doorkeeper-openid_connect 1.10.4 → 1.10.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c7b483ae4502881dca6aece41d05d538677d0e8d53f2fa3b82d9b89dc9aa1d8
-  data.tar.gz: dd8ed48877f8c68199c466afba4bd27a3b26671a00bd5af949146e103849544e
+  metadata.gz: cc9243cc386621bb9b9474617c885f398632d60fdeabc7ecb50deab1364bb787
+  data.tar.gz: e33f32f4992a35ec43762c4c5c60d0ba6e98bb8b4f7c60c8cd0d4d69b4c1f535
 SHA512:
-  metadata.gz: 18b20b9a1d04b2dfe1bfd6a169057e08fee82d538990e506f46df58f70ff29a8681d30055e18542f2af82fdb3ebceb11dc976d8b4d55f2b0f01e41fb406b931c
-  data.tar.gz: 86b69e55903f371666178cfcaa8989e4d0c82939172a79bb070d3e50742ad4cac885edfd498d5c53af18cc98643c25cb63dc094b0c55f91c1279aec446f039a0
+  metadata.gz: ca8e15dde2fb57d5badf44ddb67f5109eb7b419e92ae33b4f7c3bee6cc998ae4ec50a31bc57aefae40578c5c094a85ac5cfc8cabdbbd4a1c77316fcc7651faf4
+  data.tar.gz: 7ac0048a88dc1968427dbb67ab814e85ebc361d3210d2d6d6bf29e52bd4f09fd94f6eb9792ab1c495ca7ef9323a9d0ca29d43aba8c13e6658cfe97c17f2a2230

data/CHANGELOG.md

@@ -1,6 +1,13 @@
 ## Unreleased
 
+## v1.10.5 (2026-07-09)
+
+- [#329] Restore compatibility with the full `doorkeeper >= 5.5` range declared in the gemspec ([#328](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/issues/328)). Doorkeeper 5.5.x raised `NameError: uninitialized constant Doorkeeper::Orm::ActiveRecord::Mixins` at load time (the mixin file ships since 5.5.0 but is only autoloadable since 5.6.0 — it is now required explicitly when absent), and Doorkeeper 5.6/5.7 broke the discovery endpoint because `pkce_code_challenge_methods` only exists since 5.8.0 (the discovery response now falls back to `plain S256`, which is what those versions accept). CI now exercises the oldest supported Doorkeeper series via `gemfiles/doorkeeper_5.{5,6,7}.gemfile`
 - Please add here
+- [#325] Remove the dead `Claims::AggregatedClaim` and `Claims::DistributedClaim` classes. They have never been required, instantiated, or reachable through the claims DSL (`ClaimsBuilder` only builds `NormalClaim`), and the discovery document only advertises `claim_types_supported: ["normal"]` — the files just shipped in the gem unused since 2016
+- [#324] Split `Helpers::Controller` (294 lines, one module) into focused submodules — `Prompt`, `MaxAge`, `ErrorResponse`, `TokenMatching` — and decompose the two most complex methods (`handle_oidc_prompt_param!`, `handle_oidc_max_age_param!`). This is a behavior-preserving refactor that allows dropping the `Metrics/ModuleLength`, `Metrics/CyclomaticComplexity` and `Metrics/PerceivedComplexity` overrides from `.rubocop_todo.yml`; the codebase now passes those cops at RuboCop's default thresholds
+- [#326] Make the dynamic client registration spec robust against pre-existing `Doorkeeper::Application` rows: replace absolute `Application.count` assertions and `Application.first` lookups with relative `change` matchers and `Application.find_by(uid:)` lookups keyed on the `client_id` returned by each request. With a polluted `test.sqlite3` (e.g. left behind by a `rake server` session against the same dummy app) 12 of the 20 examples failed spuriously; they now pass regardless of prior DB state
+- [#327] Document previously-undocumented config options in the generated initializer template: `authorize_dynamic_client_registration` (DCR endpoint authorization gate), `apply_prompt_to_non_oidc_requests`, `end_session_endpoint`, `discovery_url_options`, and the `response:` option for claims (controlling whether a claim appears in the ID Token, UserInfo, or both). No behavior change
 
 ## v1.10.4 (2026-07-07)
 

data/README.md

@@ -66,7 +66,7 @@ rails generate doorkeeper:openid_connect:migration
 rake db:migrate
 ```
 
-If you're upgrading from an earlier version, check [Migration from old versions](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/wiki/Migration%E2%80%90from%E2%80%90old%E2%80%90versions)
+If you're upgrading from an earlier version, check [Migration from Old Versions](https://github.com/doorkeeper-gem/doorkeeper-openid_connect/wiki/Migration-from-Old-Versions)
 wiki and [CHANGELOG.md](CHANGELOG.md) for upgrade instructions.
