doorkeeper 5.9.5 → 6.0.0.beta2

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.9.5
+  version: 6.0.0.beta2
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-08-07 00:00:00.000000000 Z
+date: 2026-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -125,6 +125,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -167,6 +181,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Doorkeeper is an OAuth 2 provider for Rails and Grape.
 email:
 - bulaj.nikita@gmail.com
@@ -184,6 +212,7 @@ files:
 - app/controllers/doorkeeper/applications_controller.rb
 - app/controllers/doorkeeper/authorizations_controller.rb
 - app/controllers/doorkeeper/authorized_applications_controller.rb
+- app/controllers/doorkeeper/metadata_controller.rb
 - app/controllers/doorkeeper/token_info_controller.rb
 - app/controllers/doorkeeper/tokens_controller.rb
 - app/helpers/doorkeeper/dashboard_helper.rb
@@ -203,10 +232,18 @@ files:
 - app/views/layouts/doorkeeper/application.html.erb
 - config/locales/en.yml
 - lib/doorkeeper.rb
+- lib/doorkeeper/client_authentication.rb
+- lib/doorkeeper/client_authentication/credentials.rb
+- lib/doorkeeper/client_authentication/fallback_method.rb
+- lib/doorkeeper/client_authentication/legacy_callable.rb
+- lib/doorkeeper/client_authentication/method.rb
+- lib/doorkeeper/client_authentication/registry.rb
+- lib/doorkeeper/client_authentication/verified_credentials.rb
 - lib/doorkeeper/config.rb
 - lib/doorkeeper/config/abstract_builder.rb
 - lib/doorkeeper/config/option.rb
 - lib/doorkeeper/config/validations.rb
+- lib/doorkeeper/document_cache.rb
 - lib/doorkeeper/engine.rb
 - lib/doorkeeper/errors.rb
 - lib/doorkeeper/grant_flow.rb
@@ -216,6 +253,7 @@ files:
 - lib/doorkeeper/grape/authorization_decorator.rb
 - lib/doorkeeper/grape/helpers.rb
 - lib/doorkeeper/helpers/controller.rb
+- lib/doorkeeper/http_fetcher.rb
 - lib/doorkeeper/models/access_grant_mixin.rb
 - lib/doorkeeper/models/access_token_mixin.rb
 - lib/doorkeeper/models/application_mixin.rb
@@ -240,7 +278,12 @@ files:
 - lib/doorkeeper/oauth/base_request.rb
 - lib/doorkeeper/oauth/base_response.rb
 - lib/doorkeeper/oauth/client.rb
-- lib/doorkeeper/oauth/client/credentials.rb
+- lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb
+- lib/doorkeeper/oauth/client_authentication/client_secret_post.rb
+- lib/doorkeeper/oauth/client_authentication/none.rb
+- lib/doorkeeper/oauth/client_authentication/private_key_jwt.rb
+- lib/doorkeeper/oauth/client_authentication/private_key_jwt/key_resolver.rb
+- lib/doorkeeper/oauth/client_authentication/private_key_jwt/replay_guard.rb
 - lib/doorkeeper/oauth/client_credentials/creator.rb
 - lib/doorkeeper/oauth/client_credentials/issuer.rb
 - lib/doorkeeper/oauth/client_credentials/validator.rb
@@ -256,12 +299,13 @@ files:
 - lib/doorkeeper/oauth/hooks/context.rb
 - lib/doorkeeper/oauth/invalid_request_response.rb
 - lib/doorkeeper/oauth/invalid_token_response.rb
+- lib/doorkeeper/oauth/metadata_response.rb
 - lib/doorkeeper/oauth/nonstandard.rb
 - lib/doorkeeper/oauth/password_access_token_request.rb
 - lib/doorkeeper/oauth/pre_authorization.rb
 - lib/doorkeeper/oauth/refresh_token_request.rb
+- lib/doorkeeper/oauth/resource_indicator_validator.rb
 - lib/doorkeeper/oauth/scopes.rb
-- lib/doorkeeper/oauth/stateless_token.rb
 - lib/doorkeeper/oauth/token.rb
 - lib/doorkeeper/oauth/token_introspection.rb
 - lib/doorkeeper/oauth/token_request.rb
@@ -305,17 +349,21 @@ files:
 - lib/generators/doorkeeper/application_owner_generator.rb
 - lib/generators/doorkeeper/confidential_applications_generator.rb
 - lib/generators/doorkeeper/enable_polymorphic_resource_owner_generator.rb
+- lib/generators/doorkeeper/grant_reuse_revocation_generator.rb
 - lib/generators/doorkeeper/install_generator.rb
 - lib/generators/doorkeeper/migration_generator.rb
