doorkeeper 5.9.9 → 6.0.0.beta1

data/lib/doorkeeper/oauth/client_authentication/client_secret_post.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    module ClientAuthentication
+      # RFC 6749 §2.3.1 "client_secret_post": client credentials are sent in
+      # the request body. The query string is intentionally ignored so that
+      # credentials must be supplied in the body as the spec requires.
+      class ClientSecretPost
+        def self.matches_request?(request)
+          params = request.request_parameters.with_indifferent_access
+
+          request.post? &&
+            params[:client_id].present? &&
+            params[:client_secret].present?
+        end
+
+        def self.authenticate(request)
+          params = request.request_parameters.with_indifferent_access
+
+          Doorkeeper::ClientAuthentication::Credentials.new(
+            params[:client_id],
+            params[:client_secret],
+          )
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/client_authentication/none.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    module ClientAuthentication
+      # RFC 6749 §2.3 "none": a public client that authenticates with only a
+      # client_id and no secret (in the request body, not the query string).
+      class None
+        # Requires the Authorization header to be absent or blank: a request
+        # that carries a non-blank one (Basic, Bearer, or anything else) is
+        # attempting header-based authentication and must not be silently
+        # treated as an unauthenticated public client. This is narrower than
+        # the legacy +from_params+ extractor, which read the body +client_id+
+        # regardless of the Authorization header.
+        def self.matches_request?(request)
+          params = request.request_parameters.with_indifferent_access
+
+          request.post? &&
+            request.authorization.blank? &&
+            params[:client_id].present? &&
+            params[:client_secret].blank?
+        end
+
+        def self.authenticate(request)
+          params = request.request_parameters.with_indifferent_access
+
+          Doorkeeper::ClientAuthentication::Credentials.new(params[:client_id], nil)
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/code_response.rb

@@ -28,17 +28,22 @@ module Doorkeeper
             token_type: auth.token.token_type,
             expires_in: auth.token.expires_in_seconds,
             state: pre_auth.state,
-          }
+          }.merge(iss_parameter)
         elsif auth.try(:access_grant?)
           {
             code: auth.token.plaintext_token,
             state: pre_auth.state,
-          }
+          }.merge(iss_parameter)
         end
       end
 
       def redirect_uri
         if URIChecker.oob_uri?(pre_auth.redirect_uri)
+          # Out-of-band "redirects" render the code/token on an authorization
+          # server page for the user to copy manually; there is no redirect
+          # back to the client. RFC 9207 scopes the iss parameter to the
+          # authorization response sent to the client, so - like state, which
+          # oob_redirect also omits - iss is intentionally not carried here.
           auth.oob_redirect
         elsif response_on_fragment
           Authorization::URIBuilder.uri_with_fragment(pre_auth.redirect_uri, body)
@@ -46,6 +51,15 @@ module Doorkeeper
           Authorization::URIBuilder.uri_with_query(pre_auth.redirect_uri, body)
         end
       end
+
+      private
+
+      # RFC 9207 Authorization Server Issuer Identification: advertise the
+      # issuer in the authorization response only when an issuer is configured.
+      def iss_parameter
+        issuer = Doorkeeper.config.issuer
+        issuer.present? ? { iss: issuer } : {}
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/error_response.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     class ErrorResponse < BaseResponse
       include OAuth::Helpers
 
-      NON_REDIRECTABLE_STATES = %i[invalid_redirect_uri invalid_client unauthorized_client].freeze
+      NON_REDIRECTABLE_STATES = %i[invalid_redirect_uri invalid_client].freeze
 
       def self.from_request(request, attributes = {})
         new(
@@ -38,6 +38,7 @@ module Doorkeeper
         @exception_class = attributes[:exception_class]
         @redirect_uri = attributes[:redirect_uri]
         @response_on_fragment = attributes[:response_on_fragment]
+        @issuer = attributes[:issuer]
       end
 
       def body
@@ -45,11 +46,19 @@ module Doorkeeper
           error: name,
           error_description: description,
           state: state,
+          # RFC 9207 scopes the issuer to authorization error responses sent to
+          # the client, i.e. the ones redirected back to its redirect_uri. It is
+          # supplied only by the authorization endpoint (never token,
+          # introspection or protected resource), and gated on redirectable? so
+          # non-redirectable errors (invalid_client, invalid_redirect_uri) and
+          # out-of-band flows - which render to the user instead of redirecting
+          # to the client - do not carry it. Blank values are dropped below.
+          iss: (@issuer if redirectable?),
         }.reject { |_, v| v.blank? }
       end
 
       def status
-        if name == :invalid_client || name == :unauthorized_client
+        if name == :invalid_client
           :unauthorized
         else
           :bad_request

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -6,15 +6,6 @@ module Doorkeeper
   module OAuth
     module Helpers
       module URIChecker
-        # Schemes a user agent evaluates in the document that navigates to
-        # them instead of fetching a resource from somewhere else. With
-        # `response_mode=form_post` that document is the authorization
-        # server's own page, so a redirect URI with one of these schemes would
-        # run the client's script on the server's origin. None of them can be
-        # a legitimate redirection endpoint (RFC 6749 Section 3.1.2), so they
-        # are refused regardless of the `forbid_redirect_uri` configuration.
-        SCRIPT_SCHEMES = %w[javascript vbscript data].freeze
-
         def self.valid?(url)
           return true if oob_uri?(url)
 
@@ -71,15 +62,10 @@ module Doorkeeper
 
         def self.valid_scheme?(uri)
           return false if uri.scheme.blank?
-          return false if script_scheme?(uri)
 
           %w[localhost].exclude?(uri.scheme)
         end
 
-        def self.script_scheme?(uri)
-          SCRIPT_SCHEMES.include?(uri.scheme.to_s.downcase)
-        end
-
         def self.hypertext_scheme?(uri)
           %w[http https].include?(uri.scheme)
         end