 
 ## Configuration

data/app/controllers/concerns/doorkeeper/openid_connect/authorizations_extension.rb

@@ -5,6 +5,11 @@ module Doorkeeper
     module AuthorizationsExtension
       private
 
+      # Whitelist the OIDC `nonce` authorization parameter so Doorkeeper
+      # carries it into the PreAuthorization (see
+      # Doorkeeper::OpenidConnect::OAuth::PreAuthorization#initialize, which
+      # reads `attrs[:nonce]`). Without this the nonce would be dropped and
+      # never make it onto the issued ID Token.
       def pre_auth_param_fields
         super.append(:nonce)
       end

data/app/controllers/doorkeeper/openid_connect/discovery_controller.rb

@@ -83,6 +83,10 @@ module Doorkeeper
       def code_challenge_methods_supported(doorkeeper)
         return unless doorkeeper.access_grant_model.pkce_supported?
 
+        # Doorkeeper < 5.8 has no `pkce_code_challenge_methods` option and
+        # always accepts both methods whenever PKCE is available.
+        return %w[plain S256] unless doorkeeper.respond_to?(:pkce_code_challenge_methods)
+
         doorkeeper.pkce_code_challenge_methods
       end
 

data/lib/doorkeeper/openid_connect/helpers/controller/error_response.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OpenidConnect
+    module Helpers
+      module Controller
+        # Renders OpenID Connect authorization errors (`login_required`,
+        # `consent_required`, ...) through Doorkeeper's OAuth response objects.
+        module ErrorResponse
+          private
+
+          def handle_oidc_error!(exception)
+            clear_oidc_response
+
+            error_response = if exception.type == :invalid_request
+                               ::Doorkeeper::OAuth::InvalidRequestResponse.new(
+                                 name: exception.type,
+                                 state: params[:state],
+                                 redirect_uri: params[:redirect_uri],
+                                 response_on_fragment: pre_auth.response_on_fragment?,
+                               )
+                             else
+                               ::Doorkeeper::OAuth::ErrorResponse.new(
+                                 name: exception.type,
+                                 state: params[:state],
+                                 redirect_uri: params[:redirect_uri],
+                                 response_on_fragment: pre_auth.response_on_fragment?,
+                               )
+                             end
+
+            response.headers.merge!(error_response.headers)
+
+            # NOTE: Assign error_response to @authorize_response then use the
+            #   redirect_or_render method defined by doorkeeper's
+            #   authorizations_controller.
+            # - https://github.com/doorkeeper-gem/doorkeeper/blob/v5.5.0/app/controllers/doorkeeper/authorizations_controller.rb#L110
+            # - https://github.com/doorkeeper-gem/doorkeeper/blob/v5.5.0/app/controllers/doorkeeper/authorizations_controller.rb#L52
+            @authorize_response = error_response
+            redirect_or_render(@authorize_response)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/openid_connect/helpers/controller/max_age.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OpenidConnect
+    module Helpers
+      module Controller
+        # Enforces the OIDC `max_age` authorization parameter (OIDC Core 1.0
+        # §3.1.2.1): when the resource owner's last authentication is older
+        # than `max_age` seconds, reauthentication is required.
+        module MaxAge
+          private
+
+          def handle_oidc_max_age_param!(owner)
+            max_age = params[:max_age].to_i
+            return unless (params[:max_age].to_s == "0" || max_age > 0) && owner
+
+            auth_time = normalized_oidc_auth_time(owner)
+
+            # NOTE: clock skew
+            max_age = [1, max_age].max
+
+            return unless oidc_auth_time_stale?(auth_time, max_age)
+
+            # OIDC Core 1.0 §3.1.2.1: with `prompt=none` the Authorization Server
+            # MUST NOT display any authentication UI. Reauthentication required by
+            # `max_age` must therefore be reported as `login_required` instead of
+            # triggering the interactive `reauthenticate_resource_owner` flow.