 - lib/generators/doorkeeper/pkce_generator.rb
 - lib/generators/doorkeeper/previous_refresh_token_generator.rb
 - lib/generators/doorkeeper/remove_applications_secret_not_null_constraint_generator.rb
+- lib/generators/doorkeeper/resource_indicators_generator.rb
 - lib/generators/doorkeeper/templates/README
+- lib/generators/doorkeeper/templates/add_access_token_to_access_grants.rb.erb
 - lib/generators/doorkeeper/templates/add_confidential_to_applications.rb.erb
 - lib/generators/doorkeeper/templates/add_owner_to_application_migration.rb.erb
 - lib/generators/doorkeeper/templates/add_previous_refresh_token_to_access_tokens.rb.erb
 - lib/generators/doorkeeper/templates/enable_pkce_migration.rb.erb
 - lib/generators/doorkeeper/templates/enable_polymorphic_resource_owner_migration.rb.erb
+- lib/generators/doorkeeper/templates/enable_resource_indicators_migration.rb.erb
 - lib/generators/doorkeeper/templates/initializer.rb
 - lib/generators/doorkeeper/templates/migration.rb.erb
 - lib/generators/doorkeeper/templates/remove_applications_secret_not_null_constraint.rb.erb

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -1,71 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  module OAuth
-    class Client
-      Credentials = Struct.new(:uid, :secret) do
-        class << self
-          # Extracts the client credentials from the request using the
-          # configured extraction methods. The first method that yields
-          # credentials wins, as it always has.
-          #
-          # Raises Errors::MultipleClientAuthMethods when the request
-          # authenticates the client with more than one method, which RFC 6749
-          # §2.3 forbids ("The client MUST NOT use more than one authentication
-          # method in each request").
-          def from_request(request, *credentials_methods)
-            # Callable extractors are opaque: they may legitimately overlap the
-            # built-in methods they are configured with, and evaluating all of
-            # them would also break the existing contract that the extractors
-            # after the matching one are not called. Such configurations keep
-            # the historical behaviour untouched.
-            return first_from_request(request, credentials_methods) unless credentials_methods.all?(Symbol)
-
-            credentials = credentials_methods.filter_map { |method| extract(request, method) }
-
-            # Only credentials carrying a secret authenticate the client. A bare
-            # uid is a public client identifying itself (RFC 6749 §2.3 "none"),
-            # not an authentication method of its own, so it doesn't count
-            # towards the single-method rule — RFC 7521 §4.2, for example,
-            # explicitly allows a client_id next to another authentication
-            # method.
-            raise Errors::MultipleClientAuthMethods if credentials.count { |c| c.secret.present? } > 1
-
-            credentials.first
-          end
-
-          def from_params(request)
-            request.parameters.values_at(:client_id, :client_secret)
-          end
-
-          def from_basic(request)
-            authorization = request.authorization
-            if authorization.present? && authorization =~ /^Basic (.*)/im
-              Base64.decode64(Regexp.last_match(1)).split(/:/, 2)
-            end
-          end
-
-          private
-
-          def first_from_request(request, credentials_methods)
-            credentials_methods.inject(nil) do |_, method|
-              credentials = extract(request, method)
-              break credentials if credentials
-            end
-          end
-
-          # Returns the credentials the given method extracts from the request,
-          # or nil when it extracts none.
