doorkeeper 5.9.5 → 6.0.0.beta2

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -15,27 +15,42 @@ module Doorkeeper
           false
         end
 
+        # RFC6749, Section 3.1.2.3 requires the requested redirect URI to be
+        # compared to the registered redirect URIs using the simple string
+        # comparison defined in RFC3986, Section 6.2.1.
+        # @see https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.3
         def self.matches?(url, client_url)
+          return true if url == client_url
+
+          # RFC8252, Paragraph 7.3 allows the port of loopback interface
+          # redirect URIs to vary at runtime, so it is ignored when both
+          # URIs point to the loopback interface.
+          # @see https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
           url = as_uri(url)
           client_url = as_uri(client_url)
 
-          unless client_url.query.nil?
-            return false unless query_matches?(url.query, client_url.query)
-
-            # Clear out queries so rest of URI can be tested. This allows query
-            # params to be in the request but order not mattering.
-            client_url.query = nil
-          end
+          return false unless loopback_uri?(url) && loopback_uri?(client_url)
 
-          # RFC8252, Paragraph 7.3
-          # @see https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
-          if loopback_uri?(url) && loopback_uri?(client_url)
-            url.port = nil
-            client_url.port = nil
-          end
+          urls_match?(url, client_url)
+        rescue URI::InvalidURIError
+          false
+        end
 
-          url.query = nil
-          url == client_url
+        # RFC 8252 §7.3 lets only the PORT of a loopback redirect URI vary at
+        # runtime. Compare every other component explicitly instead of blanking
+        # the port and comparing the reassembled strings: `URI#port=` also
+        # clears the userinfo on Ruby >= 4.0, which would let
+        # `http://attacker@127.0.0.1/cb` match a registered
+        # `http://127.0.0.1/cb`. Comparing components (not `URI#==`) also keeps
+        # the exception from widening past the port — e.g. an empty path is not
+        # treated as equal to "/".
+        def self.urls_match?(url, client_url)
+          url.scheme == client_url.scheme &&
+            url.userinfo == client_url.userinfo &&
+            url.host == client_url.host &&
+            url.path == client_url.path &&
+            url.query == client_url.query &&
+            url.fragment == client_url.fragment
         end
 
         def self.loopback_uri?(uri)
@@ -45,6 +60,11 @@ module Doorkeeper
         end
 
         def self.valid_for_authorization?(url, client_url)
+          # client_url is blank when the application was registered without a
+          # redirect URI (allow_blank_redirect_uri) — no possible match for
+          # redirection based OAuth flows, not an error.
+          return false if client_url.blank?
+
           valid?(url) && client_url.split.any? { |other_url| matches?(url, other_url) }
         end
 
@@ -52,14 +72,6 @@ module Doorkeeper
           URI.parse(url)
         end
 
-        def self.query_matches?(query, client_query)
-          return true if client_query.blank? && query.blank?
-          return false if client_query.nil? || query.nil?
-
-          # Will return true independent of query order
-          client_query.split("&").sort == query.split("&").sort
-        end
-
         def self.valid_scheme?(uri)
           return false if uri.scheme.blank?
 

data/lib/doorkeeper/oauth/metadata_response.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    # OAuth 2.0 Authorization Server Metadata response as described in
+    # RFC 8414 (https://www.rfc-editor.org/rfc/rfc8414).
+    class MetadataResponse < BaseResponse
+      def initialize(base_url, url_builder)
+        super()
+        @base_url = base_url
+        @url_builder = url_builder
+      end
+
+      def body
+        @body ||= begin
+          data = {
+            # presence: a blank issuer (e.g. an unset env var) must fall back
+            # to base_url, matching the issuer.present? condition below so the
+            # two fields cannot disagree.
+            issuer: issuer.presence || @base_url,
+            # Only advertise endpoints whose controllers are installed. A
+            # controller disabled through skip_controllers has no routes mapping,
+            # so endpoint_for resolves it to nil and it is dropped below.
+            authorization_endpoint: authorization_endpoint,
+            token_endpoint: token_endpoint,
+            revocation_endpoint: revocation_endpoint,
+            introspection_endpoint: (introspection_endpoint if introspection_enabled?),
+            scopes_supported: scopes_supported,
+            response_types_supported: response_types_supported,
+            response_modes_supported: response_modes_supported,
+            grant_types_supported: grant_types_supported,
+            token_endpoint_auth_methods_supported: token_endpoint_auth_methods_supported,
+            code_challenge_methods_supported: code_challenge_methods_supported,
+            # RFC 9207: true only when an issuer is configured, matching the
+            # condition under which the iss parameter is emitted. false survives
+            # the compaction below, so it is advertised explicitly.
+            authorization_response_iss_parameter_supported: config.issuer.present?,
+            # RFC 8707: advertise resource indicator support when configured.
+            resource_indicators_supported: resource_indicators_supported?,
+          }
+          data.compact!
+
+          # userinfo_endpoint is intentionally advertised as null for backwards
+          # compatibility; it is meant to be populated through custom_metadata
+          # (e.g. by an OIDC extension), so it must survive the compaction above.
+          data[:userinfo_endpoint] = userinfo_endpoint
+
+          data.merge(custom_metadata)
+        end
+      end
+
+      def status
+        :ok
+      end
+
+      def headers
+        {
+          "Cache-Control" => "public",
+          "Content-Type" => "application/json; charset=utf-8",
+        }
+      end
+
+      private
+
+      def config
+        @config ||= Doorkeeper.configuration
+      end
+
+      def url_for(**args)
+        @url_builder.call(**args)
+      end
+
+      # Resolve the URL for the given route group, or nil when the group has no
+      # routes mapping (i.e. the controller was disabled via skip_controllers).
+      def endpoint_for(group, action:)
+        mapping = Doorkeeper::Rails::Routes.mapping[group]
+        return unless mapping
+
+        # The leading slash anchors the controller name: without it, Rails
+        # resolves the name relative to the current (doorkeeper/metadata)
+        # namespace whenever their segment depths differ, e.g. a configured
+        # `controllers tokens: "custom_tokens"` would be looked up as
+        # "doorkeeper/custom_tokens" and raise ActionController::UrlGenerationError.
+        url_for(controller: "/#{mapping[:controllers]}", action: action)
+      end
+
+      def custom_metadata
+        config.custom_metadata.symbolize_keys
+      end
+
+      def issuer
+        config.issuer
+      end
+
+      def authorization_endpoint
+        endpoint_for(:authorizations, action: "new")
+      end
+
+      def token_endpoint
+        endpoint_for(:tokens, action: "create")
+      end
+
+      def userinfo_endpoint
+        nil
+      end
+
+      def revocation_endpoint
+        endpoint_for(:tokens, action: "revoke")
+      end
+
+      def introspection_endpoint
+        endpoint_for(:tokens, action: "introspect")
+      end
+
+      def introspection_enabled?
+        Doorkeeper.configured? &&
+          !config.allow_token_introspection.is_a?(FalseClass)
+      end
+
+      def scopes_supported
+        config.scopes.to_a
+      end
+
+      def response_types_supported
+        config.authorization_response_types
+      end
+
+      def response_modes_supported
+        config.authorization_response_flows.flat_map(&:response_mode_matches).uniq
+      end
+
+      def grant_types_supported
+        # RFC 8414 lists token-endpoint grant type values (e.g.
+        # "authorization_code", "refresh_token"), so derive them from the
+        # flows that actually handle a grant_type and use their grant_type
+        # value rather than the configured flow name. This drops
+        # response-type-only flows such as :implicit and reports the real
+        # grant type for flows whose name differs from it (e.g. a URN).
+        config.token_grant_types
+      end
+
+      # The resolved methods (rather than the raw client_authentication names)
+      # reflect what the server actually accepts: unregistered names are
+      # dropped by the resolver, and a deprecated client_credentials-only
+      # configuration is honored as the source of truth. Legacy callable
+      # extractors have no registered method name a client could use, so they
+      # are not advertised.
+      def token_endpoint_auth_methods_supported
+        config.client_authentication_methods.filter_map do |method|
+          method.name.to_s if Doorkeeper::ClientAuthentication.get(method.name)
+        end
+      end
+
+      def code_challenge_methods_supported
+        config.pkce_code_challenge_methods_supported
+      end
+
+      def resource_indicators_supported?
+        config.resource_indicator_validator.present? &&
+          Doorkeeper.config.access_grant_model.resource_indicators_supported? &&
+          Doorkeeper.config.access_token_model.resource_indicators_supported?
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -9,10 +9,12 @@ module Doorkeeper
       validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
       validate :resource_owner, error: Errors::InvalidGrant
       validate :scopes, error: Errors::InvalidScope
+      validate :resource_indicators, error: Errors::InvalidTarget
 