+            # (Conflicting combinations like `prompt=none login` are still left to
+            # `handle_oidc_prompt_param!`, which raises `invalid_request`.)
+            raise Errors::LoginRequired if oidc_prompt_values == ["none"]
+
+            reauthenticate_oidc_resource_owner(owner)
+          end
+
+          # Normalize non-Time values (e.g. an Integer epoch) so that the
+          # staleness subtraction yields a Float of elapsed seconds rather
+          # than a shifted Time value.
+          def normalized_oidc_auth_time(owner)
+            auth_time = resolve_oidc_auth_time(owner)
+            return auth_time if !auth_time || auth_time.is_a?(Time) || auth_time.is_a?(DateTime)
+
+            Time.zone.at(auth_time.to_i)
+          end
+
+          def oidc_auth_time_stale?(auth_time, max_age)
+            !auth_time || (Time.zone.now - auth_time) > max_age
+          end
+
+          # Resolve auth_time for max_age enforcement.
+          #
+          # Prefers `auth_time_from_session` so that multi-session deployments can
+          # return the auth_time of the *current* session rather than the user's
+          # most recent login on any device (issue #150). Falls back to the legacy
+          # `auth_time_from_resource_owner` with a one-time deprecation warning.
+          def resolve_oidc_auth_time(owner)
+            config = Doorkeeper::OpenidConnect.configuration
+
+            if config.auth_time_from_session
+              return instance_exec(session, request, &config.auth_time_from_session)
+            end
+
+            Doorkeeper::OpenidConnect::Helpers::Controller.warn_auth_time_from_resource_owner_deprecation
+            instance_exec(owner, &config.auth_time_from_resource_owner)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/openid_connect/helpers/controller/prompt.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OpenidConnect
+    module Helpers
+      module Controller
+        # Handles the OIDC `prompt` authorization parameter (OIDC Core 1.0
+        # §3.1.2.1): `none`, `login`, `consent`, `select_account`.
+        module Prompt
+          private
+
+          def handle_oidc_prompt_param!(owner)
+            priority = %w[none consent login select_account]
+            prompt_values = oidc_prompt_values.sort_by do |prompt|
+              priority.find_index(prompt).to_i
+            end
+
+            prompt_values.each do |prompt|
+              apply_oidc_prompt!(prompt, prompt_values, owner)
+            end
+          end
+
+          def apply_oidc_prompt!(prompt, prompt_values, owner)
+            case prompt
+            when "none"
+              handle_oidc_prompt_none!(prompt_values, owner)
+            when "login"
+              handle_oidc_prompt_login!(owner)
+            when "consent"
+              handle_oidc_prompt_consent!(owner)
+            when "select_account"
+              select_account_for_oidc_resource_owner(owner)
+            when "create"
+              # NOTE: not supported, but does not raise an error.
+            else
+              raise Errors::InvalidRequest
+            end
+          end
+
+          def handle_oidc_prompt_none!(prompt_values, owner)
+            raise Errors::InvalidRequest if (prompt_values - ["none"]).any?
+            raise Errors::LoginRequired unless owner
+            raise Errors::ConsentRequired if oidc_consent_required?(owner)
+
+            # Issue #63: if an active token already covers the requested scopes
+            # (a non-strict superset, including the exact-match case), force
+            # auto-issue rather than rendering the consent form — `prompt=none`
+            # forbids any interactive UI (OIDC Core §3.1.2.1).
+            @_oidc_prompt_none_skip_authorization = true if oidc_matching_subset_token?(owner)
+          end
+
+          def handle_oidc_prompt_login!(owner)
+            reauthenticate_oidc_resource_owner(owner) if owner
+          end
+
+          def handle_oidc_prompt_consent!(owner)
+            return unless owner
+
+            clear_oidc_response
+            render :new
+          end
+
+          def oidc_prompt_values
+            # Reject blank entries so leading/duplicate spaces in the
+            # space-delimited `prompt` parameter don't surface as an empty
+            # value (which would otherwise be treated as an unknown prompt and
+            # rejected with `invalid_request`).
