doorkeeper 5.9.5 → 6.0.0.beta2

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -92,13 +92,16 @@ module Doorkeeper
       #   A nil value will ignore custom attributes, while an empty hash will
       #   only match tokens that have no custom attributes set.
       #
+      # @yield [token] optional additional predicate a token must satisfy to
+      #   count as a match (e.g. the refresh token requirement of the request).
+      #
       # @return [Doorkeeper::AccessToken, nil] Access Token instance or
       #   nil if matching record was not found
       #
-      def matching_token_for(application, resource_owner, scopes, custom_attributes: nil, include_expired: true)
+      def matching_token_for(application, resource_owner, scopes, custom_attributes: nil, include_expired: true, &filter)
         tokens = authorized_tokens_for(application&.id, resource_owner)
         tokens = tokens.not_expired unless include_expired
-        find_matching_token(tokens, application, custom_attributes, scopes)
+        find_matching_token(tokens, application, custom_attributes, scopes, &filter)
       end
 
       # Interface to enumerate access token records in batches in order not
@@ -131,7 +134,7 @@ module Doorkeeper
       # @return [Doorkeeper::AccessToken, nil] Access Token instance or
       #   nil if matching record was not found
       #
-      def find_matching_token(relation, application, custom_attributes, scopes)
+      def find_matching_token(relation, application, custom_attributes, scopes, &filter)
         return nil unless relation
 
         matching_tokens = []
@@ -140,7 +143,8 @@ module Doorkeeper
         find_access_token_in_batches(relation, batch_size: batch_size) do |batch|
           tokens = batch.select do |token|
             scopes_match?(token.scopes, scopes, application&.scopes) &&
-              custom_attributes_match?(token, custom_attributes)
+              custom_attributes_match?(token, custom_attributes) &&
+              (filter.nil? || filter.call(token))
           end
 
           matching_tokens.concat(tokens)
@@ -149,6 +153,32 @@ module Doorkeeper
         matching_tokens.max_by(&:created_at)
       end
 
+      # Checks whether a candidate token for reuse matches the refresh token
+      # requirement of the current request.
+      #
+      # The candidate's refresh token presence must match what the request asks
+      # for, in both directions. A request that expects a refresh token (e.g. an
+      # authorization_code or password grant while `use_refresh_token` is
+      # enabled) must not reuse a token issued without one, or the response would
+      # silently omit the refresh token. Conversely, a request that does not ask
+      # for a refresh token must not reuse a token that carries one, or the
+      # response would return a refresh token the request never requested (this
+      # is reachable when `refresh_token_enabled` is a per-request callable).
+      # When no matching token satisfies the requirement a fresh token is
+      # issued instead.
+      #
+      # @param access_token [Doorkeeper::AccessToken]
+      #   the candidate token for reuse
+      # @param token_attributes [Hash]
+      #   attributes for the token being requested
+      #
+      # @return [Boolean] true if the candidate token's refresh token presence
+      #   matches the request's refresh token requirement, false otherwise
+      #
+      def refresh_token_matches?(access_token, token_attributes)
+        access_token.refresh_token.present? == !!token_attributes[:use_refresh_token]
+      end
+
       # Checks whether the token scopes match the scopes from the parameters
       #
       # @param token_scopes [#to_s]
@@ -199,6 +229,39 @@ module Doorkeeper
         end
       end
 