-          def extract(request, method)
-            method = self.method(method) if method.is_a?(Symbol)
-            Credentials.new(*method.call(request)).presence
-          end
-        end
-
-        # Public clients may have their secret blank, but "credentials" are
-        # still present
-        delegate :blank?, to: :uid
-      end
-    end
-  end
-end

data/lib/doorkeeper/oauth/stateless_token.rb

@@ -1,139 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  module OAuth
-    # In-memory representation of a verified JWT access token. Returned by
-    # OAuth::Token.authenticate when stateless_jwt_tokens is enabled, so that
-    # the existing doorkeeper_token / doorkeeper_authorize! helpers work
-    # without any database read.
-    #
-    # Stateless tokens cannot be revoked or refreshed server-side: #revoked?
-    # is always false and #revoke is a no-op. Rely on short token lifetimes
-    # (access_token_expires_in) for early invalidation.
-    class StatelessToken
-      attr_reader :claims, :application, :raw_token
-
-      def initialize(claims:, application: nil, raw_token: nil)
-        @claims = claims
-        @application = application
-        @raw_token = raw_token
-      end
-
-      def token_type
-        "Bearer"
-      end
-
-      # The raw token string. Used by introspection's
-      # authorized_token_matches_introspected? security check.
-      def token
-        @raw_token
-      end
-
-      # Issuance path: the freshly-signed JWT returned to the client.
-      def plaintext_token
-        @raw_token
-      end
-
-      def plaintext_refresh_token
-        nil
-      end
-
-      def resource_owner_id
-        claims["resource_owner_id"] || claims["sub"]
-      end
-
-      def application_id
-        application&.id
-      end
-
-      def scopes_string
-        claims["scope"].to_s
-      end
-
-      def scopes
-        OAuth::Scopes.from_string(scopes_string)
-      end
-
-      def includes_scope?(*required_scopes)
-        required_scopes.blank? || required_scopes.any? { |scope| scopes.exists?(scope.to_s) }
-      end
-
-      def custom_attributes
-        claims.slice(*Doorkeeper.config.custom_access_token_attributes.map(&:to_s))
-      end
-
-      # RFC 8707 resource indicator. Stored as a space-delimited string to
-      # match the AccessToken column shape consumed by token_introspection.
-      def resource
-        aud = claims["aud"]
-        return nil if aud.blank?
-
-        aud.is_a?(Array) ? aud.join(" ") : aud.to_s
-      end
-
-      def created_at
-        Time.at(claims["iat"].to_i).utc
-      end
-
-      def expires_in
-        claims["expires_in"]
-      end
-
-      def expires_at
-        return nil unless claims["exp"]
-
-        Time.at(claims["exp"].to_i).utc
-      end
-
-      def expires_in_seconds
-        return nil unless expires_at
-
-        expires = expires_at - Time.now.utc
-        sec = expires.seconds.round(0)
-        sec > 0 ? sec : 0
-      end
-
-      def expired?
-        return false unless expires_at
-
-        Time.now.utc > expires_at
-      end
-
-      def revoked?
-        false
-      end
-
-      def accessible?
-        !expired? && !revoked?
-      end
-
-      def acceptable?(required_scopes)
-        accessible? && includes_scope?(*required_scopes)
-      end
-
-      def revoke_previous_refresh_token!
-        # no-op: stateless tokens carry no refresh-token chain to revoke.
-      end
-
-      def revoke
-        # no-op: stateless tokens cannot be revoked server-side.
-      end
-
-      def revocable?
-        false
-      end
-
-      def as_json(_options = {})
-        {
-          resource_owner_id: resource_owner_id,
-          scope: scopes,
-          expires_in: expires_in_seconds,
-          application: { uid: application.try(:uid) },
-          created_at: created_at.to_i,
-        }.tap do |json|
-          json[:resource_owner_type] = claims["resource_owner_type"] if Doorkeeper.configuration.polymorphic_resource_owner?
-        end
-      end
-    end
-  end
-end