doorkeeper-openid_connect 2.0.0.beta1 → 2.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 960d2cf9c359d5bae10fc7be2eff5fba0eb5309b359422d81ea0e0a3c451f192
-  data.tar.gz: e2efc3c51af4c54d599dd884264b9ce41cf136fa94f291d4222186dac3e266bd
+  metadata.gz: a6ac229d2a87bb6712986b26a47a87ef8758b581b1fa99ddd2475d0a860f9e65
+  data.tar.gz: 27300a20c1ad92391d2ecd2bbe8a635ccb97b490505f8d0c9752c09f8738d0ba
 SHA512:
-  metadata.gz: f349f5d093f30c5ed07a77349cc63d0651047185587c149172ec5d38eb29bd4644a74f3b10fd54674f43beda2885f58b7b400094e19afda4d24daadd56dc1e8d
-  data.tar.gz: 73e1e48f7fa439a9f7df513db74ba0a5df969a19a32abdf9c1b8bda34db08356abde81b3b3fdf425a0bbc46c8f258b669d1368cf25d067f187405e2f7cc8efd0
+  metadata.gz: b1bc13a50ca14f08f218341c00ff2ab15d9b04cf1bc4d25b92d9d8617cb7a432acf86df5ee69bebec6b3e576956734db840ecec63453f5572f848c6e35976416
+  data.tar.gz: ce360e5a9ad631ff29da07b288e0fd74523293c4227d1a9f9bd9583a3e41539225d8a61e70ab3e26aa43ffe51ec9fb061328f0be6e7089f02639739f8f6c21e3

data/CHANGELOG.md

@@ -4,6 +4,23 @@ Upgrading? [Migration from Old Versions](https://github.com/doorkeeper-gem/doork
 
 - Add entry here
 
+## v2.0.0 (2026-09-22)
+
+>[!IMPORTANT]
+>
+>- **Breaking (class overrides):** a configured `id_token_class` / `user_info_class` must now inherit from `Doorkeeper::OpenidConnect::IdToken` / `UserInfo` ([#364])
+>- **Breaking (settings removed):** the deprecated `jws_private_key` / `jws_public_key` initializer settings are gone ([#387])
+>- **Breaking (constant renamed):** `Doorkeeper::OpenidConnect::HybridIdTokenConcern` is now `AtHashConcern`, with no alias for the old name ([#399])
+>
+>**Coming from 1.10.x?** Every breaking change listed under 2.0.0.beta1 below applies as well — the `post_logout_redirect_uris` migration ([#243]), the `id_token token` response type change ([#337]), the removal of `IdTokenToken` ([#338]) and the Dynamic Client Registration defaults ([#350]). Those notes name `HybridIdTokenConcern`; read them as `AtHashConcern`, which is what 2.0.0 ships.
+>
+>[Migration from Old Versions](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/wiki/Migration-from-Old-Versions) walks through each one.
+
+- **Security:** Register a dynamically registered client with the server's `default_scopes` when the registration request omits `scope`, instead of persisting an empty scope set. Only deployments that enable `dynamic_client_registration` are affected.
+- [#364] **Breaking:** Require `id_token_class` / `user_info_class` overrides to inherit from `Doorkeeper::OpenidConnect::IdToken` / `UserInfo` ([#344](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/344)). Adds an `IdToken#select_key` hook returning the signing key and its algorithm together (`IdToken::SigningKey`) for per-client, rotating or multi-tenant keys, and binds the `at_hash` digest to that algorithm (OIDC Core §3.2.2.10) rather than the global `signing_algorithm`
+- [#387] **Breaking:** Remove the deprecated `jws_private_key` and `jws_public_key` initializer settings
+- [#399] **Breaking:** Rename `Doorkeeper::OpenidConnect::HybridIdTokenConcern` to `AtHashConcern`. The old name described the `id_token token` response type as a hybrid flow, but OpenID Connect Core defines that response type under the Implicit Flow (§3.2) — the Hybrid Flow response types of §3.3 are not implemented by this gem. Removed without an alias: the constant only ever shipped in 2.0.0.beta1
+
 ## v2.0.0.beta1 (2026-08-20)
 
