doorkeeper-openid_connect 1.10.2 → 1.10.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a7213362be6e1d40b9d790e35b6b860d6cbf80691282732e1257a4a01998ee39
-  data.tar.gz: 0f0830786b8f43e64ee75c69c4ffadcfae0e1af2d5d4ace18214879740dbb7c3
+  metadata.gz: 7c7b483ae4502881dca6aece41d05d538677d0e8d53f2fa3b82d9b89dc9aa1d8
+  data.tar.gz: dd8ed48877f8c68199c466afba4bd27a3b26671a00bd5af949146e103849544e
 SHA512:
-  metadata.gz: 626d292fa7351472982a54e48001973c7d9202bf146ce6dbd5f2577def44ee22d3f753117db18ae175134e727caaca64a4ab05b5b87f38e821254af13e93416b
-  data.tar.gz: d48ae4ce304b01e15f45200b9c3bf47e987decf85bd6c7270c87f56bb3f463617ac5de287b9b243d2538ff3c92f2b84d03771df81b5edea50360694029afa5dc
+  metadata.gz: 18b20b9a1d04b2dfe1bfd6a169057e08fee82d538990e506f46df58f70ff29a8681d30055e18542f2af82fdb3ebceb11dc976d8b4d55f2b0f01e41fb406b931c
+  data.tar.gz: 86b69e55903f371666178cfcaa8989e4d0c82939172a79bb070d3e50742ad4cac885edfd498d5c53af18cc98643c25cb63dc094b0c55f91c1279aec446f039a0

data/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 - Please add here
 
+## v1.10.4 (2026-07-07)
+
+- Validate the `scope` supplied to Dynamic Client Registration against the server's configured scopes (`default_scopes` + `optional_scopes`) before persisting it. Unrecognized scopes are silently dropped and the confirmed set is echoed in the registration response (RFC 7591 §2); a request whose scopes are all unsupported is rejected with `invalid_client_metadata` instead of being registered with an empty scope set.
+
+## v1.10.3 (2026-06-23)
+
+- [#308] Fix `NameError: uninitialized constant Auth::ApplicationRecord` on boot when using a namespaced custom access grant model (e.g. `Auth::OAuthAccessGrant < ApplicationRecord`). Since v1.10.0 ([#241]) the `openid_request` association was wired inside an `ActiveSupport.on_load(:active_record)` block, which fires while `ActiveRecord::Base` is first loaded and constantizes the grant model too early. The association is now added from Doorkeeper's `AccessGrant` mixin `included` callback — at the model's own load time, without constantizing — mirroring the fix doorkeeper made in [#1830](https://github.com/doorkeeper-gem/doorkeeper/pull/1830) ([#306](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/306))
+
 ## v1.10.2 (2026-06-22)
 
 - [#315] Drop support for EOL Ruby 3.1 (EOL 2025-03-25) and require Ruby `>= 3.2`. `i18n 1.15.0` uses the `Fiber[]` storage API which only exists on Ruby 3.2+, so the Ruby 3.1 CI row no longer loads; the matrix now tests Ruby 3.2 as the minimum

data/app/controllers/doorkeeper/openid_connect/dynamic_client_registration_controller.rb

@@ -51,7 +51,7 @@ module Doorkeeper
         {
           name: params[:client_name],
           redirect_uri: params[:redirect_uris] || [],
-          scopes: params[:scope],
+          scopes: registration.permitted_scopes,
           confidential: registration.confidential_client?,
         }
       end

data/lib/doorkeeper/openid_connect/oauth/dynamic_registration_request.rb

@@ -17,6 +17,7 @@ module Doorkeeper
         validate :application_type,           error: :invalid_client_metadata
         validate :response_types,             error: :invalid_client_metadata
         validate :grant_types,                error: :invalid_client_metadata
+        validate :scope,                      error: :invalid_client_metadata
 
         def initialize(server, params)
           @server = server
@@ -45,6 +46,26 @@ module Doorkeeper
           token_endpoint_auth_method != PUBLIC_CLIENT_AUTH_METHOD
         end
 
+        # RFC 7591 §2 lets the authorization server replace or omit requested
+        # scopes. The requested scope is intersected against the server's
+        # configured scopes (default + optional): partially unrecognized
+        # scopes are silently dropped, while a request whose scopes are all
+        # unsupported is rejected via #validate_scope, since persisting an
+        # empty scope set would make Doorkeeper's ScopeChecker fall back to
+        # the full server scope set. `Scopes#allowed` honors dynamic scopes
+        # and preserves the requested order, but only exists on Doorkeeper
+        # 5.8.1+; older versions fall back to plain intersection (dynamic
+        # scopes do not exist there, so nothing is lost).
+        def permitted_scopes
+          server_scopes = server.scopes
+
+          if server_scopes.respond_to?(:allowed)
+            server_scopes.allowed(requested_scopes).to_s
+          else
+            (server_scopes & requested_scopes).to_s
+          end
+        end
+
         def error_response
           { error: error.to_s, error_description: @error_description }
         end
@@ -91,6 +112,19 @@ module Doorkeeper
           false
         end
 
+        def requested_scopes
+          ::Doorkeeper::OAuth::Scopes.from_string(@params[:scope].to_s)
+        end
+
+        def validate_scope
+          return true if requested_scopes.blank? || permitted_scopes.present?
+
+          @error_description =
+            "scope '#{requested_scopes}' contains no scopes supported by this server. " \
+            "Supported scopes: #{server.scopes}"
+          false
+        end
+
         def server_response_types
           server.authorization_response_types
         end

data/lib/doorkeeper/openid_connect/orm/active_record/mixins/openid_request.rb

@@ -11,6 +11,18 @@ module Doorkeeper
             included do
               self.table_name = "#{table_name_prefix}oauth_openid_requests#{table_name_suffix}".to_sym
 