data/lib/doorkeeper/oauth/metadata_response.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    # OAuth 2.0 Authorization Server Metadata response as described in
+    # RFC 8414 (https://www.rfc-editor.org/rfc/rfc8414).
+    class MetadataResponse < BaseResponse
+      def initialize(base_url, url_builder)
+        super()
+        @base_url = base_url
+        @url_builder = url_builder
+      end
+
+      def body
+        @body ||= begin
+          data = {
+            # presence: a blank issuer (e.g. an unset env var) must fall back
+            # to base_url, matching the issuer.present? condition below so the
+            # two fields cannot disagree.
+            issuer: issuer.presence || @base_url,
+            # Only advertise endpoints whose controllers are installed. A
+            # controller disabled through skip_controllers has no routes mapping,
+            # so endpoint_for resolves it to nil and it is dropped below.
+            authorization_endpoint: authorization_endpoint,
+            token_endpoint: token_endpoint,
+            revocation_endpoint: revocation_endpoint,
+            introspection_endpoint: (introspection_endpoint if introspection_enabled?),
+            scopes_supported: scopes_supported,
+            response_types_supported: response_types_supported,
+            response_modes_supported: response_modes_supported,
+            grant_types_supported: grant_types_supported,
+            token_endpoint_auth_methods_supported: token_endpoint_auth_methods_supported,
+            code_challenge_methods_supported: code_challenge_methods_supported,
+            # RFC 9207: true only when an issuer is configured, matching the
+            # condition under which the iss parameter is emitted. false survives
+            # the compaction below, so it is advertised explicitly.
+            authorization_response_iss_parameter_supported: config.issuer.present?,
+          }
+          data.compact!
+
+          # userinfo_endpoint is intentionally advertised as null for backwards
+          # compatibility; it is meant to be populated through custom_metadata
+          # (e.g. by an OIDC extension), so it must survive the compaction above.
+          data[:userinfo_endpoint] = userinfo_endpoint
+
+          data.merge(custom_metadata)
+        end
+      end
+
+      def status
+        :ok
+      end
+
+      def headers
+        {
+          "Cache-Control" => "public",
+          "Content-Type" => "application/json; charset=utf-8",
+        }
+      end
+
+      private
+
+      def config
+        @config ||= Doorkeeper.configuration
+      end
+
+      def url_for(**args)
+        @url_builder.call(**args)
+      end
+
+      # Resolve the URL for the given route group, or nil when the group has no
+      # routes mapping (i.e. the controller was disabled via skip_controllers).
+      def endpoint_for(group, action:)
+        mapping = Doorkeeper::Rails::Routes.mapping[group]
+        return unless mapping
+
+        # The leading slash anchors the controller name: without it, Rails
+        # resolves the name relative to the current (doorkeeper/metadata)
+        # namespace whenever their segment depths differ, e.g. a configured
+        # `controllers tokens: "custom_tokens"` would be looked up as
+        # "doorkeeper/custom_tokens" and raise ActionController::UrlGenerationError.
+        url_for(controller: "/#{mapping[:controllers]}", action: action)
+      end
+
+      def custom_metadata
+        config.custom_metadata.symbolize_keys
+      end
+
+      def issuer
+        config.issuer
+      end
+
+      def authorization_endpoint
+        endpoint_for(:authorizations, action: "new")
+      end
+
+      def token_endpoint
+        endpoint_for(:tokens, action: "create")
+      end
+
+      def userinfo_endpoint
+        nil
+      end
+
+      def revocation_endpoint
+        endpoint_for(:tokens, action: "revoke")
+      end
+
+      def introspection_endpoint
+        endpoint_for(:tokens, action: "introspect")
+      end
+
+      def introspection_enabled?
+        Doorkeeper.configured? &&
+          !config.allow_token_introspection.is_a?(FalseClass)
+      end
+
+      def scopes_supported
+        config.scopes.to_a
+      end
+
+      def response_types_supported
+        config.authorization_response_types
+      end
+
+      def response_modes_supported
+        config.authorization_response_flows.flat_map(&:response_mode_matches).uniq
+      end
+
+      def grant_types_supported
+        # RFC 8414 lists token-endpoint grant type values (e.g.
+        # "authorization_code", "refresh_token"), so derive them from the
+        # flows that actually handle a grant_type and use their grant_type
+        # value rather than the configured flow name. This drops
+        # response-type-only flows such as :implicit and reports the real
+        # grant type for flows whose name differs from it (e.g. a URN).
+        config.token_grant_types
+      end
+
+      # The resolved methods (rather than the raw client_authentication names)
+      # reflect what the server actually accepts: unregistered names are
+      # dropped by the resolver, and a deprecated client_credentials-only
+      # configuration is honored as the source of truth. Legacy callable
+      # extractors have no registered method name a client could use, so they
+      # are not advertised.
+      def token_endpoint_auth_methods_supported
+        config.client_authentication_methods.filter_map do |method|
+          method.name.to_s if Doorkeeper::ClientAuthentication.get(method.name)
+        end
+      end
+
+      def code_challenge_methods_supported
+        config.pkce_code_challenge_methods_supported
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -5,19 +5,11 @@ module Doorkeeper
     class PreAuthorization
       include Validations
 
-      # The validations that identify the client and its redirect URI. None of
-      # them depend on the resource owner, and none of their failures leaves a
-      # redirect target worth trusting: RFC 6749 Section 4.1.2.1 (Section
-      # 4.2.2.1 for the implicit flow) asks for the resource owner to be
-      # informed when the client_id is missing or invalid, and Section 3.1.2.4
-      # asks the same for the redirect URI.
-      CLIENT_VALIDATIONS = %i[client_id client redirect_uri].freeze
-
       validate :client_id, error: Errors::InvalidRequest
       validate :client, error: Errors::InvalidClient
-      validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
-      validate :resource_owner_authorize_for_client, error: Errors::InvalidClient
       validate :redirect_uri, error: Errors::InvalidRedirectUri
+      validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
+      validate :resource_owner_authorize_for_client, error: Errors::AccessDenied
       validate :params, error: Errors::InvalidRequest
       validate :response_type, error: Errors::UnsupportedResponseType
       validate :response_mode, error: Errors::UnsupportedResponseMode
@@ -48,25 +40,6 @@ module Doorkeeper
         valid?
       end
 
