doorkeeper 4.2.6 → 5.5.4

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class RefreshTokenRequest < BaseRequest
@@ -9,36 +11,37 @@ module Doorkeeper
       validate :client_match, error: :invalid_grant
       validate :scope,        error: :invalid_scope
 
-      attr_accessor :access_token, :client, :credentials, :refresh_token,
-                    :server
+      attr_reader :access_token, :client, :credentials, :refresh_token
+      attr_reader :missing_param
 
       def initialize(server, refresh_token, credentials, parameters = {})
-        @server          = server
-        @refresh_token   = refresh_token
-        @credentials     = credentials
+        @server = server
+        @refresh_token = refresh_token
+        @credentials = credentials
         @original_scopes = parameters[:scope] || parameters[:scopes]
         @refresh_token_parameter = parameters[:refresh_token]
-
-        if credentials
-          @client = Application.by_uid_and_secret credentials.uid,
-                                                  credentials.secret
-        end
+        @client = load_client(credentials) if credentials
       end
 
       private
 
+      def load_client(credentials)
+        server_config.application_model.by_uid_and_secret(credentials.uid, credentials.secret)
+      end
+
       def before_successful_response
         refresh_token.transaction do
           refresh_token.lock!
-          raise Errors::InvalidTokenReuse if refresh_token.revoked?
+          raise Errors::InvalidGrantReuse if refresh_token.revoked?
 
           refresh_token.revoke unless refresh_token_revoked_on_use?
           create_access_token
         end
+        super
       end
 
       def refresh_token_revoked_on_use?
-        Doorkeeper::AccessToken.refresh_token_revoked_on_use?
+        server_config.access_token_model.refresh_token_revoked_on_use?
       end
 
       def default_scopes
@@ -46,29 +49,46 @@ module Doorkeeper
       end
 
       def create_access_token
-        @access_token = AccessToken.create!(access_token_attributes)
-      end
+        attributes = {}
 
-      def access_token_attributes
-        {
-          application_id: refresh_token.application_id,
-          resource_owner_id: refresh_token.resource_owner_id,
-          scopes: scopes.to_s,
-          expires_in: access_token_expires_in,
-          use_refresh_token: true
-        }.tap do |attributes|
-          if refresh_token_revoked_on_use?
-            attributes[:previous_refresh_token] = refresh_token.refresh_token
+        resource_owner =
+          if Doorkeeper.config.polymorphic_resource_owner?
+            refresh_token.resource_owner
+          else
+            refresh_token.resource_owner_id
           end
+
+        if refresh_token_revoked_on_use?
+          attributes[:previous_refresh_token] = refresh_token.refresh_token
         end
-      end
 
-      def access_token_expires_in
-        Authorization::Token.access_token_expires_in(server, client)
+        # RFC6749
+        # 1.5.  Refresh Token
+        #
+        # Refresh tokens are issued to the client by the authorization server and are
+        # used to obtain a new access token when the current access token
+        # becomes invalid or expires, or to obtain additional access tokens
+        # with identical or narrower scope (access tokens may have a shorter
+        # lifetime and fewer permissions than authorized by the resource
+        # owner).
+        #
+        # Here we assume that TTL of the token received after refreshing should be
+        # the same as that of the original token.
+        #
+        @access_token = server_config.access_token_model.create_for(
+          application: refresh_token.application,
+          resource_owner: resource_owner,
+          scopes: scopes,
+          expires_in: refresh_token.expires_in,
+          use_refresh_token: true,
+          **attributes,
+        )
       end
 
       def validate_token_presence
-        refresh_token.present? || @refresh_token_parameter.present?
+        @missing_param = :refresh_token if refresh_token.blank? && @refresh_token_parameter.blank?
+
+        @missing_param.nil?
       end
 
       def validate_token
@@ -76,16 +96,25 @@ module Doorkeeper
       end
 
       def validate_client
-        !credentials || !!client
+        return true if credentials.blank?
+
+        client.present?
       end
 