 >[!IMPORTANT]

data/app/controllers/doorkeeper/openid_connect/discovery_controller.rb

@@ -28,6 +28,10 @@ module Doorkeeper
 
       private
 
+      # One method per metadata document: the provider metadata is a flat
+      # listing of endpoints and capabilities, and splitting it would hide the
+      # shape of the published document.
+      # rubocop:disable Metrics/AbcSize
       def provider_response
         doorkeeper = ::Doorkeeper.configuration
         openid_connect = ::Doorkeeper::OpenidConnect.configuration
@@ -79,6 +83,7 @@ module Doorkeeper
           code_challenge_methods_supported: code_challenge_methods_supported(doorkeeper),
         }.compact
       end
+      # rubocop:enable Metrics/AbcSize
 
       def response_modes_supported(doorkeeper)
         doorkeeper.authorization_response_flows.flat_map(&:response_mode_matches).uniq

data/app/controllers/doorkeeper/openid_connect/dynamic_client_registration_controller.rb

@@ -16,10 +16,7 @@ module Doorkeeper
         client = Doorkeeper.configuration.application_model.create!(application_params(registration))
         render json: registration_response(client, registration), status: :created
       rescue ActiveRecord::RecordInvalid => e
-        render json: {
-          error: registration_error_code(e.record),
-          error_description: e.record.errors.full_messages.join(", "),
-        }, status: :bad_request
+        render json: record_invalid_response(e.record), status: :bad_request
       end
 
       private
@@ -49,6 +46,13 @@ module Doorkeeper
         end
       end
 
+      def record_invalid_response(record)
+        {
+          error: registration_error_code(record),
+          error_description: record.errors.full_messages.join(", "),
+        }
+      end
+
       # RFC 7591 §3.2.2 registration error codes: `invalid_redirect_uri` for
       # redirect URI problems, `invalid_client_metadata` for everything else.
       def registration_error_code(record)
@@ -78,6 +82,10 @@ module Doorkeeper
         Doorkeeper.config.application_model.column_names.include?("post_logout_redirect_uris")
       end
 
+      # One method per metadata document: the registration response echoes
+      # the client metadata as RFC 7591 §3.2.1 lists it, and splitting it
+      # would hide the shape of the published document.
+      # rubocop:disable Metrics/AbcSize
       def registration_response(doorkeeper_application, registration)
         response = {
           client_id: doorkeeper_application.uid,
@@ -111,6 +119,7 @@ module Doorkeeper
 
         response
       end
+      # rubocop:enable Metrics/AbcSize
     end
   end
 end

data/lib/doorkeeper/oauth/id_token_token_request.rb

@@ -11,7 +11,7 @@ module Doorkeeper
         # serves the default and any custom id_token_class alike.
         id_token_token = Doorkeeper::OpenidConnect.configuration.id_token_model
                                                   .new(auth.token, pre_auth.nonce)
-                                                  .extend(Doorkeeper::OpenidConnect::HybridIdTokenConcern)
+                                                  .extend(Doorkeeper::OpenidConnect::AtHashConcern)
 
         IdTokenTokenResponse.new(pre_auth, auth, id_token_token)
       end

data/lib/doorkeeper/openid_connect/{hybrid_id_token_concern.rb → at_hash_concern.rb}

@@ -2,11 +2,16 @@
 
 module Doorkeeper
   module OpenidConnect
-    # Adds the `at_hash` claim required by the hybrid `id_token token` flow.
-    # The host object must implement `#claims` and expose the access token
-    # via an `#access_token` reader (public or private), as
-    # `Doorkeeper::OpenidConnect::IdToken` does.
-    module HybridIdTokenConcern
+    # Adds the `at_hash` claim required when an ID Token is issued alongside an
+    # access token — the `id_token token` response type, which OpenID Connect
+    # Core §3.2 defines as part of the Implicit Flow, not the Hybrid Flow of §3.3
+    # (whose response types this gem does not implement).
+    #
+    # The host object must implement `#claims`, expose the access token via an
+    # `#access_token` reader, and resolve its signing key via `#selected_key` —
+    # all provided by `Doorkeeper::OpenidConnect::IdToken`, which configured
+    # `id_token_class` overrides must inherit from.
+    module AtHashConcern
       def claims
         super.merge(at_hash: at_hash)
       end
@@ -37,8 +42,12 @@ module Doorkeeper
         Base64.urlsafe_encode64(first_half).tr("=", "")
       end
 