-      # Runs only CLIENT_VALIDATIONS, in declared order, so a request naming an
-      # unknown client or an invalid redirect URI can be refused on its own -
-      # the validations in between (client_supports_grant_flow,
-      # resource_owner_authorize_for_client) answer a different question and
-      # are left to a full #validate run.
-      def client_valid?
-        @error = nil
-        @missing_param = nil
-
-        self.class.validations.each do |validation|
-          next unless CLIENT_VALIDATIONS.include?(validation[:attribute])
-
-          @error = validation[:options][:error] unless send("validate_#{validation[:attribute]}")
-          break if @error
-        end
-
-        @error.nil?
-      end
-
       def scopes
         Scopes.from_string(scope)
       end
@@ -76,13 +49,21 @@ module Doorkeeper
       end
 
       def error_response
+        # RFC 9207: authorization error responses advertise the issuer. Passing
+        # the configured issuer here (nil when unset) scopes the iss parameter
+        # to the authorization endpoint only.
         if error == Errors::InvalidRequest
           OAuth::InvalidRequestResponse.from_request(
             self,
             response_on_fragment: response_on_fragment?,
+            issuer: Doorkeeper.config.issuer,
           )
         else
-          OAuth::ErrorResponse.from_request(self, response_on_fragment: response_on_fragment?)
+          OAuth::ErrorResponse.from_request(
+            self,
+            response_on_fragment: response_on_fragment?,
+            issuer: Doorkeeper.config.issuer,
+          )
         end
       end
 
@@ -174,7 +155,6 @@ module Doorkeeper
 
       def validate_code_challenge
         return true unless Doorkeeper.config.force_pkce?
-        return true if client.confidential
         return true if code_challenge.present?
 
         @invalid_request_reason = :invalid_code_challenge
@@ -207,7 +187,7 @@ module Doorkeeper
           scope: scope,
           client_name: client.name,
           status: I18n.t("doorkeeper.pre_authorization.status"),
-        }
+        }.reverse_merge(custom_access_token_attributes.symbolize_keys)
       end
     end
   end

data/lib/doorkeeper/oauth/token.rb

@@ -3,54 +3,8 @@
 module Doorkeeper
   module OAuth
     class Token
-      # Built-in extractors that read a request parameter, and the parameter
-      # each of them reads. RFC 6750 treats the form-encoded body (§2.2) and
-      # the URI query string (§2.3) as two distinct transmission methods, but
-      # Rack and ActionDispatch both collapse them into a single parameter
-      # hash — ActionDispatch lets the query win, Rack lets the body win — so
-      # a request carrying the parameter in both would present a single value
-      # to the extractor and never be refused. The multi-method check reads
-      # the two sources separately for these extractors; selection keeps
-      # using the extractor, so which one wins is unchanged.
-      PARAMETER_EXTRACTORS = {
-        from_access_token_param: "access_token",
-        from_bearer_param: "bearer_token",
-      }.freeze
-
       class << self
-        # RFC 6750 §2: "Clients MUST NOT use more than one method to transmit
-        # the token in each request", and §3.1 lists using more than one method
-        # among the conditions an invalid_request answers. Returning the first
-        # method that yields a value would discard every other token presented
-        # in the same request with no error, warning or log entry, leaving
-        # which token authorizes the request to be decided by the configured
-        # order of +access_token_methods+ rather than by what the caller sent —
-        # so a layer in front of Doorkeeper that reads a different one of them
-        # can reach a different verdict about the very same request.
-        #
-        # What §2 forbids is using more than one method, so the check counts
-        # transmission methods rather than comparing the tokens they carry:
-        # the same value presented twice is still two methods. Refusal answers
-        # nil: the caller is told the request carries no usable token and
-        # fails closed with the invalid_token (401) response, keeping every
-        # calling contract on this stable branch intact — the invalid_request
-        # (400) that §3.1 strictly prescribes needs a new error and render
-        # path, so it ships with 6.0 only.
-        #
-        # Only the built-in extractors — symbols naming methods on this class,
-        # all of them side-effect-free reads of the request — take part in
-        # that check. A custom callable extractor is a configuration adapter
-        # rather than a transmission method: it keeps the historical
-        # first-wins selection and is never invoked more than once, the same
-        # exemption client authentication gives its legacy callable
-        # extractors (Request#validate_client_authentication!).
         def from_request(request, *methods)
-          used = methods.sum do |method|
-            method.is_a?(Symbol) ? transmission_methods_used(request, method) : 0
-          end
-
-          return if used > 1
-
           methods.inject(nil) do |_, method|
             method = self.method(method) if method.is_a?(Symbol)
             credentials = method.call(request)
@@ -69,11 +23,11 @@ module Doorkeeper
         end
 
