doorkeeper-openid_connect 2.0.0.beta1 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 960d2cf9c359d5bae10fc7be2eff5fba0eb5309b359422d81ea0e0a3c451f192
-  data.tar.gz: e2efc3c51af4c54d599dd884264b9ce41cf136fa94f291d4222186dac3e266bd
+  metadata.gz: 8eba70212cad992603afa10fe0f3ae1db4461c03938897418e8659f6a95c64bb
+  data.tar.gz: 74cc66dd6b502f6897428d36173f8faa0b68293dd456b99d7d80343714b2bb54
 SHA512:
-  metadata.gz: f349f5d093f30c5ed07a77349cc63d0651047185587c149172ec5d38eb29bd4644a74f3b10fd54674f43beda2885f58b7b400094e19afda4d24daadd56dc1e8d
-  data.tar.gz: 73e1e48f7fa439a9f7df513db74ba0a5df969a19a32abdf9c1b8bda34db08356abde81b3b3fdf425a0bbc46c8f258b669d1368cf25d067f187405e2f7cc8efd0
+  metadata.gz: 751bf66f9a2a58009f787a13c50d9a22a9f7b76117c8fbf1062e22896237ef7d8b66778e4834d59092fa7cdc623f48850b4e61eb796ba36f035418f3d4a39512
+  data.tar.gz: 1df8e6e7c4600a43e81833f5dcc3a210d99d4003a7f8a5bcde2ae53b8df662ced2147e7961d022b13a20607692f9147c44c7eee31704fd2ef11f289b0dd1ddac

data/CHANGELOG.md

@@ -4,6 +4,31 @@ Upgrading? [Migration from Old Versions](https://github.com/doorkeeper-gem/doork
 
 - Add entry here
 
+## v2.1.0 (2026-10-20)
+
+- [#401] Fix `max_age` reauthentication loop when `auth_time_from_session` returns a String — parse it as a timestamp instead of falling through to `to_i` (same class of bug as [#248]) — and treat a future auth_time as stale (60 s clock-skew leeway)
+- [#407] Prepend `AuthorizationsExtension` and `MetadataExtension` when Zeitwerk loads `Doorkeeper::AuthorizationsController` and `Doorkeeper::MetadataController`, instead of from `to_prepare`. Naming the controllers in `to_prepare` autoloaded them on every boot, together with `Doorkeeper::ApplicationController` and, through its default `ActionController::Base` superclass, every helper in the host application
+  - This gem no longer loads `ActionController::Base` during boot, so an Action Controller load hook that names an application constant such as `ApplicationController` should move to `config.to_prepare`
+- [#408] Drop the `ostruct` runtime dependency (#210, added in #218). `Doorkeeper::OpenidConnect.configuration.claims` is now a Hash keyed by Symbol claim name instead of an `OpenStruct`. The OpenStruct-only forms (`claims.nickname`, `claims.nickname = ...`, String keys in `[]`, `[]=` and `dig`, and `delete_field`) still work but print a deprecation warning and will be removed in the next major version; use `claims[:nickname]`.
+- [#402] Fix a boot failure (`MissingConfiguration`) when the access grant model loads before `Doorkeeper::OpenidConnect.configure` — e.g. from an initializer sorting between `doorkeeper.rb` and `doorkeeper_openid_connect.rb` (regression since v1.10.3)
+
+## v2.0.0 (2026-09-22)
+
+>[!IMPORTANT]
+>
+>- **Breaking (class overrides):** a configured `id_token_class` / `user_info_class` must now inherit from `Doorkeeper::OpenidConnect::IdToken` / `UserInfo` ([#364])
+>- **Breaking (settings removed):** the deprecated `jws_private_key` / `jws_public_key` initializer settings are gone ([#387])
+>- **Breaking (constant renamed):** `Doorkeeper::OpenidConnect::HybridIdTokenConcern` is now `AtHashConcern`, with no alias for the old name ([#399])
+>
+>**Coming from 1.10.x?** Every breaking change listed under 2.0.0.beta1 below applies as well — the `post_logout_redirect_uris` migration ([#243]), the `id_token token` response type change ([#337]), the removal of `IdTokenToken` ([#338]) and the Dynamic Client Registration defaults ([#350]). Those notes name `HybridIdTokenConcern`; read them as `AtHashConcern`, which is what 2.0.0 ships.
+>
+>[Migration from Old Versions](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/wiki/Migration-from-Old-Versions) walks through each one.
+
+- **Security:** Register a dynamically registered client with the server's `default_scopes` when the registration request omits `scope`, instead of persisting an empty scope set. Only deployments that enable `dynamic_client_registration` are affected.
+- [#364] **Breaking:** Require `id_token_class` / `user_info_class` overrides to inherit from `Doorkeeper::OpenidConnect::IdToken` / `UserInfo` ([#344](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/344)). Adds an `IdToken#select_key` hook returning the signing key and its algorithm together (`IdToken::SigningKey`) for per-client, rotating or multi-tenant keys, and binds the `at_hash` digest to that algorithm (OIDC Core §3.2.2.10) rather than the global `signing_algorithm`
+- [#387] **Breaking:** Remove the deprecated `jws_private_key` and `jws_public_key` initializer settings
+- [#399] **Breaking:** Rename `Doorkeeper::OpenidConnect::HybridIdTokenConcern` to `AtHashConcern`. The old name described the `id_token token` response type as a hybrid flow, but OpenID Connect Core defines that response type under the Implicit Flow (§3.2) — the Hybrid Flow response types of §3.3 are not implemented by this gem. Removed without an alias: the constant only ever shipped in 2.0.0.beta1
+
 ## v2.0.0.beta1 (2026-08-20)
 
 >[!IMPORTANT]

data/app/controllers/doorkeeper/openid_connect/discovery_controller.rb

@@ -28,6 +28,10 @@ module Doorkeeper
 
       private
 
+      # One method per metadata document: the provider metadata is a flat
+      # listing of endpoints and capabilities, and splitting it would hide the
+      # shape of the published document.
+      # rubocop:disable Metrics/AbcSize
       def provider_response
         doorkeeper = ::Doorkeeper.configuration
         openid_connect = ::Doorkeeper::OpenidConnect.configuration
@@ -79,6 +83,7 @@ module Doorkeeper
           code_challenge_methods_supported: code_challenge_methods_supported(doorkeeper),
         }.compact
       end
+      # rubocop:enable Metrics/AbcSize
 
       def response_modes_supported(doorkeeper)
         doorkeeper.authorization_response_flows.flat_map(&:response_mode_matches).uniq

data/app/controllers/doorkeeper/openid_connect/dynamic_client_registration_controller.rb