+      # @see https://datatracker.ietf.org/doc/html/rfc6749#section-1.5
+      #
       def validate_client_match
-        !client || refresh_token.application_id == client.id
+        return true if refresh_token.application_id.blank?
+
+        client && refresh_token.application_id == client.id
       end
 
       def validate_scope
         if @original_scopes.present?
-          ScopeChecker.valid?(@original_scopes, refresh_token.scopes)
+          ScopeChecker.valid?(
+            scope_str: @original_scopes,
+            server_scopes: refresh_token.scopes,
+          )
         else
           true
         end

data/lib/doorkeeper/oauth/scopes.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class Scopes
@@ -5,7 +7,7 @@ module Doorkeeper
       include Comparable
 
       def self.from_string(string)
-        string ||= ''
+        string ||= ""
         new.tap do |scope|
           scope.add(*string.split)
         end
@@ -37,28 +39,40 @@ module Doorkeeper
       end
 
       def to_s
-        @scopes.join(' ')
+        @scopes.join(" ")
       end
 
-      def has_scopes?(scopes)
-        scopes.all? { |s| exists?(s) }
+      def scopes?(scopes)
+        scopes.all? { |scope| exists?(scope) }
       end
 
+      alias has_scopes? scopes?
+
       def +(other)
-        if other.is_a? Scopes
-          self.class.from_array(all + other.all)
-        else
-          super(other)
-        end
+        self.class.from_array(all + to_array(other))
       end
 
       def <=>(other)
-        map(&:to_s).sort <=> other.map(&:to_s).sort
+        if other.respond_to?(:map)
+          map(&:to_s).sort <=> other.map(&:to_s).sort
+        else
+          super
+        end
       end
 
       def &(other)
-        other_array = other.present? ? other.all : []
-        self.class.from_array(all & other_array)
+        self.class.from_array(all & to_array(other))
+      end
+
+      private
+
+      def to_array(other)
+        case other
+        when Scopes
+          other.all
+        else
+          other.to_a
+        end
       end
     end
   end

data/lib/doorkeeper/oauth/token.rb

@@ -1,19 +1,23 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class Token
       class << self
         def from_request(request, *methods)
-          methods.inject(nil) do |credentials, method|
+          methods.inject(nil) do |_, method|
             method = self.method(method) if method.is_a?(Symbol)
             credentials = method.call(request)
-            break credentials unless credentials.blank?
+            break credentials if credentials.present?
           end
         end
 
         def authenticate(request, *methods)
-          if token = from_request(request, *methods)
-            access_token = AccessToken.by_token(token)
-            access_token.revoke_previous_refresh_token! if access_token
+          if (token = from_request(request, *methods))
+            access_token = Doorkeeper.config.access_token_model.by_token(token)
+            if access_token.present? && Doorkeeper.config.refresh_token_enabled?
+              access_token.revoke_previous_refresh_token!
+            end
             access_token
           end
         end
@@ -28,13 +32,13 @@ module Doorkeeper
 
         def from_bearer_authorization(request)
           pattern = /^Bearer /i
-          header  = request.authorization
+          header = request.authorization
           token_from_header(header, pattern) if match?(header, pattern)
         end
 
         def from_basic_authorization(request)
           pattern = /^Basic /i
-          header  = request.authorization
+          header = request.authorization
           token_from_basic_header(header, pattern) if match?(header, pattern)
         end
 
@@ -50,11 +54,11 @@ module Doorkeeper
         end
 
         def token_from_header(header, pattern)
-          header.gsub pattern, ''
+          header.gsub(pattern, "")
         end
 
         def match?(header, pattern)
-          header && header.match(pattern)
+          header&.match(pattern)
         end
       end
     end