+      # OIDC Core §3.2.2.10 requires the digest to match the `alg` of the ID
+      # Token's actual JOSE header — derived from the key the token is signed
+      # with (`selected_key`, shared with `as_jws_token`), not from the global
+      # `signing_algorithm`, which a `select_key` override may diverge from.
       def at_hash_digest
-        case Doorkeeper::OpenidConnect.signing_algorithm.to_s
+        case selected_key.algorithm.to_s
         when /256\z/ then Digest::SHA256
         when /384\z/ then Digest::SHA384
         when /512\z/ then Digest::SHA512

data/lib/doorkeeper/openid_connect/claims_builder.rb

@@ -18,13 +18,20 @@ module Doorkeeper
         end
 
         Doorkeeper::OpenidConnect.configuration.claims.to_h.map do |name, claim|
-          if claim.scopes.any? { |scope| access_token.scopes.exists?(scope) } &&
-             claim.response.include?(response)
+          if claim_applies?(claim, access_token, response)
             [name, claim.generator.call(resource_owner, access_token.scopes, access_token)]
           end
         end.compact.to_h
       end
 
+      # A claim is included when the token carries one of its scopes and it is
+      # configured for this response type (:id_token / :user_info).
+      def self.claim_applies?(claim, access_token, response)
+        claim.scopes.any? { |scope| access_token.scopes.exists?(scope) } &&
+          claim.response.include?(response)
+      end
+      private_class_method :claim_applies?
+
       def initialize(&block)
         @claims = OpenStruct.new
         instance_eval(&block)

data/lib/doorkeeper/openid_connect/config.rb

@@ -68,15 +68,6 @@ module Doorkeeper
         def build
           @config
         end
-
-        def jws_public_key(*_args)
-          warn "DEPRECATION WARNING: `jws_public_key` is not needed anymore and will be removed in a future version, please remove it from config/initializers/doorkeeper_openid_connect.rb"
-        end
-
-        def jws_private_key(*args)
-          warn "DEPRECATION WARNING: `jws_private_key` has been replaced by `signing_key` and will be removed in a future version, please remove it from config/initializers/doorkeeper_openid_connect.rb"
-          signing_key(*args)
-        end
       end
 
       mattr_reader(:builder_class) { Config::Builder }
@@ -140,15 +131,19 @@ module Doorkeeper
       option :open_id_request_class, default: "Doorkeeper::OpenidConnect::Request"
 
       # A class that provides custom behavior for generating ID tokens.
-      # Should probably inherit from `Doorkeeper::OpenidConnect::IdToken`, but may also be completely custom
-      # so long as it responds to `#as_json`, `#as_jws_token`, `#issuer`, exposes the access token via
-      # an `#access_token` reader (public or private), and has the same initializer. The reader is what
-      # `HybridIdTokenConcern` uses to compute the `at_hash` claim in the hybrid `id_token token` flow.
+      # Must inherit from `Doorkeeper::OpenidConnect::IdToken`, which carries the
+      # security-critical invariants (required-claim enforcement, the merge order that keeps the
+      # `claims` configuration block from overriding `sub`/`aud`/`exp`, nonce and `at_hash`
+      # handling), so a subclass only overrides what it actually needs — typically `claims`
+      # (call `super.merge(...)` so the registered claims are always present; a key you add that
+      # collides with one of them does replace it, so keep your keys distinct unless replacing it
+      # is what you mean), `audience`, or `select_key` for custom signing-key selection.
       option :id_token_class, default: "Doorkeeper::OpenidConnect::IdToken"
 
       # A class that provides custom behavior for generating the UserInfo response.
-      # Should probably inherit from `Doorkeeper::OpenidConnect::UserInfo`, but may also be completely custom
-      # so long as it responds to `#as_json` and has the same initializer.
+      # Must inherit from `Doorkeeper::OpenidConnect::UserInfo`; a subclass typically only
+      # overrides `claims` (call `super.merge(...)`, and leave `sub` out of the merged hash unless
+      # replacing the canonical subject identifier is what you mean).
       option :user_info_class, default: "Doorkeeper::OpenidConnect::UserInfo"
 