@@ -16,10 +16,7 @@ module Doorkeeper
         client = Doorkeeper.configuration.application_model.create!(application_params(registration))
         render json: registration_response(client, registration), status: :created
       rescue ActiveRecord::RecordInvalid => e
-        render json: {
-          error: registration_error_code(e.record),
-          error_description: e.record.errors.full_messages.join(", "),
-        }, status: :bad_request
+        render json: record_invalid_response(e.record), status: :bad_request
       end
 
       private
@@ -49,6 +46,13 @@ module Doorkeeper
         end
       end
 
+      def record_invalid_response(record)
+        {
+          error: registration_error_code(record),
+          error_description: record.errors.full_messages.join(", "),
+        }
+      end
+
       # RFC 7591 §3.2.2 registration error codes: `invalid_redirect_uri` for
       # redirect URI problems, `invalid_client_metadata` for everything else.
       def registration_error_code(record)
@@ -78,6 +82,10 @@ module Doorkeeper
         Doorkeeper.config.application_model.column_names.include?("post_logout_redirect_uris")
       end
 
+      # One method per metadata document: the registration response echoes
+      # the client metadata as RFC 7591 §3.2.1 lists it, and splitting it
+      # would hide the shape of the published document.
+      # rubocop:disable Metrics/AbcSize
       def registration_response(doorkeeper_application, registration)
         response = {
           client_id: doorkeeper_application.uid,
@@ -111,6 +119,7 @@ module Doorkeeper
 
         response
       end
+      # rubocop:enable Metrics/AbcSize
     end
   end
 end

data/lib/doorkeeper/oauth/id_token_token_request.rb

@@ -11,7 +11,7 @@ module Doorkeeper
         # serves the default and any custom id_token_class alike.
         id_token_token = Doorkeeper::OpenidConnect.configuration.id_token_model
                                                   .new(auth.token, pre_auth.nonce)
-                                                  .extend(Doorkeeper::OpenidConnect::HybridIdTokenConcern)
+                                                  .extend(Doorkeeper::OpenidConnect::AtHashConcern)
 
         IdTokenTokenResponse.new(pre_auth, auth, id_token_token)
       end

data/lib/doorkeeper/openid_connect/{hybrid_id_token_concern.rb → at_hash_concern.rb}

@@ -2,11 +2,16 @@
 
 module Doorkeeper
   module OpenidConnect
-    # Adds the `at_hash` claim required by the hybrid `id_token token` flow.
-    # The host object must implement `#claims` and expose the access token
-    # via an `#access_token` reader (public or private), as
-    # `Doorkeeper::OpenidConnect::IdToken` does.
-    module HybridIdTokenConcern
+    # Adds the `at_hash` claim required when an ID Token is issued alongside an
+    # access token — the `id_token token` response type, which OpenID Connect
+    # Core §3.2 defines as part of the Implicit Flow, not the Hybrid Flow of §3.3
+    # (whose response types this gem does not implement).
+    #
+    # The host object must implement `#claims`, expose the access token via an
+    # `#access_token` reader, and resolve its signing key via `#selected_key` —
+    # all provided by `Doorkeeper::OpenidConnect::IdToken`, which configured
+    # `id_token_class` overrides must inherit from.
+    module AtHashConcern
       def claims
         super.merge(at_hash: at_hash)
       end
@@ -37,8 +42,12 @@ module Doorkeeper
         Base64.urlsafe_encode64(first_half).tr("=", "")
       end
 
+      # OIDC Core §3.2.2.10 requires the digest to match the `alg` of the ID
+      # Token's actual JOSE header — derived from the key the token is signed
+      # with (`selected_key`, shared with `as_jws_token`), not from the global
+      # `signing_algorithm`, which a `select_key` override may diverge from.
       def at_hash_digest
-        case Doorkeeper::OpenidConnect.signing_algorithm.to_s
+        case selected_key.algorithm.to_s
         when /256\z/ then Digest::SHA256
         when /384\z/ then Digest::SHA384
         when /512\z/ then Digest::SHA512

data/lib/doorkeeper/openid_connect/claims_builder.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "ostruct"
-
 module Doorkeeper
   module OpenidConnect
     class ClaimsBuilder
@@ -18,15 +16,22 @@ module Doorkeeper
         end
 
         Doorkeeper::OpenidConnect.configuration.claims.to_h.map do |name, claim|
-          if claim.scopes.any? { |scope| access_token.scopes.exists?(scope) } &&
-             claim.response.include?(response)
+          if claim_applies?(claim, access_token, response)
             [name, claim.generator.call(resource_owner, access_token.scopes, access_token)]
           end
         end.compact.to_h
       end
 
+      # A claim is included when the token carries one of its scopes and it is
+      # configured for this response type (:id_token / :user_info).
+      def self.claim_applies?(claim, access_token, response)
+        claim.scopes.any? { |scope| access_token.scopes.exists?(scope) } &&
+          claim.response.include?(response)
+      end
+      private_class_method :claim_applies?
+
       def initialize(&block)
-        @claims = OpenStruct.new
+        @claims = ClaimsHash.new
         instance_eval(&block)
       end
 