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    # RFC7662 OAuth 2.0 Token Introspection
+    #
+    # @see https://datatracker.ietf.org/doc/html/rfc7662
+    class TokenIntrospection
+      def initialize(server, token)
+        @server = server
+        @token = token
+
+        authorize!
+      end
+
+      def authorized?
+        @error.blank?
+      end
+
+      def error_response
+        return if @error.blank?
+
+        if @error == :invalid_token
+          OAuth::InvalidTokenResponse.from_access_token(authorized_token)
+        elsif @error == :invalid_request
+          OAuth::InvalidRequestResponse.from_request(self)
+        else
+          OAuth::ErrorResponse.new(name: @error)
+        end
+      end
+
+      def to_json(*)
+        active? ? success_response : failure_response
+      end
+
+      private
+
+      attr_reader :server, :token
+      attr_reader :error, :invalid_request_reason
+
+      # If the protected resource uses OAuth 2.0 client credentials to
+      # authenticate to the introspection endpoint and its credentials are
+      # invalid, the authorization server responds with an HTTP 401
+      # (Unauthorized) as described in Section 5.2 of OAuth 2.0 [RFC6749].
+      #
+      # Endpoint must first validate the authentication.
+      # If the authentication is invalid, the endpoint should respond with
+      # an HTTP 401 status code and an invalid_client response.
+      #
+      # @see https://www.oauth.com/oauth2-servers/token-introspection-endpoint/
+      #
+      # To prevent token scanning attacks, the endpoint MUST also require
+      # some form of authorization to access this endpoint, such as client
+      # authentication as described in OAuth 2.0 [RFC6749] or a separate
+      # OAuth 2.0 access token such as the bearer token described in OAuth
+      # 2.0 Bearer Token Usage [RFC6750].
+      #
+      def authorize!
+        # Requested client authorization
+        if server.credentials
+          @error = :invalid_client unless authorized_client
+        elsif authorized_token
+          # Requested bearer token authorization
+          #
+          #  If the protected resource uses an OAuth 2.0 bearer token to authorize
+          #  its call to the introspection endpoint and the token used for
+          #  authorization does not contain sufficient privileges or is otherwise
+          #  invalid for this request, the authorization server responds with an
+          #  HTTP 401 code as described in Section 3 of OAuth 2.0 Bearer Token
+          #  Usage [RFC6750].
+          #
+          @error = :invalid_token unless valid_authorized_token?
+        else
+          @error = :invalid_request
+          @invalid_request_reason = :request_not_authorized
+        end
+      end
+
+      # Client Authentication
+      def authorized_client
+        @authorized_client ||= server.credentials && server.client
+      end
+
+      # Bearer Token Authentication
+      def authorized_token
+        @authorized_token ||= Doorkeeper.authenticate(server.context.request)
+      end
+
+      # 2.2. Introspection Response
+      def success_response
+        customize_response(
+          active: true,
+          scope: @token.scopes_string,
+          client_id: @token.try(:application).try(:uid),
+          token_type: @token.token_type,
+          exp: @token.expires_at.to_i,
+          iat: @token.created_at.to_i,
+        )
+      end
+
+      # If the introspection call is properly authorized but the token is not
+      # active, does not exist on this server, or the protected resource is
+      # not allowed to introspect this particular token, then the
+      # authorization server MUST return an introspection response with the
+      # "active" field set to "false".  Note that to avoid disclosing too
+      # much of the authorization server's state to a third party, the
+      # authorization server SHOULD NOT include any additional information
+      # about an inactive token, including why the token is inactive.
+      #
+      # @see https://datatracker.ietf.org/doc/html/rfc7662 2.2. Introspection Response
+      #
+      def failure_response
+        {
+          active: false,
+        }
+      end
+
+      # Boolean indicator of whether or not the presented token
+      # is currently active.  The specifics of a token's "active" state
+      # will vary depending on the implementation of the authorization
+      # server and the information it keeps about its tokens, but a "true"
+      # value return for the "active" property will generally indicate
+      # that a given token has been issued by this authorization server,
+      # has not been revoked by the resource owner, and is within its
+      # given time window of validity (e.g., after its issuance time and
+      # before its expiration time).
+      #
+      # Any other error is considered an "inactive" token.
+      #
+      # * The token requested does not exist or is invalid
+      # * The token expired
+      # * The token was issued to a different client than is making this request
+      #
+      # Since resource servers using token introspection rely on the
+      # authorization server to determine the state of a token, the
+      # authorization server MUST perform all applicable checks against a
+      # token's state.  For instance, these tests include the following:
+      #
+      #    o  If the token can expire, the authorization server MUST determine
+      #       whether or not the token has expired.
+      #    o  If the token can be issued before it is able to be used, the
+      #       authorization server MUST determine whether or not a token's valid
+      #       period has started yet.
+      #    o  If the token can be revoked after it was issued, the authorization
+      #       server MUST determine whether or not such a revocation has taken
+      #       place.
+      #    o  If the token has been signed, the authorization server MUST
+      #       validate the signature.
+      #    o  If the token can be used only at certain resource servers, the
+      #       authorization server MUST determine whether or not the token can
+      #       be used at the resource server making the introspection call.
+      #
+      def active?
+        if authorized_client
+          valid_token? && token_introspection_allowed?(auth_client: authorized_client.application)
+        else
+          valid_token?
+        end
+      end
+
+      # Token can be valid only if it is not expired or revoked.
+      def valid_token?
+        @token&.accessible?
+      end
+
+      def valid_authorized_token?
+        !authorized_token_matches_introspected? &&
+          authorized_token.accessible? &&
+          token_introspection_allowed?(auth_token: authorized_token)
+      end
+
+      # RFC7662 Section 2.1
+      def authorized_token_matches_introspected?
+        authorized_token.token == @token&.token
+      end
+
+      # Config constraints for introspection in Doorkeeper.config.allow_token_introspection
+      def token_introspection_allowed?(auth_client: nil, auth_token: nil)
+        allow_introspection = Doorkeeper.config.allow_token_introspection
+        return allow_introspection unless allow_introspection.respond_to?(:call)
+
+        allow_introspection.call(@token, auth_client, auth_token)
+      end
+
+      # Allows to customize introspection response.
+      # Provides context (controller) and token for generating developer-specific
+      # response.
+      #
+      # @see https://datatracker.ietf.org/doc/html/rfc7662#section-2.2
+      #
+      def customize_response(response)
+        customized_response = Doorkeeper.config.custom_introspection_response.call(
+          token,
+          server.context,
+        )
+        return response if customized_response.blank?
+
+        response.merge(customized_response)
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/token_request.rb