+            @oidc_prompt_values ||= params[:prompt].to_s.split(/ +/).reject(&:blank?).uniq
+          end
+
+          def return_without_oidc_prompt_param(prompt_value)
+            return_to = URI.parse(request.path)
+            return_to.query = request.query_parameters.tap do |params|
+              params["prompt"] = params["prompt"].to_s.sub(/\b#{prompt_value}\s*\b/, "").strip
+              params.delete("prompt") if params["prompt"].blank?
+            end.to_query
+            return_to.to_s
+          end
+
+          def reauthenticate_oidc_resource_owner(owner)
+            clear_oidc_response
+            return_to = return_without_oidc_prompt_param("login")
+
+            instance_exec(
+              owner,
+              return_to,
+              &Doorkeeper::OpenidConnect.configuration.reauthenticate_resource_owner
+            )
+
+            raise Errors::LoginRequired unless performed?
+          end
+
+          def select_account_for_oidc_resource_owner(owner)
+            clear_oidc_response
+            return_to = return_without_oidc_prompt_param("select_account")
+
+            instance_exec(
+              owner,
+              return_to,
+              &Doorkeeper::OpenidConnect.configuration.select_account_for_resource_owner
+            )
+
+            # OIDC Core 1.0 §3.1.2.6: if the account selection cannot be performed
+            # the request MUST fail with `account_selection_required` rather than
+            # silently continuing the authorization (mirrors the `login_required`
+            # backstop in #reauthenticate_oidc_resource_owner).
+            raise Errors::AccountSelectionRequired unless performed?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/openid_connect/helpers/controller/token_matching.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OpenidConnect
+    module Helpers
+      module Controller
+        # Decides whether an already-issued access token can satisfy the
+        # current authorization request, so `prompt=none` can succeed (or
+        # consent can be skipped) without interactive UI.
+        module TokenMatching
+          private
+
+          def oidc_consent_required?(owner)
+            !skip_authorization? && !matching_token? && !oidc_matching_subset_token?(owner)
+          end
+
+          # Returns true if the resource owner already has an active token for this
+          # client whose scopes are a (non-strict) superset of the requested scopes.
+          # Used to allow `prompt=none` to succeed when the client re-authorizes
+          # with a narrower set of scopes (issue #63).
+          #
+          # Scans tokens via `find_access_token_in_batches` (same pattern as
+          # upstream Doorkeeper's `find_matching_token`) so that installations
+          # with many active tokens per (client, resource owner) pair do not
+          # load the entire relation into memory.
+          def oidc_matching_subset_token?(owner)
+            return @oidc_matching_subset_token if defined?(@oidc_matching_subset_token)
+
+            @oidc_matching_subset_token =
+              !pre_auth.scopes.empty? && oidc_subset_token_exists?(owner)
+          end
+
+          def oidc_subset_token_exists?(owner)
+            token_model = Doorkeeper.config.access_token_model
+            relation = token_model.authorized_tokens_for(pre_auth.client.id, owner)
+            batch_size = Doorkeeper.configuration.token_lookup_batch_size
+
+            match_found = false
+            token_model.find_access_token_in_batches(relation, batch_size: batch_size) do |batch|
+              if batch.any? { |token| token.scopes.scopes?(pre_auth.scopes) }
+                match_found = true
+                break
+              end
+            end
+            match_found
+          end
+
+          # Force Doorkeeper's `render_success` onto the auto-issue path when a
+          # `prompt=none` subset-scope reauthorization has been validated above.
+          def skip_authorization?
+            return true if @_oidc_prompt_none_skip_authorization
+
+            super
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/openid_connect/helpers/controller.rb

@@ -1,5 +1,10 @@
 # frozen_string_literal: true
 
+require "doorkeeper/openid_connect/helpers/controller/error_response"
+require "doorkeeper/openid_connect/helpers/controller/max_age"
+require "doorkeeper/openid_connect/helpers/controller/prompt"
+require "doorkeeper/openid_connect/helpers/controller/token_matching"
+
 module Doorkeeper
   module OpenidConnect
     module Helpers
@@ -27,6 +32,15 @@ module Doorkeeper
           @auth_time_from_resource_owner_deprecation_warned = false
         end
 
+        # Because this module is prepended onto Doorkeeper's
+        # Helpers::Controller, the included modules end up between it and
+        # Doorkeeper's implementation in the ancestor chain — their `super`
+        # calls (e.g. in `skip_authorization?`) still reach Doorkeeper.