         def from_access_token_param(request)
-          parameters(request)[:access_token]
+          request.parameters[:access_token]
         end
 
         def from_bearer_param(request)
-          parameters(request)[:bearer_token]
+          request.parameters[:bearer_token]
         end
 
         def from_bearer_authorization(request)
@@ -90,53 +44,6 @@ module Doorkeeper
 
         private
 
-        # How many transmission methods the given built-in extractor finds a
-        # token in. Usually one, or none — but for the parameter extractors
-        # above it is the body and the query counted separately, since the
-        # parameter hash collapsed them into the single value the extractor
-        # reads. That value is counted on its own only when neither raw source
-        # explains it, so a token reaching the extractor by some other route —
-        # an :access_token path segment, or a host that overrode the extractor
-        # — is still counted exactly once rather than twice.
-        def transmission_methods_used(request, method)
-          value = self.method(method).call(request).presence
-
-          parameter = PARAMETER_EXTRACTORS[method]
-          return value ? 1 : 0 unless parameter
-
-          sources = parameter_sources(request, parameter)
-          sources.size + (value && !sources.include?(value) ? 1 : 0)
-        end
-
-        # The form-encoded body (§2.2) and the URI query (§2.3) as Rack
-        # exposes them, for a request object that keeps the two apart.
-        def parameter_sources(request, parameter)
-          return [] unless request.respond_to?(:GET) && request.respond_to?(:POST)
-
-          query = request.GET
-          body = body_parameters(request)
-          return [] unless query.is_a?(Hash) && body.is_a?(Hash)
-
-          [query[parameter], body[parameter]].filter_map(&:presence)
-        end
-
-        # A body ActionDispatch cannot parse — malformed JSON under a JSON
-        # content type, say — carries no token. Reading it must not raise out
-        # of the extractors, which host apps call from places that run after
-        # their own ParseError handling (instrumentation, exception apps), the
-        # same way ActionDispatch's own #filtered_parameters treats that error.
-        def parameters(request)
-          request.parameters
-        rescue ActionDispatch::Http::Parameters::ParseError
-          {}
-        end
-
-        def body_parameters(request)
-          request.POST
-        rescue ActionDispatch::Http::Parameters::ParseError
-          {}
-        end
-
         def token_from_basic_header(header, pattern)
           encoded_header = token_from_header(header, pattern)
           decode_basic_credentials_token(encoded_header)

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -8,9 +8,13 @@ module Doorkeeper
     class TokenIntrospection
       attr_reader :token, :error, :invalid_request_reason
 
-      def initialize(server, token)
+      # +token_type+ tells which credential of the token record the caller
+      # actually received (:access_token or :refresh_token), so the "active"
+      # state and the response describe the presented token per RFC 7662 §2.2.
+      def initialize(server, token, token_type: :access_token)
         @server = server
         @token = token
+        @token_type = token_type
       end
 
       def authorized?
@@ -106,12 +110,19 @@ module Doorkeeper
           active: true,
           scope: @token.scopes_string,
           client_id: @token.try(:application).try(:uid),
-          token_type: @token.token_type,
           iat: @token.created_at.to_i,
         }
-        # `exp` is OPTIONAL per RFC 7662 §2.2; omit it for non-expiring tokens
-        # so clients don't interpret `0` as "expired at 1970-01-01".
-        response[:exp] = @token.expires_at.to_i if @token.expires_at
+
+        # `token_type` (RFC 6749 §7.1) and `exp` describe the access token:
+        # a refresh token is not a Bearer credential and has no expiry of its
+        # own, so both are omitted (they are OPTIONAL per RFC 7662 §2.2) when
+        # a refresh token is presented.
+        unless refresh_token_presented?
+          response[:token_type] = @token.token_type
+          # `exp` is OPTIONAL per RFC 7662 §2.2; omit it for non-expiring tokens
+          # so clients don't interpret `0` as "expired at 1970-01-01".
+          response[:exp] = @token.expires_at.to_i if @token.expires_at
+        end
 
         customize_response(response)
       end
@@ -176,9 +187,18 @@ module Doorkeeper
         end
       end
 
-      # Token can be valid only if it is not expired or revoked.
+      # The presented token can be valid only if it is not revoked; an access
+      # token must additionally be unexpired. A refresh token has no expiry of
+      # its own and stays usable at the token endpoint after its paired access
+      # token expires, so that expiry is not consulted here.
       def valid_token?
-        @token&.accessible?
+        return false if @token.blank?
+
+        refresh_token_presented? ? !@token.revoked? : @token.accessible?
+      end
+
+      def refresh_token_presented?
+        @token_type == :refresh_token
       end
 
       def valid_authorized_token?

data/lib/doorkeeper/orm/active_record/mixins/application.rb

@@ -116,9 +116,9 @@ module Doorkeeper::Orm::ActiveRecord::Mixins
 
         return generator if generator.respond_to?(:generate)
 
-        raise Errors::UnableToGenerateToken, "#{generator} does not respond to `.generate`."
+        raise Doorkeeper::Errors::UnableToGenerateToken, "#{generator} does not respond to `.generate`."
       rescue NameError
-        raise Errors::TokenGeneratorNotFound, "#{generator_name} not found"
+        raise Doorkeeper::Errors::TokenGeneratorNotFound, "#{generator_name} not found"
       end
 
       def generate_uid

data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -34,12 +34,8 @@ module Doorkeeper
       Doorkeeper::OAuth::NonStandard::IETF_WG_OAUTH2_OOB_METHODS.include?(uri)
     end
 
-    # Script schemes are refused before the host application's rule is
-    # consulted, so a `forbid_redirect_uri` that rejects them too does not
-    # report the error twice.
     def forbidden_uri?(uri)
-      Doorkeeper::OAuth::Helpers::URIChecker.script_scheme?(uri) ||
-        Doorkeeper.config.forbid_redirect_uri.call(uri)
+      Doorkeeper.config.forbid_redirect_uri.call(uri)
     end
 
     def unspecified_scheme?(uri)

data/lib/doorkeeper/rails/routes/mapping.rb

@@ -11,6 +11,7 @@ module Doorkeeper
             authorizations: "doorkeeper/authorizations",
             applications: "doorkeeper/applications",
             authorized_applications: "doorkeeper/authorized_applications",
+            metadata: "doorkeeper/metadata",
             tokens: "doorkeeper/tokens",
             token_info: "doorkeeper/token_info",
           }

data/lib/doorkeeper/rails/routes.rb

@@ -41,10 +41,16 @@ module Doorkeeper
           map_route(:authorized_applications, :authorized_applications_routes)
           map_route(:token_info, :token_info_routes)
         end
+
+        map_route(:metadata, :metadata_routes)
       end
 
       private
 
+      def metadata_routes(mapping)
+        routes.get ".well-known/oauth-authorization-server", controller: mapping[:controllers], action: :show
+      end
+
       def authorization_routes(mapping)
         routes.resource(
           :authorization,