doorkeeper-openid_connect 1.5.3 → 1.5.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 19eb794bd5e95ffce94e66f31408dd28466a80b4e282a0e2ac6ad5cecdd39882
-  data.tar.gz: a76b2f91648df1f2ca2a3e2951163b4727e43121beeda3c7cdceb2c16b1b8827
+  metadata.gz: b09a17901bf54012e9d0fa0e454e34fd3f12c146fe41d7e40d19124718c95186
+  data.tar.gz: 7a0e5dac4ccde54639a9f6e73f7550c3a1d86b051c0225beb7186f5ca667000e
 SHA512:
-  metadata.gz: cfb1372220f224e7f1aa37539aea5d4d02b9be19b1dbb793c9ad34a29cceb701adecc11cab883054d2d22424ff16659096dc758079179a7f1454e854b3a5f447
-  data.tar.gz: 0a6475882e55fe7baf685ceb45d038f8d66d59ed6013faade643e296c94cc83aa30b2278ab9a766b29b9ba42f249140f92bf2f36a107281eae0f54c6f3a9278c
+  metadata.gz: 45106e01b76d5f0f9727e9ad83bac894627b463fd32741cce898a54b4f2e9716a7c75ed701f0f9ef044b73e31f7f067673442defae26edf1e8591cc8d2a402ef
+  data.tar.gz: b2036d745efe2c848a531a0b29a9b6d26b0c10071ffc258a6ff607b238d95fe003fca4a29a7b395f073749f101c7283ccd3994731a9f0efcea285b41e175f59d

data/.ruby-version

@@ -1 +1 @@
-2.6.0
+2.6.1

data/CHANGELOG.md

@@ -2,29 +2,44 @@
 
 No changes yet.
 
+## v1.5.4 (2019-02-15)
+
+### Bugfixes
+
+- [#66] Fix an open redirect vulnerability (thanks to @meagar)
+- [#67] Don't delete existing tokens with `prompt=consent` (thanks to @nov)
+
+### Changes
+
+- [#62] Support customization of redirect params in `id_token` and `id_token token` responses (thanks to @meagar)
+
 ## v1.5.3 (2019-01-19)
 
+### Bugfixes
+
+- [#60] Don't break native authorization in Doorkeeper 5.x
+
 ### Changes
 
-- Use versioned migrations for Rails 5.x (thanks to @tvongaza)
+- [#58] Use versioned migrations for Rails 5.x (thanks to @tvongaza)
 
 ## v1.5.2 (2018-09-04)
 
 ### Changes
 
-- The previous release was a bit premature, this fixes some compatibility issues with Doorkeeper 5.x
+- [#56] The previous release was a bit premature, this fixes some compatibility issues with Doorkeeper 5.x
 
 ## v1.5.1 (2018-09-04)
 
 ### Changes
 
-- This gem is now compatible with Doorkeeper 5.x
+- [#55] This gem is now compatible with Doorkeeper 5.x
 
 ## v1.5.0 (2018-06-27)
 
 ### Features
 
-- Custom claims can now also be returned directly in the ID token, see the updated README for usage instructions
+- [#52] Custom claims can now also be returned directly in the ID token, see the updated README for usage instructions
 
 ## v1.4.0 (2018-05-31)
 

data/Gemfile

@@ -4,4 +4,8 @@ source 'https://rubygems.org'
 ENV['rails'] ||= '5.2.0'
 gem 'rails', "~> #{ENV['rails']}"
 
+if ENV['rails'] =~ /^5./
+  gem 'rails-controller-testing'
+end
+
 gemspec

data/README.md

@@ -1,7 +1,6 @@
 # Doorkeeper::OpenidConnect
 
 [![Build Status](https://travis-ci.org/doorkeeper-gem/doorkeeper-openid_connect.svg?branch=master)](https://travis-ci.org/doorkeeper-gem/doorkeeper-openid_connect)
-[![Dependency Status](https://gemnasium.com/doorkeeper-gem/doorkeeper-openid_connect.svg?travis)](https://gemnasium.com/doorkeeper-gem/doorkeeper-openid_connect)
 [![Code Climate](https://codeclimate.com/github/doorkeeper-gem/doorkeeper-openid_connect.svg)](https://codeclimate.com/github/doorkeeper-gem/doorkeeper-openid_connect)
 [![Gem Version](https://badge.fury.io/rb/doorkeeper-openid_connect.svg)](https://rubygems.org/gems/doorkeeper-openid_connect)
 
@@ -12,6 +11,7 @@ OpenID Connect is a single-sign-on and identity layer with a [growing list of se
 ## Table of Contents
 
 - [Status](#status)
+  - [Known Issues](#known-issues)
   - [Example Applications](#example-applications)
 - [Installation](#installation)
 - [Configuration](#configuration)
@@ -37,6 +37,10 @@ In addition we also support most of [OpenID Connect Discovery 1.0](http://openid
 
 Take a look at the [DiscoveryController](app/controllers/doorkeeper/openid_connect/discovery_controller.rb) for more details on supported features.
 
+### Known Issues
+
+- Doorkeeper's API mode (`Doorkeeper.configuration.api_only`) is not properly supported yet
+
 ### Example Applications
 
 - [GitLab](https://gitlab.com/gitlab-org/gitlab-ce) ([original MR](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/8018))
@@ -169,10 +173,10 @@ Doorkeeper::OpenidConnect.configure do
       "#{resource_owner.first_name} #{resource_owner.last_name}"
     end
 
-    claim :preferred_username, scope: :openid do |resource_owner, application_scopes, access_token|
+    claim :preferred_username, scope: :openid do |resource_owner, scopes, access_token|
       # Pass the resource_owner's preferred_username if the application has
       # `profile` scope access. Otherwise, provide a more generic alternative.
-      application_scopes.exists?(:profile) ? resource_owner.preferred_username : "summer-sun-9449"
+      scopes.exists?(:profile) ? resource_owner.preferred_username : "summer-sun-9449"
     end
 
     claim :groups, response: [:id_token, :user_info] do |resource_owner|
@@ -182,6 +186,12 @@ Doorkeeper::OpenidConnect.configure do
 end
 ```
 
+Each claim block will be passed:
+
+- the `resource_owner`, which is the return value of `resource_owner_authenticator` in your initializer
+- the `scopes` granted by the access token, which is an instance of `Doorkeeper::OAuth::Scopes`
+- the `access_token` itself, which is an instance of `Doorkeeper::AccessToken`
+
 By default all custom claims are only returned from the `UserInfo` endpoint and not included in the ID token. You can optionally pass a `response:` keyword with one or both of the symbols `:id_token` or `:user_info` to specify where the claim should be returned.
 
 You can also pass a `scope:` keyword argument on each claim to specify which OAuth scope should be required to access the claim. If you define any of the defined [Standard Claims](http://openid.net/specs/openid-connect-core-1_0.html#StandardClaims) they will by default use their [corresponding scopes](http://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims) (`profile`, `email`, `address` and `phone`), and any other claims will by default use the `profile` scope. Again, to use any of these scopes you need to enable them as described above.

data/doorkeeper-openid_connect.gemspec

@@ -24,7 +24,7 @@ Gem::Specification.new do |spec|
 
   spec.add_development_dependency 'rspec-rails'
   spec.add_development_dependency 'factory_bot'
-  spec.add_development_dependency 'sqlite3'
+  spec.add_development_dependency 'sqlite3', '~> 1.3.6'
   spec.add_development_dependency 'pry-byebug'
   spec.add_development_dependency 'conventional-changelog', '~> 1.2'
 end

data/lib/doorkeeper/oauth/id_token_response.rb

@@ -16,12 +16,17 @@ module Doorkeeper
       end
 
       def redirect_uri
-        Authorization::URIBuilder.uri_with_fragment(
-          pre_auth.redirect_uri,
+        Authorization::URIBuilder.uri_with_fragment(pre_auth.redirect_uri, redirect_uri_params)
+      end
+
+      private
+
+      def redirect_uri_params
+        {
           expires_in: auth.token.expires_in_seconds,
           state: pre_auth.state,
           id_token: id_token.as_jws_token
-        )
+        }
       end
     end
   end

data/lib/doorkeeper/oauth/id_token_token_response.rb

@@ -1,15 +1,13 @@
 module Doorkeeper
   module OAuth
     class IdTokenTokenResponse < IdTokenResponse
-      def redirect_uri
-        Authorization::URIBuilder.uri_with_fragment(
-          pre_auth.redirect_uri,
+      private
+
+      def redirect_uri_params
+        super.merge({
           access_token: auth.token.token,
-          token_type: auth.token.token_type,
-          expires_in: auth.token.expires_in_seconds,
-          state: pre_auth.state,
-          id_token: id_token.as_jws_token
-        )
+          token_type: auth.token.token_type
+        })
       end
     end
   end

data/lib/doorkeeper/openid_connect/helpers/controller.rb

@@ -6,8 +6,9 @@ module Doorkeeper
 
         def authenticate_resource_owner!
           super.tap do |owner|
-            next unless respond_to?(:pre_auth, true)
-            next unless pre_auth.client && pre_auth.scopes.include?('openid')
+            next unless controller_path == Doorkeeper::Rails::Routes.mapping[:authorizations][:controllers] &&
+              action_name == 'new'
+            next unless pre_auth.scopes.include?('openid')
 
             handle_prompt_param!(owner)
             handle_max_age_param!(owner)
@@ -19,13 +20,22 @@ module Doorkeeper
           # FIXME: workaround for Rails 5, see https://github.com/rails/rails/issues/25106
           @_response_body = nil
 
-          error = ::Doorkeeper::OAuth::ErrorResponse.new(name: exception.error_name, state: params[:state], redirect_uri: params[:redirect_uri])
-          response.headers.merge!(error.headers)
+          error_response = if pre_auth.valid?
+            ::Doorkeeper::OAuth::ErrorResponse.new(
+              name: exception.error_name,
+              state: params[:state],
+              redirect_uri: params[:redirect_uri]
+            )
+          else
+            pre_auth.error_response
+          end
+
+          response.headers.merge!(error_response.headers)
 
-          if error.redirectable?
-            render json: error.body, status: :found, location: error.redirect_uri
+          if error_response.redirectable?
+            render json: error_response.body, status: :found, location: error_response.redirect_uri
           else
-            render json: error.body, status: error.status
+            render json: error_response.body, status: error_response.status
           end
         end
 
@@ -41,7 +51,7 @@ module Doorkeeper
             when 'login' then
               reauthenticate_resource_owner(owner) if owner
             when 'consent' then
-              matching_tokens_for_resource_owner(owner).map(&:destroy)
+              render :new
             when 'select_account' then
               # TODO: let the user implement this
               raise Errors::AccountSelectionRequired

data/lib/doorkeeper/openid_connect/version.rb

@@ -1,5 +1,5 @@
 module Doorkeeper
   module OpenidConnect
-    VERSION = '1.5.3'.freeze
+    VERSION = '1.5.4'.freeze
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-openid_connect
 version: !ruby/object:Gem::Version
-  version: 1.5.3
+  version: 1.5.4
 platform: ruby
 authors:
 - Sam Dengler
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-01-19 00:00:00.000000000 Z
+date: 2019-02-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper
@@ -71,16 +71,16 @@ dependencies:
   name: sqlite3
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 1.3.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: 1.3.6
 - !ruby/object:Gem::Dependency
   name: pry-byebug
   requirement: !ruby/object:Gem::Requirement