+        include ErrorResponse
+        include MaxAge
+        include Prompt
+        include TokenMatching
+
         private
 
         # FIXME: remove after Doorkeeper will merge it
@@ -74,217 +88,14 @@ module Doorkeeper
             pre_auth.valid?
         end
 
-        def handle_oidc_error!(exception)
-          # clear the previous response body to avoid a DoubleRenderError
+        # Clear the previous response body to avoid a DoubleRenderError when
+        # rendering or redirecting again after the authenticator already
+        # produced a response.
+        def clear_oidc_response
           self.response_body = nil
 
           # FIXME: workaround for Rails 5, see https://github.com/rails/rails/issues/25106
           @_response_body = nil
-
-          error_response = if exception.type == :invalid_request
-                             ::Doorkeeper::OAuth::InvalidRequestResponse.new(
-                               name: exception.type,
-                               state: params[:state],
-                               redirect_uri: params[:redirect_uri],
-                               response_on_fragment: pre_auth.response_on_fragment?,
-                             )
-                           else
-                             ::Doorkeeper::OAuth::ErrorResponse.new(
-                               name: exception.type,
-                               state: params[:state],
-                               redirect_uri: params[:redirect_uri],
-                               response_on_fragment: pre_auth.response_on_fragment?,
-                             )
-                           end
-
-          response.headers.merge!(error_response.headers)
-
-          # NOTE: Assign error_response to @authorize_response then use redirect_or_render method that are defined at
-          #   doorkeeper's authorizations_controller.
-          # - https://github.com/doorkeeper-gem/doorkeeper/blob/v5.5.0/app/controllers/doorkeeper/authorizations_controller.rb#L110
-          # - https://github.com/doorkeeper-gem/doorkeeper/blob/v5.5.0/app/controllers/doorkeeper/authorizations_controller.rb#L52
-          @authorize_response = error_response
-          redirect_or_render(@authorize_response)
-        end
-
-        def handle_oidc_prompt_param!(owner)
-          priority = %w[none consent login select_account]
-          prompt_values = oidc_prompt_values.sort_by do |prompt|
-            priority.find_index(prompt).to_i
-          end
-
-          prompt_values.each do |prompt|
-            case prompt
-            when "none"
-              handle_oidc_prompt_none!(prompt_values, owner)
-            when "login"
-              reauthenticate_oidc_resource_owner(owner) if owner
-            when "consent"
-              if owner
-                clear_oidc_response
-                render :new
-              end
-            when "select_account"
-              select_account_for_oidc_resource_owner(owner)
-            when "create"
-              # NOTE: not supported, but not raise error.
-            else
-              raise Errors::InvalidRequest
-            end
-          end
-        end
-
-        def handle_oidc_prompt_none!(prompt_values, owner)
-          raise Errors::InvalidRequest if (prompt_values - ["none"]).any?
-          raise Errors::LoginRequired unless owner
-          raise Errors::ConsentRequired if oidc_consent_required?(owner)
-
-          # Issue #63: if an active token already covers the requested scopes
-          # (a non-strict superset, including the exact-match case), force
-          # auto-issue rather than rendering the consent form — `prompt=none`
-          # forbids any interactive UI (OIDC Core §3.1.2.1).
-          @_oidc_prompt_none_skip_authorization = true if oidc_matching_subset_token?(owner)
-        end
-
-        def handle_oidc_max_age_param!(owner)
-          max_age = params[:max_age].to_i
-          return unless (params[:max_age].to_s == "0" || max_age > 0) && owner
-
-          auth_time = resolve_oidc_auth_time(owner)
-
-          # Normalize non-Time values (e.g. an Integer epoch) so that the
-          # subtraction below yields a Float of elapsed seconds rather than a
-          # shifted Time value.
