doorkeeper 5.9.5 → 6.0.0.beta2

data/lib/doorkeeper/config.rb

@@ -65,13 +65,50 @@ module Doorkeeper
       end
 
       # Change the way client credentials are retrieved from the request object.
-      # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
-      # falls back to the `:client_id` and `:client_secret` params from the
-      # `params` object.
+      #
+      # @deprecated Use the +client_authentication+ option instead. The legacy
+      #   +:from_basic+ / +:from_params+ methods are automatically converted to
+      #   the +:client_secret_basic+ / +:client_secret_post+ authentication
+      #   methods. +:none+ (public client support) is appended only when
+      #   +:from_params+ was configured, since that is the only legacy method
+      #   that accepted a bare +client_id+ without a secret — +:from_basic+ on
+      #   its own never did, so it is not broadened. Callable extractors are
+      #   wrapped in a legacy adapter so they keep working during the
+      #   deprecation window.
       #
       # @param methods [Array] Define client credentials
       def client_credentials(*methods)
-        @config.instance_variable_set(:@client_credentials_methods, methods)
+        deprecated(
+          "client_credentials",
+          "Use the client_authentication option instead. Automatically converting to client_authentication",
+        )
+
+        client_authentication = Doorkeeper::ClientAuthentication.from_legacy_client_credentials(methods)
+
+        if client_authentication.empty?
+          Kernel.warn(
+            "[DOORKEEPER] No known client_credentials method detected, " \
+            "cannot automatically convert to client_authentication option",
+          )
+        else
+          @config.instance_variable_set(:@client_credentials_methods, client_authentication)
+        end
+      end
+
+      # Declare which client authentication methods (RFC 6749 §2.3) are
+      # accepted and the order in which they are tried. Accepts either an array
+      # or varargs, so both forms are honoured exactly as written:
+      #
+      #   client_authentication %i[client_secret_basic client_secret_post none]
+      #   client_authentication :client_secret_basic, :client_secret_post
+      #
+      # Unlike the deprecated +client_credentials+ option, the listed methods
+      # are used verbatim — nothing (in particular +:none+) is appended, so a
+      # restrictive configuration is never silently broadened.
+      #
+      # @param methods [Array<Symbol>] the client authentication method names
+      def client_authentication(*methods)
+        @config.instance_variable_set(:@client_authentication, methods.flatten)
       end
 
       # Change the way access token is authenticated from the request object.
@@ -202,6 +239,13 @@ module Doorkeeper
 
       private
 
+      def deprecated(name, message = nil)
+        warning = "[DOORKEEPER] #{name} has been deprecated and will soon be removed"
+        warning = "#{warning}\n#{message}" if message.present?
+
+        Kernel.warn(warning)
+      end
+
       # Configure the secret storing functionality
       def configure_secrets_for(type, using:, fallback:)
         raise ArgumentError, "Invalid type #{type}" if %i[application token].exclude?(type)
@@ -337,6 +381,57 @@ module Doorkeeper
     #
     option :realm,                          default: "Doorkeeper"
 