@@ -35,13 +40,14 @@ module Doorkeeper
       end
 
       def normal_claim(name, response: [:user_info], scope: nil, &block)
-        @claims[name] =
+        claim =
           Claims::NormalClaim.new(
             name: name,
             response: response,
             scope: scope,
             generator: block,
           )
+        @claims[claim.name] = claim
       end
       alias claim normal_claim
     end

data/lib/doorkeeper/openid_connect/claims_hash.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OpenidConnect
+    # The configured claims, keyed by Symbol claim name.
+    #
+    # This used to be an `OpenStruct`. It is a Hash now, but it still answers the
+    # OpenStruct-only forms (`claims.nickname`, `claims.nickname = ...`, String keys
+    # in `[]`, `[]=` and `dig`, and `delete_field`) with a deprecation warning, so
+    # apps that relied on them keep working until the next major version, when this
+    # becomes a plain Hash.
+    class ClaimsHash < Hash
+      # Emit the deprecation at most once per process; claims are read on every
+      # ID Token and UserInfo response.
+      @deprecation_warned = false
+
+      class << self
+        def warn_deprecation
+          return if @deprecation_warned
+
+          @deprecation_warned = true
+          warn "DEPRECATION WARNING: `Doorkeeper::OpenidConnect.configuration.claims` is a Hash " \
+               "keyed by Symbol claim name. Reading or writing it method-style " \
+               "(`claims.nickname`), with String keys (`claims[\"nickname\"]`) or with " \
+               "`delete_field` is deprecated and will stop working in the next major version. " \
+               "Use `claims[:nickname]` and `claims.delete(:nickname)` instead."
+        end
+
+        # Reset the deprecation flag (test helper).
+        def reset_deprecation_warning!
+          @deprecation_warned = false
+        end
+      end
+
+      def [](name)
+        return super unless name.is_a?(String)
+
+        self.class.warn_deprecation
+        super(name.to_sym)
+      end
+
+      def []=(name, value)
+        if name.is_a?(String)
+          self.class.warn_deprecation
+          name = name.to_sym
+        end
+        super
+      end
+
+      def dig(name, *rest)
+        return super unless name.is_a?(String)
+
+        self.class.warn_deprecation
+        super(name.to_sym, *rest)
+      end
+
+      # Like OpenStruct#delete_field: raises NameError for an unknown claim unless given a block.
+      def delete_field(name)
+        self.class.warn_deprecation
+        key = name.to_sym
+        return delete(key) if key?(key)
+        return yield if block_given?
+
+        raise NameError.new("no field `#{key}' in #{self.class}", key)
+      end
+
+      def method_missing(method_name, *args, &block)
+        name = method_name.to_s
+        if name.end_with?("=") && args.size == 1 && block.nil?
+          self.class.warn_deprecation
+          self[name.chomp("=").to_sym] = args.first
+        elsif args.empty? && block.nil?
+          self.class.warn_deprecation
+          fetch(method_name, nil)
+        else
+          super
+        end
+      end
+
+      def respond_to_missing?(method_name, include_private = false)
+        key?(method_name) || method_name.to_s.end_with?("=") || super
+      end
+    end
+  end
+end

data/lib/doorkeeper/openid_connect/config.rb

@@ -10,6 +10,12 @@ module Doorkeeper
 
       @config = Config::Builder.new(&block).build
       validate_issuer_consistency
+      # Access grant models that loaded before this point deferred their
+      # `openid_request` association because it needs `open_id_request_class`.
+      # The namespace is spelled out: a bare `AccessGrant` would resolve to
+      # Doorkeeper's own grant model through the enclosing lexical scope if the
+      # autoload were ever dropped.
+      OpenidConnect::AccessGrant.wire_pending_hosts
       @config
     end
 
@@ -68,15 +74,6 @@ module Doorkeeper
         def build
           @config
         end
-
-        def jws_public_key(*_args)
-          warn "DEPRECATION WARNING: `jws_public_key` is not needed anymore and will be removed in a future version, please remove it from config/initializers/doorkeeper_openid_connect.rb"
-        end
-
-        def jws_private_key(*args)
-          warn "DEPRECATION WARNING: `jws_private_key` has been replaced by `signing_key` and will be removed in a future version, please remove it from config/initializers/doorkeeper_openid_connect.rb"
-          signing_key(*args)
-        end
       end
 
       mattr_reader(:builder_class) { Config::Builder }
@@ -140,15 +137,19 @@ module Doorkeeper
       option :open_id_request_class, default: "Doorkeeper::OpenidConnect::Request"
 
       # A class that provides custom behavior for generating ID tokens.
-      # Should probably inherit from `Doorkeeper::OpenidConnect::IdToken`, but may also be completely custom
-      # so long as it responds to `#as_json`, `#as_jws_token`, `#issuer`, exposes the access token via
-      # an `#access_token` reader (public or private), and has the same initializer. The reader is what
-      # `HybridIdTokenConcern` uses to compute the `at_hash` claim in the hybrid `id_token token` flow.
+      # Must inherit from `Doorkeeper::OpenidConnect::IdToken`, which carries the
+      # security-critical invariants (required-claim enforcement, the merge order that keeps the
+      # `claims` configuration block from overriding `sub`/`aud`/`exp`, nonce and `at_hash`
+      # handling), so a subclass only overrides what it actually needs — typically `claims`
+      # (call `super.merge(...)` so the registered claims are always present; a key you add that
+      # collides with one of them does replace it, so keep your keys distinct unless replacing it
+      # is what you mean), `audience`, or `select_key` for custom signing-key selection.
       option :id_token_class, default: "Doorkeeper::OpenidConnect::IdToken"
 
       # A class that provides custom behavior for generating the UserInfo response.
-      # Should probably inherit from `Doorkeeper::OpenidConnect::UserInfo`, but may also be completely custom
-      # so long as it responds to `#as_json` and has the same initializer.
+      # Must inherit from `Doorkeeper::OpenidConnect::UserInfo`; a subclass typically only
+      # overrides `claims` (call `super.merge(...)`, and leave `sub` out of the merged hash unless
+      # replacing the canonical subject identifier is what you mean).
       option :user_info_class, default: "Doorkeeper::OpenidConnect::UserInfo"
 