+      # RFC 8707: checks whether an existing token's audience matches the
+      # requested resource indicators. Used during token reuse to prevent
+      # returning a token audience-restricted to one resource for a request
+      # targeting a different resource.
+      #
+      # The comparison runs whenever either side carries a resource, even when
+      # no validator is configured: a grant bound to resources still restricts
+      # the token's audience (see AuthorizationCodeRequest), so reuse must not
+      # silently widen it by matching an unrestricted or differently-scoped
+      # token. When both sides are blank the tokens are unrestricted and match.
+      #
+      # @param token [Doorkeeper::AccessToken] existing token
+      # @param requested_resource [String, nil] space-delimited resource URIs
+      # @return [Boolean]
+      def resource_indicators_match?(token, requested_resource)
+        token_resource = token.try(:resource)
+
+        # Both blank — neither is audience-restricted, match.
+        return true if token_resource.blank? && requested_resource.blank?
+        # One blank, the other not — mismatch.
+        return false if token_resource.blank? || requested_resource.blank?
+
+        # Both present — compare as sorted sets.
+        token_resource.split.sort == requested_resource.split.sort
+      end
+
+      # RFC 8707: resource indicators are supported only when the
+      # `resource` column exists (added by the
+      # `doorkeeper:resource_indicators` generator).
+      def resource_indicators_supported?
+        column_names.include?("resource")
+      end
+
       # Looking for not expired AccessToken record with a matching set of
       # scopes that belongs to specific Application and Resource Owner.
       # If it doesn't exists - then creates it.
@@ -226,9 +289,22 @@ module Doorkeeper
           # attributes when matching, while an empty hash only matches tokens
           # that have no custom attributes set.
           custom_attributes = extract_custom_attributes(token_attributes)
+          # The refresh token requirement participates in the matching itself
+          # rather than being checked on its single newest result: the newest
+          # matching token may carry the wrong refresh token presence (e.g. it
+          # was issued through a grant with a different `use_refresh_token`)
+          # while an older token satisfies the request and can still be reused.
+          #
+          # RFC 8707: resource indicators must also match so that a token
+          # audience-restricted to one resource is never reused for another.
+          requested_resource = token_attributes[:resource]
+
           access_token = matching_token_for(
             application, resource_owner, scopes, custom_attributes: custom_attributes, include_expired: false,
-          )
+          ) do |token|
+            refresh_token_matches?(token, token_attributes) &&
+              resource_indicators_match?(token, requested_resource)
+          end
 
           return access_token if access_token&.reusable?
         end

data/lib/doorkeeper/models/application_mixin.rb

@@ -5,6 +5,7 @@ module Doorkeeper
     extend ActiveSupport::Concern
 
     include OAuth::Helpers
+    include Models::Concerns::WriteToPrimary
     include Models::Orderable
     include Models::SecretStorable
     include Models::Scopes
@@ -27,9 +28,8 @@ module Doorkeeper
         app = by_uid(uid)
         return unless app
         return app if secret.blank? && !app.confidential?
-        return unless app.secret_matches?(secret)
 
-        app
+        app if app.secret_matches?(secret)
       end
 
       # Returns an instance of the Doorkeeper::Application with specific UID.
@@ -76,18 +76,26 @@ module Doorkeeper
     # @return [Boolean] Whether the given secret matches the stored secret
     #                of this application.
     #
+    # @note When the secret matches only via the fallback strategy, the stored
+    #       secret is upgraded to the active strategy as a side-effect (mirrors
+    #       the find_by_plaintext_token -> find_by_fallback_token pattern).
+    #
     def secret_matches?(input)
       # return false if either is nil, since secure_compare depends on strings
       # but Application secrets MAY be nil depending on confidentiality.
       return false if input.nil? || secret.nil?
 
+      input = input.to_s
+
       # When matching the secret by comparer function, all is well.
       return true if secret_strategy.secret_matches?(input, secret)
 
-      # When fallback lookup is enabled, ensure applications
-      # with plain secrets can still be found
-      if fallback_secret_strategy
-        fallback_secret_strategy.secret_matches?(input, secret)
+      # When fallback lookup is enabled, ensure applications with plain secrets
+      # can still be found, upgrading the stored secret to the active strategy
+      # on a successful match.
+      if fallback_secret_strategy&.secret_matches?(input, secret)
+        self.class.upgrade_fallback_value(self, :secret, input)
+        true
       else
         false
       end

data/lib/doorkeeper/models/concerns/secret_storable.rb

@@ -84,7 +84,16 @@ module Doorkeeper
         #
         def upgrade_fallback_value(instance, attr, plain_secret)
           upgraded = secret_strategy.store_secret(instance, attr, plain_secret)
-          instance.update(attr => upgraded)
+
+          # The upgrade is a write on what is otherwise a read path (finding a
+          # record by its secret), so it must reach the primary database when
+          # automatic role switching would route the surrounding request to a
+          # read replica.
+          if respond_to?(:with_primary_role)
+            with_primary_role { instance.update(attr => upgraded) }
+          else
+            instance.update(attr => upgraded)
+          end
         end
 
         ##

data/lib/doorkeeper/oauth/authorization/code.rb

@@ -47,6 +47,16 @@ module Doorkeeper
             attributes[:resource_owner_id] = resource_owner.id
           end
 
+          # RFC 8707: persist resource indicators so they can be enforced at
+          # the token endpoint (subset validation) and carried to the token.
+          if pre_auth.respond_to?(:resource_indicators) && pre_auth.resource_indicators.present?
+            unless Doorkeeper.config.access_grant_model.resource_indicators_supported?
+              raise Doorkeeper::Errors::MissingResourceColumn, "oauth_access_grants"
+            end
+
+            attributes[:resource] = pre_auth.resource_indicators.join(" ")
+          end
+
           pkce_attributes.merge(attributes).merge(custom_attributes)
         end
 

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -59,13 +59,24 @@ module Doorkeeper
             resource_owner,
           )
 
-          @token = Doorkeeper.config.access_token_model.find_or_create_for(
+          token_attributes = {
             application: application,
             resource_owner: resource_owner,
             scopes: pre_auth.scopes,
             expires_in: self.class.access_token_expires_in(Doorkeeper.config, context),
             use_refresh_token: false,
-          )
+          }
+
+          # RFC 8707: carry resource indicators to the access token
+          if pre_auth.respond_to?(:resource_indicators) && pre_auth.resource_indicators.present?
+            unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+              raise Doorkeeper::Errors::MissingResourceColumn, "oauth_access_tokens"
+            end
+
+            token_attributes[:resource] = pre_auth.resource_indicators.join(" ")
+          end
+
+          @token = Doorkeeper.config.access_token_model.find_or_create_for(**token_attributes)
         end
 
         def application

data/lib/doorkeeper/oauth/authorization/uri_builder.rb

@@ -10,6 +10,17 @@ module Doorkeeper
           def uri_with_query(url, parameters = {})
             uri = URI.parse(url)
             original_query = Rack::Utils.parse_query(uri.query)
+            # `parse_query` yields string keys while `parameters` uses symbol
+            # keys, so a naive merge cannot dedupe a collision (e.g. a registered
+            # redirect_uri already carrying `state`) and would emit the param
+            # twice. Normalize keys so the response parameters win over any
+            # same-named query already present in the redirect_uri. Blank
+            # response parameters are dropped before the merge: they carry no
+            # value to respond with, and letting them clobber a same-named
+            # registered parameter would violate RFC 6749 §3.1.2 (the registered
+            # query component "MUST be retained when adding additional query
+            # parameters").
+            parameters = parameters.transform_keys(&:to_s).reject { |_, value| value.blank? }
             uri.query = build_query(original_query.merge(parameters))
             uri.to_s
           end

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -9,10 +9,17 @@ module Doorkeeper
       # @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
       validate :redirect_uri, error: Errors::InvalidGrant
       validate :code_verifier, error: Errors::InvalidGrant
+      # Runs last, so the single-use enforcement it performs only acts once
+      # the caller has proven possession of the code (redirect_uri + PKCE).
+      validate :grant_accessible, error: Errors::InvalidGrant
+      validate :resource_indicators, error: Errors::InvalidTarget
 
       attr_reader :grant, :client, :redirect_uri, :access_token, :code_verifier,
                   :invalid_request_reason, :missing_param
 
+      # A scope parameter is deliberately not read here: RFC 6749 does not
+      # define one for the authorization_code token request (§4.1.3), so it
+      # is ignored and the access token inherits the scopes of the grant.
       def initialize(server, grant, client, parameters = {})
         super()
         @server = server
@@ -21,6 +28,7 @@ module Doorkeeper
         @grant_type = Doorkeeper::OAuth::AUTHORIZATION_CODE
         @redirect_uri = parameters[:redirect_uri]
         @code_verifier = parameters[:code_verifier]
+        @raw_resource_indicators = parameters[:resource]
       end
 
       private
@@ -36,16 +44,40 @@ module Doorkeeper
 
           grant.revoke
 
+          token_attributes = custom_token_attributes_with_data
+          # RFC 8707 §2.2: audience-restrict the access token to the resources
+          # bound to the grant. When the token request specifies a (valid)
+          # subset, use that subset; when it omits `resource`, inherit the
+          # grant's full resource set so the token is never issued without an
+          # audience restriction.
+          effective_resources = resolved_resource_indicators.presence || grant_resource_indicators
+          if effective_resources.present?
+            unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+              raise Errors::MissingResourceColumn, "oauth_access_tokens"
+            end
+
+            token_attributes[:resource] = effective_resources.join(" ")
+          end
+
           find_or_create_access_token(
             client,
             resource_owner,
             grant.scopes,
-            custom_token_attributes_with_data,
+            token_attributes,
             server,
           )
+
+          link_access_token_to_grant
         end
 
         super
+      rescue Errors::InvalidGrantReuse
+        # A concurrent exchange of the same code won the race: the raise
+        # rolled this transaction back, so the revocation must happen
+        # outside of it. `lock!` reloaded the grant after the winning
+        # exchange committed, so the token linkage is visible here.
+        revoke_token_issued_for_grant
+        raise
       end
 
       def resource_owner
@@ -64,7 +96,7 @@ module Doorkeeper
         @missing_param =
           if grant&.uses_pkce? && code_verifier.blank?
             :code_verifier
-          elsif client && !client.confidential && Doorkeeper.config.force_pkce? && code_verifier.blank?
+          elsif client && Doorkeeper.config.force_pkce? && code_verifier.blank?
             :code_verifier
           elsif redirect_uri.blank?
             :redirect_uri
@@ -78,7 +110,16 @@ module Doorkeeper
       end
 
       def validate_grant
-        return false unless grant && grant.application_id == client.id
+        grant && grant.application_id == client.id
+      end
+
+      # Checked after redirect_uri and PKCE so that a caller who cannot prove
+      # possession of the code never reaches the reuse handling below.
+      def validate_grant_accessible
+        # Authorization codes are single-use (RFC 6749 §4.1.2): observing a
+        # second exchange attempt denies the request and revokes the tokens
+        # already issued for the code (§10.5).
+        revoke_token_issued_for_grant if grant.revoked?
 
         grant.accessible?
       end
@@ -117,9 +158,92 @@ module Doorkeeper
           .symbolize_keys
       end
 
+      # RFC 8707: validate resource indicators on the token request.
+      # If the grant carries resource indicators, the token request's resource
+      # parameter must be a subset. If no grant resource is present, the
+      # validator checks the request resource against server policy.
+      #
+      # Subset and syntax enforcement run even when no validator is configured
+      # as long as the grant is already audience-restricted: a grant bound to
+      # resources must never be exchanged for a token whose audience widens
+      # beyond it. Only when the feature is disabled AND the grant has no
+      # stored resources is the `resource` parameter ignored entirely.
+      def validate_resource_indicators
+        @grant_resource_indicators = grant&.try(:resource)&.split
+
+        validator = Doorkeeper.config.resource_indicator_validator
+
+        # Feature effectively off: no validator and nothing already bound to
+        # enforce against. Ignore the `resource` parameter.
+        return true if validator.nil? && @grant_resource_indicators.blank?
+
+        @resolved_resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+          grant_resource_indicators: @grant_resource_indicators,
+        )
+        true
+      rescue Errors::InvalidTarget
+        false
+      end
+
+      def resolved_resource_indicators
+        @resolved_resource_indicators || []
+      end
+
+      def grant_resource_indicators
+        @grant_resource_indicators || []
+      end
+
       def revoke_previous_tokens(application, resource_owner)
         Doorkeeper.config.access_token_model.revoke_all_for(application.id, resource_owner)
       end
+
+      def link_access_token_to_grant
+        return unless grant.class.access_token_revoked_on_reuse?
+
+        grant.class.with_primary_role do
+          grant.update_column(:access_token_id, access_token.id)
+        end
+      end
+
+      def revoke_token_issued_for_grant
+        return unless grant.class.access_token_revoked_on_reuse?
+        return if grant.access_token_id.blank?
+
+        # Look the token up on the primary too: a lagging read replica may not
+        # have it yet, which would silently skip the revocation.
+        Doorkeeper.config.access_token_model.with_primary_role do
+          token = Doorkeeper.config.access_token_model.find_by(id: grant.access_token_id)
+          next if token.nil?
+
+          # With `reuse_access_token` the same token can back several grants
+          # (find_or_create returns a shared one). Revoking it on a replay of
+          # this grant's code would take down another valid session that still
+          # holds it. Only revoke when no other grant references the token, so
+          # the single-use revocation reaches a token unique to the replayed
+          # code and never collaterally revokes a reused, shared one.
+          next if token_shared_with_other_grant?(token)
+
+          token.revoke
+        end
+      end
+
+      # Reads the grant -> token link, which lives in the optional
+      # `oauth_access_grants.access_token_id` column: new installs get it from
+      # the generated migration, existing apps add it with the
+      # `doorkeeper:grant_reuse_revocation` generator. Callers must therefore
+      # guard with `access_token_revoked_on_reuse?` (as
+      # `link_access_token_to_grant` and `revoke_token_issued_for_grant` do),
+      # so an app that never ran the generator returns early and never queries
+      # a column it does not have.
+      def token_shared_with_other_grant?(token)
+        grant.class
+          .where(access_token_id: token.id)
+          .where.not(id: grant.id)
+          .exists?
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/base_request.rb

@@ -59,8 +59,7 @@ module Doorkeeper
           client_scopes = @client&.scopes
           return default_scopes if client_scopes.blank?
 
-          # Avoid using Scope#& for dynamic scopes
-          client_scopes.allowed(default_scopes)
+          client_scopes.common(default_scopes)
         end
       end
     end

data/lib/doorkeeper/oauth/client.rb

@@ -1,8 +1,26 @@
 # frozen_string_literal: true
 
+# The full registry rather than just credentials: requiring only
+# client_authentication/credentials fires the ClientAuthentication autoload
+# mid-load, which re-requires the in-progress file and warns under -w
+# ("circular require considered harmful").
+require "doorkeeper/client_authentication"
+
 module Doorkeeper
   module OAuth
     class Client
+      # @deprecated Moved to +Doorkeeper::ClientAuthentication::Credentials+.
+      #   This alias keeps the long-standing +Doorkeeper::OAuth::Client::Credentials+
+      #   constant resolvable for one release so referencing code does not raise
+      #   +NameError+; update references to the new constant. Note the legacy
+      #   +.from_request+/+.from_basic+/+.from_params+ class methods are gone —
+      #   client credential extraction now goes through the client authentication
+      #   registry (RFC 6749 §2.3). Marked with +deprecate_constant+, so Ruby
+      #   warns on access when deprecation warnings are enabled
+      #   (+Warning[:deprecated] = true+ or +-W:deprecated+).
+      Credentials = Doorkeeper::ClientAuthentication::Credentials
+      deprecate_constant :Credentials
+
       attr_reader :application
 
       delegate :id, :name, :uid, :redirect_uri, :scopes, :confidential, to: :@application
@@ -19,6 +37,12 @@ module Doorkeeper
 
       def self.authenticate(credentials, method = Doorkeeper.config.application_model.method(:by_uid_and_secret))
         return if credentials.blank?
+
+        # Credentials that were fully authenticated by their client
+        # authentication method (e.g. a verified private_key_jwt assertion)
+        # carry no secret to compare — resolve the client by uid alone.
+        return find(credentials.uid) if credentials.respond_to?(:pre_authenticated?) && credentials.pre_authenticated?
+
         return unless (application = method.call(credentials.uid, credentials.secret))
 
         new(application)

data/lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    module ClientAuthentication
+      # RFC 6749 §2.3.1 "client_secret_basic": client credentials are sent
+      # using HTTP Basic authentication.
+      #
+      # Known deviation: §2.3.1 also requires the client_id and client_secret
+      # to be form-urlencoded before being placed into the Basic header.
+      # Doorkeeper has never URL-decoded them (like much of the ecosystem),
+      # and this strategy deliberately keeps that behaviour — adding the
+      # decoding now would break every existing client whose credentials
+      # contain URL-encodable characters.
+      class ClientSecretBasic
+        def self.uses_shared_secret?
+          true
+        end
+
+        # Match whenever the header decodes to a non-blank +client_id+ — i.e.
+        # whenever a Basic authentication *attempt* is present. The secret may
+        # be empty (public clients) or missing; those are still Basic auth
+        # attempts and must be claimed here so that invalid credentials fail
+        # with +invalid_client+ instead of silently falling through to another
+        # configured method or the fallback (which would downgrade a failed
+        # authentication attempt to "no authentication provided").
+        def self.matches_request?(request)
+          credentials_from(request).present?
+        end
+
+        def self.authenticate(request)
+          client_id, client_secret = credentials_from(request)
+          return unless client_id
+
+          Doorkeeper::ClientAuthentication::Credentials.new(client_id, client_secret)
+        end
+
+        # Returns the decoded [client_id, client_secret] pair, or nil when the
+        # request carries no HTTP Basic +client_id+. A header that merely
+        # starts with "Basic " but decodes to an empty/blank client_id (e.g.
+        # an empty payload or a leading ":") is not a usable attempt and does
+        # not match.
+        def self.credentials_from(request)
+          authorization = request.authorization.to_s
+          return unless authorization.downcase.start_with?("basic ")
+
+          value = authorization.split(" ", 2).last
+          client_id, client_secret = Base64.decode64(value.to_s).split(":", 2)
+          return if client_id.blank?
+
+          [client_id, client_secret]
+        end
+        private_class_method :credentials_from
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_authentication/client_secret_post.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    module ClientAuthentication
+      # RFC 6749 §2.3.1 "client_secret_post": client credentials are sent in
+      # the request body. The query string is intentionally ignored so that
+      # credentials must be supplied in the body as the spec requires.
+      class ClientSecretPost
+        def self.uses_shared_secret?
+          true
+        end
+
+        def self.matches_request?(request)
+          params = request.request_parameters.with_indifferent_access
+
+          request.post? &&
+            params[:client_id].present? &&
+            params[:client_secret].present?
+        end
+
+        def self.authenticate(request)
+          params = request.request_parameters.with_indifferent_access
+
+          Doorkeeper::ClientAuthentication::Credentials.new(
+            params[:client_id],
+            params[:client_secret],
+          )
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_authentication/none.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    module ClientAuthentication
+      # RFC 6749 §2.3 "none": a public client that authenticates with only a
+      # client_id and no secret (in the request body, not the query string).
+      class None
+        # The absence of client authentication involves no secret at all.
+        def self.uses_shared_secret?
+          false
+        end
+
+        # Rejects a request that carries header-based client authentication (a
+        # +Basic+ credential, or any non-blank Authorization header that is not
+        # a bearer token): such a request must not be silently treated as an
+        # unauthenticated public client. This is narrower than the legacy
+        # +from_params+ extractor, which read the body +client_id+ regardless
+        # of the Authorization header.
+        #
+        # A +Bearer+ Authorization header is the exception: it authorizes
+        # access to the endpoint itself (e.g. a bearer-protected introspection
+        # endpoint, RFC 7662 §2.1, or a revocation request) rather than
+        # authenticating the client, so it must not suppress the +none+
+        # strategy for a public client that identifies itself with a body
+        # +client_id+.
+        #
+        # A request carrying a client_assertion is likewise attempting real
+        # client authentication (RFC 7521 allows a bare client_id next to the
+        # assertion), so it must not be picked up as an unauthenticated
+        # public client no matter where this method sits in the configured
+        # order.
+        def self.matches_request?(request)
+          params = request.request_parameters.with_indifferent_access
+
+          request.post? &&
+            !client_authentication_header?(request) &&
+            params[:client_id].present? &&
+            params[:client_secret].blank? &&
+            params[:client_assertion].blank?
+        end
+
+        # A blank Authorization header carries no client authentication; a
+        # bearer token authorizes the endpoint rather than the client. Every
+        # other non-blank scheme (Basic, etc.) is header-based client
+        # authentication. The pattern tolerates the optional whitespace HTTP
+        # allows before the scheme and requires whitespace between the scheme
+        # and the token, accepting in both places only the spaces and tabs
+        # that OWS is made of (RFC 9110 §5.6.3): a well-formed Bearer header
+        # is therefore not misclassified, while a value that relies on any
+        # other character in those positions is not taken for a bearer
+        # credential. A bearer credential also carries at least one token
+        # character after the scheme (RFC 6750 §2.1), so a scheme-only value
+        # such as "Bearer " is not exempted either.
+        def self.client_authentication_header?(request)
+          header = request.authorization
+          return false if header.blank?
+
+          !header.match?(/\A[ \t]*Bearer[ \t]+\S/i)
+        end
+        private_class_method :client_authentication_header?
+
+        def self.authenticate(request)
+          params = request.request_parameters.with_indifferent_access
+
+          Doorkeeper::ClientAuthentication::Credentials.new(params[:client_id], nil)
+        end
+      end
+    end
+  end
+end