homepage = "https://github.com/chriswarren/doorkeeper-jwt"
+  spec.homepage = "https://github.com/doorkeeper-gem/doorkeeper-jwt"
   spec.license = "MIT"
 
   spec.bindir = "exe"
@@ -30,6 +30,8 @@ Gem::Specification.new do |spec|
     "funding_uri" => "https://opencollective.com/doorkeeper-gem",
   }
 
+  spec.required_ruby_version = ">= 3.2"
+
   # Loaded at require time by lib/doorkeeper/jwt/config.rb. The options DSL it
   # relies on only resolves against our own builder since Doorkeeper 5.4.
   spec.add_dependency "doorkeeper", ">= 5.4"

data/lib/doorkeeper/jwt/config.rb

@@ -1,10 +1,11 @@
 # frozen_string_literal: true
 
 require "doorkeeper/config/option"
+require "doorkeeper/jwt/errors"
 
 module Doorkeeper
   module JWT
-    class MissingConfiguration < StandardError
+    class MissingConfiguration < Error
       def initialize
         super("Configuration for doorkeeper-jwt missing.")
       end

data/lib/doorkeeper/jwt/errors.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module JWT
+    # Base class for every error raised by doorkeeper-jwt.
+    class Error < StandardError; end
+
+    # Raised when a signing key is configured but `signing_method` is not, so
+    # the only token that could be issued would be an unsigned (alg: none) one.
+    class SigningMethodMissing < Error; end
+  end
+end

data/lib/doorkeeper/jwt/version.rb

@@ -10,7 +10,7 @@ module Doorkeeper
       # Semantic versioning
       MAJOR = 0
       MINOR = 4
-      TINY = 4
+      TINY = 5
       PRE = nil
 
       # Full version number

data/lib/doorkeeper/jwt.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "doorkeeper/jwt/version"
+require "doorkeeper/jwt/errors"
 require "doorkeeper/jwt/config"
 require "jwt"
 
@@ -8,14 +9,22 @@ module Doorkeeper
   module JWT
     class << self
       def generate(opts = {})
+        algorithm = signing_method(opts)
+
         ::JWT.encode(
           token_payload(opts),
-          secret_key(opts),
-          signing_method,
+          secret_key(opts, algorithm),
+          algorithm,
           token_headers(opts)
         )
       end
 
+      def signing_key_configured?
+        use_application_secret? ||
+          !Doorkeeper::JWT.configuration.secret_key.nil? ||
+          !Doorkeeper::JWT.configuration.secret_key_path.nil?
+      end
+
       private
 
       def token_payload(opts = {})
@@ -26,27 +35,61 @@ module Doorkeeper
         Doorkeeper::JWT.configuration.token_headers.call(opts)
       end
 
-      def secret_key(opts)
-        opts = { application: {} }.merge(opts)
-
+      def secret_key(opts, algorithm)
         return application_secret(opts) if use_application_secret?
-        return secret_key_file unless secret_key_file.nil?
-        return rsa_key if rsa_signing?
-        return ecdsa_key if ecdsa_signing?
 
-        Doorkeeper::JWT.configuration.secret_key
+        case algorithm
+        when /RS\d{3}/ then OpenSSL::PKey::RSA.new(asymmetric_key(opts))
+        when /ES\d{3}/ then OpenSSL::PKey::EC.new(asymmetric_key(opts))
+        else configured_secret_key(opts)
+        end
+      end
+
+      # A configured key file wins over `secret_key`, which is only resolved
+      # when no path is configured for this token.
+      def asymmetric_key(opts)
+        secret_key_file(opts) || configured_secret_key(opts)
+      end
+
+      def configured_secret_key(opts)
+        resolve_option(Doorkeeper::JWT.configuration.secret_key, opts)
       end
 
-      def secret_key_file
-        return nil if Doorkeeper::JWT.configuration.secret_key_path.nil?
-        return rsa_key_file if rsa_signing?
-        return ecdsa_key_file if ecdsa_signing?
+      def secret_key_file(opts)
+        path = resolve_option(Doorkeeper::JWT.configuration.secret_key_path, opts)
+        File.read(path) if path
       end
 
-      def signing_method
-        return "none" unless Doorkeeper::JWT.configuration.signing_method
+      def signing_method(opts)
+        method = resolve_option(Doorkeeper::JWT.configuration.signing_method, opts)
+        return method.to_s.upcase unless method.nil?
+
+        raise_missing_signing_method if signing_key_configured?
 
-        Doorkeeper::JWT.configuration.signing_method.to_s.upcase
+        warn_unsigned_token
+        "none"
+      end
+
+      def raise_missing_signing_method
+        raise(
+          SigningMethodMissing,
+          "JWT `signing_method` is not configured, but a signing key is." \
+          " Refusing to issue an unsigned (alg: none) token. Set" \
+          " `signing_method` explicitly, e.g. `signing_method :hs512`."
+        )
+      end
+
+      def warn_unsigned_token
+        Kernel.warn(
+          "[DOORKEEPER-JWT]: No `signing_method` configured; issuing UNSIGNED" \
+          " tokens (alg: none). This will become an error in a future release."
+        )
+      end
+
+      # Options can be configured either with a static value or with a block
+      # that receives the token generation options and returns the value.
+      def resolve_option(value, opts)
+        value.respond_to?(:call) ? value.call(opts) : value
       end
 
       def use_application_secret?
@@ -54,6 +97,8 @@ module Doorkeeper
       end
 
       def application_secret(opts)
+        opts = { application: {} }.merge(opts)
+
         if opts[:application].nil?
           raise(
             "JWT `use_application_secret` is enabled, but application is nil." \
@@ -82,34 +127,6 @@ module Doorkeeper
 
         secret
       end
-
-      def rsa_signing?
-        /RS\d{3}/ =~ signing_method
-      end
-
-      def ecdsa_signing?
-        /ES\d{3}/ =~ signing_method
-      end
-
-      def rsa_key
-        OpenSSL::PKey::RSA.new(Doorkeeper::JWT.configuration.secret_key)
-      end
-
-      def ecdsa_key
-        OpenSSL::PKey::EC.new(Doorkeeper::JWT.configuration.secret_key)
-      end
-
-      def rsa_key_file
-        secret_key_file_open { |f| OpenSSL::PKey::RSA.new(f) }
-      end
-
-      def ecdsa_key_file
-        secret_key_file_open { |f| OpenSSL::PKey::EC.new(f) }
-      end
-
-      def secret_key_file_open(&block)
-        File.open(Doorkeeper::JWT.configuration.secret_key_path, &block)
-      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-jwt
 version: !ruby/object:Gem::Version
-  version: 0.4.4
+  version: 0.4.5
 platform: ruby
 authors:
 - Chris Warren
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2026-08-21 00:00:00.000000000 Z
+date: 2026-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper
@@ -117,8 +117,9 @@ files:
 - doorkeeper-jwt.gemspec
 - lib/doorkeeper/jwt.rb
 - lib/doorkeeper/jwt/config.rb
+- lib/doorkeeper/jwt/errors.rb
 - lib/doorkeeper/jwt/version.rb
-homepage: https://github.com/chriswarren/doorkeeper-jwt
+homepage: https://github.com/doorkeeper-gem/doorkeeper-jwt
 licenses:
 - MIT
 metadata:
@@ -135,7 +136,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="