-          if auth_time && !auth_time.is_a?(Time) && !auth_time.is_a?(DateTime)
-            auth_time = Time.zone.at(auth_time.to_i)
-          end
-
-          # NOTE: clock skew
-          max_age = [1, max_age].max
-
-          return unless !auth_time || (Time.zone.now - auth_time) > max_age
-
-          # OIDC Core 1.0 §3.1.2.1: with `prompt=none` the Authorization Server
-          # MUST NOT display any authentication UI. Reauthentication required by
-          # `max_age` must therefore be reported as `login_required` instead of
-          # triggering the interactive `reauthenticate_resource_owner` flow.
-          # (Conflicting combinations like `prompt=none login` are still left to
-          # `handle_oidc_prompt_param!`, which raises `invalid_request`.)
-          raise Errors::LoginRequired if oidc_prompt_values == ["none"]
-
-          reauthenticate_oidc_resource_owner(owner)
-        end
-
-        def oidc_prompt_values
-          # Reject blank entries so leading/duplicate spaces in the
-          # space-delimited `prompt` parameter don't surface as an empty
-          # value (which would otherwise be treated as an unknown prompt and
-          # rejected with `invalid_request`).
-          @oidc_prompt_values ||= params[:prompt].to_s.split(/ +/).reject(&:blank?).uniq
-        end
-
-        # Resolve auth_time for max_age enforcement.
-        #
-        # Prefers `auth_time_from_session` so that multi-session deployments can
-        # return the auth_time of the *current* session rather than the user's
-        # most recent login on any device (issue #150). Falls back to the legacy
-        # `auth_time_from_resource_owner` with a one-time deprecation warning.
-        def resolve_oidc_auth_time(owner)
-          config = Doorkeeper::OpenidConnect.configuration
-
-          if config.auth_time_from_session
-            return instance_exec(session, request, &config.auth_time_from_session)
-          end
-
-          Doorkeeper::OpenidConnect::Helpers::Controller.warn_auth_time_from_resource_owner_deprecation
-          instance_exec(owner, &config.auth_time_from_resource_owner)
-        end
-
-        def return_without_oidc_prompt_param(prompt_value)
-          return_to = URI.parse(request.path)
-          return_to.query = request.query_parameters.tap do |params|
-            params["prompt"] = params["prompt"].to_s.sub(/\b#{prompt_value}\s*\b/, "").strip
-            params.delete("prompt") if params["prompt"].blank?
-          end.to_query
-          return_to.to_s
-        end
-
-        def clear_oidc_response
-          self.response_body = nil
-          @_response_body = nil
-        end
-
-        def reauthenticate_oidc_resource_owner(owner)
-          clear_oidc_response
-          return_to = return_without_oidc_prompt_param("login")
-
-          instance_exec(
-            owner,
-            return_to,
-            &Doorkeeper::OpenidConnect.configuration.reauthenticate_resource_owner
-          )
-
-          raise Errors::LoginRequired unless performed?
-        end
-
-        def oidc_consent_required?(owner)
-          !skip_authorization? && !matching_token? && !oidc_matching_subset_token?(owner)
-        end
-
-        # Returns true if the resource owner already has an active token for this
-        # client whose scopes are a (non-strict) superset of the requested scopes.
-        # Used to allow `prompt=none` to succeed when the client re-authorizes
-        # with a narrower set of scopes (issue #63).
-        #
-        # Scans tokens via `find_access_token_in_batches` (same pattern as
-        # upstream Doorkeeper's `find_matching_token`) so that installations
-        # with many active tokens per (client, resource owner) pair do not
-        # load the entire relation into memory.
-        def oidc_matching_subset_token?(owner)
-          return @oidc_matching_subset_token if defined?(@oidc_matching_subset_token)
-
-          @oidc_matching_subset_token =
-            if pre_auth.scopes.empty?
-              false
-            else
-              access_token_model = Doorkeeper.config.access_token_model
-              relation = access_token_model.authorized_tokens_for(pre_auth.client.id, owner)
-              batch_size = Doorkeeper.configuration.token_lookup_batch_size
-
-              match_found = false
-              access_token_model.find_access_token_in_batches(relation, batch_size: batch_size) do |batch|
-                if batch.any? { |token| token.scopes.scopes?(pre_auth.scopes) }
-                  match_found = true
-                  break
-                end
-              end
-              match_found
-            end
-        end
-
-        # Force Doorkeeper's `render_success` onto the auto-issue path when a
-        # `prompt=none` subset-scope reauthorization has been validated above.