       # Doorkeeper OpenID Request model class.
@@ -160,26 +155,32 @@ module Doorkeeper
       end
 
       def id_token_model
-        resolve_validated_model(:id_token, id_token_class, %i[as_json as_jws_token issuer access_token])
+        resolve_validated_model(:id_token, id_token_class, IdToken)
       end
 
       def user_info_model
-        resolve_validated_model(:user_info, user_info_class, %i[as_json])
+        resolve_validated_model(:user_info, user_info_class, UserInfo)
       end
 
       private
 
       # Resolves an `id_token_class` / `user_info_class` override to its class
-      # and validates that the required methods exist (presence only, not
-      # correctness). Both happen lazily at first use rather than inside
-      # `Doorkeeper::OpenidConnect.configure`: constantizing an app-defined
-      # class while initializers run breaks zeitwerk on Rails 7+, because
-      # reloadable constants must not be referenced during boot — the same
-      # reason `open_id_request_model` constantizes lazily. The class is also
-      # deliberately not memoized, so code reloading in development never
-      # hands back a stale class; only the validation result is cached, keyed
-      # on the resolved class so a reloaded class is re-validated.
-      def resolve_validated_model(kind, class_name, required_methods)
+      # and validates that it inherits from the corresponding default. The
+      # ancestry check replaced the earlier method-presence list: presence
+      # could be satisfied by any class (ActiveSupport defines `as_json` on
+      # `Object`), while inheritance also carries the security-critical
+      # behavior — required-claim enforcement, the claim merge order, nonce
+      # and `at_hash` handling — that a from-scratch implementation would
+      # have to reproduce. Both resolution and validation happen lazily at
+      # first use rather than inside `Doorkeeper::OpenidConnect.configure`:
+      # constantizing an app-defined class while initializers run breaks
+      # zeitwerk on Rails 7+, because reloadable constants must not be
+      # referenced during boot — the same reason `open_id_request_model`
+      # constantizes lazily. The class is also deliberately not memoized, so
+      # code reloading in development never hands back a stale class; only
+      # the validation result is cached, keyed on the resolved class so a
+      # reloaded class is re-validated.
+      def resolve_validated_model(kind, class_name, base_model)
         # `safe_constantize` (unlike a bare `constantize` rescue) only reports
         # nil when the configured constant itself is missing; a NameError
         # raised while loading the class body still surfaces as-is.
@@ -192,18 +193,15 @@ module Doorkeeper
         @validated_models ||= {}
         return model if @validated_models[kind] == model
 
-        missing_methods = required_methods.reject do |method|
-          model.method_defined?(method) || model.private_method_defined?(method)
-        end
+        validate_model_inheritance!(kind, class_name, model, base_model)
+        @validated_models[kind] = model
+      end
 
-        unless missing_methods.empty?
-          raise Errors::InvalidConfiguration,
-                "The configured #{kind}_class (#{class_name}) is missing the following " \
-                "required methods: #{missing_methods.join(", ")}"
-        end
+      def validate_model_inheritance!(kind, class_name, model, base_model)
+        return if model.is_a?(Class) && model <= base_model
 
-        @validated_models[kind] = model
-        model
+        raise Errors::InvalidConfiguration,
+              "The configured #{kind}_class (#{class_name}) must inherit from #{base_model.name}"
       end
     end
   end

data/lib/doorkeeper/openid_connect/helpers/controller/error_response.rb

@@ -17,23 +17,13 @@ module Doorkeeper
             # itself gates the emission on redirectability and on the issuer
             # being configured. Versions predating #1849 simply ignore the
             # attribute, so no version guard is needed.
-            error_response = if exception.type == :invalid_request
-                               ::Doorkeeper::OAuth::InvalidRequestResponse.new(
-                                 name: exception.type,
-                                 state: params[:state],
-                                 redirect_uri: params[:redirect_uri],
-                                 response_on_fragment: pre_auth.response_on_fragment?,
-                                 issuer: Doorkeeper::OpenidConnect.doorkeeper_issuer,
-                               )
-                             else
-                               ::Doorkeeper::OAuth::ErrorResponse.new(
-                                 name: exception.type,
-                                 state: params[:state],
-                                 redirect_uri: params[:redirect_uri],
-                                 response_on_fragment: pre_auth.response_on_fragment?,
-                                 issuer: Doorkeeper::OpenidConnect.doorkeeper_issuer,
-                               )
-                             end
+            error_response = oidc_error_response_class(exception).new(
+              name: exception.type,
+              state: params[:state],
+              redirect_uri: params[:redirect_uri],
+              response_on_fragment: pre_auth.response_on_fragment?,
+              issuer: Doorkeeper::OpenidConnect.doorkeeper_issuer,
+            )
 
             response.headers.merge!(error_response.headers)
 
