doorkeeper-openid_connect 1.7.0 → 1.7.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9f38540bf15e49809e21423a76e0fd8313c5494aee4a3537f6b6d1bcd5645951
-  data.tar.gz: d1408e8c1a4755356746a55957dbc941242fb266ead2e5f92d29d46646258958
+  metadata.gz: 0bcb761a45b80b603b387474f5393d9000d154468eb7974620e9aace796836c5
+  data.tar.gz: 51809691b1ea73f5f2a28f00c2aa105c821e9e4326ae781b4dcbb433c7e034ac
 SHA512:
-  metadata.gz: 71ca0f37f65e787785550e64d4b5fc4ad05ad74ec93601e909924d1984f6b42612c4856bc8439373f8af52a8958e0e80beaf711ed78b012784eb941f46aeb889
-  data.tar.gz: f5c46bc891ed65513493cbeb7304fe76c04a62c03e8ce51b5f1849319da9be27bfa304b5064e028421a88583db4adf4e3ec71e3c4d900fd6ff850e44fa76a826
+  metadata.gz: d6e3df930e4e466ffac74df7d3e237158a34a7a831f6003749a9edf8766b762db132430c862287bd16a21a66d035cb4b62fa7f8f0f518452cf8bab3ec1fd4709
+  data.tar.gz: 32721653701e09ae2d022c627bf13f2bfce5390ffad046d976c880b186c97eaec5fa9173aed21789141056322786604224bfe62e6bfe4cdb43da030ed08b2b50

data/.ruby-version

@@ -1 +1 @@
-2.6.3
+2.6.5

data/CHANGELOG.md

@@ -1,8 +1,35 @@
 ## Unreleased
 
-No changes yet.
+## v1.7.1 (2020-02-07)
 
-## v1.7.0
+### Upgrading
+
+This version adds `on_delete: :cascade` to the migration template for the `oauth_openid_requests` table, in order to fix #82.
+
+For existing installations, you should add a new migration in your application to drop the existing foreign key and replace it with a new one with `on_delete: :cascade` included. Depending on the database you're using and the size of your application this might bring up some concerns, but in most cases the following should be sufficient:
+
+```ruby
+class UpdateOauthOpenIdRequestsForeignKeys < ActiveRecord::Migration[5.2]
+  def up
+    remove_foreign_key(:oauth_openid_requests, column: :access_grant_id)
+    add_foreign_key(:oauth_openid_requests, :oauth_access_grants, column: :access_grant_id, on_delete: :cascade)
+  end
+
+  def down
+    remove_foreign_key(:oauth_openid_requests, column: :access_grant_id)
+    add_foreign_key(:oauth_openid_requests, :oauth_access_grants, column: :access_grant_id)
+  end
+end
+```
+
+### Bugfixes
+
+- [#96] Bump `json-jwt` because of CVE-2019-18848 (thanks to @leleabhinav)
+- [#97] Fixes for compatibility with Doorkeeper 5.2 (thanks to @linhdangduy)
+- [#98] Cascade deletes from `oauth_openid_requests` to `oauth_access_grants` (thanks to @manojmj92)
+- [#99] Fix `audience` claim when application is not set on access token (thanks to @ionut998)
+
+## v1.7.0 (2019-11-04)
 
 ### Changes
 

data/README.md

@@ -4,6 +4,8 @@
 [![Code Climate](https://codeclimate.com/github/doorkeeper-gem/doorkeeper-openid_connect.svg)](https://codeclimate.com/github/doorkeeper-gem/doorkeeper-openid_connect)
 [![Gem Version](https://badge.fury.io/rb/doorkeeper-openid_connect.svg)](https://rubygems.org/gems/doorkeeper-openid_connect)
 
+#### :warning: **This project is looking for maintainers, see [this issue](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/89).**
+
 This library implements an [OpenID Connect](http://openid.net/connect/) authentication provider for Rails applications on top of the [Doorkeeper](https://github.com/doorkeeper-gem/doorkeeper) OAuth 2.0 framework.
 
 OpenID Connect is a single-sign-on and identity layer with a [growing list of server and client implementations](http://openid.net/developers/libraries/). If you're looking for a client in Ruby check out [omniauth_openid_connect](https://github.com/m0n9oose/omniauth_openid_connect/).

data/app/controllers/doorkeeper/authorizations_controller.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require_dependency "#{Doorkeeper::Engine.root}/app/controllers/doorkeeper/authorizations_controller.rb"
+
+module Doorkeeper
+  class AuthorizationsController
+    module AuthorizationsExtension
+      private
+
+      def pre_auth_param_fields
+        super.append(:nonce)
+      end
+    end
+
+    Doorkeeper::AuthorizationsController.send :prepend, AuthorizationsExtension
+  end
+end

data/doorkeeper-openid_connect.gemspec

@@ -19,8 +19,8 @@ Gem::Specification.new do |spec|
 
   spec.required_ruby_version = ">= 2.4"
 