       attr_reader :client, :credentials, :resource_owner, :parameters, :access_token
 
       def initialize(server, client, credentials, resource_owner, parameters = {})
+        super()
         @server          = server
         @resource_owner  = resource_owner
         @client          = client
@@ -20,12 +22,21 @@ module Doorkeeper
         @parameters      = parameters
         @original_scopes = parameters[:scope]
         @grant_type      = Doorkeeper::OAuth::PASSWORD
+        @raw_resource_indicators = parameters[:resource]
       end
 
       private
 
       def before_successful_response
-        find_or_create_access_token(client, resource_owner, scopes, {}, server)
+        token_attributes = {}
+        if @resolved_resource_indicators.present?
+          unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+            raise Errors::MissingResourceColumn, "oauth_access_tokens"
+          end
+
+          token_attributes[:resource] = @resolved_resource_indicators.join(" ")
+        end
+        find_or_create_access_token(client, resource_owner, scopes, token_attributes, server)
         super
       end
 
@@ -70,6 +81,21 @@ module Doorkeeper
       def validate_client_supports_grant_flow
         Doorkeeper.config.allow_grant_flow_for_client?(grant_type, client&.application)
       end
+
+      # RFC 8707: validate resource indicators against server policy.
+      def validate_resource_indicators
+        validator = Doorkeeper.config.resource_indicator_validator
+        return true unless validator
+
+        @resolved_resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+        )
+        true
+      rescue Errors::InvalidTarget
+        false
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -7,20 +7,21 @@ module Doorkeeper
 
       validate :client_id, error: Errors::InvalidRequest
       validate :client, error: Errors::InvalidClient
-      validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
-      validate :resource_owner_authorize_for_client, error: Errors::InvalidClient
       validate :redirect_uri, error: Errors::InvalidRedirectUri
+      validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
+      validate :resource_owner_authorize_for_client, error: Errors::AccessDenied
       validate :params, error: Errors::InvalidRequest
       validate :response_type, error: Errors::UnsupportedResponseType
       validate :response_mode, error: Errors::UnsupportedResponseMode
       validate :scopes, error: Errors::InvalidScope
       validate :code_challenge, error: Errors::InvalidRequest
       validate :code_challenge_method, error: Errors::InvalidCodeChallengeMethod
+      validate :resource_indicators, error: Errors::InvalidTarget
 
       attr_reader :client, :code_challenge, :code_challenge_method, :missing_param,
                   :redirect_uri, :resource_owner, :response_type, :state,
                   :authorization_response_flow, :response_mode, :custom_access_token_attributes,
-                  :invalid_request_reason
+                  :invalid_request_reason, :resource_indicators
 
       def initialize(server, parameters = {}, resource_owner = nil)
         @server = server
@@ -34,6 +35,7 @@ module Doorkeeper
         @code_challenge_method = parameters[:code_challenge_method]
         @resource_owner = resource_owner
         @custom_access_token_attributes = parameters.slice(*Doorkeeper.config.custom_access_token_attributes).to_h
+        @raw_resource_indicators = parameters[:resource]
       end
 
       def authorizable?
@@ -49,13 +51,21 @@ module Doorkeeper
       end
 
       def error_response
+        # RFC 9207: authorization error responses advertise the issuer. Passing
+        # the configured issuer here (nil when unset) scopes the iss parameter
+        # to the authorization endpoint only.
         if error == Errors::InvalidRequest
           OAuth::InvalidRequestResponse.from_request(
             self,
             response_on_fragment: response_on_fragment?,
+            issuer: Doorkeeper.config.issuer,
           )
         else
-          OAuth::ErrorResponse.from_request(self, response_on_fragment: response_on_fragment?)
+          OAuth::ErrorResponse.from_request(
+            self,
+            response_on_fragment: response_on_fragment?,
+            issuer: Doorkeeper.config.issuer,
+          )
         end
       end
 
@@ -76,7 +86,7 @@ module Doorkeeper
         if client_scopes.blank?
           server.default_scopes.to_s
         else
-          server.default_scopes.allowed(client_scopes).to_s
+          server.default_scopes.common(client_scopes).to_s
         end
       end
 
@@ -115,7 +125,21 @@ module Doorkeeper
                            :scope
                          end
 
-        @missing_param.nil?
+        return false unless @missing_param.nil?
+
+        # A structured `scope` (e.g. `scope[a]=b`, parsed by Rack into a Hash)
+        # is malformed (RFC 6749 §3.3). Reject it here — before validate_scopes
+        # reaches Scopes.from_string — so the authorization endpoint answers
+        # invalid_request instead of letting the raised error surface as a 500.
+        # Set a reason so the error_description is not translated from nil.
+        return true if scope_param_well_formed?
+
+        @invalid_request_reason = :unknown
+        false
+      end
+
+      def scope_param_well_formed?
+        @scope.nil? || @scope.is_a?(String)
       end
 
       def validate_response_type
@@ -147,7 +171,14 @@ module Doorkeeper
 
       def validate_code_challenge
         return true unless Doorkeeper.config.force_pkce?
-        return true if client.confidential
+        # PKCE (RFC 7636) protects the exchange of an authorization code, so
+        # a code_challenge is only required from response types that issue one
+        # ("code" and code-carrying hybrid types like "code id_token"). For
+        # response types that never issue a code (e.g. "token" or an OIDC
+        # extension's "id_token"), there is no token-endpoint exchange where a
+        # verifier could ever be checked, so requiring a challenge would
+        # reject those requests over a parameter that cannot be validated.
+        return true unless code_issuing_response_type?
         return true if code_challenge.present?
 
         @invalid_request_reason = :invalid_code_challenge
@@ -161,6 +192,21 @@ module Doorkeeper
           (code_challenge_method.present? && Doorkeeper.config.pkce_code_challenge_methods_supported.include?(code_challenge_method))
       end
 
+      def validate_resource_indicators
+        validator = Doorkeeper.config.resource_indicator_validator
+        # When no validator is configured, resource indicators are ignored (feature disabled)
+        return true unless validator
+
+        @resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+        )
+        true
+      rescue Errors::InvalidTarget
+        false
+      end
+
       def response_on_fragment?
         return response_type == "token" if response_mode.nil?
 
@@ -171,6 +217,15 @@ module Doorkeeper
         response_type == "code" ? AUTHORIZATION_CODE : IMPLICIT
       end
 
+      # Whether the requested response type issues an authorization code.
+      # Multi-valued response types (OIDC hybrid flows registered by
+      # extensions, e.g. "code id_token") are space-delimited per OAuth 2.0
+      # Multiple Response Type Encoding Practices, so a token-wise check also
+      # covers response types Doorkeeper itself does not ship.
+      def code_issuing_response_type?
+        response_type.to_s.split.include?("code")
+      end
+
       def pre_auth_hash
         {
           client_id: client.uid,
@@ -180,7 +235,7 @@ module Doorkeeper
           scope: scope,
           client_name: client.name,
           status: I18n.t("doorkeeper.pre_authorization.status"),
-        }
+        }.reverse_merge(custom_access_token_attributes.symbolize_keys)
       end
     end
   end

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -10,6 +10,7 @@ module Doorkeeper
       validate :client,       error: Errors::InvalidClient
       validate :client_match, error: Errors::InvalidGrant
       validate :scope,        error: Errors::InvalidScope
+      validate :resource_indicators, error: Errors::InvalidTarget
 
       attr_reader :access_token, :client, :credentials, :refresh_token
       attr_reader :missing_param
@@ -21,13 +22,21 @@ module Doorkeeper
         @grant_type = Doorkeeper::OAuth::REFRESH_TOKEN
         @original_scopes = parameters[:scope] || parameters[:scopes]
         @refresh_token_parameter = parameters[:refresh_token]
+        @raw_resource_indicators = parameters[:resource]
         @client = load_client(credentials) if credentials
       end
 
       private
 
+      # Resolved through +OAuth::Client+ rather than by looking the row up
+      # directly, so this grant applies the same rules the other token
+      # endpoint grants do: credentials that carry no secret because their
+      # authentication method already proved the client's identity
+      # (private_key_jwt) resolve by uid alone. The application record is
+      # what is returned, since that is what +#client+ has always exposed
+      # here.
       def load_client(credentials)
-        Doorkeeper.config.application_model.by_uid_and_secret(credentials.uid, credentials.secret)
+        Doorkeeper::OAuth::Client.authenticate(credentials)&.application
       end
 
       def before_successful_response
@@ -74,6 +83,19 @@ module Doorkeeper
           attributes[:previous_refresh_token] = refresh_token.refresh_token
         end
 
+        # RFC 8707: carry resource indicators to the new access token.
+        # If the refresh request specified a (subset of) resource(s), use those;
+        # otherwise inherit from the refresh token itself.
+        if @resolved_resource_indicators.present?
+          unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+            raise Errors::MissingResourceColumn, "oauth_access_tokens"
+          end
+
+          attributes[:resource] = @resolved_resource_indicators.join(" ")
+        elsif refresh_token.try(:resource).present?
+          attributes[:resource] = refresh_token.resource
+        end
+
         # RFC6749
         # 1.5.  Refresh Token
         #
@@ -132,6 +154,34 @@ module Doorkeeper
         end
       end
 
+      # RFC 8707: resource indicators on refresh must be a subset of those
+      # bound to the original refresh token (which inherited from the grant).
+      #
+      # Subset and syntax enforcement run even when no validator is configured
+      # as long as the original token is already audience-restricted: a refresh
+      # must never widen the audience beyond what the original token carried.
+      # Only when the feature is disabled AND the original token has no stored
+      # resources is the `resource` parameter ignored entirely.
+      def validate_resource_indicators
+        original_resources = refresh_token.try(:resource)&.split
+
+        validator = Doorkeeper.config.resource_indicator_validator
+
+        # Feature effectively off: no validator and nothing already bound to
+        # enforce against. Ignore the `resource` parameter.
+        return true if validator.nil? && original_resources.blank?
+
+        @resolved_resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+          grant_resource_indicators: original_resources,
+        )
+        true
+      rescue Errors::InvalidTarget
+        false
+      end
+
       def custom_token_attributes_with_data
         refresh_token
           .attributes

data/lib/doorkeeper/oauth/resource_indicator_validator.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Doorkeeper
+  module OAuth
+    # Validates the `resource` parameter per RFC 8707.
+    #
+    # The `resource` value MUST be an absolute URI without a fragment component.
+    # Multiple `resource` parameters MAY be present.
+    #
+    # @see https://datatracker.ietf.org/doc/html/rfc8707#section-2
+    module ResourceIndicatorValidator
+      module_function
+
+      # Validates and normalizes an array of resource indicator values.
+      #
+      # @param resource_indicators [Array<String>, String, nil] One or more resource URIs
+      # @param config_validator [Proc, nil] Custom validator from configuration
+      # @param client [Doorkeeper::OAuth::Client, nil] The requesting client
+      # @param grant_resource_indicators [Array<String>, nil] Resource indicators from the
+      #   original authorization grant (for subset enforcement on token requests)
+      #
+      # @return [Array<String>] Validated resource indicator URIs
+      # @raise [Doorkeeper::Errors::InvalidTarget] When validation fails
+      def validate!(resource_indicators, config_validator: nil, client: nil, grant_resource_indicators: nil)
+        return [] if resource_indicators.blank?
+
+        indicators = Array.wrap(resource_indicators).reject(&:blank?).uniq
+        return [] if indicators.empty?
+
+        indicators.each { |uri| validate_uri!(uri) }
+
+        # If the token request specifies resources, they must be a subset of those
+        # originally granted (RFC 8707 §2.2).
+        raise Errors::InvalidTarget if grant_resource_indicators.present? && (indicators - grant_resource_indicators).any?
+
+        # Custom server policy validation
+        raise Errors::InvalidTarget if config_validator && !config_validator.call(indicators, client)
+
+        indicators
+      end
+
+      # @return [Boolean] true when the values are syntactically valid
+      def valid?(resource_indicators)
+        return true if resource_indicators.blank?
+
+        Array(resource_indicators).reject(&:blank?).all? { |uri| valid_uri?(uri) }
+      end
+
+      def valid_uri?(uri)
+        return false unless uri.is_a?(String)
+
+        parsed = URI.parse(uri)
+        # MUST be absolute URI
+        return false unless parsed.absolute?
+        # MUST NOT include a fragment
+        return false if parsed.fragment
+
+        true
+      rescue URI::InvalidURIError, TypeError
+        false
+      end
+
+      def validate_uri!(uri)
+        raise Errors::InvalidTarget unless valid_uri?(uri)
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/scopes.rb

@@ -10,6 +10,14 @@ module Doorkeeper
 
       def self.from_string(string)
         string ||= ""
+
+        # A non-string scope (e.g. `scope[a]=b`, parsed by Rack into a Hash)
+        # has no octets to split into tokens. Reject it as a malformed request
+        # (RFC 6749 §3.3); at the token endpoint TokensController's rescue_from
+        # turns this into invalid_request. Callers that always pass a string
+        # (the model layer) never hit this.
+        raise Errors::InvalidScopeParameter, "scope must be a String" unless string.is_a?(String)
+
         new.tap do |scope|
           scope.add(*string.split)
         end
@@ -92,6 +100,23 @@ module Doorkeeper
         self.class.from_array(filtered_scopes)
       end
 
+      # Returns the scopes present in both sets, taking dynamic scopes
+      # into account: a dynamic scope pattern (e.g. `user:*`) on either
+      # side matches the concrete scope (e.g. `user:1`) on the other,
+      # and the concrete scope is what ends up in the result. Unlike
+      # #allowed, the same scopes are returned regardless of which set is
+      # the receiver, though the order may differ: scopes matched from the
+      # argument come first, followed by any scope only the receiver
+      # contributes (a concrete scope matched by a pattern in the argument).
+      #
+      # @param other The set of scopes to intersect with
+      def common(other)
+        other = self.class.from_array(to_array(other))
+        matched = other.select { |scope| exists?(scope) } +
+                  select { |scope| other.exists?(scope) }
+        self.class.from_array(matched)
+      end
+
       private
 
       def dynamic_scopes_enabled?