@@ -45,6 +35,14 @@ module Doorkeeper
             @authorize_response = error_response
             redirect_or_render(@authorize_response)
           end
+
+          def oidc_error_response_class(exception)
+            if exception.type == :invalid_request
+              ::Doorkeeper::OAuth::InvalidRequestResponse
+            else
+              ::Doorkeeper::OAuth::ErrorResponse
+            end
+          end
         end
       end
     end

data/lib/doorkeeper/openid_connect/helpers/controller/prompt.rb

@@ -22,18 +22,12 @@ module Doorkeeper
 
           def apply_oidc_prompt!(prompt, prompt_values, owner)
             case prompt
-            when "none"
-              handle_oidc_prompt_none!(prompt_values, owner)
-            when "login"
-              handle_oidc_prompt_login!(owner)
-            when "consent"
-              handle_oidc_prompt_consent!(owner)
-            when "select_account"
-              select_account_for_oidc_resource_owner(owner)
-            when "create"
-              # NOTE: not supported, but does not raise an error.
-            else
-              raise Errors::InvalidRequest
+            when "none" then handle_oidc_prompt_none!(prompt_values, owner)
+            when "login" then handle_oidc_prompt_login!(owner)
+            when "consent" then handle_oidc_prompt_consent!(owner)
+            when "select_account" then select_account_for_oidc_resource_owner(owner)
+            when "create" then nil # NOTE: not supported, but does not raise an error.
+            else raise Errors::InvalidRequest
             end
           end
 
@@ -81,6 +75,11 @@ module Doorkeeper
 
           def return_without_oidc_prompt_param(prompt_value)
             return_to = URI.parse(request.path)
+            return_to.query = query_parameters_without_oidc_prompt(prompt_value).to_query
+            return_to.to_s
+          end
+
+          def query_parameters_without_oidc_prompt(prompt_value)
             # Work on a copy: `request.query_parameters` is memoized and shared, so
             # mutating it in place would corrupt the parameters seen by the rest of
             # the request (and any subsequent prompt value in the same loop).
@@ -95,8 +94,7 @@ module Doorkeeper
             else
               query.delete("prompt")
             end
-            return_to.query = query.to_query
-            return_to.to_s
+            query
           end
 
           def reauthenticate_oidc_resource_owner(owner)

data/lib/doorkeeper/openid_connect/helpers/controller/token_matching.rb

@@ -35,14 +35,10 @@ module Doorkeeper
             relation = token_model.authorized_tokens_for(pre_auth.client.id, owner)
             batch_size = Doorkeeper.configuration.token_lookup_batch_size
 
-            match_found = false
             token_model.find_access_token_in_batches(relation, batch_size: batch_size) do |batch|
-              if batch.any? { |token| token.scopes.scopes?(pre_auth.scopes) }
-                match_found = true
-                break
-              end
+              return true if batch.any? { |token| token.scopes.scopes?(pre_auth.scopes) }
             end
-            match_found
+            false
           end
 
           # Force Doorkeeper's `render_success` onto the auto-issue path when a

data/lib/doorkeeper/openid_connect/id_token.rb

@@ -9,10 +9,16 @@ module Doorkeeper
       # must never be silently dropped when blank.
       REQUIRED_CLAIMS = %i[iss sub aud exp iat].freeze
 
+      # The return type of `select_key`: the key material and the algorithm it
+      # signs with, kept together so `at_hash` can always be computed with the
+      # digest matching the algorithm in the token's actual JOSE header
+      # (OIDC Core §3.2.2.10).
+      SigningKey = Struct.new(:keypair, :kid, :algorithm, keyword_init: true)
+
       # `resource_owner` is exposed so callers can detect a token whose owner no
       # longer resolves (e.g. deleted after issuance) before serializing — the
       # `sub` claim would otherwise dereference a nil owner and raise.
-      # `access_token` is the reader HybridIdTokenConcern relies on to compute
+      # `access_token` is the reader AtHashConcern relies on to compute
       # `at_hash`; a custom id_token_class must expose one as well.
       attr_reader :access_token, :nonce, :resource_owner
 
@@ -58,10 +64,31 @@ module Doorkeeper
       end
 
       def as_jws_token
+        key = selected_key
+
         ::JWT.encode(as_json,
-                     Doorkeeper::OpenidConnect.signing_key.keypair,
-                     Doorkeeper::OpenidConnect.signing_algorithm.to_s,
-                     { typ: "JWT", kid: Doorkeeper::OpenidConnect.signing_key.kid }).to_s
+                     key.keypair,
+                     key.algorithm.to_s,
+                     { typ: "JWT", kid: key.kid }).to_s
+      end
+
+      # Override point for custom signing-key selection (per-client keys, key
+      # rotation, multi-tenant setups, …). Must return an object responding to
+      # `#keypair`, `#kid` and `#algorithm` — use `SigningKey` for convenience.
+      # Keys returned from here are not advertised automatically: a custom
+      # implementation is responsible for exposing any additional keys through
+      # its own JWKS handling so clients can validate the signature.
+      def select_key
+        # Resolved once: `signing_key` builds a fresh JWK per call and honors
+        # callable configuration, so reading `keypair` and `kid` from separate
+        # calls could pair values from two different keys.
+        jwk = Doorkeeper::OpenidConnect.signing_key
+
+        SigningKey.new(
+          keypair: jwk.keypair,
+          kid: jwk.kid,
+          algorithm: Doorkeeper::OpenidConnect.signing_algorithm.to_s,
+        )
       end
 
       # Public: the RFC 9207 `iss` authorization response parameter must be
@@ -78,6 +105,15 @@ module Doorkeeper
 
       private
 
+      # `select_key` resolved exactly once per token, mirroring the `issuer`
+      # memoization above: the signature (`as_jws_token`) and the `at_hash`
+      # digest (`AtHashConcern`) must agree on the algorithm, so a
+      # dynamic `select_key` implementation must not be re-invoked between
+      # the two.
+      def selected_key
+        @selected_key ||= select_key
+      end
+
       def subject
         Doorkeeper::OpenidConnect.configuration.subject.call(
           @resource_owner,

data/lib/doorkeeper/openid_connect/oauth/dynamic_registration_request.rb

@@ -65,9 +65,9 @@ module Doorkeeper
           server_scopes = server.scopes
 
           if server_scopes.respond_to?(:allowed)
-            server_scopes.allowed(requested_scopes).to_s
+            server_scopes.allowed(effective_requested_scopes).to_s
           else
-            (server_scopes & requested_scopes).to_s
+            (server_scopes & effective_requested_scopes).to_s
           end
         end
 
@@ -121,12 +121,34 @@ module Doorkeeper
           ::Doorkeeper::OAuth::Scopes.from_string(@params[:scope].to_s)
         end
 
+        # RFC 7591 §2: when the request omits `scope`, the authorization
+        # server registers the client with its own default set. Doorkeeper
+        # has one — `default_scopes` — and registering with no scopes at all
+        # is emphatically not it: an application whose `scopes` column is
+        # blank is treated as unrestricted by Doorkeeper's ScopeChecker
+        # (`app_scopes.presence || server_scopes`), so an omitted `scope`
+        # would register a client entitled to every scope the server defines,
+        # while a client that honestly declared a narrow scope stays confined
+        # to it.
+        def effective_requested_scopes
+          requested_scopes.presence || server.default_scopes
+        end
+
+        # A registration must never persist an empty scope set, whichever way
+        # it got there: neither an explicit `scope` made up entirely of
+        # unsupported values, nor an omitted `scope` on a server that
+        # configures no default scopes.
         def validate_scope
-          return true if requested_scopes.blank? || permitted_scopes.present?
+          return true if permitted_scopes.present?
 