-        def skip_authorization?
-          return true if @_oidc_prompt_none_skip_authorization
-
-          super
-        end
-
-        def select_account_for_oidc_resource_owner(owner)
-          clear_oidc_response
-          return_to = return_without_oidc_prompt_param("select_account")
-
-          instance_exec(
-            owner,
-            return_to,
-            &Doorkeeper::OpenidConnect.configuration.select_account_for_resource_owner
-          )
-
-          # OIDC Core 1.0 §3.1.2.6: if the account selection cannot be performed
-          # the request MUST fail with `account_selection_required` rather than
-          # silently continuing the authorization (mirrors the `login_required`
-          # backstop in #reauthenticate_oidc_resource_owner).
-          raise Errors::AccountSelectionRequired unless performed?
         end
       end
     end

data/lib/doorkeeper/openid_connect/oauth/authorization_code_request.rb

@@ -9,6 +9,11 @@ module Doorkeeper
         def after_successful_response
           super
 
+          # The nonce was stashed on a one-time OpenidRequest row when the
+          # authorization code was issued (see OAuth::Authorization::Code).
+          # Read it before destroying the row so it can be bound to the ID
+          # Token, then delete the row so a leaked/replayed code cannot mint
+          # another token carrying the same nonce.
           openid_request = grant.openid_request
           nonce = openid_request&.nonce
           openid_request&.destroy!

data/lib/doorkeeper/openid_connect/oauth/token_response.rb

@@ -8,6 +8,10 @@ module Doorkeeper
 
         def body
           if token.includes_scope? "openid"
+            # `id_token` is preset by the flows that carry a nonce (the
+            # authorization code and password grants). Grants without one —
+            # e.g. refresh_token — reach here with it unset, so build a
+            # nonce-less ID Token on the fly.
             id_token = self.id_token || Doorkeeper::OpenidConnect::IdToken.new(token)
 
             super

data/lib/doorkeeper/openid_connect/orm/active_record.rb

@@ -48,6 +48,13 @@ module Doorkeeper
     end
   end
 
+  # Doorkeeper 5.5.x ships the very same mixin file, but only 5.6.0+
+  # registers an autoload for `Doorkeeper::Orm::ActiveRecord::Mixins`, so
+  # on 5.5.x the constant has to be resolved by requiring it explicitly.
+  unless defined?(Orm::ActiveRecord::Mixins::AccessGrant)
+    require "doorkeeper/orm/active_record/mixins/access_grant"
+  end
+
   Orm::ActiveRecord::Mixins::AccessGrant.singleton_class.prepend(
     OpenidConnect::Orm::ActiveRecord::AccessGrantExtension,
   )

data/lib/doorkeeper/openid_connect/version.rb

@@ -4,7 +4,7 @@ module Doorkeeper
   module OpenidConnect
     MAJOR = 1
     MINOR = 10
-    TINY = 4
+    TINY = 5
     PRE = nil
 
     # Full version number

data/lib/generators/doorkeeper/openid_connect/templates/initializer.rb

@@ -104,6 +104,55 @@ Doorkeeper::OpenidConnect.configure do
   # Enable dynamic client registration (default false)
   # dynamic_client_registration true
 
+  # Gate the dynamic client registration endpoint (RFC 7591 §3.1). Leave unset
+  # (default `nil`) to keep the endpoint open once `dynamic_client_registration`
+  # is enabled. Set a block to require authorization: it is evaluated in the
+  # controller scope (so it can read `request`, `params`, `request.headers`,
+  # etc.) and a falsy return rejects the request with `401 invalid_token`.
+  #
+  # authorize_dynamic_client_registration do
+  #   # Example: require an Initial Access Token in the Authorization header.
+  #   # Fail closed when the token isn't configured, so an unset env var can't
+  #   # leave the endpoint open. Compare in constant time to avoid leaking the
+  #   # token via timing; digesting first keeps the comparison fixed-length so
+  #   # the token's length isn't leaked either.
+  #   expected = ENV["DCR_INITIAL_ACCESS_TOKEN"].to_s
+  #   next false if expected.empty?