+    # Issuer URL advertised in the OAuth 2.0 Authorization Server Metadata
+    # (RFC 8414). When nil, the request base URL is used instead.
+    option :issuer,                         default: nil
+
+    # Resource Indicators for OAuth 2.0 (RFC 8707).
+    #
+    # When set to a callable (lambda/proc), enables RFC 8707 support. The callable
+    # receives the array of resource indicator URIs and the client, and must return
+    # true if the resource(s) are acceptable, or false to reject with `invalid_target`.
+    #
+    # When nil (default), the `resource` parameter is ignored and RFC 8707 is disabled.
+    #
+    # @example
+    #   resource_indicator_validator ->(resource_indicators, client) {
+    #     resource_indicators.all? { |r| allowed_resources.include?(r) }
+    #   }
+    #
+    # @param validator [Proc, nil] A callable that validates resource indicators
+    # @see https://datatracker.ietf.org/doc/html/rfc8707
+    #
+    option :resource_indicator_validator, default: nil
+
+    # Replay guard for `private_key_jwt` client assertions (jti single-use
+    # tracking, OIDC Core §9). The default guard remembers jti values in
+    # process-local memory, so it cannot see a replay delivered to a
+    # different server process; a multi-process deployment can supply a
+    # shared store instead — any object answering
+    # `first_use?(key, expires_at:)`, returning true when the key was never
+    # seen before and remembering it until the unix time `expires_at`.
+    #
+    # @example
+    #   private_key_jwt_replay_guard RedisReplayGuard.new
+    #
+    # @param guard [#first_use?, nil] nil uses the built-in process-local guard
+    #
+    option :private_key_jwt_replay_guard, default: nil
+
+    # Cache for JWK Sets fetched from a client's `jwks_uri` during
+    # `private_key_jwt` authentication. Defaults to a process-local
+    # Doorkeeper::DocumentCache with a 60 second TTL; supply your own
+    # instance to change the TTL, or any object answering
+    # `fetch(url) { ... }` (returning the cached document or storing and
+    # returning the block's result) to share the cache across processes.
+    #
+    # @example
+    #   private_key_jwt_jwks_cache Doorkeeper::DocumentCache.new(ttl: 300)
+    #
+    # @param cache [#fetch, nil] nil uses a built-in process-local cache
+    #
+    option :private_key_jwt_jwks_cache, default: nil
+
     # Forces the usage of the HTTPS protocol in non-native redirect uris
     # (enabled by default in non-development environments). OAuth2
     # delegates security in communication to the HTTPS protocol so it is
@@ -413,6 +508,10 @@ module Doorkeeper
     option :application_class,
            default: "Doorkeeper::Application"
 
+    # Allows setting a hash of custom data merged into the OAuth 2.0
+    # Authorization Server Metadata response (RFC 8414).
+    option :custom_metadata, default: {}
+
     # Allows to set blank redirect URIs for Applications in case
     # server configured to use URI-less grant flows.
     #
@@ -596,8 +695,57 @@ module Doorkeeper
       pkce_code_challenge_methods
     end
 
+    # Resolves the configured client authentication methods (RFC 6749 §2.3)
+    # into the registered +Doorkeeper::ClientAuthentication::Method+ objects.
+    #
+    # Honors the deprecated +client_credentials+ option for backwards
+    # compatibility: if it was used it provides the source of truth, unless
+    # +client_authentication+ was also set explicitly, in which case the
+    # latter wins.
+    def client_authentication_methods
+      return @client_authentication_methods if defined?(@client_authentication_methods)
+
+      # When both the deprecated +client_credentials+ and the new
+      # +client_authentication+ are set, +client_authentication+ wins. The
+      # conflict is warned about at validation time (see Validations), not here,
+      # so the message is not swallowed by this memoised resolver.
+      only_legacy = instance_variable_defined?(:@client_credentials_methods) &&
+                    !instance_variable_defined?(:@client_authentication)
+      names = only_legacy ? @client_credentials_methods : client_authentication
+
+      # Names configured more than once resolve to the same registered Method
+      # instance, so identity-based #uniq drops the duplicates (which would
+      # otherwise be matched against requests twice and advertised twice in
+      # the server metadata) while distinct legacy callable adapters survive.
+      @client_authentication_methods = names.filter_map do |name|
+        # Legacy callables are already wrapped as Method adapters (see #client_credentials).
+        name.is_a?(Doorkeeper::ClientAuthentication::Method) ? name : Doorkeeper::ClientAuthentication.get(name)
+      end.uniq
+    end
+
+    # The configured client authentication method names (RFC 6749 §2.3),
+    # defaulting to the registry's DEFAULT_METHODS when not set.
+    def client_authentication
+      return Doorkeeper::ClientAuthentication::DEFAULT_METHODS.dup unless instance_variable_defined?(:@client_authentication)
+
+      @client_authentication
+    end
+
+    # @deprecated Renamed to +client_authentication_methods+. This alias keeps
+    #   external callers (e.g. doorkeeper-openid_connect) working for one release
+    #   and will be removed afterwards. It returns the legacy symbol names
+    #   (e.g. +:from_basic+) rather than the internal Method objects so that
+    #   consumers mapping from those symbols keep working unchanged.
     def client_credentials_methods
-      @client_credentials_methods ||= %i[from_basic from_params]
+      unless defined?(@client_credentials_methods_rename_warned)
+        Kernel.warn(
+          "[DOORKEEPER] Doorkeeper.config.client_credentials_methods has been renamed to " \
+          "client_authentication_methods and will be removed in a future version.",
+        )
+        @client_credentials_methods_rename_warned = true
+      end
+
+      Doorkeeper::ClientAuthentication.to_legacy_client_credentials_names(client_authentication_methods)
     end
 
     def access_token_methods
@@ -665,13 +813,17 @@ module Doorkeeper
     def calculate_token_grant_types
       types = grant_flows - ["implicit"]
       types << "refresh_token" if refresh_token_enabled?
-      types
+      types.uniq
     end
 