-  spec.add_runtime_dependency 'doorkeeper', '~> 5.2.0'
-  spec.add_runtime_dependency 'json-jwt', '~> 1.6'
+  spec.add_runtime_dependency 'doorkeeper', '>= 5.2', '< 5.4'
+  spec.add_runtime_dependency 'json-jwt', '>= 1.11.0'
 
   spec.add_development_dependency 'rspec-rails'
   spec.add_development_dependency 'factory_bot'

data/lib/doorkeeper/oauth/id_token_request.rb

@@ -9,18 +9,14 @@ module Doorkeeper
       end
 
       def authorize
-        if pre_auth.authorizable?
-          @auth = Authorization::Token.new(pre_auth, resource_owner)
-          @auth.issue_token
-          @response = response
-        else
-          @response = error_response
-        end
+        @auth = Authorization::Token.new(pre_auth, resource_owner)
+        @auth.issue_token
+        response
       end
 
       def deny
         pre_auth.error = :access_denied
-        error_response
+        pre_auth.error_response
       end
 
       private
@@ -30,12 +26,6 @@ module Doorkeeper
 
         IdTokenResponse.new(pre_auth, auth, id_token)
       end
-
-      def error_response
-        ErrorResponse.from_request pre_auth,
-                                   redirect_uri: pre_auth.redirect_uri,
-                                   response_on_fragment: true
-      end
     end
   end
 end

data/lib/doorkeeper/openid_connect/helpers/controller.rb

@@ -19,7 +19,6 @@ module Doorkeeper
           controller_path == Doorkeeper::Rails::Routes.mapping[:authorizations][:controllers] &&
             action_name == 'new' &&
             pre_auth.valid? &&
-            pre_auth.client &&
             pre_auth.scopes.include?('openid')
         end
 
@@ -61,7 +60,7 @@ module Doorkeeper
             when 'none'
               raise Errors::InvalidRequest if (prompt_values - [ 'none' ]).any?
               raise Errors::LoginRequired unless owner
-              raise Errors::ConsentRequired if oidc_consent_required?(owner)
+              raise Errors::ConsentRequired if oidc_consent_required?
             when 'login'
               reauthenticate_oidc_resource_owner(owner) if owner
             when 'consent'
@@ -105,16 +104,8 @@ module Doorkeeper
           raise Errors::LoginRequired unless performed?
         end
 
-        def matching_tokens_for_oidc_resource_owner(owner)
-          Doorkeeper::AccessToken.authorized_tokens_for(pre_auth.client.id, owner.id).select do |token|
-            Doorkeeper::AccessToken.scopes_match?(token.scopes, pre_auth.scopes, pre_auth.client.scopes)
-          end
-        end
-
-        def oidc_consent_required?(owner)
-          return false if skip_authorization?
-
-          matching_tokens_for_oidc_resource_owner(owner).blank?
+        def oidc_consent_required?
+          !skip_authorization? && !matching_token?
         end
       end
     end

data/lib/doorkeeper/openid_connect/id_token.rb

@@ -46,7 +46,7 @@ module Doorkeeper
       end
 
       def audience
-        @access_token.application.uid
+        @access_token.application.try(:uid)
       end
 
       def expiration

data/lib/doorkeeper/openid_connect/oauth/pre_authorization.rb

@@ -8,6 +8,22 @@ module Doorkeeper
           super
           @nonce = attrs[:nonce]
         end
+
+        # This method will be updated when doorkeeper move to version > 5.2.2
+        # TODO: delete this method and refactor response_on_fragment? method (below) when doorkeeper gem version constrains is > 5.2.2
+        def error_response
+          if error == :invalid_request
+            Doorkeeper::OAuth::InvalidRequestResponse.from_request(self, response_on_fragment: response_on_fragment?)
+          else
+            Doorkeeper::OAuth::ErrorResponse.from_request(self, response_on_fragment: response_on_fragment?)
+          end
+        end
+
+        private
+
+        def response_on_fragment?
+          response_type == "token" || response_type == "id_token" || response_type == "id_token token"
+        end
       end
     end
   end

data/lib/doorkeeper/openid_connect/version.rb

@@ -1,5 +1,5 @@
 module Doorkeeper
   module OpenidConnect
-    VERSION = '1.7.0'.freeze
+    VERSION = '1.7.1'.freeze
   end
 end

data/lib/generators/doorkeeper/openid_connect/templates/migration.rb.erb

@@ -8,7 +8,8 @@ class CreateDoorkeeperOpenidConnectTables < ActiveRecord::Migration<%= migration
     add_foreign_key(
       :oauth_openid_requests,
       :oauth_access_grants,
-      column: :access_grant_id
+      column: :access_grant_id,
+      on_delete: :cascade
     )
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-openid_connect
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.7.1
 platform: ruby
 authors:
 - Sam Dengler
@@ -9,36 +9,42 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-04 00:00:00.000000000 Z
+date: 2020-02-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '5.2'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: 5.2.0
+        version: '5.4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: 5.2.0
+        version: '5.2'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '5.4'
 - !ruby/object:Gem::Dependency
   name: json-jwt
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: 1.11.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
-        version: '1.6'
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
@@ -126,6 +132,7 @@ files:
 - LICENSE.txt
 - README.md
 - Rakefile
+- app/controllers/doorkeeper/authorizations_controller.rb
 - app/controllers/doorkeeper/openid_connect/discovery_controller.rb
 - app/controllers/doorkeeper/openid_connect/userinfo_controller.rb
 - bin/console