           @error_description =
-            "scope '#{requested_scopes}' contains no scopes supported by this server. " \
-            "Supported scopes: #{server.scopes}"
+            if requested_scopes.present?
+              "scope '#{requested_scopes}' contains no scopes supported by this server. " \
+              "Supported scopes: #{server.scopes}"
+            else
+              "scope is required: this server registers no default scopes, so a client " \
+              "must request at least one of its supported scopes: #{server.scopes}"
+            end
           false
         end
 

data/lib/doorkeeper/openid_connect/rails/routes.rb

@@ -26,33 +26,38 @@ module Doorkeeper
 
         def generate_routes!(options)
           @mapping = Mapper.new.map(&@block)
-          openid_connect = ::Doorkeeper::OpenidConnect.configuration
-          prefix = route_helper_prefix(options)
 
           routes.scope options[:scope] || "oauth", as: "oauth" do
-            map_route(:userinfo, :userinfo_routes)
-            map_route(:discovery, :discovery_routes)
+            map_oauth_routes
+          end
 
-            if openid_connect.dynamic_client_registration
-              map_route(:dynamic_client_registration, :dynamic_client_registration_routes)
-            end
+          routes.scope(**well_known_scope(options)) do
+            map_route(:discovery, :discovery_well_known_routes)
           end
+        end
 
-          well_known_scope = { as: "oauth" }
+        private
+
+        def map_oauth_routes
+          map_route(:userinfo, :userinfo_routes)
+          map_route(:discovery, :discovery_routes)
+          return unless ::Doorkeeper::OpenidConnect.configuration.dynamic_client_registration
+
+          map_route(:dynamic_client_registration, :dynamic_client_registration_routes)
+        end
+
+        def well_known_scope(options)
+          prefix = route_helper_prefix(options)
+          scope = { as: "oauth" }
           # When the engine is mounted under a named scope (e.g.
           # `scope :users, as: :users`), Doorkeeper's and this engine's URL
           # helpers are generated with that prefix (`users_oauth_*`). Pass the
           # prefix down to the discovery controller via a route default so it can
           # resolve the correct namespaced helpers for the published endpoints.
-          well_known_scope[:defaults] = { route_helper_prefix: prefix } if prefix.present?
-
-          routes.scope(**well_known_scope) do
-            map_route(:discovery, :discovery_well_known_routes)
-          end
+          scope[:defaults] = { route_helper_prefix: prefix } if prefix.present?
+          scope
         end
 
-        private
-
         def route_helper_prefix(options)
           name = options[:as]
           name.present? ? "#{name}_" : ""

data/lib/doorkeeper/openid_connect/version.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     MAJOR = 2
     MINOR = 0
     TINY = 0
-    PRE = "beta1"
+    PRE = nil
 
     # Full version number
     VERSION = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/doorkeeper/openid_connect.rb

@@ -17,11 +17,11 @@ require "jwt"
 # `ClaimsBuilder` while its class body runs.
 module Doorkeeper
   module OpenidConnect
+    autoload :AtHashConcern, "doorkeeper/openid_connect/at_hash_concern"
     autoload :ClaimsBuilder, "doorkeeper/openid_connect/claims_builder"
     autoload :DiscoveryHelpersMixin, "doorkeeper/openid_connect/discovery_helpers_mixin"
     autoload :Errors, "doorkeeper/openid_connect/errors"
     autoload :GrantTypesSupportedMixin, "doorkeeper/openid_connect/grant_types_supported_mixin"
-    autoload :HybridIdTokenConcern, "doorkeeper/openid_connect/hybrid_id_token_concern"
     autoload :IdToken, "doorkeeper/openid_connect/id_token"
     autoload :TokenEndpointAuthMethodsSupportedMixin,
              "doorkeeper/openid_connect/token_endpoint_auth_methods_supported_mixin"
@@ -45,8 +45,8 @@ module Doorkeeper
   # makes them safe to autoload from a namespace this gem does not own.
   #
   # `Request::IdToken` and `Request::IdTokenToken` reach these at request time;
-  # for an application that never enables the OpenID Connect implicit or hybrid
-  # flows, none of the four is ever loaded.
+  # for an application that never enables the OpenID Connect implicit flows,
+  # none of the four is ever loaded.
   module OAuth
     autoload :IdTokenRequest, "doorkeeper/oauth/id_token_request"
     autoload :IdTokenResponse, "doorkeeper/oauth/id_token_response"
@@ -298,14 +298,10 @@ module Doorkeeper
       return issuer unless issuer.respond_to?(:call)
 