@@ -1,36 +1,24 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenRequest
-      attr_accessor :pre_auth, :resource_owner
+      attr_reader :pre_auth, :resource_owner
 
       def initialize(pre_auth, resource_owner)
-        @pre_auth       = pre_auth
+        @pre_auth = pre_auth
         @resource_owner = resource_owner
       end
 
       def authorize
-        if pre_auth.authorizable?
-          auth = Authorization::Token.new(pre_auth, resource_owner)
-          auth.issue_token
-          @response = CodeResponse.new pre_auth,
-                                       auth,
-                                       response_on_fragment: true
-        else
-          @response = error_response
-        end
+        auth = Authorization::Token.new(pre_auth, resource_owner)
+        auth.issue_token!
+        CodeResponse.new(pre_auth, auth, response_on_fragment: true)
       end
 
       def deny
         pre_auth.error = :access_denied
-        error_response
-      end
-
-      private
-
-      def error_response
-        ErrorResponse.from_request pre_auth,
-                                   redirect_uri: pre_auth.redirect_uri,
-                                   response_on_fragment: true
+        pre_auth.error_response
       end
     end
   end

data/lib/doorkeeper/oauth/token_response.rb

@@ -1,7 +1,9 @@
+# frozen_string_literal: true
+
 module Doorkeeper
   module OAuth
     class TokenResponse
-      attr_accessor :token
+      attr_reader :token
 
       def initialize(token)
         @token = token
@@ -9,12 +11,12 @@ module Doorkeeper
 
       def body
         {
-          'access_token'  => token.token,
-          'token_type'    => token.token_type,
-          'expires_in'    => token.expires_in_seconds,
-          'refresh_token' => token.refresh_token,
-          'scope'         => token.scopes_string,
-          'created_at'    => token.created_at.to_i
+          "access_token" => token.plaintext_token,
+          "token_type" => token.token_type,
+          "expires_in" => token.expires_in_seconds,
+          "refresh_token" => token.plaintext_refresh_token,
+          "scope" => token.scopes_string,
+          "created_at" => token.created_at.to_i,
         }.reject { |_, value| value.blank? }
       end
 
@@ -23,9 +25,11 @@ module Doorkeeper
       end
 
       def headers
-        { 'Cache-Control' => 'no-store',
-          'Pragma' => 'no-cache',
-          'Content-Type' => 'application/json; charset=utf-8' }
+        {
+          "Cache-Control" => "no-store",
+          "Pragma" => "no-cache",
+          "Content-Type" => "application/json; charset=utf-8",
+        }
       end
     end
   end

data/lib/doorkeeper/oauth.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    GRANT_TYPES = [
+      AUTHORIZATION_CODE = "authorization_code",
+      IMPLICIT = "implicit",
+      PASSWORD = "password",
+      CLIENT_CREDENTIALS = "client_credentials",
+      REFRESH_TOKEN = "refresh_token",
+    ].freeze
+  end
+end

data/lib/doorkeeper/orm/active_record/access_grant.rb

@@ -1,7 +1,9 @@
-module Doorkeeper
-  class AccessGrant < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_access_grants#{table_name_suffix}".to_sym
+# frozen_string_literal: true
+
+require "doorkeeper/orm/active_record/mixins/access_grant"
 
-    include AccessGrantMixin
+module Doorkeeper
+  class AccessGrant < ::ActiveRecord::Base
+    include Doorkeeper::Orm::ActiveRecord::Mixins::AccessGrant
   end
 end

data/lib/doorkeeper/orm/active_record/access_token.rb

@@ -1,46 +1,9 @@
-module Doorkeeper
-  class AccessToken < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_access_tokens#{table_name_suffix}".to_sym
-
-    include AccessTokenMixin
-
-    # Deletes all the Access Tokens created for the specific
-    # Application and Resource Owner.
-    #
-    # @param application_id [Integer] Application ID
-    # @param resource_owner [ActiveRecord::Base] Resource Owner model instance
-    #
-    def self.delete_all_for(application_id, resource_owner)
-      where(application_id: application_id,
-            resource_owner_id: resource_owner.id).delete_all
-    end
-    private_class_method :delete_all_for
+# frozen_string_literal: true
 
-    # Searches for not revoked Access Tokens associated with the
-    # specific Resource Owner.
-    #
-    # @param resource_owner [ActiveRecord::Base]
-    #   Resource Owner model instance
-    #
-    # @return [ActiveRecord::Relation]
-    #   active Access Tokens for Resource Owner
-    #
-    def self.active_for(resource_owner)
-      where(resource_owner_id: resource_owner.id, revoked_at: nil)
-    end
+require "doorkeeper/orm/active_record/mixins/access_token"
 
-    # ORM-specific order method.
-    def self.order_method
-      :order
-    end
-
-    def self.refresh_token_revoked_on_use?
-      column_names.include?('previous_refresh_token')
-    end
-
-    # ORM-specific DESC order for `:created_at` column.
-    def self.created_at_desc
-      'created_at desc'
-    end
+module Doorkeeper
+  class AccessToken < ::ActiveRecord::Base
+    include Doorkeeper::Orm::ActiveRecord::Mixins::AccessToken
   end
 end

data/lib/doorkeeper/orm/active_record/application.rb

@@ -1,24 +1,10 @@
-module Doorkeeper
-  class Application < ActiveRecord::Base
-    self.table_name = "#{table_name_prefix}oauth_applications#{table_name_suffix}".to_sym
-
-    include ApplicationMixin
+# frozen_string_literal: true
 
-    has_many :authorized_tokens, -> { where(revoked_at: nil) }, class_name: 'AccessToken'
-    has_many :authorized_applications, through: :authorized_tokens, source: :application
+require "doorkeeper/orm/active_record/redirect_uri_validator"
+require "doorkeeper/orm/active_record/mixins/application"
 
-    # Returns Applications associated with active (not revoked) Access Tokens
-    # that are owned by the specific Resource Owner.
-    #
-    # @param resource_owner [ActiveRecord::Base]
-    #   Resource Owner model instance
-    #
-    # @return [ActiveRecord::Relation]
-    #   Applications authorized for the Resource Owner
-    #
-    def self.authorized_for(resource_owner)
-      resource_access_tokens = AccessToken.active_for(resource_owner)
-      where(id: resource_access_tokens.select(:application_id).distinct)
-    end
+module Doorkeeper
+  class Application < ::ActiveRecord::Base
+    include ::Doorkeeper::Orm::ActiveRecord::Mixins::Application
   end
 end