doorkeeper 5.4.0.rc1 → 5.5.0

data/lib/doorkeeper/grant_flow/registry.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module GrantFlow
+    module Registry
+      mattr_accessor :flows
+      self.flows = {}
+
+      mattr_accessor :aliases
+      self.aliases = {}
+
+      # Allows to register custom OAuth grant flow so that Doorkeeper
+      # could recognize and process it.
+      #
+      def register(name_or_flow, **options)
+        unless name_or_flow.is_a?(Doorkeeper::GrantFlow::Flow)
+          name_or_flow = Flow.new(name_or_flow, **options)
+        end
+
+        flow_key = name_or_flow.name.to_sym
+
+        if flows.key?(flow_key)
+          ::Kernel.warn <<~WARNING
+            [DOORKEEPER] '#{flow_key}' grant flow already registered and will be overridden
+            in #{caller(1..1).first}
+          WARNING
+        end
+
+        flows[flow_key] = name_or_flow
+      end
+
+      # Allows to register aliases that could be used in `grant_flows`
+      # configuration option. It is possible to have aliases like 1:1 or
+      # 1:N, i.e. "implicit_oidc" => ['token', 'id_token', 'id_token token'].
+      #
+      def register_alias(alias_name, **options)
+        aliases[alias_name.to_sym] = Array.wrap(options.fetch(:as))
+      end
+
+      def expand_alias(alias_name)
+        aliases.fetch(alias_name.to_sym, [])
+      end
+
+      # [NOTE]: make it to use #fetch after removing fallbacks
+      def get(name)
+        flows[name.to_sym]
+      end
+    end
+  end
+end

data/lib/doorkeeper/helpers/controller.rb

@@ -16,6 +16,8 @@ module Doorkeeper
 
       # :doc:
       def current_resource_owner
+        return @current_resource_owner if defined?(@current_resource_owner)
+
         @current_resource_owner ||= begin
           instance_eval(&Doorkeeper.config.authenticate_resource_owner)
         end
@@ -36,7 +38,9 @@ module Doorkeeper
 
       # :doc:
       def doorkeeper_token
-        @doorkeeper_token ||= OAuth::Token.authenticate request, *config_methods
+        return @doorkeeper_token if defined?(@doorkeeper_token)
+
+        @doorkeeper_token ||= OAuth::Token.authenticate(request, *config_methods)
       end
 
       def config_methods
@@ -58,10 +62,10 @@ module Doorkeeper
       end
 
       def handle_token_exception(exception)
-        error = get_error_response_from_exception exception
-        headers.merge! error.headers
+        error = get_error_response_from_exception(exception)
+        headers.merge!(error.headers)
         self.response_body = error.body.to_json
-        self.status        = error.status
+        self.status = error.status
       end
 
       def skip_authorization?

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -13,7 +13,7 @@ module Doorkeeper
     include Models::Scopes
     include Models::ResourceOwnerable
 
-    # never uses pkce, if pkce migrations were not generated
+    # Never uses PKCE if PKCE migrations were not generated
     def uses_pkce?
       self.class.pkce_supported? && code_challenge.present?
     end
@@ -24,8 +24,8 @@ module Doorkeeper
       #
       # @param token [#to_s] token value (any object that responds to `#to_s`)
       #
-      # @return [Doorkeeper::AccessGrant, nil] AccessGrant object or nil
-      #   if there is no record with such token
+      # @return [Doorkeeper::AccessGrant, nil]
+      #   AccessGrant object or nil if there is no record with such token
       #
       def by_token(token)
         find_by_plaintext_token(:token, token)
@@ -36,8 +36,8 @@ module Doorkeeper
       #
       # @param application_id [Integer]
       #   ID of the Application
-      # @param resource_owner [ActiveRecord::Base]
-      #   instance of the Resource Owner model
+      # @param resource_owner [ActiveRecord::Base, Integer]
+      #   instance of the Resource Owner model or it's ID
       #
       def revoke_all_for(application_id, resource_owner, clock = Time)
         by_resource_owner(resource_owner)
@@ -89,8 +89,7 @@ module Doorkeeper
       # suitable for PKCE validation
       #
       def generate_code_challenge(code_verifier)
-        padded_result = Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier))
-        padded_result.split("=")[0] # Remove any trailing '='
+        Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
       end
 
       def pkce_supported?
@@ -100,6 +99,9 @@ module Doorkeeper
       ##
       # Determines the secret storing transformer
       # Unless configured otherwise, uses the plain secret strategy
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
       def secret_strategy
         ::Doorkeeper.config.token_secret_strategy
       end
@@ -107,6 +109,9 @@ module Doorkeeper
       ##
       # Determine the fallback storing strategy
       # Unless configured, there will be no fallback
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
       def fallback_secret_strategy
         ::Doorkeeper.config.token_secret_fallback_strategy
       end

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -61,8 +61,8 @@ module Doorkeeper
       #
       # @param application_id [Integer]
       #   ID of the Application
-      # @param resource_owner [ActiveRecord::Base]
-      #   instance of the Resource Owner model
+      # @param resource_owner [ActiveRecord::Base, Integer]
+      #   instance of the Resource Owner model or it's ID
       #
       def revoke_all_for(application_id, resource_owner, clock = Time)
         by_resource_owner(resource_owner)
@@ -94,8 +94,8 @@ module Doorkeeper
       # Interface to enumerate access token records in batches in order not
       # to bloat the memory. Could be overloaded in any ORM extension.
       #
-      def find_access_token_in_batches(relation, *args, &block)
-        relation.find_in_batches(*args, &block)
+      def find_access_token_in_batches(relation, **args, &block)
+        relation.find_in_batches(**args, &block)
       end
 
       # Enumerates AccessToken records in batches to find a matching token.
@@ -230,10 +230,11 @@ module Doorkeeper
       #
       # @param application_id [Integer]
       #   ID of the Application model instance
-      # @param resource_owner [Integer]
-      #   ID of the Resource Owner model instance
+      # @param resource_owner [ActiveRecord::Base, Integer]
+      #   Resource Owner model instance or it's ID
       #
-      # @return [Doorkeeper::AccessToken] array of matching AccessToken objects
+      # @return [ActiveRecord::Relation]
+      #   collection of matching AccessToken objects
       #
       def authorized_tokens_for(application_id, resource_owner)
         by_resource_owner(resource_owner).where(
@@ -262,6 +263,9 @@ module Doorkeeper
       ##
       # Determines the secret storing transformer
       # Unless configured otherwise, uses the plain secret strategy
+      #
+      # @return [Doorkeeper::SecretStoring::Base]
+      #
       def secret_strategy
         ::Doorkeeper.config.token_secret_strategy
       end
@@ -373,7 +377,7 @@ module Doorkeeper
       return unless self.class.refresh_token_revoked_on_use?
 
       old_refresh_token&.revoke
-      update_column(:previous_refresh_token, "")
+      update_attribute(:previous_refresh_token, "") if previous_refresh_token.present?
     end
 
     private

data/lib/doorkeeper/models/application_mixin.rb

@@ -20,8 +20,8 @@ module Doorkeeper
       # @param uid [#to_s] UID (any object that responds to `#to_s`)
       # @param secret [#to_s] secret (any object that responds to `#to_s`)
       #
-      # @return [Doorkeeper::Application, nil] Application instance or nil
-      #   if there is no record with such credentials
+      # @return [Doorkeeper::Application, nil]
+      #   Application instance or nil if there is no record with such credentials
       #
       def by_uid_and_secret(uid, secret)
         app = by_uid(uid)
@@ -60,9 +60,10 @@ module Doorkeeper
 
     # Set an application's valid redirect URIs.
     #
-    # @param uris [String, Array] Newline-separated string or array the URI(s)
+    # @param uris [String, Array<String>] Newline-separated string or array the URI(s)
+    #
+    # @return [String] The redirect URI(s) separated by newlines.
     #
-    # @return [String] The redirect URI(s) seperated by newlines.
     def redirect_uri=(uris)
       super(uris.is_a?(Array) ? uris.join("\n") : uris)
     end

data/lib/doorkeeper/models/concerns/revocable.rb

@@ -9,7 +9,7 @@ module Doorkeeper
       # @param clock [Time] time object
       #
       def revoke(clock = Time)
-        update_column(:revoked_at, clock.now.utc)
+        update_attribute(:revoked_at, clock.now.utc)
       end
 
       # Indicates whether the object has been revoked.

data/lib/doorkeeper/oauth/authorization/code.rb

@@ -11,7 +11,7 @@ module Doorkeeper
           @resource_owner = resource_owner
         end
 
-        def issue_token
+        def issue_token!
           return @token if defined?(@token)
 
           @token = Doorkeeper.config.access_grant_model.create!(access_grant_attributes)
@@ -21,6 +21,10 @@ module Doorkeeper
           { action: :show, code: token.plaintext_token }
         end
 
+        def access_grant?
+          true
+        end
+
         private
 
         def authorization_code_expires_in

data/lib/doorkeeper/oauth/authorization/context.rb

@@ -4,12 +4,12 @@ module Doorkeeper
   module OAuth
     module Authorization
       class Context
-        attr_reader :client, :grant_type, :scopes
+        attr_reader :client, :grant_type, :resource_owner, :scopes
 
-        def initialize(client, grant_type, scopes)
-          @client = client
-          @grant_type = grant_type
-          @scopes = scopes
+        def initialize(**attributes)
+          attributes.each do |name, value|
+            instance_variable_set(:"@#{name}", value) if respond_to?(name)
+          end
         end
       end
     end

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -7,7 +7,7 @@ module Doorkeeper
         attr_reader :pre_auth, :resource_owner, :token
 
         class << self
-          def build_context(pre_auth_or_oauth_client, grant_type, scopes)
+          def build_context(pre_auth_or_oauth_client, grant_type, scopes, resource_owner)
             oauth_client = if pre_auth_or_oauth_client.respond_to?(:application)
                              pre_auth_or_oauth_client.application
                            elsif pre_auth_or_oauth_client.respond_to?(:client)
@@ -17,9 +17,10 @@ module Doorkeeper
                            end
 
             Doorkeeper::OAuth::Authorization::Context.new(
-              oauth_client,
-              grant_type,
-              scopes,
+              client: oauth_client,
+              grant_type: grant_type,
+              scopes: scopes,
+              resource_owner: resource_owner,
             )
           end
 
@@ -48,13 +49,14 @@ module Doorkeeper
           @resource_owner = resource_owner
         end
 
-        def issue_token
+        def issue_token!
           return @token if defined?(@token)
 
           context = self.class.build_context(
             pre_auth.client,
             Doorkeeper::OAuth::IMPLICIT,
             pre_auth.scopes,
+            resource_owner,
           )
 
           @token = Doorkeeper.config.access_token_model.find_or_create_for(
@@ -74,6 +76,10 @@ module Doorkeeper
           }
         end
 
+        def access_token?
+          true
+        end
+
         private
 
         def controller

data/lib/doorkeeper/oauth/authorization/uri_builder.rb

@@ -23,7 +23,7 @@ module Doorkeeper
           private
 
           def build_query(parameters = {})
-            parameters = parameters.reject { |_, value| value.blank? }
+            parameters.reject! { |_, value| value.blank? }
             Rack::Utils.build_query(parameters)
           end
         end

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -3,7 +3,6 @@
 module Doorkeeper
   module OAuth
     class AuthorizationCodeRequest < BaseRequest
-      validate :pkce_support, error: :invalid_request
       validate :params,       error: :invalid_request
       validate :client,       error: :invalid_client
       validate :grant,        error: :invalid_grant
@@ -32,12 +31,6 @@ module Doorkeeper
 
           grant.revoke
 
-          resource_owner = if Doorkeeper.config.polymorphic_resource_owner?
-                             grant.resource_owner
-                           else
-                             grant.resource_owner_id
-                           end
-
           find_or_create_access_token(
             grant.application,
             resource_owner,
@@ -49,16 +42,16 @@ module Doorkeeper
         super
       end
 
-      def pkce_supported?
-        Doorkeeper.config.access_grant_model.pkce_supported?
+      def resource_owner
+        if Doorkeeper.config.polymorphic_resource_owner?
+          grant.resource_owner
+        else
+          grant.resource_owner_id
+        end
       end
 
-      def validate_pkce_support
-        @invalid_request_reason = :not_support_pkce if grant &&
-                                                       !pkce_supported? &&
-                                                       code_verifier.present?
-
-        @invalid_request_reason.nil?
+      def pkce_supported?
+        Doorkeeper.config.access_grant_model.pkce_supported?
       end
 
       def validate_params
@@ -91,8 +84,8 @@ module Doorkeeper
       # if either side (server or client) request PKCE, check the verifier
       # against the DB - if PKCE is supported
       def validate_code_verifier
-        return true unless grant.uses_pkce? || code_verifier
-        return false unless pkce_supported?
+        return true unless pkce_supported?
+        return grant.code_challenge.blank? if code_verifier.blank?
 
         if grant.code_challenge_method == "S256"
           grant.code_challenge == generate_code_challenge(code_verifier)

data/lib/doorkeeper/oauth/base_request.rb

@@ -27,7 +27,7 @@ module Doorkeeper
       end
 
       def find_or_create_access_token(client, resource_owner, scopes, server)
-        context = Authorization::Token.build_context(client, grant_type, scopes)
+        context = Authorization::Token.build_context(client, grant_type, scopes, resource_owner)
         @access_token = server_config.access_token_model.find_or_create_for(
           application: client,
           resource_owner: resource_owner,

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -25,7 +25,7 @@ module Doorkeeper
         private
 
         def with_revocation(existing_token:)
-          if existing_token && server_config.revoke_previous_client_credentials_token
+          if existing_token && server_config.revoke_previous_client_credentials_token?
             existing_token.with_lock do
               raise Errors::DoorkeeperError, :invalid_token_reuse if existing_token.revoked?
 
@@ -39,7 +39,8 @@ module Doorkeeper
         end
 
         def lookup_existing_token?
-          server_config.reuse_access_token || server_config.revoke_previous_client_credentials_token
+          server_config.reuse_access_token ||
+            server_config.revoke_previous_client_credentials_token?
         end
 
         def find_existing_token_for(client, scopes)

data/lib/doorkeeper/oauth/client_credentials/issuer.rb

@@ -30,6 +30,7 @@ module Doorkeeper
             client,
             Doorkeeper::OAuth::CLIENT_CREDENTIALS,
             scopes,
+            nil,
           )
           ttl = Authorization::Token.access_token_expires_in(@server, context)
 

data/lib/doorkeeper/oauth/client_credentials/validator.rb

@@ -26,9 +26,11 @@ module Doorkeeper
         end
 
         def validate_client_supports_grant_flow
+          return if @client.blank?
+
           Doorkeeper.config.allow_grant_flow_for_client?(
             Doorkeeper::OAuth::CLIENT_CREDENTIALS,
-            @client,
+            @client.application,
           )
         end
 

data/lib/doorkeeper/oauth/code_request.rb

@@ -6,13 +6,13 @@ module Doorkeeper
       attr_reader :pre_auth, :resource_owner
 
       def initialize(pre_auth, resource_owner)
-        @pre_auth       = pre_auth
+        @pre_auth = pre_auth
         @resource_owner = resource_owner
       end
 
       def authorize
         auth = Authorization::Code.new(pre_auth, resource_owner)
-        auth.issue_token
+        auth.issue_token!
         CodeResponse.new(pre_auth, auth)
       end