       # Doorkeeper OpenID Request model class.
@@ -160,26 +161,32 @@ module Doorkeeper
       end
 
       def id_token_model
-        resolve_validated_model(:id_token, id_token_class, %i[as_json as_jws_token issuer access_token])
+        resolve_validated_model(:id_token, id_token_class, IdToken)
       end
 
       def user_info_model
-        resolve_validated_model(:user_info, user_info_class, %i[as_json])
+        resolve_validated_model(:user_info, user_info_class, UserInfo)
       end
 
       private
 
       # Resolves an `id_token_class` / `user_info_class` override to its class
-      # and validates that the required methods exist (presence only, not
-      # correctness). Both happen lazily at first use rather than inside
-      # `Doorkeeper::OpenidConnect.configure`: constantizing an app-defined
-      # class while initializers run breaks zeitwerk on Rails 7+, because
-      # reloadable constants must not be referenced during boot — the same
-      # reason `open_id_request_model` constantizes lazily. The class is also
-      # deliberately not memoized, so code reloading in development never
-      # hands back a stale class; only the validation result is cached, keyed
-      # on the resolved class so a reloaded class is re-validated.
-      def resolve_validated_model(kind, class_name, required_methods)
+      # and validates that it inherits from the corresponding default. The
+      # ancestry check replaced the earlier method-presence list: presence
+      # could be satisfied by any class (ActiveSupport defines `as_json` on
+      # `Object`), while inheritance also carries the security-critical
+      # behavior — required-claim enforcement, the claim merge order, nonce
+      # and `at_hash` handling — that a from-scratch implementation would
+      # have to reproduce. Both resolution and validation happen lazily at
+      # first use rather than inside `Doorkeeper::OpenidConnect.configure`:
+      # constantizing an app-defined class while initializers run breaks
+      # zeitwerk on Rails 7+, because reloadable constants must not be
+      # referenced during boot — the same reason `open_id_request_model`
+      # constantizes lazily. The class is also deliberately not memoized, so
+      # code reloading in development never hands back a stale class; only
+      # the validation result is cached, keyed on the resolved class so a
+      # reloaded class is re-validated.
+      def resolve_validated_model(kind, class_name, base_model)
         # `safe_constantize` (unlike a bare `constantize` rescue) only reports
         # nil when the configured constant itself is missing; a NameError
         # raised while loading the class body still surfaces as-is.
@@ -192,18 +199,15 @@ module Doorkeeper
         @validated_models ||= {}
         return model if @validated_models[kind] == model
 
-        missing_methods = required_methods.reject do |method|
-          model.method_defined?(method) || model.private_method_defined?(method)
-        end
+        validate_model_inheritance!(kind, class_name, model, base_model)
+        @validated_models[kind] = model
+      end
 
-        unless missing_methods.empty?
-          raise Errors::InvalidConfiguration,
-                "The configured #{kind}_class (#{class_name}) is missing the following " \
-                "required methods: #{missing_methods.join(", ")}"
-        end
+      def validate_model_inheritance!(kind, class_name, model, base_model)
+        return if model.is_a?(Class) && model <= base_model
 
-        @validated_models[kind] = model
-        model
+        raise Errors::InvalidConfiguration,
+              "The configured #{kind}_class (#{class_name}) must inherit from #{base_model.name}"
       end
     end
   end

data/lib/doorkeeper/openid_connect/engine.rb

@@ -7,14 +7,18 @@ module Doorkeeper
         Doorkeeper::OpenidConnect::Rails::Routes.install!
       end
 
-      config.to_prepare do
-        Doorkeeper::AuthorizationsController.prepend Doorkeeper::OpenidConnect::AuthorizationsExtension
+      initializer "doorkeeper.openid_connect.controller_extensions" do |app|
+        app.autoloaders.main.on_load("Doorkeeper::AuthorizationsController") do |controller|
+          controller.prepend Doorkeeper::OpenidConnect::AuthorizationsExtension
+        end
 
         # Doorkeeper >= 6.0 serves its own RFC 8414 metadata document at
         # /.well-known/oauth-authorization-server; enrich it with the OpenID
         # Connect metadata (see MetadataExtension).
         if Doorkeeper::OpenidConnect.doorkeeper_metadata_endpoint?
-          Doorkeeper::MetadataController.prepend Doorkeeper::OpenidConnect::MetadataExtension
+          app.autoloaders.main.on_load("Doorkeeper::MetadataController") do |controller|
+            controller.prepend Doorkeeper::OpenidConnect::MetadataExtension
+          end
         end
       end
     end

data/lib/doorkeeper/openid_connect/helpers/controller/error_response.rb

@@ -17,23 +17,13 @@ module Doorkeeper
             # itself gates the emission on redirectability and on the issuer
             # being configured. Versions predating #1849 simply ignore the
             # attribute, so no version guard is needed.
-            error_response = if exception.type == :invalid_request
-                               ::Doorkeeper::OAuth::InvalidRequestResponse.new(
-                                 name: exception.type,
-                                 state: params[:state],
-                                 redirect_uri: params[:redirect_uri],
-                                 response_on_fragment: pre_auth.response_on_fragment?,
-                                 issuer: Doorkeeper::OpenidConnect.doorkeeper_issuer,
-                               )
-                             else
-                               ::Doorkeeper::OAuth::ErrorResponse.new(
-                                 name: exception.type,
-                                 state: params[:state],
-                                 redirect_uri: params[:redirect_uri],
-                                 response_on_fragment: pre_auth.response_on_fragment?,
-                                 issuer: Doorkeeper::OpenidConnect.doorkeeper_issuer,
-                               )
-                             end
+            error_response = oidc_error_response_class(exception).new(
+              name: exception.type,
+              state: params[:state],
+              redirect_uri: params[:redirect_uri],
+              response_on_fragment: pre_auth.response_on_fragment?,
+              issuer: Doorkeeper::OpenidConnect.doorkeeper_issuer,
+            )
 
             response.headers.merge!(error_response.headers)
 
@@ -45,6 +35,14 @@ module Doorkeeper
             @authorize_response = error_response
             redirect_or_render(@authorize_response)
           end
+
+          def oidc_error_response_class(exception)
+            if exception.type == :invalid_request
+              ::Doorkeeper::OAuth::InvalidRequestResponse
+            else
+              ::Doorkeeper::OAuth::ErrorResponse
+            end
+          end
         end
       end
     end

data/lib/doorkeeper/openid_connect/helpers/controller/max_age.rb

@@ -8,6 +8,38 @@ module Doorkeeper
         # §3.1.2.1): when the resource owner's last authentication is older
         # than `max_age` seconds, reauthentication is required.
         module MaxAge
+          # The shapes a `Time` takes once it has been serialized into the
+          # session:
+          #
+          # * `"2026-09-05T03:59:10.270Z"` — `ActiveSupport::JSON`, which is
+          #   what the JSON cookie serializer emits
+          # * `"2026/09/05 03:59:10 +0000"` — the same encoder with
+          #   `ActiveSupport::JSON::Encoding.use_standard_json_time_format`
+          #   turned off
+          # * `"2026-09-05 03:59:27 UTC"` — `JSON.generate` on a bare `Time`
+          #
+          # The date separator is captured and backreferenced so the two forms
+          # cannot be mixed, and the zone suffix is optional so that a
+          # serializer which drops it still reads as a local time.
+          OIDC_SERIALIZED_AUTH_TIME = %r{
+            \A
+            (?<year>\d{4})(?<sep>[-/])(?<month>\d{2})\k<sep>(?<day>\d{2})  # date
+            [T\ ]
+            \d{2}:\d{2}:\d{2}                    # time
+            (?:\.\d+)?                           # optional fractional seconds
+            (?:\ ?(?:Z|UTC|[+-]\d{2}:?\d{2}))?   # optional zone
+            \z
+          }x
+
+          # How far ahead of the provider's clock an auth_time may sit and
+          # still be trusted. An authentication cannot have happened in the
+          # future, but the servers that write auth_time and the one that
+          # checks it do not share a clock, and a user who authenticated a
+          # moment ago must not be sent to reauthenticate over ordinary skew —
+          # the fresh auth_time from that reauthentication would be ahead
+          # again, looping forever.
+          OIDC_AUTH_TIME_FUTURE_LEEWAY = 60
+
           private
 
           def handle_oidc_max_age_param!(owner)
@@ -56,12 +88,84 @@ module Doorkeeper
           def normalized_oidc_auth_time(owner)
             auth_time = resolve_oidc_auth_time(owner)
             return auth_time if !auth_time || auth_time.is_a?(Time) || auth_time.is_a?(DateTime)
+            return parse_oidc_auth_time_string(auth_time) if auth_time.is_a?(String)
 
             Time.zone.at(auth_time.to_i)
           end
 
+          # A `Time` written to the session comes back as a String once the
+          # session is serialized, which is the default since Rails 7.0
+          # (`config.load_defaults` selects the JSON cookie serializer). Running
+          # such a value through `to_i` yields the leading year — `"2026-09-05
+          # T03:59:10.270Z".to_i` is `2026` — placing auth_time in 1970 and
+          # making every `max_age` request look stale, so the RP and the
+          # provider bounce the user through reauthentication forever. Same
+          # class of bug as #248, which fixed the Integer case.
+          #
+          # A numeric String is an epoch. The grammar covers every *numeric*
+          # String `to_i` resolved — optional surrounding whitespace, an
+          # optional sign, an optional fractional part — and `to_f` rather than
+          # `to_i` keeps the sub-second part of `"1757150000.5"`. A signed
+          # value stays meaningful either way: `"+1757150000"` is the epoch it
+          # looks like, and a negative one resolves to a pre-1970 time, which
+          # is stale under any `max_age` and so requires reauthentication
+          # regardless.
+          #
+          # Anchoring it at both ends is the one deliberate narrowing here.
+          # `to_i` also truncated a String to its leading integer, so
+          # `"1788703912 seconds"` used to resolve and no longer does. Keeping
+          # that as a fallback would reinstate the bug above for every
+          # serialization this method does not recognise —
+          # `"20260905T035910Z".to_i` is `20260905`, i.e. 1970 and stale
+          # forever — while reading `"99999999999999 garbage"` as a year
+          # 3170843 timestamp, i.e. fresh. Truncation guesses wrong in both
+          # directions; a String that is not wholly a number is not an epoch.
+          #
+          # Anything else has to look like one of the
+          # serialized timestamps, which `Time.zone.parse` then reads. `parse`
+          # is not used on its own because it is far more permissive than any
+          # of those formats: it takes `"10 minutes"` for day 10 of the current
+          # month, and such a value landing within `max_age` of now would read
+          # as *fresh* and silently skip the reauthentication.
+          # `Time.zone.iso8601` is no alternative — it rejects the bare-`Time`
+          # form outright.
+          #
+          # Matching the shape is not enough on its own: `parse` rolls an
+          # impossible calendar date over instead of raising, so `"2026-02-31"`
+          # comes back as 2026-03-03 — a date that does not exist would read as
+          # fresh whenever its rollover lands within `max_age` of now. The day
+          # is therefore checked with `Date.valid_date?` before parsing.
+          #
+          # What is left over is rescued: an out-of-range hour, minute or
+          # second raises `ArgumentError`, and a numeric String too long to be
+          # a Float (`"9" * 400` overflows to `Float::INFINITY`) makes
+          # `Time.zone.at` raise `FloatDomainError`. A value of any of these
+          # shapes returns nil, which `oidc_auth_time_stale?` treats as "no
+          # known auth_time" and so requires reauthentication — a malformed
+          # callback value must fail closed, not 500.
+          def parse_oidc_auth_time_string(value)
+            return Time.zone.at(value.to_f) if value.match?(/\A\s*[+-]?\d+(?:\.\d+)?\s*\z/)
+
+            match = OIDC_SERIALIZED_AUTH_TIME.match(value)
+            return unless match
+            return unless Date.valid_date?(match[:year].to_i, match[:month].to_i, match[:day].to_i)
+
+            Time.zone.parse(value)
+          rescue ArgumentError, RangeError
+            nil
+          end
+
+          # An auth_time further in the future than clock skew explains is not
+          # a time the resource owner authenticated at, whatever its type — a
+          # `Time`, an Integer epoch and a parsed String all reach here — so it
+          # is treated like an unknown one and requires reauthentication.
+          # Left unchecked, its negative age is below any `max_age` and it
+          # would read as fresh indefinitely.
           def oidc_auth_time_stale?(auth_time, max_age)
-            !auth_time || (Time.zone.now - auth_time) > max_age
+            return true unless auth_time
+
+            age = Time.zone.now - auth_time
+            age > max_age || age < -OIDC_AUTH_TIME_FUTURE_LEEWAY
           end
 
           # Resolve auth_time for max_age enforcement.

data/lib/doorkeeper/openid_connect/helpers/controller/prompt.rb

@@ -22,18 +22,12 @@ module Doorkeeper
 
           def apply_oidc_prompt!(prompt, prompt_values, owner)
             case prompt
-            when "none"
-              handle_oidc_prompt_none!(prompt_values, owner)
-            when "login"
-              handle_oidc_prompt_login!(owner)
-            when "consent"
-              handle_oidc_prompt_consent!(owner)
-            when "select_account"
-              select_account_for_oidc_resource_owner(owner)
-            when "create"
-              # NOTE: not supported, but does not raise an error.
-            else
-              raise Errors::InvalidRequest
+            when "none" then handle_oidc_prompt_none!(prompt_values, owner)
+            when "login" then handle_oidc_prompt_login!(owner)
+            when "consent" then handle_oidc_prompt_consent!(owner)
+            when "select_account" then select_account_for_oidc_resource_owner(owner)
+            when "create" then nil # NOTE: not supported, but does not raise an error.
+            else raise Errors::InvalidRequest
             end
           end
 
@@ -81,6 +75,11 @@ module Doorkeeper
 
           def return_without_oidc_prompt_param(prompt_value)
             return_to = URI.parse(request.path)
+            return_to.query = query_parameters_without_oidc_prompt(prompt_value).to_query
+            return_to.to_s
+          end
+
+          def query_parameters_without_oidc_prompt(prompt_value)
             # Work on a copy: `request.query_parameters` is memoized and shared, so
             # mutating it in place would corrupt the parameters seen by the rest of
             # the request (and any subsequent prompt value in the same loop).
@@ -95,8 +94,7 @@ module Doorkeeper
             else
               query.delete("prompt")
             end
-            return_to.query = query.to_query
-            return_to.to_s
+            query
           end
 
           def reauthenticate_oidc_resource_owner(owner)

data/lib/doorkeeper/openid_connect/helpers/controller/token_matching.rb

@@ -35,14 +35,10 @@ module Doorkeeper
             relation = token_model.authorized_tokens_for(pre_auth.client.id, owner)
             batch_size = Doorkeeper.configuration.token_lookup_batch_size
 
-            match_found = false
             token_model.find_access_token_in_batches(relation, batch_size: batch_size) do |batch|
-              if batch.any? { |token| token.scopes.scopes?(pre_auth.scopes) }
-                match_found = true
-                break
-              end
+              return true if batch.any? { |token| token.scopes.scopes?(pre_auth.scopes) }
             end
-            match_found
+            false
           end
 
           # Force Doorkeeper's `render_success` onto the auto-issue path when a

data/lib/doorkeeper/openid_connect/id_token.rb

@@ -9,10 +9,16 @@ module Doorkeeper
       # must never be silently dropped when blank.
       REQUIRED_CLAIMS = %i[iss sub aud exp iat].freeze
 
+      # The return type of `select_key`: the key material and the algorithm it
+      # signs with, kept together so `at_hash` can always be computed with the
+      # digest matching the algorithm in the token's actual JOSE header
+      # (OIDC Core §3.2.2.10).
+      SigningKey = Struct.new(:keypair, :kid, :algorithm, keyword_init: true)
+
       # `resource_owner` is exposed so callers can detect a token whose owner no
       # longer resolves (e.g. deleted after issuance) before serializing — the
       # `sub` claim would otherwise dereference a nil owner and raise.
-      # `access_token` is the reader HybridIdTokenConcern relies on to compute
+      # `access_token` is the reader AtHashConcern relies on to compute
       # `at_hash`; a custom id_token_class must expose one as well.
       attr_reader :access_token, :nonce, :resource_owner
 
@@ -58,10 +64,31 @@ module Doorkeeper
       end
 
       def as_jws_token
+        key = selected_key
+
         ::JWT.encode(as_json,
-                     Doorkeeper::OpenidConnect.signing_key.keypair,
-                     Doorkeeper::OpenidConnect.signing_algorithm.to_s,
-                     { typ: "JWT", kid: Doorkeeper::OpenidConnect.signing_key.kid }).to_s
+                     key.keypair,
+                     key.algorithm.to_s,
+                     { typ: "JWT", kid: key.kid }).to_s
+      end
+
+      # Override point for custom signing-key selection (per-client keys, key
+      # rotation, multi-tenant setups, …). Must return an object responding to
+      # `#keypair`, `#kid` and `#algorithm` — use `SigningKey` for convenience.
+      # Keys returned from here are not advertised automatically: a custom
+      # implementation is responsible for exposing any additional keys through
+      # its own JWKS handling so clients can validate the signature.
+      def select_key
+        # Resolved once: `signing_key` builds a fresh JWK per call and honors
+        # callable configuration, so reading `keypair` and `kid` from separate
+        # calls could pair values from two different keys.
+        jwk = Doorkeeper::OpenidConnect.signing_key
+
+        SigningKey.new(
+          keypair: jwk.keypair,
+          kid: jwk.kid,
+          algorithm: Doorkeeper::OpenidConnect.signing_algorithm.to_s,
+        )
       end
 
       # Public: the RFC 9207 `iss` authorization response parameter must be
@@ -78,6 +105,15 @@ module Doorkeeper
 
       private
 
+      # `select_key` resolved exactly once per token, mirroring the `issuer`
+      # memoization above: the signature (`as_jws_token`) and the `at_hash`
+      # digest (`AtHashConcern`) must agree on the algorithm, so a
+      # dynamic `select_key` implementation must not be re-invoked between
+      # the two.
+      def selected_key
+        @selected_key ||= select_key
+      end
+
       def subject
         Doorkeeper::OpenidConnect.configuration.subject.call(
           @resource_owner,

data/lib/doorkeeper/openid_connect/oauth/dynamic_registration_request.rb

@@ -65,9 +65,9 @@ module Doorkeeper
           server_scopes = server.scopes
 
           if server_scopes.respond_to?(:allowed)
-            server_scopes.allowed(requested_scopes).to_s
+            server_scopes.allowed(effective_requested_scopes).to_s
           else
-            (server_scopes & requested_scopes).to_s
+            (server_scopes & effective_requested_scopes).to_s
           end
         end
 
@@ -121,12 +121,34 @@ module Doorkeeper
           ::Doorkeeper::OAuth::Scopes.from_string(@params[:scope].to_s)
         end
 
+        # RFC 7591 §2: when the request omits `scope`, the authorization
+        # server registers the client with its own default set. Doorkeeper
+        # has one — `default_scopes` — and registering with no scopes at all
+        # is emphatically not it: an application whose `scopes` column is
+        # blank is treated as unrestricted by Doorkeeper's ScopeChecker
+        # (`app_scopes.presence || server_scopes`), so an omitted `scope`
+        # would register a client entitled to every scope the server defines,
+        # while a client that honestly declared a narrow scope stays confined
+        # to it.
+        def effective_requested_scopes
+          requested_scopes.presence || server.default_scopes
+        end
+
+        # A registration must never persist an empty scope set, whichever way
+        # it got there: neither an explicit `scope` made up entirely of
+        # unsupported values, nor an omitted `scope` on a server that
+        # configures no default scopes.
         def validate_scope
-          return true if requested_scopes.blank? || permitted_scopes.present?
+          return true if permitted_scopes.present?
 
           @error_description =
-            "scope '#{requested_scopes}' contains no scopes supported by this server. " \
-            "Supported scopes: #{server.scopes}"
+            if requested_scopes.present?
+              "scope '#{requested_scopes}' contains no scopes supported by this server. " \
+              "Supported scopes: #{server.scopes}"
+            else
+              "scope is required: this server registers no default scopes, so a client " \
+              "must request at least one of its supported scopes: #{server.scopes}"
+            end
           false
         end
 

data/lib/doorkeeper/openid_connect/orm/active_record/access_grant.rb

@@ -3,13 +3,47 @@
 module Doorkeeper
   module OpenidConnect
     module AccessGrant
-      def self.prepended(base)
-        base.class_eval do
-          has_one :openid_request,
-                  class_name: Doorkeeper::OpenidConnect.configuration.open_id_request_class,
-                  foreign_key: "access_grant_id",
-                  inverse_of: :access_grant,
-                  dependent: :delete
+      class << self
+        # Wiring the `openid_request` association needs
+        # `open_id_request_class`, so it can only run once
+        # `Doorkeeper::OpenidConnect.configure` has. The grant model is not
+        # guaranteed to load after that: Doorkeeper's own `initialize_models!`
+        # reaches for it from `Doorkeeper.configure` (immediately, when a
+        # railtie has already loaded `ActiveRecord::Base`), and any initializer
+        # sorting between `doorkeeper.rb` and `doorkeeper_openid_connect.rb`
+        # can name the model itself. Reading the configuration here would raise
+        # `MissingConfiguration` in both cases — with a message pointing at an
+        # initializer that does exist and simply has not run yet.
+        #
+        # So wire immediately when the configuration is there, and otherwise
+        # remember the host model and wire it from `configure`.
+        def prepended(base)
+          return pending_hosts << base unless OpenidConnect.configured?
+
+          wire_openid_request_association(base)
+        end
+
+        # Called from `Doorkeeper::OpenidConnect.configure` for the models that
+        # loaded before it.
+        def wire_pending_hosts
+          pending_hosts.each { |base| wire_openid_request_association(base) }
+          pending_hosts.clear
+        end
+
+        private
+
+        def pending_hosts
+          @pending_hosts ||= []
+        end
+
+        def wire_openid_request_association(base)
+          base.class_eval do
+            has_one :openid_request,
+                    class_name: Doorkeeper::OpenidConnect.configuration.open_id_request_class,
+                    foreign_key: "access_grant_id",
+                    inverse_of: :access_grant,
+                    dependent: :delete
+          end
         end
       end
     end

data/lib/doorkeeper/openid_connect/rails/routes.rb

@@ -26,33 +26,38 @@ module Doorkeeper
 
         def generate_routes!(options)
           @mapping = Mapper.new.map(&@block)
-          openid_connect = ::Doorkeeper::OpenidConnect.configuration
-          prefix = route_helper_prefix(options)
 
           routes.scope options[:scope] || "oauth", as: "oauth" do
-            map_route(:userinfo, :userinfo_routes)
-            map_route(:discovery, :discovery_routes)
+            map_oauth_routes
+          end
 
-            if openid_connect.dynamic_client_registration
-              map_route(:dynamic_client_registration, :dynamic_client_registration_routes)
-            end
+          routes.scope(**well_known_scope(options)) do
+            map_route(:discovery, :discovery_well_known_routes)
           end
+        end
 
-          well_known_scope = { as: "oauth" }
+        private
+
+        def map_oauth_routes
+          map_route(:userinfo, :userinfo_routes)
+          map_route(:discovery, :discovery_routes)
+          return unless ::Doorkeeper::OpenidConnect.configuration.dynamic_client_registration
+
+          map_route(:dynamic_client_registration, :dynamic_client_registration_routes)
+        end
+
+        def well_known_scope(options)
+          prefix = route_helper_prefix(options)
+          scope = { as: "oauth" }
           # When the engine is mounted under a named scope (e.g.
           # `scope :users, as: :users`), Doorkeeper's and this engine's URL
           # helpers are generated with that prefix (`users_oauth_*`). Pass the
           # prefix down to the discovery controller via a route default so it can
           # resolve the correct namespaced helpers for the published endpoints.
-          well_known_scope[:defaults] = { route_helper_prefix: prefix } if prefix.present?
-
-          routes.scope(**well_known_scope) do
-            map_route(:discovery, :discovery_well_known_routes)
-          end
+          scope[:defaults] = { route_helper_prefix: prefix } if prefix.present?
+          scope
         end
 
-        private
-
         def route_helper_prefix(options)
           name = options[:as]
           name.present? ? "#{name}_" : ""

data/lib/doorkeeper/openid_connect/version.rb

@@ -3,9 +3,9 @@
 module Doorkeeper
   module OpenidConnect
     MAJOR = 2
-    MINOR = 0
+    MINOR = 1
     TINY = 0
-    PRE = "beta1"
+    PRE = nil
 
     # Full version number
     VERSION = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/doorkeeper/openid_connect.rb

@@ -17,11 +17,12 @@ require "jwt"
 # `ClaimsBuilder` while its class body runs.
 module Doorkeeper
   module OpenidConnect
+    autoload :AtHashConcern, "doorkeeper/openid_connect/at_hash_concern"
     autoload :ClaimsBuilder, "doorkeeper/openid_connect/claims_builder"
+    autoload :ClaimsHash, "doorkeeper/openid_connect/claims_hash"
     autoload :DiscoveryHelpersMixin, "doorkeeper/openid_connect/discovery_helpers_mixin"
     autoload :Errors, "doorkeeper/openid_connect/errors"
     autoload :GrantTypesSupportedMixin, "doorkeeper/openid_connect/grant_types_supported_mixin"
-    autoload :HybridIdTokenConcern, "doorkeeper/openid_connect/hybrid_id_token_concern"
     autoload :IdToken, "doorkeeper/openid_connect/id_token"
     autoload :TokenEndpointAuthMethodsSupportedMixin,
              "doorkeeper/openid_connect/token_endpoint_auth_methods_supported_mixin"
@@ -45,8 +46,8 @@ module Doorkeeper
   # makes them safe to autoload from a namespace this gem does not own.
   #
   # `Request::IdToken` and `Request::IdTokenToken` reach these at request time;
-  # for an application that never enables the OpenID Connect implicit or hybrid
-  # flows, none of the four is ever loaded.
+  # for an application that never enables the OpenID Connect implicit flows,
+  # none of the four is ever loaded.
   module OAuth
     autoload :IdTokenRequest, "doorkeeper/oauth/id_token_request"
     autoload :IdTokenResponse, "doorkeeper/oauth/id_token_response"
@@ -298,14 +299,10 @@ module Doorkeeper
       return issuer unless issuer.respond_to?(:call)
 