     # Calculates grant flows configured by the user in Doorkeeper
     # configuration considering registered aliases that is exposed
     # to single or multiple other flows.
     #
+    # The refresh_token flow is added implicitly when +use_refresh_token+
+    # is configured, so the result lists every enabled flow (useful for
+    # RFC 8414 authorization server metadata).
+    #
     def calculate_grant_flows
       configured_flows = grant_flows.map(&:to_s)
       aliases = Doorkeeper::GrantFlow.aliases.keys.map(&:to_s)
@@ -683,6 +835,8 @@ module Doorkeeper
         flows.concat(Doorkeeper::GrantFlow.expand_alias(flow_alias))
       end
 
+      flows << "refresh_token" if refresh_token_enabled?
+
       flows.flatten.uniq
     end
 
@@ -713,9 +867,7 @@ module Doorkeeper
     end
 
     def calculate_token_grant_flows
-      flows = enabled_grant_flows.select(&:handles_grant_type?)
-      flows << Doorkeeper::GrantFlow.get("refresh_token") if refresh_token_enabled?
-      flows
+      enabled_grant_flows.select(&:handles_grant_type?)
     end
   end
 end

data/lib/doorkeeper/document_cache.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  # A small thread-safe, fixed-TTL, in-memory memo keyed by URL. It exists
+  # so one authorization flow (authorize GET, consent POST, token exchange)
+  # does not refetch the same URL several times within a few seconds; it
+  # deliberately implements no HTTP caching semantics.
+  #
+  # Only successfully fetched and validated values may be stored — an error
+  # response or a malformed document must never be cached — which is
+  # guaranteed by callers never yielding anything but a validated value.
+  class DocumentCache
+    DEFAULT_TTL = 60
+    MAX_ENTRIES = 500
+
+    def initialize(ttl: DEFAULT_TTL)
+      @ttl = ttl
+      @mutex = Mutex.new
+      @store = {}
+    end
+
+    # Returns the cached document for the URL, or stores and returns the
+    # block's result. The block's failures (raises, nil) are not cached.
+    def fetch(url)
+      cached = read(url)
+      return cached if cached
+
+      document = yield
+      write(url, document) if document
+      document
+    end
+
+    def clear
+      @mutex.synchronize { @store.clear }
+    end
+
+    private
+
+    def read(url)
+      @mutex.synchronize do
+        entry = @store[url]
+        next nil unless entry
+
+        if entry[:expires_at] <= monotonic_now
+          @store.delete(url)
+          next nil
+        end
+
+        entry[:document]
+      end
+    end
+
+    def write(url, document)
+      @mutex.synchronize do
+        # Deleted first so a rewritten entry moves to the end of the hash's
+        # insertion order, which is the end #prune evicts from. #read
+        # already drops an entry when it finds it expired, so this only
+        # matters when two threads resolve the same URL at once.
+        @store.delete(url)
+        prune
+        @store[url] = { document: document, expires_at: monotonic_now + @ttl }
+      end
+    end
+
+    # Drop expired entries; if the store is still full, drop the oldest
+    # entries so a burst of unique URLs cannot grow the memo unbounded.
+    def prune
+      now = monotonic_now
+      @store.delete_if { |_url, entry| entry[:expires_at] <= now }
+
+      overflow = @store.size - (MAX_ENTRIES - 1)
+      return if overflow <= 0
+
+      @store.keys.first(overflow).each { |url| @store.delete(url) }
+    end
+
+    def monotonic_now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/doorkeeper/errors.rb

@@ -50,6 +50,23 @@ module Doorkeeper
       end
     end
 
+    # Raised when the `scope` parameter is present but not a string — e.g.
+    # `scope[a]=b`, which Rack parses into a Hash. Its octets cannot be split
+    # into scope tokens, so the request is malformed (RFC 6749 §3.3) and must
+    # be answered with `invalid_request` rather than an unhandled 500.
+    class InvalidScopeParameter < DoorkeeperError
+      def type
+        :invalid_request
+      end
+
+      # Maps to `invalid_request.unknown` ("... or is otherwise malformed").
+      # Without a reason the token endpoint would translate `nil` and return a
+      # blank error_description.
+      def reason
+        :unknown
+      end
+    end
+
     class BaseResponseError < DoorkeeperError
       attr_reader :response
 
@@ -75,6 +92,28 @@ module Doorkeeper
     UnableToGenerateToken = Class.new(DoorkeeperError)
     TokenGeneratorNotFound = Class.new(DoorkeeperError)
     NoOrmCleaner = Class.new(DoorkeeperError)
+    MissingConfigurationBuilderClass = Class.new(DoorkeeperError)
+
+    # Raised when resource_indicator_validator is configured but the required
+    # `resource` column has not been added to the database. Provides an
+    # actionable message pointing to the generator.
+    #
+    # `#type` returns `:server_error` so the token endpoint (which rescues
+    # DoorkeeperError and builds an OAuth error response from `#type`) emits a
+    # spec-compliant error code; the actionable message is retained on the
+    # exception for logs rather than being sent as the `error` value.
+    class MissingResourceColumn < DoorkeeperError
+      def initialize(table)
+        super(
+          "resource_indicator_validator is configured but the `resource` column is missing from " \
+          "the #{table} table. Run `rails generate doorkeeper:resource_indicators` and apply the migration.",
+        )
+      end
+
+      def type
+        :server_error
+      end
+    end
 
     InvalidRequest = Class.new(BaseResponseError)
     InvalidToken = Class.new(BaseResponseError)
@@ -82,6 +121,16 @@ module Doorkeeper
     InvalidScope = Class.new(BaseResponseError)
     InvalidRedirectUri = Class.new(BaseResponseError)
     InvalidGrant = Class.new(BaseResponseError)
+    # RFC 8707 error: the requested resource is invalid, missing, unknown, or malformed.
+    # Raised bare (no arguments) as a signal inside ResourceIndicatorValidator,
+    # then rescued and surfaced through the validation framework. Also raised
+    # with a response by ErrorResponse#raise_exception! so that controller
+    # rescue handlers can extract #response for translated error descriptions.
+    class InvalidTarget < BaseResponseError
+      def initialize(response = nil)
+        super
+      end
+    end
 
     UnauthorizedClient = Class.new(BaseResponseError)
     UnsupportedResponseType = Class.new(BaseResponseError)

data/lib/doorkeeper/http_fetcher.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "net/http"
+require "resolv"
+require "uri"
+
+module Doorkeeper
+  # Fetches a small operator-untrusted JSON document — a client's jwks_uri
+  # today — over HTTPS: redirects are never followed and any status other
+  # than 200 OK is an error.
+  #
+  # SSRF hardening: the host is resolved up front and the request is refused
+  # when any resolved address falls into an RFC 6890 special-use range
+  # (loopback, private-use, link-local, ...). The connection is then pinned
+  # to the vetted address via Net::HTTP#ipaddr= so a second, post-check DNS
+  # resolution (DNS rebinding) cannot redirect the request; TLS is still
+  # negotiated and verified against the original hostname. An exception for
+  # authorization servers themselves running on a loopback interface is
+  # intentionally not implemented. These rules follow the fetch hardening of
+  # draft-ietf-oauth-client-id-metadata-document (Sections 6.5 / 6.6), which
+  # fetches documents from the same kind of client-chosen URL.
+  #
+  # The response body is bounded and so is the total time spent reading it:
+  # a per-read timeout alone does not stop a server that dribbles bytes out
+  # indefinitely.
+  #
+  # Everything about the response is chosen by whoever hosts the document —
+  # which is whoever supplied the URL — so no failure mode here may escape
+  # as anything other than a FetchError.
+  class HttpFetcher
+    OPEN_TIMEOUT = 5
+    READ_TIMEOUT = 5
+
+    # draft-ietf-oauth-client-id-metadata-document Section 6.6 recommends a
+    # maximum response size of 5 kilobytes for a document like this.
+    MAX_RESPONSE_SIZE = 5 * 1024
+
+    # Ceiling on the whole exchange, so a body delivered one byte per
+    # READ_TIMEOUT cannot hold the connection (and the thread) for hours.
+    MAX_TOTAL_TIME = 10
+
+    # The document is served as JSON, either "application/json" or an
+    # "application/<more specific>+json" variant. A response declaring
+    # anything else plainly serves something other than the document sought
+    # and is refused without being parsed. A response declaring no media type
+    # at all is tolerated — the check is there to catch such a URL early, not
+    # as a security control, since the body still has to parse and validate
+    # in the caller.
+    JSON_MEDIA_TYPE = %r{\Aapplication/([\w.+-]+\+)?json\z}i
+
+    # RFC 6890 special-purpose IPv4/IPv6 registries, plus multicast ranges
+    # (224.0.0.0/4, ff00::/8), which are equally unfit as a document origin.
+    SPECIAL_USE_RANGES = [
+      "0.0.0.0/8",          # "this host on this network"
+      "10.0.0.0/8",         # private-use
+      "100.64.0.0/10",      # shared address space (CGN)
+      "127.0.0.0/8",        # loopback
+      "169.254.0.0/16",     # link-local
+      "172.16.0.0/12",      # private-use
+      "192.0.0.0/24",       # IETF protocol assignments
+      "192.0.2.0/24",       # documentation (TEST-NET-1)
+      "192.88.99.0/24",     # 6to4 relay anycast
+      "192.168.0.0/16",     # private-use
+      "198.18.0.0/15",      # benchmarking
+      "198.51.100.0/24",    # documentation (TEST-NET-2)
+      "203.0.113.0/24",     # documentation (TEST-NET-3)
+      "224.0.0.0/4",        # multicast
+      "240.0.0.0/4",        # reserved (includes limited broadcast)
+      "::/128",             # unspecified
+      "::1/128",            # loopback
+      # IPv4-compatible addresses (::a.b.c.d), deprecated by RFC 4291
+      # Section 2.5.5.1. Unlike the IPv4-mapped form handled in
+      # .special_use? these carry no ::ffff: marker, so they are refused
+      # wholesale rather than delegated to the embedded IPv4 address. The
+      # range also covers the two entries above.
+      "::/96",
+      "64:ff9b::/96",       # IPv4-IPv6 translation
+      "100::/64",           # discard-only
+      "2001::/23",          # IETF protocol assignments (TEREDO, ORCHID, ...)
+      "2001:db8::/32",      # documentation
+      "2002::/16",          # 6to4
+      "fc00::/7",           # unique-local
+      "fe80::/10",          # link-local
+      "ff00::/8",           # multicast
+    ].map { |cidr| IPAddr.new(cidr) }.freeze
+
+    FetchError = Class.new(StandardError)
+
+    # Everything a host can fail at while answering, so that it surfaces as
+    # a rejected client rather than an exception out of the endpoint.
+    #
+    # Net::HTTPBadResponse and Net::HTTPHeaderSyntaxError are listed
+    # explicitly because they descend straight from StandardError, *not*
+    # from Net::ProtocolError: a host answering with a mangled status line
+    # or header field raises them out of Net::HTTP.
+    TRANSPORT_ERRORS = [
+      Timeout::Error,
+      SystemCallError,
+      SocketError,
+      IOError,
+      OpenSSL::SSL::SSLError,
+      Net::ProtocolError,
+      Net::HTTPBadResponse,
+      Net::HTTPHeaderSyntaxError,
+      Resolv::ResolvError,
+      # Only reachable if a body is decompressed despite the identity
+      # Accept-Encoding requested below. Ruby can be built without zlib.
+      (Zlib::Error if defined?(::Zlib::Error)),
+    ].compact.freeze
+
+    def initialize(resolver: Resolv)
+      @resolver = resolver
+    end
+
+    # @param url [String] an already validated https:// URL
+    # @return [String] the response body
+    # @raise [FetchError] on resolution, transport or non-200 failures
+    def fetch(url)
+      uri = URI.parse(url)
+      # URI.parse("https:foo") yields a URI::HTTPS whose host is nil, so a
+      # caller's is_a?(URI::HTTPS) validation does not guarantee a host —
+      # and Resolv raises ArgumentError, not ResolvError, when handed nil.
+      raise FetchError, "#{url.inspect} has no host" if uri.host.blank?
+
+      address = vetted_address_for(uri.host)
+
+      perform_request(uri, address)
+    rescue *TRANSPORT_ERRORS => e
+      raise FetchError, "#{e.class}: #{e.message}"
+    end
+
+    def self.special_use?(address)
+      ip = address.is_a?(IPAddr) ? address : IPAddr.new(address.to_s)
+      # An IPv4-mapped IPv6 address is exactly as special-use as its
+      # embedded IPv4 address: ::ffff:127.0.0.1 must be refused while a
+      # mapped form of a public address stays reachable.
+      return special_use?(ip.native) if ip.ipv4_mapped?
+
+      SPECIAL_USE_RANGES.any? { |range| range.include?(ip) }
+    rescue IPAddr::InvalidAddressError
+      true
+    end
+
+    private
+
+    def vetted_address_for(host)
+      addresses = @resolver.getaddresses(host)
+      raise FetchError, "could not resolve #{host}" if addresses.empty?
+
+      # Every resolved address must be acceptable: pinning to one vetted
+      # address below keeps the connection off the others, but a host that
+      # mixes public and special-use records is treated as hostile.
+      if addresses.any? { |address| self.class.special_use?(address) }
+        raise FetchError, "#{host} resolves to a special-use address (RFC 6890)"
+      end
+
+      addresses.first.to_s
+    end
+
+    def perform_request(uri, address)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = true
+      http.ipaddr = address
+      http.open_timeout = OPEN_TIMEOUT
+      http.read_timeout = READ_TIMEOUT
+
+      request = Net::HTTP::Get.new(
+        uri.request_uri,
+        # Without an explicit Accept-Encoding, Net::HTTP negotiates gzip and
+        # inflates the body itself, which would both feed attacker-chosen
+        # bytes to zlib and turn the Content-Length check below into a check
+        # on the compressed size. A 5 kilobyte document does not need it.
+        { "Accept" => "application/json", "Accept-Encoding" => "identity" },
+      )
+      deadline = monotonic_now + MAX_TOTAL_TIME
+      body = nil
+
+      http.start do |connection|
+        # Net::HTTP never follows redirects on its own; a 3xx just fails
+        # the status check below.
+        connection.request(request) do |response|
+          raise FetchError, "expected 200 OK from #{uri.host}, got #{response.code}" unless response.is_a?(Net::HTTPOK)
+
+          verify_media_type!(response, uri.host)
+          body = bounded_body(response, uri.host, deadline)
+        end
+      end
+
+      body
+    end
+
+    def verify_media_type!(response, host)
+      declared = response["Content-Type"]
+      return if declared.blank?
+
+      media_type = declared.split(";").first.to_s.strip
+      return if JSON_MEDIA_TYPE.match?(media_type)
+
+      raise FetchError, "#{host} served #{media_type.inspect}, which is not a JSON media type"
+    end
+
+    # Reads the response in chunks so an oversized (or endlessly dribbled)
+    # body is abandoned instead of buffered in full. Raising here unwinds
+    # out of Net::HTTP#start, which closes the connection.
+    def bounded_body(response, host, deadline)
+      declared = response["Content-Length"]
+      if declared && declared.to_i > MAX_RESPONSE_SIZE
+        raise FetchError, "#{host} declares a #{declared} byte document, over the " \
+                          "#{MAX_RESPONSE_SIZE} byte limit"
+      end
+
+      body = +""
+
+      response.read_body do |chunk|
+        body << chunk
+
+        if body.bytesize > MAX_RESPONSE_SIZE
+          raise FetchError, "the document from #{host} exceeds #{MAX_RESPONSE_SIZE} bytes"
+        elsif monotonic_now > deadline
+          raise FetchError, "reading the document from #{host} took too long"
+        end
+      end
+
+      body
+    end
+
+    def monotonic_now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -100,6 +100,22 @@ module Doorkeeper
         column_names.include?("code_challenge")
       end
 
+      # RFC 8707: resource indicators are supported only when the
+      # `resource` column exists (added by the
+      # `doorkeeper:resource_indicators` generator).
+      def resource_indicators_supported?
+        column_names.include?("resource")
+      end
+
+      # Replay protection for authorization codes (RFC 6749 §4.1.2, §10.5)
+      # is active only when the `access_token_id` column exists (added by
+      # the `doorkeeper:grant_reuse_revocation` generator): the column
+      # records the access token issued when the code was exchanged, so a
+      # second exchange attempt can revoke it.
+      def access_token_revoked_on_reuse?
+        column_names.include?("access_token_id")
+      end
+
       ##
       # Determines the secret storing transformer
       # Unless configured otherwise, uses the plain secret strategy