+              # Legacy multi-database support: older Doorkeeper releases let
+              # users route the ORM models to a separate connection via
+              # `active_record_options[:establish_connection]`. Doorkeeper
+              # 5.9.x no longer exposes `active_record_options`, so the guard
+              # makes this a no-op there. It used to live in the ORM adapter's
+              # `run_hooks`; wiring it from the model's own `included` block
+              # keeps it off the re-entrant `on_load(:active_record)` path.
+              if Doorkeeper.configuration.respond_to?(:active_record_options) &&
+                 (connection_options = Doorkeeper.configuration.active_record_options[:establish_connection])
+                establish_connection(connection_options)
+              end
+
               validates :access_grant_id, :nonce, presence: true
 
               if Gem.loaded_specs["doorkeeper"].version >= Gem::Version.create("5.5.0")

data/lib/doorkeeper/openid_connect/orm/active_record.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "active_support/lazy_load_hooks"
-
 module Doorkeeper
   module OpenidConnect
     autoload :AccessGrant, "doorkeeper/openid_connect/orm/active_record/access_grant"
@@ -14,51 +12,43 @@ module Doorkeeper
                    "doorkeeper/openid_connect/orm/active_record/mixins/openid_request"
         end
 
-        def run_hooks
-          super
-
-          ActiveSupport.on_load(:active_record) do
-            require "doorkeeper/openid_connect/orm/active_record/access_grant"
-            require "doorkeeper/openid_connect/orm/active_record/request"
-
-            if Gem.loaded_specs["doorkeeper"].version >= Gem::Version.create("5.5.0")
-              Doorkeeper.config.access_grant_model.prepend Doorkeeper::OpenidConnect::AccessGrant
-            else
-              Doorkeeper::AccessGrant.prepend Doorkeeper::OpenidConnect::AccessGrant
-            end
-
-            if Doorkeeper.configuration.respond_to?(:active_record_options) && Doorkeeper.configuration.active_record_options[:establish_connection]
-              [Doorkeeper::OpenidConnect.configuration.open_id_request_model].each do |c|
-                c.send :establish_connection,
-                       Doorkeeper.configuration.active_record_options[:establish_connection]
-              end
-            end
-          end
-        end
-
-        def initialize_models!
-          super
-          ActiveSupport.on_load(:active_record) do
-            require "doorkeeper/openid_connect/orm/active_record/access_grant"
-            require "doorkeeper/openid_connect/orm/active_record/request"
-
-            if Gem.loaded_specs["doorkeeper"].version >= Gem::Version.create("5.5.0")
-              Doorkeeper.config.access_grant_model.prepend Doorkeeper::OpenidConnect::AccessGrant
-            else
-              Doorkeeper::AccessGrant.prepend Doorkeeper::OpenidConnect::AccessGrant
-            end
-
-            if Doorkeeper.configuration.active_record_options[:establish_connection]
-              [Doorkeeper::OpenidConnect.configuration.open_id_request_model].each do |c|
-                c.send :establish_connection,
-                       Doorkeeper.configuration.active_record_options[:establish_connection]
-              end
-            end
+        # Prepended onto the singleton class of Doorkeeper's AccessGrant
+        # mixin so that every model which includes
+        # `Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant` — the default
+        # `Doorkeeper::AccessGrant` as well as any (possibly namespaced)
+        # custom access grant model — also gains the OpenID Connect
+        # `openid_request` association.
+        #
+        # The association is wired from the mixin's `included` callback, at
+        # the moment the host model is loaded: `base` is the model class
+        # itself, handed to us by Ruby. Nothing reaches out to constantize
+        # the configured grant class, so the re-entrant
+        # `ActiveSupport.on_load(:active_record)` window that broke
+        # namespaced custom models is gone.
+        #
+        # Background: doorkeeper-openid_connect v1.10.0 (#241) wrapped the
+        # grant-model prepend in `ActiveSupport.on_load(:active_record)`,
+        # following doorkeeper #1804. doorkeeper later reverted that in
+        # #1830 (v5.9.2) because the hook fires while `ActiveRecord::Base`
+        # is first loaded — e.g. mid-evaluation of
+        # `class ApplicationRecord < ActiveRecord::Base` — at which point
+        # constantizing `Auth::OAuthAccessGrant < ApplicationRecord` raises
+        # `NameError: uninitialized constant Auth::ApplicationRecord` (#306).
+        # We follow the same fix: wire from the mixin instead of on_load.
+        module AccessGrantExtension
+          def included(base)
+            super
+            # `base` is a Module (not the model) when the mixin is included
+            # into an intermediate ActiveSupport::Concern; the concern defers
+            # the include, so this hook fires again with the model class.
+            base.prepend(OpenidConnect::AccessGrant) if base.is_a?(Class)
           end
         end
       end
     end
   end
 
-  Orm::ActiveRecord.singleton_class.send :prepend, OpenidConnect::Orm::ActiveRecord
+  Orm::ActiveRecord::Mixins::AccessGrant.singleton_class.prepend(
+    OpenidConnect::Orm::ActiveRecord::AccessGrantExtension,
+  )
 end

data/lib/doorkeeper/openid_connect/version.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   module OpenidConnect
     MAJOR = 1
     MINOR = 10
-    TINY = 2
+    TINY = 4
     PRE = nil
 
     # Full version number

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-openid_connect
 version: !ruby/object:Gem::Version
-  version: 1.10.2
+  version: 1.10.4
 platform: ruby
 authors:
 - Sam Dengler
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-06-22 00:00:00.000000000 Z
+date: 2026-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper