doorkeeper-openid_connect 1.6.3 → 1.7.4

data/lib/doorkeeper/openid_connect/engine.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     class Engine < ::Rails::Engine

data/lib/doorkeeper/openid_connect/errors.rb

@@ -1,9 +1,11 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module Errors
       class OpenidConnectError < StandardError
-        def error_name
-          self.class.name.demodulize.underscore
+        def type
+          self.class.name.demodulize.underscore.to_sym
         end
       end
 
@@ -24,7 +26,6 @@ module Doorkeeper
       class LoginRequired < OpenidConnectError; end
       class ConsentRequired < OpenidConnectError; end
       class InteractionRequired < OpenidConnectError; end
-      class AccountSelectionRequired < OpenidConnectError; end
     end
   end
 end

data/lib/doorkeeper/openid_connect/helpers/controller.rb

@@ -1,9 +1,18 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module Helpers
       module Controller
         private
 
+        # FIXME: remove after Doorkeeper will merge it
+        def current_resource_owner
+          return @current_resource_owner if defined?(@current_resource_owner)
+
+          super
+        end
+
         def authenticate_resource_owner!
           super.tap do |owner|
             next unless oidc_authorization_request?
@@ -11,14 +20,14 @@ module Doorkeeper
             handle_oidc_prompt_param!(owner)
             handle_oidc_max_age_param!(owner)
           end
-        rescue Errors::OpenidConnectError => exception
-          handle_oidc_error!(exception)
+        rescue Errors::OpenidConnectError => e
+          handle_oidc_error!(e)
         end
 
         def oidc_authorization_request?
           controller_path == Doorkeeper::Rails::Routes.mapping[:authorizations][:controllers] &&
             action_name == 'new' &&
-            pre_auth.client &&
+            pre_auth.valid? &&
             pre_auth.scopes.include?('openid')
         end
 
@@ -29,14 +38,20 @@ module Doorkeeper
           # FIXME: workaround for Rails 5, see https://github.com/rails/rails/issues/25106
           @_response_body = nil
 
-          error_response = if pre_auth.valid?
-            ::Doorkeeper::OAuth::ErrorResponse.new(
-              name: exception.error_name,
-              state: params[:state],
-              redirect_uri: params[:redirect_uri]
-            )
-          else
-            pre_auth.error_response
+          error_response = if exception.type == :invalid_request
+                             ::Doorkeeper::OAuth::InvalidRequestResponse.new(
+                               name: exception.type,
+                               state: params[:state],
+                               redirect_uri: params[:redirect_uri],
+                               response_on_fragment: pre_auth.response_on_fragment?,
+                             )
+                           else
+                             ::Doorkeeper::OAuth::ErrorResponse.new(
+                               name: exception.type,
+                               state: params[:state],
+                               redirect_uri: params[:redirect_uri],
+                               response_on_fragment: pre_auth.response_on_fragment?,
+                             )
           end
 
           response.headers.merge!(error_response.headers)
@@ -53,17 +68,16 @@ module Doorkeeper
 
           prompt_values.each do |prompt|
             case prompt
-            when 'none' then
-              raise Errors::InvalidRequest if (prompt_values - [ 'none' ]).any?
+            when 'none'
+              raise Errors::InvalidRequest if (prompt_values - ['none']).any?
               raise Errors::LoginRequired unless owner
-              raise Errors::ConsentRequired if oidc_consent_required?(owner)
-            when 'login' then
+              raise Errors::ConsentRequired if oidc_consent_required?
+            when 'login'
               reauthenticate_oidc_resource_owner(owner) if owner
-            when 'consent' then
+            when 'consent'
               render :new
-            when 'select_account' then
-              # TODO: let the user implement this
-              raise Errors::AccountSelectionRequired
+            when 'select_account'
+              select_account_for_oidc_resource_owner(owner)
             else
               raise Errors::InvalidRequest
             end
@@ -74,40 +88,53 @@ module Doorkeeper
           max_age = params[:max_age].to_i
           return unless max_age > 0 && owner
 
-          auth_time = instance_exec owner,
+          auth_time = instance_exec(
+            owner,
             &Doorkeeper::OpenidConnect.configuration.auth_time_from_resource_owner
+          )
 
           if !auth_time || (Time.zone.now - auth_time) > max_age
             reauthenticate_oidc_resource_owner(owner)
           end
         end
 
-        def reauthenticate_oidc_resource_owner(owner)
+        def return_without_oidc_prompt_param(prompt_value)
           return_to = URI.parse(request.path)
           return_to.query = request.query_parameters.tap do |params|
-            params['prompt'] = params['prompt'].to_s.sub(/\blogin\s*\b/, '').strip
+            params['prompt'] = params['prompt'].to_s.sub(/\b#{prompt_value}\s*\b/, '').strip
             params.delete('prompt') if params['prompt'].blank?
           end.to_query
+          return_to.to_s
+        end
+
+        def reauthenticate_oidc_resource_owner(owner)
+          return_to = return_without_oidc_prompt_param('login')
 
-          instance_exec owner, return_to.to_s,
+          instance_exec(
+            owner,
+            return_to,
             &Doorkeeper::OpenidConnect.configuration.reauthenticate_resource_owner
+          )
 
           raise Errors::LoginRequired unless performed?
         end
 
-        def matching_tokens_for_oidc_resource_owner(owner)
-          Doorkeeper::AccessToken.authorized_tokens_for(pre_auth.client.id, owner.id).select do |token|
-            Doorkeeper::AccessToken.scopes_match?(token.scopes, pre_auth.scopes, pre_auth.client.scopes)
-          end
+        def oidc_consent_required?
+          !skip_authorization? && !matching_token?
         end
 
-        def oidc_consent_required?(owner)
-          return false if skip_authorization?
-          matching_tokens_for_oidc_resource_owner(owner).blank?
+        def select_account_for_oidc_resource_owner(owner)
+          return_to = return_without_oidc_prompt_param('select_account')
+
+          instance_exec(
+            owner,
+            return_to,
+            &Doorkeeper::OpenidConnect.configuration.select_account_for_resource_owner
+          )
         end
       end
     end
   end
 
-  Helpers::Controller.send :prepend, OpenidConnect::Helpers::Controller
+  Helpers::Controller.prepend OpenidConnect::Helpers::Controller
 end

data/lib/doorkeeper/openid_connect/id_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     class IdToken
@@ -9,7 +11,7 @@ module Doorkeeper
         @access_token = access_token
         @nonce = nonce
         @resource_owner = Doorkeeper::OpenidConnect.configuration.resource_owner_from_access_token.call(access_token)
-        @issued_at = Time.now
+        @issued_at = Time.zone.now
       end
 
       def claims
@@ -46,7 +48,7 @@ module Doorkeeper
       end
 
       def audience
-        @access_token.application.uid
+        @access_token.application.try(:uid)
       end
 
       def expiration

data/lib/doorkeeper/openid_connect/id_token_token.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     class IdTokenToken < IdToken

data/lib/doorkeeper/openid_connect/oauth/authorization/code.rb

@@ -1,22 +1,39 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module OAuth
       module Authorization
         module Code
-          def issue_token
-            super.tap do |access_grant|
-              if pre_auth.nonce.present?
-                ::Doorkeeper::OpenidConnect::Request.create!(
-                  access_grant: access_grant,
-                  nonce: pre_auth.nonce
-                )
+          if Doorkeeper::OAuth::Authorization::Code.method_defined?(:issue_token!)
+            def issue_token!
+              super.tap do |access_grant|
+                create_openid_request(access_grant) if pre_auth.nonce.present?
+              end
+            end
+
+            alias issue_token issue_token!
+          else
+            # FIXME: drop this after dropping support of Doorkeeper < 5.4
+            def issue_token
+              super.tap do |access_grant|
+                create_openid_request(access_grant) if pre_auth.nonce.present?
               end
             end
           end
+
+          private
+
+          def create_openid_request(access_grant)
+            ::Doorkeeper::OpenidConnect::Request.create!(
+              access_grant: access_grant,
+              nonce: pre_auth.nonce
+            )
+          end
         end
       end
     end
   end
 
-  OAuth::Authorization::Code.send :prepend, OpenidConnect::OAuth::Authorization::Code
+  OAuth::Authorization::Code.prepend OpenidConnect::OAuth::Authorization::Code
 end

data/lib/doorkeeper/openid_connect/oauth/authorization_code_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module OAuth
@@ -8,7 +10,7 @@ module Doorkeeper
           super
 
           nonce =
-            if openid_request = grant.openid_request
+            if (openid_request = grant.openid_request)
               openid_request.destroy!
               openid_request.nonce
             end
@@ -20,5 +22,5 @@ module Doorkeeper
     end
   end
 
-  OAuth::AuthorizationCodeRequest.send :prepend, OpenidConnect::OAuth::AuthorizationCodeRequest
+  OAuth::AuthorizationCodeRequest.prepend OpenidConnect::OAuth::AuthorizationCodeRequest
 end

data/lib/doorkeeper/openid_connect/oauth/password_access_token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module OAuth
@@ -20,5 +22,5 @@ module Doorkeeper
     end
   end
 
-  OAuth::PasswordAccessTokenRequest.send :prepend, OpenidConnect::OAuth::PasswordAccessTokenRequest
+  OAuth::PasswordAccessTokenRequest.prepend OpenidConnect::OAuth::PasswordAccessTokenRequest
 end

data/lib/doorkeeper/openid_connect/oauth/pre_authorization.rb

@@ -1,16 +1,37 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module OAuth
       module PreAuthorization
         attr_reader :nonce
 
-        def initialize(server, client, attrs = {})
-          super
+        def initialize(server, attrs = {}, resource_owner = nil)
+          if (Doorkeeper::VERSION::MAJOR >= 5 && Doorkeeper::VERSION::MINOR >= 4) ||
+             Doorkeeper::VERSION::MAJOR >= 6
+            super
+          else
+            super(server, attrs)
+          end
           @nonce = attrs[:nonce]
         end
+
+        # This method will be updated when doorkeeper move to version > 5.2.2
+        # TODO: delete this method and refactor response_on_fragment? method (below) when doorkeeper gem version constrains is > 5.2.2
+        def error_response
+          if error == :invalid_request
+            Doorkeeper::OAuth::InvalidRequestResponse.from_request(self, response_on_fragment: response_on_fragment?)
+          else
+            Doorkeeper::OAuth::ErrorResponse.from_request(self, response_on_fragment: response_on_fragment?)
+          end
+        end
+
+        def response_on_fragment?
+          Doorkeeper::OpenidConnect::ResponseMode.new(response_type).fragment?
+        end
       end
     end
   end
 
-  OAuth::PreAuthorization.send :prepend, OpenidConnect::OAuth::PreAuthorization
+  OAuth::PreAuthorization.prepend OpenidConnect::OAuth::PreAuthorization
 end

data/lib/doorkeeper/openid_connect/oauth/token_response.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module OAuth
@@ -19,5 +21,5 @@ module Doorkeeper
     end
   end
 
-  OAuth::TokenResponse.send :prepend, OpenidConnect::OAuth::TokenResponse
+  OAuth::TokenResponse.prepend OpenidConnect::OAuth::TokenResponse
 end

data/lib/doorkeeper/openid_connect/orm/active_record.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'active_support/lazy_load_hooks'
 
 module Doorkeeper

data/lib/doorkeeper/openid_connect/orm/active_record/access_grant.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module AccessGrant
@@ -12,5 +14,5 @@ module Doorkeeper
     end
   end
 
-  AccessGrant.send :prepend, OpenidConnect::AccessGrant
+  AccessGrant.prepend OpenidConnect::AccessGrant
 end

data/lib/doorkeeper/openid_connect/orm/active_record/request.rb

@@ -1,12 +1,14 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
-    class Request < ActiveRecord::Base
+    class Request < ApplicationRecord
       self.table_name = "#{table_name_prefix}oauth_openid_requests#{table_name_suffix}".to_sym
 
       validates :access_grant_id, :nonce, presence: true
       belongs_to :access_grant,
-        class_name: 'Doorkeeper::AccessGrant',
-        inverse_of: :openid_request
+                 class_name: 'Doorkeeper::AccessGrant',
+                 inverse_of: :openid_request
     end
   end
 end

data/lib/doorkeeper/openid_connect/rails/routes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'doorkeeper/openid_connect/rails/routes/mapping'
 require 'doorkeeper/openid_connect/rails/routes/mapper'
 
@@ -12,7 +14,7 @@ module Doorkeeper
         end
 
         def self.install!
-          ActionDispatch::Routing::Mapper.send :include, Doorkeeper::OpenidConnect::Rails::Routes::Helper
+          ActionDispatch::Routing::Mapper.include Doorkeeper::OpenidConnect::Rails::Routes::Helper
         end
 
         attr_accessor :routes

data/lib/doorkeeper/openid_connect/rails/routes/mapper.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module Rails

data/lib/doorkeeper/openid_connect/rails/routes/mapping.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OpenidConnect
     module Rails

data/lib/doorkeeper/openid_connect/response_mode.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OpenidConnect
+    class ResponseMode
+      attr_reader :type
+
+      def initialize(response_type)
+        @type = response_type
+      end
+
+      def fragment?
+        mode == 'fragment'
+      end
+
+      def query?
+        mode == 'query'
+      end
+
+      def mode
+        case type
+        when 'token', 'id_token', 'id_token token'
+          'fragment'
+        else
+          'query'
+        end
+      end
+    end
+  end
+end