       case issuer.arity
-      when 0
-        issuer.call
-      when 1
-        issuer.call(request || resource_owner)
-      when 2
-        issuer.call(resource_owner, application)
-      else
-        issuer.call(resource_owner, application, request)
+      when 0 then issuer.call
+      when 1 then issuer.call(request || resource_owner)
+      when 2 then issuer.call(resource_owner, application)
+      else issuer.call(resource_owner, application, request)
       end
     end
     private_class_method :call_issuer

data/lib/generators/doorkeeper/openid_connect/templates/initializer.rb

@@ -208,12 +208,20 @@ Doorkeeper::OpenidConnect.configure do
   # different apps may need different claim sets) or if you need to transform data before returning
   # it to external clients.
   #
-  # It is generally recommended to subclass the default models, but you can implement your own so
-  # long as they respond to `#as_json` (and, for the ID Token, also to `#as_jws_token`, `#issuer`,
-  # and an `#access_token` reader — the latter is used to compute the `at_hash` claim in the hybrid
-  # `id_token token` response type), and have the same initializer. These methods may be private;
-  # their presence is validated when the class is first used. Depending on the implementation, this
-  # may or may not override the provided behavior of the `claims` block.
+  # Custom classes must inherit from Doorkeeper::OpenidConnect::IdToken /
+  # Doorkeeper::OpenidConnect::UserInfo (validated when the class is first used). The base classes
+  # carry the security-critical behavior — required-claim enforcement, the claim merge order that
+  # keeps the `claims` configuration block from overriding `sub`/`aud`/`exp`, nonce and `at_hash`
+  # handling — so a subclass only overrides what it actually needs. Typical override points:
+  #
+  #   - `claims` — call `super.merge(...)` so the base claims are always present. A key you add
+  #     that collides with a registered claim replaces it, so keep your keys distinct unless
+  #     replacing it is what you mean
+  #   - `audience` (ID Token) — the `aud` claim may be a string or an array per OIDC Core
+  #   - `select_key` (ID Token) — return a Doorkeeper::OpenidConnect::IdToken::SigningKey to sign
+  #     with a different key/algorithm (per-client keys, rotation, multi-tenancy). The `at_hash`
+  #     digest follows the selected algorithm automatically; advertising any additional keys via
+  #     JWKS is the application's responsibility.
   #
   # Refer to Doorkeeper::OpenidConnect::IdToken and Doorkeeper::OpenidConnect::UserInfo for more
   # information and implementation details.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-openid_connect
 version: !ruby/object:Gem::Version
-  version: 2.0.0.beta1
+  version: 2.0.0
 platform: ruby
 authors:
 - Sam Dengler
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-20 00:00:00.000000000 Z
+date: 2026-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper
@@ -195,6 +195,7 @@ files:
 - lib/doorkeeper/oauth/id_token_token_request.rb
 - lib/doorkeeper/oauth/id_token_token_response.rb
 - lib/doorkeeper/openid_connect.rb
+- lib/doorkeeper/openid_connect/at_hash_concern.rb
 - lib/doorkeeper/openid_connect/claims/claim.rb
 - lib/doorkeeper/openid_connect/claims/normal_claim.rb
 - lib/doorkeeper/openid_connect/claims_builder.rb
@@ -208,7 +209,6 @@ files:
 - lib/doorkeeper/openid_connect/helpers/controller/max_age.rb
 - lib/doorkeeper/openid_connect/helpers/controller/prompt.rb
 - lib/doorkeeper/openid_connect/helpers/controller/token_matching.rb
-- lib/doorkeeper/openid_connect/hybrid_id_token_concern.rb
 - lib/doorkeeper/openid_connect/id_token.rb
 - lib/doorkeeper/openid_connect/oauth/authorization/code.rb
 - lib/doorkeeper/openid_connect/oauth/authorization_code_request.rb
@@ -256,9 +256,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubygems_version: 3.1.6
 signing_key: