doorkeeper 5.9.5 → 6.0.0.beta2

data/lib/doorkeeper/oauth/client_authentication/private_key_jwt/key_resolver.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module Doorkeeper
+  module OAuth
+    module ClientAuthentication
+      class PrivateKeyJwt
+        # Resolves the JWK Set a client's assertion must verify against:
+        # the +jwks+ / +jwks_uri+ attributes of its application, when the
+        # application model provides them (Doorkeeper defines no such
+        # columns itself).
+        #
+        # Symmetric ("oct") keys are dropped: a symmetric key in a JWK Set is
+        # a shared secret, which this method must never verify against.
+        #
+        # The jwt gem is always referenced as ::JWT: doorkeeper-jwt defines
+        # Doorkeeper::JWT, which would otherwise shadow the gem everywhere
+        # inside this module.
+        module KeyResolver
+          # A published JWK Set is remote, client-controlled input, so each
+          # level is type-checked before it is indexed into: a JWK Set that
+          # is not an object of objects must fail authentication, never
+          # raise out of the token endpoint.
+          def self.jwk_set_for(application)
+            raw = raw_jwks(application)
+            return unless raw.is_a?(Hash)
+
+            keys = raw["keys"] || raw[:keys]
+            return unless keys.is_a?(Array)
+
+            asymmetric = keys.grep(Hash).reject { |key| (key["kty"] || key[:kty]).to_s == "oct" }
+            return if asymmetric.empty?
+
+            ::JWT::JWK::Set.new({ "keys" => asymmetric })
+          rescue ::JWT::DecodeError, OpenSSL::OpenSSLError
+            # A hostile key can fail to parse in more ways than JWT::JWKError:
+            # a member that is not valid base64url raises JWT::Base64DecodeError
+            # (a sibling of JWT::JWKError under JWT::DecodeError, not a
+            # subclass), and an EC point that is not on its curve raises a bare
+            # OpenSSL error. None of them may escape into the token endpoint.
+            nil
+          end
+
+          def self.raw_jwks(application)
+            application_jwks(application) || fetch_jwks(application_jwks_uri(application))
+          end
+          private_class_method :raw_jwks
+
+          def self.application_jwks(application)
+            return unless application.respond_to?(:jwks)
+
+            jwks = application.jwks
+            jwks.is_a?(String) ? JSON.parse(jwks) : jwks.presence
+          rescue JSON::ParserError
+            nil
+          end
+          private_class_method :application_jwks
+
+          def self.application_jwks_uri(application)
+            application.jwks_uri if application.respond_to?(:jwks_uri)
+          end
+          private_class_method :application_jwks_uri
+
+          # The jwks_uri is fetched with a hardened HTTP client: https only,
+          # no redirects, 200 OK only, and RFC 6890 special-use addresses
+          # refused.
+          #
+          # The result is memoized, since otherwise every single authenticated
+          # request would fetch it again; a rotated key is picked up once the
+          # memo expires. Only JSON objects are stored, so a malformed
+          # response is not cached.
+          def self.fetch_jwks(jwks_uri)
+            return if jwks_uri.blank?
+
+            url = jwks_uri.to_s
+            return unless URI.parse(url).is_a?(URI::HTTPS)
+
+            jwks_cache.fetch(url) do
+              parsed = JSON.parse(Doorkeeper::HttpFetcher.new.fetch(url))
+              parsed if parsed.is_a?(Hash)
+            end
+          rescue Doorkeeper::HttpFetcher::FetchError, JSON::ParserError, URI::InvalidURIError
+            nil
+          end
+          private_class_method :fetch_jwks
+
+          # The built-in cache is process-local with a fixed TTL; the
+          # private_key_jwt_jwks_cache config option replaces it with any
+          # object answering fetch(url) { ... }.
+          def self.jwks_cache
+            Doorkeeper.config.private_key_jwt_jwks_cache || default_jwks_cache
+          end
+
+          def self.default_jwks_cache
+            @default_jwks_cache ||= Doorkeeper::DocumentCache.new
+          end
+          private_class_method :default_jwks_cache
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_authentication/private_key_jwt/replay_guard.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require "singleton"
+
+module Doorkeeper
+  module OAuth
+    module ClientAuthentication
+      class PrivateKeyJwt
+        # In-memory, process-local single-use guard for assertion jti values
+        # (OIDC Core §9: an assertion may only be used once). Entries live
+        # until the assertion's own exp, which PrivateKeyJwt caps at
+        # MAX_LIFETIME, so the memory held here is bounded: at most
+        # MAX_ENTRIES entries, each for at most MAX_LIFETIME seconds.
+        #
+        # Being process-local this cannot catch a replay delivered to a
+        # different server process (separate Puma workers, separate hosts).
+        # Whether that matters depends on the deployment: the replay window
+        # is at most MAX_LIFETIME anyway, and an attacker who can capture an
+        # assertion in transit usually defeats TLS first. A deployment that
+        # wants cross-process replay protection supplies a shared store
+        # (backed by Redis or the like) through the
+        # private_key_jwt_replay_guard config option.
+        class ReplayGuard
+          include Singleton
+
+          # Upper bound on remembered jti values. When the guard is full even
+          # after expired entries are pruned, the oldest entries are evicted
+          # rather than new assertions rejected — see first_use?.
+          MAX_ENTRIES = 10_000
+
+          # Expired entries are swept periodically rather than on every
+          # authentication: the sweep is O(entries) and would otherwise run on
+          # each request, walking up to MAX_ENTRIES every time. An entry that
+          # outlives its exp by up to this long only makes the guard stricter,
+          # never more permissive.
+          SWEEP_INTERVAL = 10
+
+          def initialize
+            @mutex = Mutex.new
+            @seen = {}
+            @sweep_after = 0
+          end
+
+          # @return [Boolean] true when the key was not seen before; the key
+          #   is then remembered until +expires_at+ (unix time).
+          def first_use?(key, expires_at:)
+            now = Time.now.to_i
+
+            @mutex.synchronize do
+              if now >= @sweep_after || @seen.size >= MAX_ENTRIES
+                @seen.delete_if { |_, expiry| expiry <= now }
+                @sweep_after = now + SWEEP_INTERVAL
+              end
+
+              return false if @seen.key?(key)
+
+              # When full even after expiry pruning, evict the oldest entries
+              # rather than rejecting new assertions: rejecting would let a
+              # flood of assertions lock legitimate clients out entirely,
+              # while evicting only shortens the replay window under attack.
+              @seen.shift while @seen.size >= MAX_ENTRIES
+
+              @seen[key] = expires_at
+              true
+            end
+          end
+
+          def clear
+            @mutex.synchronize do
+              @seen.clear
+              @sweep_after = 0
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_authentication/private_key_jwt.rb

@@ -0,0 +1,247 @@
+# frozen_string_literal: true
+
+require "uri"
+
+require "doorkeeper/oauth/client_authentication/private_key_jwt/key_resolver"
+require "doorkeeper/oauth/client_authentication/private_key_jwt/replay_guard"
+
+module Doorkeeper
+  module OAuth
+    module ClientAuthentication
+      # "private_key_jwt" client authentication (RFC 7523 / OIDC Core §9):
+      # the client authenticates with a JWT assertion signed by its private
+      # key; the server verifies it against the client's published public
+      # keys (a jwks attribute on the application model, or keys fetched
+      # from its jwks_uri). No shared secret is involved.
+      #
+      # The "jwt" gem is required only when an assertion is actually
+      # authenticated, so servers that don't enable this method don't need
+      # the dependency. Its constants are always referenced as ::JWT:
+      # doorkeeper-jwt defines Doorkeeper::JWT, which would otherwise shadow
+      # the gem everywhere inside this class.
+      class PrivateKeyJwt
+        CLIENT_ASSERTION_TYPE = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+
+        # Assertions are verified against the client's published public
+        # keys; no shared secret is involved.
+        def self.uses_shared_secret?
+          false
+        end
+
+        # Asymmetric signature algorithms only: HMAC family (and "none") are
+        # shared-secret/unauthenticated and must never verify an assertion.
+        ALLOWED_ALGORITHMS = %w[RS256 RS384 RS512 PS256 PS384 PS512 ES256 ES384 ES512].freeze
+
+        # iss/sub identify the client, aud prevents cross-server replay,
+        # exp bounds the assertion lifetime and jti makes it single-use
+        # (OIDC Core §9 requires all of these for private_key_jwt).
+        REQUIRED_CLAIMS = %w[iss sub aud exp jti].freeze
+
+        # Upper bound on how far in the future an assertion may expire. This
+        # both rejects sloppily long-lived assertions and bounds the replay
+        # guard's memory.
+        MAX_LIFETIME = 3600
+
+        def self.matches_request?(request)
+          params = request.request_parameters.with_indifferent_access
+
+          request.post? &&
+            params[:client_assertion].present? &&
+            params[:client_assertion_type] == CLIENT_ASSERTION_TYPE
+        end
+
+        def self.authenticate(request)
+          require_jwt!
+
+          params = request.request_parameters.with_indifferent_access
+          assertion = params[:client_assertion].to_s
+
+          client_id = unverified_client_id(assertion)
+          return if client_id.blank?
+          # RFC 7521 §4.2: a client_id parameter sent alongside the assertion
+          # must agree with the assertion's issuer.
+          return if params[:client_id].present? && params[:client_id] != client_id
+
+          application = OAuth::Client.find(client_id)&.application
+          return unless application
+
+          jwk_set = KeyResolver.jwk_set_for(application)
+          return unless jwk_set
+
+          claims = verified_claims(assertion, client_id, jwk_set, request)
+          return unless claims
+          return unless replay_guard.first_use?(
+            "#{client_id}:#{claims["jti"]}",
+            expires_at: claims["exp"].to_i,
+          )
+
+          Doorkeeper::ClientAuthentication::VerifiedCredentials.new(client_id)
+        end
+
+        # The built-in guard is process-local; a multi-process deployment can
+        # supply a shared store through the private_key_jwt_replay_guard
+        # config option.
+        def self.replay_guard
+          Doorkeeper.config.private_key_jwt_replay_guard || ReplayGuard.instance
+        end
+        private_class_method :replay_guard
+
+        # The issuer read without verifying the signature — only used to
+        # locate the client (and thereby its keys); every claim is verified
+        # against those keys before the assertion authenticates anyone.
+        def self.unverified_client_id(assertion)
+          claims, = ::JWT.decode(assertion, nil, false)
+          # A JWT payload is any JSON value, not necessarily an object, and
+          # nothing is verified at this point — so the decoded claims are
+          # type-checked before being indexed into.
+          return unless claims.is_a?(Hash)
+
+          issuer = claims["iss"]
+
+          issuer if issuer.is_a?(String) && issuer == claims["sub"]
+        rescue ::JWT::DecodeError
+          nil
+        end
+        private_class_method :unverified_client_id
+
+        def self.verified_claims(assertion, client_id, jwk_set, request)
+          claims, = ::JWT.decode(
+            assertion,
+            nil,
+            true,
+            algorithms: ALLOWED_ALGORITHMS,
+            jwks: jwk_set,
+            required_claims: REQUIRED_CLAIMS,
+            iss: client_id,
+            verify_iss: true,
+            sub: client_id,
+            verify_sub: true,
+            aud: acceptable_audiences(request),
+            verify_aud: true,
+            # Passed explicitly so a host application that globally disabled
+            # expiration checking for its own tokens (JWT.configuration.decode)
+            # cannot silently turn off assertion expiry verification.
+            verify_expiration: true,
+          )
+
+          # RFC 7519 §4.1.4: exp is a NumericDate — a number. The jwt gem's
+          # own expiration check casts it with to_i, which would let a numeric
+          # string through (and read a non-numeric one as 0), so the type is
+          # pinned before the value is compared or handed to the replay guard.
+          exp = claims["exp"]
+          return unless exp.is_a?(Numeric) && exp.finite?
+          return unless exp <= Time.now.to_i + MAX_LIFETIME
+          return unless claims["jti"].is_a?(String) && claims["jti"].present?
+
+          claims
+        rescue ::JWT::DecodeError, OpenSSL::OpenSSLError
+          # A published key is only parsed far enough to be usable when it is
+          # actually needed to verify a signature, so a structurally valid but
+          # mathematically nonsensical key (an EC point that is not on the
+          # curve, say) surfaces here as a bare OpenSSL error rather than a
+          # JWT one. Both mean the same thing: this assertion does not verify.
+          nil
+        end
+        private_class_method :verified_claims
+
+        # RFC 7523bis expects the issuer identifier as the audience; older
+        # deployments use the token endpoint URL. Both are accepted.
+        #
+        # OIDC Core §9 says the audience SHOULD be the token endpoint URL, and
+        # clients follow that for every endpoint they authenticate at — so the
+        # token endpoint URL is accepted at the revocation and introspection
+        # endpoints too, not just at the endpoint being called.
+        #
+        # The endpoint URLs are built from the server's own configured
+        # identity, never from the request: aud is what keeps an assertion
+        # minted for another authorization server from being replayed here, so
+        # deriving it from the client-supplied Host header would defeat its
+        # purpose on any deployment that does not filter hosts. Only a server
+        # that identifies itself nowhere falls back to the request, which is
+        # how MetadataResponse derives its issuer as well.
+        def self.acceptable_audiences(request)
+          options = server_url_options(request)
+
+          [
+            Doorkeeper.config.issuer.presence,
+            "#{base_url(options)}#{request.path}",
+            token_endpoint_url(options),
+          ].compact.uniq
+        end
+        private_class_method :acceptable_audiences
+
+        def self.server_url_options(request)
+          configured_url_options ||
+            { protocol: request.protocol, host: request.host, port: request.optional_port }
+        end
+        private_class_method :server_url_options
+
+        # An explicitly configured canonical host wins; failing that, the
+        # issuer, when it is an absolute URL (Doorkeeper allows any string).
+        def self.configured_url_options
+          default = ::Rails.application&.routes&.default_url_options || {}
+          return url_options_from(default) if default[:host].present?
+
+          issuer = URI.parse(Doorkeeper.config.issuer.to_s)
+          return unless issuer.is_a?(URI::HTTP) && issuer.host.present?
+
+          {
+            protocol: "#{issuer.scheme}://",
+            host: issuer.host,
+            port: (issuer.port unless issuer.port == issuer.default_port),
+          }
+        rescue URI::InvalidURIError
+          nil
+        end
+        private_class_method :configured_url_options
+
+        def self.url_options_from(default)
+          { protocol: default[:protocol] || "https://", host: default[:host], port: default[:port] }
+        end
+        private_class_method :url_options_from
+
+        def self.base_url(options)
+          protocol = options[:protocol].to_s
+          protocol = "#{protocol}://" unless protocol.end_with?("://")
+          host = options[:port].present? ? "#{options[:host]}:#{options[:port]}" : options[:host]
+
+          "#{protocol}#{host}"
+        end
+        private_class_method :base_url
+
+        # Built the way MetadataResponse advertises the token endpoint, so a
+        # host application that renamed the tokens controller still gets the
+        # URL its own metadata publishes.
+        def self.token_endpoint_url(url_options)
+          mapping = Doorkeeper::Rails::Routes.mapping[:tokens]
+          return unless mapping
+
+          ::Rails.application.routes.url_for(
+            { controller: "/#{mapping[:controllers]}", action: "create" }.merge(url_options),
+          )
+        rescue StandardError
+          # Routes may be skipped or unmounted; fall back to the other audiences.
+          nil
+        end
+        private_class_method :token_endpoint_url
+
+        # Enabling this method without the gem installed is a deployment
+        # mistake, not a protocol error the client could correct — so the
+        # explanation has to reach the operator rather than the client. A
+        # Doorkeeper::Errors::DoorkeeperError would be translated into an OAuth
+        # error response whose "error" value is its message (DoorkeeperError#type
+        # returns the message), handing the client a sentence where a registered
+        # error code belongs; LoadError keeps the diagnosis in the server's logs
+        # and surfaces the request as the server error it is.
+        def self.require_jwt!
+          require "jwt"
+        rescue LoadError
+          raise LoadError,
+                "private_key_jwt client authentication requires the 'jwt' gem (>= 2.7); " \
+                "add it to your Gemfile to use this method"
+        end
+        private_class_method :require_jwt!
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -5,13 +5,13 @@ module Doorkeeper
     module ClientCredentials
       class Creator
         def call(client, scopes, attributes = {})
-          existing_token = nil
-
-          if lookup_existing_token?
-            existing_token = find_active_existing_token_for(client, scopes, attributes)
-            return existing_token if Doorkeeper.config.reuse_access_token && existing_token&.reusable?
+          if Doorkeeper.config.reuse_access_token
+            reusable_token = find_reusable_token_for(client, scopes, attributes)
+            return reusable_token if reusable_token
           end
 
+          existing_token = find_revocable_token_for(client, scopes, attributes)
+
           with_revocation(existing_token: existing_token) do
             application = client.is_a?(Doorkeeper.config.application_model) ? client : client&.application
             Doorkeeper.config.access_token_model.create_for(
@@ -39,9 +39,16 @@ module Doorkeeper
           end
         end
 
-        def lookup_existing_token?
-          Doorkeeper.config.reuse_access_token ||
-            Doorkeeper.config.revoke_previous_client_credentials_token?
+        def find_reusable_token_for(client, scopes, attributes)
+          token = find_active_existing_token_for(client, scopes, attributes)
+
+          token if token&.reusable?
+        end
+
+        def find_revocable_token_for(client, scopes, attributes)
+          return unless Doorkeeper.config.revoke_previous_client_credentials_token?
+
+          find_active_existing_token_for(client, scopes, attributes)
         end
 
         def find_active_existing_token_for(client, scopes, attributes)
@@ -52,7 +59,16 @@ module Doorkeeper
             .extract_custom_attributes(attributes)
           Doorkeeper.config.access_token_model.matching_token_for(
             client, nil, scopes, custom_attributes: custom_attributes, include_expired: false,
-          )
+          ) do |token|
+            # RFC 8707: a token bound to another audience is a different token.
+            # It must neither be reused for this request nor revoked on its
+            # behalf, so the resource takes part in the lookup both callers use.
+            # It has to be part of the lookup rather than a check on its result,
+            # because only the newest match is returned.
+            Doorkeeper.config.access_token_model.resource_indicators_match?(
+              token, attributes[:resource],
+            )
+          end
         end
       end
     end

data/lib/doorkeeper/oauth/client_credentials_request.rb

@@ -7,21 +7,25 @@ module Doorkeeper
 
       alias error_response response
 
-      delegate :error, to: :issuer
-
       def initialize(server, client, parameters = {})
+        super()
         @client = client
         @server = server
         @response = nil
         @grant_type = Doorkeeper::OAuth::CLIENT_CREDENTIALS
         @original_scopes = parameters[:scope]
-        @parameters = parameters.except(:scope)
+        @raw_resource_indicators = parameters[:resource]
+        @parameters = parameters.except(:scope, :resource)
       end
 
       def access_token
         issuer.token
       end
 
+      def error
+        @resource_indicator_error || issuer.error
+      end
+
       def issuer
         @issuer ||= ClientCredentials::Issuer.new(
           server,
@@ -32,14 +36,41 @@ module Doorkeeper
       private
 
       def valid?
-        issuer.create(client, scopes, custom_token_attributes_with_data)
+        validate_resource_indicators && issuer.create(client, scopes, custom_token_attributes_with_data)
+      end
+
+      def validate_resource_indicators
+        validator = Doorkeeper.config.resource_indicator_validator
+        return true unless validator
+        return true if @raw_resource_indicators.blank?
+
+        @resolved_resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+        )
+        true
+      rescue Errors::InvalidTarget
+        @resource_indicator_error = Errors::InvalidTarget
+        false
       end
 
       def custom_token_attributes_with_data
-        parameters
+        attrs = parameters
           .with_indifferent_access
           .slice(*Doorkeeper.config.custom_access_token_attributes)
           .symbolize_keys
+
+        # RFC 8707: attach validated resource indicators to token attributes
+        if @resolved_resource_indicators.present?
+          unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+            raise Errors::MissingResourceColumn, "oauth_access_tokens"
+          end
+
+          attrs[:resource] = @resolved_resource_indicators.join(" ")
+        end
+
+        attrs
       end
     end
   end

data/lib/doorkeeper/oauth/code_response.rb

@@ -28,17 +28,22 @@ module Doorkeeper
             token_type: auth.token.token_type,
             expires_in: auth.token.expires_in_seconds,
             state: pre_auth.state,
-          }
+          }.merge(iss_parameter)
         elsif auth.try(:access_grant?)
           {
             code: auth.token.plaintext_token,
             state: pre_auth.state,
-          }
+          }.merge(iss_parameter)
         end
       end
 
       def redirect_uri
         if URIChecker.oob_uri?(pre_auth.redirect_uri)
+          # Out-of-band "redirects" render the code/token on an authorization
+          # server page for the user to copy manually; there is no redirect
+          # back to the client. RFC 9207 scopes the iss parameter to the
+          # authorization response sent to the client, so - like state, which
+          # oob_redirect also omits - iss is intentionally not carried here.
           auth.oob_redirect
         elsif response_on_fragment
           Authorization::URIBuilder.uri_with_fragment(pre_auth.redirect_uri, body)
@@ -46,6 +51,15 @@ module Doorkeeper
           Authorization::URIBuilder.uri_with_query(pre_auth.redirect_uri, body)
         end
       end
+
+      private
+
+      # RFC 9207 Authorization Server Issuer Identification: advertise the
+      # issuer in the authorization response only when an issuer is configured.
+      def iss_parameter
+        issuer = Doorkeeper.config.issuer
+        issuer.present? ? { iss: issuer } : {}
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/error_response.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     class ErrorResponse < BaseResponse
       include OAuth::Helpers
 
-      NON_REDIRECTABLE_STATES = %i[invalid_redirect_uri invalid_client unauthorized_client].freeze
+      NON_REDIRECTABLE_STATES = %i[invalid_redirect_uri invalid_client].freeze
 
       def self.from_request(request, attributes = {})
         new(
@@ -38,6 +38,7 @@ module Doorkeeper
         @exception_class = attributes[:exception_class]
         @redirect_uri = attributes[:redirect_uri]
         @response_on_fragment = attributes[:response_on_fragment]
+        @issuer = attributes[:issuer]
       end
 
       def body
@@ -45,11 +46,19 @@ module Doorkeeper
           error: name,
           error_description: description,
           state: state,
+          # RFC 9207 scopes the issuer to authorization error responses sent to
+          # the client, i.e. the ones redirected back to its redirect_uri. It is
+          # supplied only by the authorization endpoint (never token,
+          # introspection or protected resource), and gated on redirectable? so
+          # non-redirectable errors (invalid_client, invalid_redirect_uri) and
+          # out-of-band flows - which render to the user instead of redirecting
+          # to the client - do not carry it. Blank values are dropped below.
+          iss: (@issuer if redirectable?),
         }.reject { |_, v| v.blank? }
       end
 
       def status
-        if name == :invalid_client || name == :unauthorized_client
+        if name == :invalid_client
           :unauthorized
         else
           :bad_request