doorkeeper-openid_connect 1.10.3 → 1.10.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4bedc8346eca194f64043d9326c448e386f3cf3ba3a9f1e3be620bef94f809f2
-  data.tar.gz: 04a5b33f8edb2ddd2ae4dc792ce40649aa1e65548953565cdf0edc9332e5013b
+  metadata.gz: 7c7b483ae4502881dca6aece41d05d538677d0e8d53f2fa3b82d9b89dc9aa1d8
+  data.tar.gz: dd8ed48877f8c68199c466afba4bd27a3b26671a00bd5af949146e103849544e
 SHA512:
-  metadata.gz: c125fedebc47c300e44a8c62e0424e180cdb48173a4cea5faab0928e9698738495f5cd9ddb7a55d482919dd84dbf02a059e268fb239d60c95648a935fb0b8b6e
-  data.tar.gz: fbedda34c90a57041aab6683f88ab5c57135894f86f6dc0c5872f062cdb881a029323ae05c59e63d4286108ed492122a3269c67fd8244a214a43f6713545a0ca
+  metadata.gz: 18b20b9a1d04b2dfe1bfd6a169057e08fee82d538990e506f46df58f70ff29a8681d30055e18542f2af82fdb3ebceb11dc976d8b4d55f2b0f01e41fb406b931c
+  data.tar.gz: 86b69e55903f371666178cfcaa8989e4d0c82939172a79bb070d3e50742ad4cac885edfd498d5c53af18cc98643c25cb63dc094b0c55f91c1279aec446f039a0

data/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 - Please add here
 
+## v1.10.4 (2026-07-07)
+
+- Validate the `scope` supplied to Dynamic Client Registration against the server's configured scopes (`default_scopes` + `optional_scopes`) before persisting it. Unrecognized scopes are silently dropped and the confirmed set is echoed in the registration response (RFC 7591 §2); a request whose scopes are all unsupported is rejected with `invalid_client_metadata` instead of being registered with an empty scope set.
+
 ## v1.10.3 (2026-06-23)
 
 - [#308] Fix `NameError: uninitialized constant Auth::ApplicationRecord` on boot when using a namespaced custom access grant model (e.g. `Auth::OAuthAccessGrant < ApplicationRecord`). Since v1.10.0 ([#241]) the `openid_request` association was wired inside an `ActiveSupport.on_load(:active_record)` block, which fires while `ActiveRecord::Base` is first loaded and constantizes the grant model too early. The association is now added from Doorkeeper's `AccessGrant` mixin `included` callback — at the model's own load time, without constantizing — mirroring the fix doorkeeper made in [#1830](https://github.com/doorkeeper-gem/doorkeeper/pull/1830) ([#306](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/306))

data/app/controllers/doorkeeper/openid_connect/dynamic_client_registration_controller.rb

@@ -51,7 +51,7 @@ module Doorkeeper
         {
           name: params[:client_name],
           redirect_uri: params[:redirect_uris] || [],
-          scopes: params[:scope],
+          scopes: registration.permitted_scopes,
           confidential: registration.confidential_client?,
         }
       end

data/lib/doorkeeper/openid_connect/oauth/dynamic_registration_request.rb

@@ -17,6 +17,7 @@ module Doorkeeper
         validate :application_type,           error: :invalid_client_metadata
         validate :response_types,             error: :invalid_client_metadata
         validate :grant_types,                error: :invalid_client_metadata
+        validate :scope,                      error: :invalid_client_metadata
 
         def initialize(server, params)
           @server = server
@@ -45,6 +46,26 @@ module Doorkeeper
           token_endpoint_auth_method != PUBLIC_CLIENT_AUTH_METHOD
         end
 
+        # RFC 7591 §2 lets the authorization server replace or omit requested
+        # scopes. The requested scope is intersected against the server's
+        # configured scopes (default + optional): partially unrecognized
+        # scopes are silently dropped, while a request whose scopes are all
+        # unsupported is rejected via #validate_scope, since persisting an
+        # empty scope set would make Doorkeeper's ScopeChecker fall back to
+        # the full server scope set. `Scopes#allowed` honors dynamic scopes
+        # and preserves the requested order, but only exists on Doorkeeper
+        # 5.8.1+; older versions fall back to plain intersection (dynamic
+        # scopes do not exist there, so nothing is lost).
+        def permitted_scopes
+          server_scopes = server.scopes
+
+          if server_scopes.respond_to?(:allowed)
+            server_scopes.allowed(requested_scopes).to_s
+          else
+            (server_scopes & requested_scopes).to_s
+          end
+        end
+
         def error_response
           { error: error.to_s, error_description: @error_description }
         end
@@ -91,6 +112,19 @@ module Doorkeeper
           false
         end
 
+        def requested_scopes
+          ::Doorkeeper::OAuth::Scopes.from_string(@params[:scope].to_s)
+        end
+
+        def validate_scope
+          return true if requested_scopes.blank? || permitted_scopes.present?
+
+          @error_description =
+            "scope '#{requested_scopes}' contains no scopes supported by this server. " \
+            "Supported scopes: #{server.scopes}"
+          false
+        end
+
         def server_response_types
           server.authorization_response_types
         end

data/lib/doorkeeper/openid_connect/version.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   module OpenidConnect
     MAJOR = 1
     MINOR = 10
-    TINY = 3
+    TINY = 4
     PRE = nil
 
     # Full version number

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-openid_connect
 version: !ruby/object:Gem::Version
-  version: 1.10.3
+  version: 1.10.4
 platform: ruby
 authors:
 - Sam Dengler
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-06-23 00:00:00.000000000 Z
+date: 2026-07-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper