doorkeeper-openid_connect 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a6ac229d2a87bb6712986b26a47a87ef8758b581b1fa99ddd2475d0a860f9e65
-  data.tar.gz: 27300a20c1ad92391d2ecd2bbe8a635ccb97b490505f8d0c9752c09f8738d0ba
+  metadata.gz: 8eba70212cad992603afa10fe0f3ae1db4461c03938897418e8659f6a95c64bb
+  data.tar.gz: 74cc66dd6b502f6897428d36173f8faa0b68293dd456b99d7d80343714b2bb54
 SHA512:
-  metadata.gz: b1bc13a50ca14f08f218341c00ff2ab15d9b04cf1bc4d25b92d9d8617cb7a432acf86df5ee69bebec6b3e576956734db840ecec63453f5572f848c6e35976416
-  data.tar.gz: ce360e5a9ad631ff29da07b288e0fd74523293c4227d1a9f9bd9583a3e41539225d8a61e70ab3e26aa43ffe51ec9fb061328f0be6e7089f02639739f8f6c21e3
+  metadata.gz: 751bf66f9a2a58009f787a13c50d9a22a9f7b76117c8fbf1062e22896237ef7d8b66778e4834d59092fa7cdc623f48850b4e61eb796ba36f035418f3d4a39512
+  data.tar.gz: 1df8e6e7c4600a43e81833f5dcc3a210d99d4003a7f8a5bcde2ae53b8df662ced2147e7961d022b13a20607692f9147c44c7eee31704fd2ef11f289b0dd1ddac

data/CHANGELOG.md

@@ -4,6 +4,14 @@ Upgrading? [Migration from Old Versions](https://github.com/doorkeeper-gem/doork
 
 - Add entry here
 
+## v2.1.0 (2026-10-20)
+
+- [#401] Fix `max_age` reauthentication loop when `auth_time_from_session` returns a String — parse it as a timestamp instead of falling through to `to_i` (same class of bug as [#248]) — and treat a future auth_time as stale (60 s clock-skew leeway)
+- [#407] Prepend `AuthorizationsExtension` and `MetadataExtension` when Zeitwerk loads `Doorkeeper::AuthorizationsController` and `Doorkeeper::MetadataController`, instead of from `to_prepare`. Naming the controllers in `to_prepare` autoloaded them on every boot, together with `Doorkeeper::ApplicationController` and, through its default `ActionController::Base` superclass, every helper in the host application
+  - This gem no longer loads `ActionController::Base` during boot, so an Action Controller load hook that names an application constant such as `ApplicationController` should move to `config.to_prepare`
+- [#408] Drop the `ostruct` runtime dependency (#210, added in #218). `Doorkeeper::OpenidConnect.configuration.claims` is now a Hash keyed by Symbol claim name instead of an `OpenStruct`. The OpenStruct-only forms (`claims.nickname`, `claims.nickname = ...`, String keys in `[]`, `[]=` and `dig`, and `delete_field`) still work but print a deprecation warning and will be removed in the next major version; use `claims[:nickname]`.
+- [#402] Fix a boot failure (`MissingConfiguration`) when the access grant model loads before `Doorkeeper::OpenidConnect.configure` — e.g. from an initializer sorting between `doorkeeper.rb` and `doorkeeper_openid_connect.rb` (regression since v1.10.3)
+
 ## v2.0.0 (2026-09-22)
 
 >[!IMPORTANT]

data/lib/doorkeeper/openid_connect/claims_builder.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require "ostruct"
-
 module Doorkeeper
   module OpenidConnect
     class ClaimsBuilder
@@ -33,7 +31,7 @@ module Doorkeeper
       private_class_method :claim_applies?
 
       def initialize(&block)
-        @claims = OpenStruct.new
+        @claims = ClaimsHash.new
         instance_eval(&block)
       end
 
@@ -42,13 +40,14 @@ module Doorkeeper
       end
 
       def normal_claim(name, response: [:user_info], scope: nil, &block)
-        @claims[name] =
+        claim =
           Claims::NormalClaim.new(
             name: name,
             response: response,
             scope: scope,
             generator: block,
           )
+        @claims[claim.name] = claim
       end
       alias claim normal_claim
     end

data/lib/doorkeeper/openid_connect/claims_hash.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OpenidConnect
+    # The configured claims, keyed by Symbol claim name.
+    #
+    # This used to be an `OpenStruct`. It is a Hash now, but it still answers the
+    # OpenStruct-only forms (`claims.nickname`, `claims.nickname = ...`, String keys
+    # in `[]`, `[]=` and `dig`, and `delete_field`) with a deprecation warning, so
+    # apps that relied on them keep working until the next major version, when this
+    # becomes a plain Hash.
+    class ClaimsHash < Hash
+      # Emit the deprecation at most once per process; claims are read on every
+      # ID Token and UserInfo response.
+      @deprecation_warned = false
+
+      class << self
+        def warn_deprecation
+          return if @deprecation_warned
+
+          @deprecation_warned = true
+          warn "DEPRECATION WARNING: `Doorkeeper::OpenidConnect.configuration.claims` is a Hash " \
+               "keyed by Symbol claim name. Reading or writing it method-style " \
+               "(`claims.nickname`), with String keys (`claims[\"nickname\"]`) or with " \
+               "`delete_field` is deprecated and will stop working in the next major version. " \
+               "Use `claims[:nickname]` and `claims.delete(:nickname)` instead."
+        end
+
+        # Reset the deprecation flag (test helper).
+        def reset_deprecation_warning!
+          @deprecation_warned = false
+        end
+      end
+
+      def [](name)
+        return super unless name.is_a?(String)
+
+        self.class.warn_deprecation
+        super(name.to_sym)
+      end
+
+      def []=(name, value)
+        if name.is_a?(String)
+          self.class.warn_deprecation
+          name = name.to_sym
+        end
+        super
+      end
+
+      def dig(name, *rest)
+        return super unless name.is_a?(String)
+
+        self.class.warn_deprecation
+        super(name.to_sym, *rest)
+      end
+
+      # Like OpenStruct#delete_field: raises NameError for an unknown claim unless given a block.
+      def delete_field(name)
+        self.class.warn_deprecation
+        key = name.to_sym
+        return delete(key) if key?(key)
+        return yield if block_given?
+
+        raise NameError.new("no field `#{key}' in #{self.class}", key)
+      end
+
+      def method_missing(method_name, *args, &block)
+        name = method_name.to_s
+        if name.end_with?("=") && args.size == 1 && block.nil?
+          self.class.warn_deprecation
+          self[name.chomp("=").to_sym] = args.first
+        elsif args.empty? && block.nil?
+          self.class.warn_deprecation
+          fetch(method_name, nil)
+        else
+          super
+        end
+      end
+
+      def respond_to_missing?(method_name, include_private = false)
+        key?(method_name) || method_name.to_s.end_with?("=") || super
+      end
+    end
+  end
+end

data/lib/doorkeeper/openid_connect/config.rb

@@ -10,6 +10,12 @@ module Doorkeeper
 
       @config = Config::Builder.new(&block).build
       validate_issuer_consistency
+      # Access grant models that loaded before this point deferred their
+      # `openid_request` association because it needs `open_id_request_class`.
+      # The namespace is spelled out: a bare `AccessGrant` would resolve to
+      # Doorkeeper's own grant model through the enclosing lexical scope if the
+      # autoload were ever dropped.
+      OpenidConnect::AccessGrant.wire_pending_hosts
       @config
     end
 

data/lib/doorkeeper/openid_connect/engine.rb

@@ -7,14 +7,18 @@ module Doorkeeper
         Doorkeeper::OpenidConnect::Rails::Routes.install!
       end
 
-      config.to_prepare do
-        Doorkeeper::AuthorizationsController.prepend Doorkeeper::OpenidConnect::AuthorizationsExtension
+      initializer "doorkeeper.openid_connect.controller_extensions" do |app|
+        app.autoloaders.main.on_load("Doorkeeper::AuthorizationsController") do |controller|
+          controller.prepend Doorkeeper::OpenidConnect::AuthorizationsExtension
+        end
 
         # Doorkeeper >= 6.0 serves its own RFC 8414 metadata document at
         # /.well-known/oauth-authorization-server; enrich it with the OpenID
         # Connect metadata (see MetadataExtension).
         if Doorkeeper::OpenidConnect.doorkeeper_metadata_endpoint?
-          Doorkeeper::MetadataController.prepend Doorkeeper::OpenidConnect::MetadataExtension
+          app.autoloaders.main.on_load("Doorkeeper::MetadataController") do |controller|
+            controller.prepend Doorkeeper::OpenidConnect::MetadataExtension
+          end
         end
       end
     end

data/lib/doorkeeper/openid_connect/helpers/controller/max_age.rb

@@ -8,6 +8,38 @@ module Doorkeeper
         # §3.1.2.1): when the resource owner's last authentication is older
         # than `max_age` seconds, reauthentication is required.
         module MaxAge
+          # The shapes a `Time` takes once it has been serialized into the
+          # session:
+          #
+          # * `"2026-09-05T03:59:10.270Z"` — `ActiveSupport::JSON`, which is
+          #   what the JSON cookie serializer emits
+          # * `"2026/09/05 03:59:10 +0000"` — the same encoder with
+          #   `ActiveSupport::JSON::Encoding.use_standard_json_time_format`
+          #   turned off
+          # * `"2026-09-05 03:59:27 UTC"` — `JSON.generate` on a bare `Time`
+          #
+          # The date separator is captured and backreferenced so the two forms
+          # cannot be mixed, and the zone suffix is optional so that a
+          # serializer which drops it still reads as a local time.
+          OIDC_SERIALIZED_AUTH_TIME = %r{
+            \A
+            (?<year>\d{4})(?<sep>[-/])(?<month>\d{2})\k<sep>(?<day>\d{2})  # date
+            [T\ ]
+            \d{2}:\d{2}:\d{2}                    # time
+            (?:\.\d+)?                           # optional fractional seconds
+            (?:\ ?(?:Z|UTC|[+-]\d{2}:?\d{2}))?   # optional zone
+            \z
+          }x
+
+          # How far ahead of the provider's clock an auth_time may sit and
+          # still be trusted. An authentication cannot have happened in the
+          # future, but the servers that write auth_time and the one that
+          # checks it do not share a clock, and a user who authenticated a
+          # moment ago must not be sent to reauthenticate over ordinary skew —
+          # the fresh auth_time from that reauthentication would be ahead
+          # again, looping forever.
+          OIDC_AUTH_TIME_FUTURE_LEEWAY = 60
+
           private
 
           def handle_oidc_max_age_param!(owner)
@@ -56,12 +88,84 @@ module Doorkeeper
           def normalized_oidc_auth_time(owner)
             auth_time = resolve_oidc_auth_time(owner)
             return auth_time if !auth_time || auth_time.is_a?(Time) || auth_time.is_a?(DateTime)
+            return parse_oidc_auth_time_string(auth_time) if auth_time.is_a?(String)
 
             Time.zone.at(auth_time.to_i)
           end
 
+          # A `Time` written to the session comes back as a String once the
+          # session is serialized, which is the default since Rails 7.0
+          # (`config.load_defaults` selects the JSON cookie serializer). Running
+          # such a value through `to_i` yields the leading year — `"2026-09-05
+          # T03:59:10.270Z".to_i` is `2026` — placing auth_time in 1970 and
+          # making every `max_age` request look stale, so the RP and the
+          # provider bounce the user through reauthentication forever. Same
+          # class of bug as #248, which fixed the Integer case.
+          #
+          # A numeric String is an epoch. The grammar covers every *numeric*
+          # String `to_i` resolved — optional surrounding whitespace, an
+          # optional sign, an optional fractional part — and `to_f` rather than
+          # `to_i` keeps the sub-second part of `"1757150000.5"`. A signed
+          # value stays meaningful either way: `"+1757150000"` is the epoch it
+          # looks like, and a negative one resolves to a pre-1970 time, which
+          # is stale under any `max_age` and so requires reauthentication
+          # regardless.
+          #
+          # Anchoring it at both ends is the one deliberate narrowing here.
+          # `to_i` also truncated a String to its leading integer, so
+          # `"1788703912 seconds"` used to resolve and no longer does. Keeping
+          # that as a fallback would reinstate the bug above for every
+          # serialization this method does not recognise —
+          # `"20260905T035910Z".to_i` is `20260905`, i.e. 1970 and stale
+          # forever — while reading `"99999999999999 garbage"` as a year
+          # 3170843 timestamp, i.e. fresh. Truncation guesses wrong in both
+          # directions; a String that is not wholly a number is not an epoch.
+          #
+          # Anything else has to look like one of the
+          # serialized timestamps, which `Time.zone.parse` then reads. `parse`
+          # is not used on its own because it is far more permissive than any
+          # of those formats: it takes `"10 minutes"` for day 10 of the current
+          # month, and such a value landing within `max_age` of now would read
+          # as *fresh* and silently skip the reauthentication.
+          # `Time.zone.iso8601` is no alternative — it rejects the bare-`Time`
+          # form outright.
+          #
+          # Matching the shape is not enough on its own: `parse` rolls an
+          # impossible calendar date over instead of raising, so `"2026-02-31"`
+          # comes back as 2026-03-03 — a date that does not exist would read as
+          # fresh whenever its rollover lands within `max_age` of now. The day
+          # is therefore checked with `Date.valid_date?` before parsing.
+          #
+          # What is left over is rescued: an out-of-range hour, minute or
+          # second raises `ArgumentError`, and a numeric String too long to be
+          # a Float (`"9" * 400` overflows to `Float::INFINITY`) makes
+          # `Time.zone.at` raise `FloatDomainError`. A value of any of these
+          # shapes returns nil, which `oidc_auth_time_stale?` treats as "no
+          # known auth_time" and so requires reauthentication — a malformed
+          # callback value must fail closed, not 500.
+          def parse_oidc_auth_time_string(value)
+            return Time.zone.at(value.to_f) if value.match?(/\A\s*[+-]?\d+(?:\.\d+)?\s*\z/)
+
+            match = OIDC_SERIALIZED_AUTH_TIME.match(value)
+            return unless match
+            return unless Date.valid_date?(match[:year].to_i, match[:month].to_i, match[:day].to_i)
+
+            Time.zone.parse(value)
+          rescue ArgumentError, RangeError
+            nil
+          end
+
+          # An auth_time further in the future than clock skew explains is not
+          # a time the resource owner authenticated at, whatever its type — a
+          # `Time`, an Integer epoch and a parsed String all reach here — so it
+          # is treated like an unknown one and requires reauthentication.
+          # Left unchecked, its negative age is below any `max_age` and it
+          # would read as fresh indefinitely.
           def oidc_auth_time_stale?(auth_time, max_age)
-            !auth_time || (Time.zone.now - auth_time) > max_age
+            return true unless auth_time
+
+            age = Time.zone.now - auth_time
+            age > max_age || age < -OIDC_AUTH_TIME_FUTURE_LEEWAY
           end
 
           # Resolve auth_time for max_age enforcement.

data/lib/doorkeeper/openid_connect/orm/active_record/access_grant.rb

@@ -3,13 +3,47 @@
 module Doorkeeper
   module OpenidConnect
     module AccessGrant
-      def self.prepended(base)
-        base.class_eval do
-          has_one :openid_request,
-                  class_name: Doorkeeper::OpenidConnect.configuration.open_id_request_class,
-                  foreign_key: "access_grant_id",
-                  inverse_of: :access_grant,
-                  dependent: :delete
+      class << self
+        # Wiring the `openid_request` association needs
+        # `open_id_request_class`, so it can only run once
+        # `Doorkeeper::OpenidConnect.configure` has. The grant model is not
+        # guaranteed to load after that: Doorkeeper's own `initialize_models!`
+        # reaches for it from `Doorkeeper.configure` (immediately, when a
+        # railtie has already loaded `ActiveRecord::Base`), and any initializer
+        # sorting between `doorkeeper.rb` and `doorkeeper_openid_connect.rb`
+        # can name the model itself. Reading the configuration here would raise
+        # `MissingConfiguration` in both cases — with a message pointing at an
+        # initializer that does exist and simply has not run yet.
+        #
+        # So wire immediately when the configuration is there, and otherwise
+        # remember the host model and wire it from `configure`.
+        def prepended(base)
+          return pending_hosts << base unless OpenidConnect.configured?
+
+          wire_openid_request_association(base)
+        end
+
+        # Called from `Doorkeeper::OpenidConnect.configure` for the models that
+        # loaded before it.
+        def wire_pending_hosts
+          pending_hosts.each { |base| wire_openid_request_association(base) }
+          pending_hosts.clear
+        end
+
+        private
+
+        def pending_hosts
+          @pending_hosts ||= []
+        end
+
+        def wire_openid_request_association(base)
+          base.class_eval do
+            has_one :openid_request,
+                    class_name: Doorkeeper::OpenidConnect.configuration.open_id_request_class,
+                    foreign_key: "access_grant_id",
+                    inverse_of: :access_grant,
+                    dependent: :delete
+          end
         end
       end
     end

data/lib/doorkeeper/openid_connect/version.rb

@@ -3,7 +3,7 @@
 module Doorkeeper
   module OpenidConnect
     MAJOR = 2
-    MINOR = 0
+    MINOR = 1
     TINY = 0
     PRE = nil
 

data/lib/doorkeeper/openid_connect.rb

@@ -19,6 +19,7 @@ module Doorkeeper
   module OpenidConnect
     autoload :AtHashConcern, "doorkeeper/openid_connect/at_hash_concern"
     autoload :ClaimsBuilder, "doorkeeper/openid_connect/claims_builder"
+    autoload :ClaimsHash, "doorkeeper/openid_connect/claims_hash"
     autoload :DiscoveryHelpersMixin, "doorkeeper/openid_connect/discovery_helpers_mixin"
     autoload :Errors, "doorkeeper/openid_connect/errors"
     autoload :GrantTypesSupportedMixin, "doorkeeper/openid_connect/grant_types_supported_mixin"

data/lib/generators/doorkeeper/openid_connect/templates/initializer.rb

@@ -59,9 +59,13 @@ Doorkeeper::OpenidConnect.configure do
   # piggy-backing on a fresh login from another device.
   #
   # The block is executed in the controller's scope and receives the
-  # current `session` and `request`. Return value can be a `Time`,
-  # `DateTime`, or anything responding to `to_i`. Return `nil` to force
-  # reauthentication.
+  # current `session` and `request`. Return value can be a `Time`, a
+  # `DateTime`, epoch seconds (an Integer or a numeric String), or a
+  # serialized timestamp String such as `"2026-09-05T03:59:10.270Z"` — a
+  # `Time` stored in the session comes back as the latter once it
+  # round-trips through the JSON cookie serializer, which Rails 7.0+
+  # selects by default. A String of any other shape is read as an unknown
+  # auth_time and forces reauthentication, as does `nil`.
   #
   # auth_time_from_session do |session, _request|
   #   # Example implementation: capture auth_time on the session at login,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-openid_connect
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - Sam Dengler
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-09-22 00:00:00.000000000 Z
+date: 2026-10-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper
@@ -46,20 +46,6 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '2.5'
-- !ruby/object:Gem::Dependency
-  name: ostruct
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.5'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0.5'
 - !ruby/object:Gem::Dependency
   name: bigdecimal
   requirement: !ruby/object:Gem::Requirement
@@ -199,6 +185,7 @@ files:
 - lib/doorkeeper/openid_connect/claims/claim.rb
 - lib/doorkeeper/openid_connect/claims/normal_claim.rb
 - lib/doorkeeper/openid_connect/claims_builder.rb
+- lib/doorkeeper/openid_connect/claims_hash.rb
 - lib/doorkeeper/openid_connect/config.rb
 - lib/doorkeeper/openid_connect/discovery_helpers_mixin.rb
 - lib/doorkeeper/openid_connect/engine.rb