       case issuer.arity
-      when 0
-        issuer.call
-      when 1
-        issuer.call(request || resource_owner)
-      when 2
-        issuer.call(resource_owner, application)
-      else
-        issuer.call(resource_owner, application, request)
+      when 0 then issuer.call
+      when 1 then issuer.call(request || resource_owner)
+      when 2 then issuer.call(resource_owner, application)
+      else issuer.call(resource_owner, application, request)
       end
     end
     private_class_method :call_issuer

data/lib/generators/doorkeeper/openid_connect/templates/initializer.rb

@@ -59,9 +59,13 @@ Doorkeeper::OpenidConnect.configure do
   # piggy-backing on a fresh login from another device.
   #
   # The block is executed in the controller's scope and receives the
-  # current `session` and `request`. Return value can be a `Time`,
-  # `DateTime`, or anything responding to `to_i`. Return `nil` to force
-  # reauthentication.
+  # current `session` and `request`. Return value can be a `Time`, a
+  # `DateTime`, epoch seconds (an Integer or a numeric String), or a
+  # serialized timestamp String such as `"2026-09-05T03:59:10.270Z"` — a
+  # `Time` stored in the session comes back as the latter once it
+  # round-trips through the JSON cookie serializer, which Rails 7.0+
+  # selects by default. A String of any other shape is read as an unknown
+  # auth_time and forces reauthentication, as does `nil`.
   #
   # auth_time_from_session do |session, _request|
   #   # Example implementation: capture auth_time on the session at login,
@@ -208,12 +212,20 @@ Doorkeeper::OpenidConnect.configure do
   # different apps may need different claim sets) or if you need to transform data before returning
   # it to external clients.
   #
-  # It is generally recommended to subclass the default models, but you can implement your own so
-  # long as they respond to `#as_json` (and, for the ID Token, also to `#as_jws_token`, `#issuer`,
-  # and an `#access_token` reader — the latter is used to compute the `at_hash` claim in the hybrid
-  # `id_token token` response type), and have the same initializer. These methods may be private;
-  # their presence is validated when the class is first used. Depending on the implementation, this
-  # may or may not override the provided behavior of the `claims` block.
+  # Custom classes must inherit from Doorkeeper::OpenidConnect::IdToken /
+  # Doorkeeper::OpenidConnect::UserInfo (validated when the class is first used). The base classes
+  # carry the security-critical behavior — required-claim enforcement, the claim merge order that
+  # keeps the `claims` configuration block from overriding `sub`/`aud`/`exp`, nonce and `at_hash`
+  # handling — so a subclass only overrides what it actually needs. Typical override points:
+  #
+  #   - `claims` — call `super.merge(...)` so the base claims are always present. A key you add
+  #     that collides with a registered claim replaces it, so keep your keys distinct unless
+  #     replacing it is what you mean
+  #   - `audience` (ID Token) — the `aud` claim may be a string or an array per OIDC Core
+  #   - `select_key` (ID Token) — return a Doorkeeper::OpenidConnect::IdToken::SigningKey to sign
+  #     with a different key/algorithm (per-client keys, rotation, multi-tenancy). The `at_hash`
+  #     digest follows the selected algorithm automatically; advertising any additional keys via
+  #     JWKS is the application's responsibility.
   #
   # Refer to Doorkeeper::OpenidConnect::IdToken and Doorkeeper::OpenidConnect::UserInfo for more
   # information and implementation details.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-openid_connect
 version: !ruby/object:Gem::Version
-  version: 2.0.0.beta1
+  version: 2.1.0
 platform: ruby
 authors:
 - Sam Dengler
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-20 00:00:00.000000000 Z
+date: 2026-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper
@@ -46,20 +46,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.5'
-- !ruby/object:Gem::Dependency
-  name: ostruct
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.5'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.5'
 - !ruby/object:Gem::Dependency
   name: bigdecimal
   requirement: !ruby/object:Gem::Requirement
@@ -195,9 +181,11 @@ files:
 - lib/doorkeeper/oauth/id_token_token_request.rb
 - lib/doorkeeper/oauth/id_token_token_response.rb
 - lib/doorkeeper/openid_connect.rb
+- lib/doorkeeper/openid_connect/at_hash_concern.rb
 - lib/doorkeeper/openid_connect/claims/claim.rb
 - lib/doorkeeper/openid_connect/claims/normal_claim.rb
 - lib/doorkeeper/openid_connect/claims_builder.rb
+- lib/doorkeeper/openid_connect/claims_hash.rb
 - lib/doorkeeper/openid_connect/config.rb
 - lib/doorkeeper/openid_connect/discovery_helpers_mixin.rb
 - lib/doorkeeper/openid_connect/engine.rb
@@ -208,7 +196,6 @@ files:
 - lib/doorkeeper/openid_connect/helpers/controller/max_age.rb
 - lib/doorkeeper/openid_connect/helpers/controller/prompt.rb
 - lib/doorkeeper/openid_connect/helpers/controller/token_matching.rb
-- lib/doorkeeper/openid_connect/hybrid_id_token_concern.rb
 - lib/doorkeeper/openid_connect/id_token.rb
 - lib/doorkeeper/openid_connect/oauth/authorization/code.rb
 - lib/doorkeeper/openid_connect/oauth/authorization_code_request.rb
@@ -256,9 +243,9 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '3.2'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements: []
 rubygems_version: 3.1.6
 signing_key: