doorkeeper 5.9.5 → 6.0.0.beta1

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -1,71 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  module OAuth
-    class Client
-      Credentials = Struct.new(:uid, :secret) do
-        class << self
-          # Extracts the client credentials from the request using the
-          # configured extraction methods. The first method that yields
-          # credentials wins, as it always has.
-          #
-          # Raises Errors::MultipleClientAuthMethods when the request
-          # authenticates the client with more than one method, which RFC 6749
-          # §2.3 forbids ("The client MUST NOT use more than one authentication
-          # method in each request").
-          def from_request(request, *credentials_methods)
-            # Callable extractors are opaque: they may legitimately overlap the
-            # built-in methods they are configured with, and evaluating all of
-            # them would also break the existing contract that the extractors
-            # after the matching one are not called. Such configurations keep
-            # the historical behaviour untouched.
-            return first_from_request(request, credentials_methods) unless credentials_methods.all?(Symbol)
-
-            credentials = credentials_methods.filter_map { |method| extract(request, method) }
-
-            # Only credentials carrying a secret authenticate the client. A bare
-            # uid is a public client identifying itself (RFC 6749 §2.3 "none"),
-            # not an authentication method of its own, so it doesn't count
-            # towards the single-method rule — RFC 7521 §4.2, for example,
-            # explicitly allows a client_id next to another authentication
-            # method.
-            raise Errors::MultipleClientAuthMethods if credentials.count { |c| c.secret.present? } > 1
-
-            credentials.first
-          end
-
-          def from_params(request)
-            request.parameters.values_at(:client_id, :client_secret)
-          end
-
-          def from_basic(request)
-            authorization = request.authorization
-            if authorization.present? && authorization =~ /^Basic (.*)/im
-              Base64.decode64(Regexp.last_match(1)).split(/:/, 2)
-            end
-          end
-
-          private
-
-          def first_from_request(request, credentials_methods)
-            credentials_methods.inject(nil) do |_, method|
-              credentials = extract(request, method)
-              break credentials if credentials
-            end
-          end
-
-          # Returns the credentials the given method extracts from the request,
-          # or nil when it extracts none.
-          def extract(request, method)
-            method = self.method(method) if method.is_a?(Symbol)
-            Credentials.new(*method.call(request)).presence
-          end
-        end
-
-        # Public clients may have their secret blank, but "credentials" are
-        # still present
-        delegate :blank?, to: :uid
-      end
-    end
-  end
-end

data/lib/doorkeeper/oauth/stateless_token.rb

@@ -1,139 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  module OAuth
-    # In-memory representation of a verified JWT access token. Returned by
-    # OAuth::Token.authenticate when stateless_jwt_tokens is enabled, so that
-    # the existing doorkeeper_token / doorkeeper_authorize! helpers work
-    # without any database read.
-    #
-    # Stateless tokens cannot be revoked or refreshed server-side: #revoked?
-    # is always false and #revoke is a no-op. Rely on short token lifetimes
-    # (access_token_expires_in) for early invalidation.
-    class StatelessToken
-      attr_reader :claims, :application, :raw_token
-
-      def initialize(claims:, application: nil, raw_token: nil)
-        @claims = claims
-        @application = application
-        @raw_token = raw_token
-      end
-
-      def token_type
-        "Bearer"
-      end
-
-      # The raw token string. Used by introspection's
-      # authorized_token_matches_introspected? security check.
-      def token
-        @raw_token
-      end
-
-      # Issuance path: the freshly-signed JWT returned to the client.
-      def plaintext_token
-        @raw_token
-      end
-
-      def plaintext_refresh_token
-        nil
-      end
-
-      def resource_owner_id
-        claims["resource_owner_id"] || claims["sub"]
-      end
-
-      def application_id
-        application&.id
-      end
-
-      def scopes_string
-        claims["scope"].to_s
-      end
-
-      def scopes
-        OAuth::Scopes.from_string(scopes_string)
-      end
-
-      def includes_scope?(*required_scopes)
-        required_scopes.blank? || required_scopes.any? { |scope| scopes.exists?(scope.to_s) }
-      end
-
-      def custom_attributes
-        claims.slice(*Doorkeeper.config.custom_access_token_attributes.map(&:to_s))
-      end
-
-      # RFC 8707 resource indicator. Stored as a space-delimited string to
-      # match the AccessToken column shape consumed by token_introspection.
-      def resource
-        aud = claims["aud"]
-        return nil if aud.blank?
-
-        aud.is_a?(Array) ? aud.join(" ") : aud.to_s
-      end
-
-      def created_at
-        Time.at(claims["iat"].to_i).utc
-      end
-
-      def expires_in
-        claims["expires_in"]
-      end
-
-      def expires_at
-        return nil unless claims["exp"]
-
-        Time.at(claims["exp"].to_i).utc
-      end
-
-      def expires_in_seconds
-        return nil unless expires_at
-
-        expires = expires_at - Time.now.utc
-        sec = expires.seconds.round(0)
-        sec > 0 ? sec : 0
-      end
-
-      def expired?
-        return false unless expires_at
-
-        Time.now.utc > expires_at
-      end
-
-      def revoked?
-        false
-      end
-
-      def accessible?
-        !expired? && !revoked?
-      end
-
-      def acceptable?(required_scopes)
-        accessible? && includes_scope?(*required_scopes)
-      end
-
-      def revoke_previous_refresh_token!
-        # no-op: stateless tokens carry no refresh-token chain to revoke.
-      end
-
-      def revoke
-        # no-op: stateless tokens cannot be revoked server-side.
-      end
-
-      def revocable?
-        false
-      end
-
-      def as_json(_options = {})
-        {
-          resource_owner_id: resource_owner_id,
-          scope: scopes,
-          expires_in: expires_in_seconds,
-          application: { uid: application.try(:uid) },
-          created_at: created_at.to_i,
-        }.tap do |json|
-          json[:resource_owner_type] = claims["resource_owner_type"] if Doorkeeper.configuration.polymorphic_resource_owner?
-        end
-      end
-    end
-  end
-end