+  #
+  #   provided = request.headers["Authorization"].to_s
+  #   ActiveSupport::SecurityUtils.secure_compare(
+  #     Digest::SHA256.hexdigest(provided),
+  #     Digest::SHA256.hexdigest("Bearer #{expected}"),
+  #   )
+  # end
+
+  # By default the `prompt` parameter (`none`, `login`, `consent`,
+  # `select_account`) is only honored for OIDC requests (those carrying the
+  # `openid` scope). Enable this to also honor `prompt` on non-OIDC
+  # authorization requests. `max_age` stays OIDC-only, as it is defined by
+  # OIDC Core.
+  #
+  # apply_prompt_to_non_oidc_requests true
+
+  # End-session endpoint advertised in the discovery document
+  # (`end_session_endpoint`). The block is evaluated in the controller scope;
+  # return the absolute URL of your RP-initiated logout endpoint. Defaults to
+  # `nil`, which omits the member from the discovery document.
+  #
+  # end_session_endpoint do
+  #   end_session_url
+  # end
+
+  # Per-endpoint overrides for the URLs generated in the discovery document
+  # (e.g. to advertise a different host or force HTTPS). The block receives the
+  # current `request` and returns a hash keyed by endpoint name.
+  #
+  # discovery_url_options do |request|
+  #   {
+  #     authorization: { protocol: request.ssl? ? :https : :http },
+  #   }
+  # end
+
   # You can use your own model class if you need to extend (or even override) the default
   # Doorkeeper::OpenidConnect::Request model (e.g. to use a different database connection).
   #
@@ -132,5 +181,13 @@ Doorkeeper::OpenidConnect.configure do
   #   normal_claim :_bar_ do |resource_owner|
   #     resource_owner.bar
   #   end
+
+  #   # By default a claim is only returned from the UserInfo endpoint
+  #   # (`response: [:user_info]`). Pass `response:` to control where it
+  #   # appears — the ID Token, UserInfo, or both. `scope:` restricts the
+  #   # claim to grants that include the given scope.
+  #   normal_claim :_baz_, scope: :profile, response: %i[id_token user_info] do |resource_owner|
+  #     resource_owner.baz
+  #   end
   # end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper-openid_connect
 version: !ruby/object:Gem::Version
-  version: 1.10.4
+  version: 1.10.5
 platform: ruby
 authors:
 - Sam Dengler
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-07-07 00:00:00.000000000 Z
+date: 2026-07-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: doorkeeper
@@ -194,9 +194,7 @@ files:
 - lib/doorkeeper/oauth/id_token_token_request.rb
 - lib/doorkeeper/oauth/id_token_token_response.rb
 - lib/doorkeeper/openid_connect.rb
-- lib/doorkeeper/openid_connect/claims/aggregated_claim.rb
 - lib/doorkeeper/openid_connect/claims/claim.rb
-- lib/doorkeeper/openid_connect/claims/distributed_claim.rb
 - lib/doorkeeper/openid_connect/claims/normal_claim.rb
 - lib/doorkeeper/openid_connect/claims_builder.rb
 - lib/doorkeeper/openid_connect/config.rb
@@ -204,6 +202,10 @@ files:
 - lib/doorkeeper/openid_connect/errors.rb
 - lib/doorkeeper/openid_connect/grant_types_supported_mixin.rb
 - lib/doorkeeper/openid_connect/helpers/controller.rb
+- lib/doorkeeper/openid_connect/helpers/controller/error_response.rb
+- lib/doorkeeper/openid_connect/helpers/controller/max_age.rb
+- lib/doorkeeper/openid_connect/helpers/controller/prompt.rb
+- lib/doorkeeper/openid_connect/helpers/controller/token_matching.rb
 - lib/doorkeeper/openid_connect/id_token.rb
 - lib/doorkeeper/openid_connect/id_token_token.rb
 - lib/doorkeeper/openid_connect/oauth/authorization/code.rb

data/lib/doorkeeper/openid_connect/claims/aggregated_claim.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  module OpenidConnect
-    module Claims
-      class AggregatedClaim < Claim
-        attr_accessor :jwt
-      end
-    end
-  end
-end

data/lib/doorkeeper/openid_connect/claims/distributed_claim.rb

@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  module OpenidConnect
-    module Claims
-      class DistributedClaim < Claim
-        attr_accessor :endpoint, :access_token
-      end
-    end
-  end
-end