doorkeeper 5.9.9 → 6.0.0.beta1

data/lib/doorkeeper/request.rb

@@ -3,30 +3,40 @@
 module Doorkeeper
   module Request
     class << self
-      # Resolves the strategy that answers the given response_type at the
-      # authorization endpoint.
+      # Detect the OAuth client authentication method (RFC 6749 §2.3) that the
+      # given request uses. Returns the matching method's strategy (not the
+      # registry's Method wrapper), or FallbackMethod when none matches
+      # (which authenticates to no credentials).
       #
-      # A response_type no registered authorization flow handles is refused
-      # rather than turned into a class name: `constantize` would otherwise
-      # resolve any constant under Doorkeeper::Request, token endpoint
-      # strategies (`password`, `client_credentials`, `refresh_token`,
-      # `authorization_code`) included, none of which can answer an
-      # authorization request.
-      def authorization_strategy(response_type)
-        response_type = response_type.to_s
+      # Raises Errors::MultipleClientAuthMethods when the request itself
+      # uses more than one client authentication method, since RFC 6749 §2.3
+      # forbids that (see +validate_client_authentication!+).
+      def client_authentication_method(request)
+        validate_client_authentication!(request)
+
+        authentication_method = client_authentication_methods.detect do |method|
+          method.matches_request?(request)
+        end
+
+        if authentication_method
+          authentication_method.strategy
+        else
+          Doorkeeper::ClientAuthentication::FallbackMethod
+        end
+      end
 
+      def authorization_strategy(response_type)
         grant_flow = authorization_flows.detect do |flow|
           flow.matches_response_type?(response_type)
         end
 
-        raise Errors::InvalidTokenStrategy unless grant_flow
-
-        # [NOTE]: this will be removed in a newer versions of Doorkeeper.
-        # For retro-compatibility only: flows declared through the deprecated
-        # Config#calculate_authorization_response_types hook are built as
-        # GrantFlow::FallbackFlow and carry no strategy, so the class is looked
-        # up by name - but only for a response type the server does declare.
-        grant_flow.response_type_strategy || build_fallback_strategy_class(response_type)
+        if grant_flow
+          grant_flow.response_type_strategy
+        else
+          # [NOTE]: this will be removed in a newer versions of Doorkeeper.
+          # For retro-compatibility only
+          build_fallback_strategy_class(response_type)
+        end
       end
 
       def token_strategy(grant_type)
@@ -52,6 +62,43 @@ module Doorkeeper
 
       private
 
+      # RFC 6749 §2.3 forbids clients to "use more than one authentication
+      # method in each request", so the request payload is validated against
+      # every *registered* method — regardless of which ones are configured —
+      # before any method is selected: a client sending, say, both Basic
+      # credentials and body credentials is rejected even when only one of
+      # those methods is enabled on the server.
+      #
+      # Only real authentication mechanisms count towards the limit:
+      #
+      # * +:none+ is the absence of client authentication (a public client
+      #   identifying itself with a bare +client_id+), not a mechanism of its
+      #   own — RFC 7521 §4.2, for example, explicitly allows a +client_id+
+      #   next to a client assertion.
+      # * Deprecated +client_credentials+ callable extractors are
+      #   configuration adapters rather than registered methods, so they
+      #   cannot count either; they keep the historical "first extractor that
+      #   returns a uid wins" selection (see
+      #   ClientAuthentication::LegacyCallable) for the deprecation window.
+      def validate_client_authentication!(request)
+        matched = 0
+
+        Doorkeeper::ClientAuthentication.registered_methods.each_value do |method|
+          next if method.name == :none
+          next unless method.matches_request?(request)
+
+          matched += 1
+
+          # RFC 6749 §2.3 only forbids using more than one method, so bail out
+          # on the second match instead of evaluating the remaining methods.
+          raise Errors::MultipleClientAuthMethods if matched > 1
+        end
+      end
+
+      def client_authentication_methods
+        Doorkeeper.configuration.client_authentication_methods
+      end
+
       def authorization_flows
         Doorkeeper.configuration.authorization_response_flows
       end

data/lib/doorkeeper/server.rb

@@ -8,6 +8,10 @@ module Doorkeeper
       @context = context
     end
 
+    def client_authentication_method_for_request
+      Request.client_authentication_method(context.request)
+    end
+
     def authorization_request(strategy)
       klass = Request.authorization_strategy(strategy)
       klass.new(self)
@@ -37,8 +41,7 @@ module Doorkeeper
     end
 
     def credentials
-      methods = Doorkeeper.config.client_credentials_methods
-      @credentials ||= OAuth::Client::Credentials.from_request(context.request, *methods)
+      @credentials ||= client_authentication_method_for_request.authenticate(context.request)
     end
   end
 end

data/lib/doorkeeper/version.rb

@@ -3,10 +3,10 @@
 module Doorkeeper
   module VERSION
     # Semantic versioning
-    MAJOR = 5
-    MINOR = 9
-    TINY = 9
-    PRE = nil
+    MAJOR = 6
+    MINOR = 0
+    TINY = 0
+    PRE = "beta1"
 
     # Full version number
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/doorkeeper.rb

@@ -7,6 +7,7 @@ require "doorkeeper/engine"
 #
 module Doorkeeper
   autoload :Errors, "doorkeeper/errors"
+  autoload :ClientAuthentication, "doorkeeper/client_authentication"
   autoload :GrantFlow, "doorkeeper/grant_flow"
   autoload :OAuth, "doorkeeper/oauth"
   autoload :Rake, "doorkeeper/rake"
@@ -52,6 +53,7 @@ module Doorkeeper
     autoload :InvalidTokenResponse, "doorkeeper/oauth/invalid_token_response"
     autoload :InvalidRequestResponse, "doorkeeper/oauth/invalid_request_response"
     autoload :ForbiddenTokenResponse, "doorkeeper/oauth/forbidden_token_response"
+    autoload :MetadataResponse, "doorkeeper/oauth/metadata_response"
     autoload :NonStandard, "doorkeeper/oauth/nonstandard"
     autoload :PasswordAccessTokenRequest, "doorkeeper/oauth/password_access_token_request"
     autoload :PreAuthorization, "doorkeeper/oauth/pre_authorization"
@@ -62,6 +64,12 @@ module Doorkeeper
     autoload :TokenRequest, "doorkeeper/oauth/token_request"
     autoload :TokenResponse, "doorkeeper/oauth/token_response"
 
+    module ClientAuthentication
+      autoload :None, "doorkeeper/oauth/client_authentication/none"
+      autoload :ClientSecretBasic, "doorkeeper/oauth/client_authentication/client_secret_basic"
+      autoload :ClientSecretPost, "doorkeeper/oauth/client_authentication/client_secret_post"
+    end
+
     module Authorization
       autoload :Code, "doorkeeper/oauth/authorization/code"
       autoload :Context, "doorkeeper/oauth/authorization/context"
@@ -69,10 +77,6 @@ module Doorkeeper
       autoload :URIBuilder, "doorkeeper/oauth/authorization/uri_builder"
     end
 
-    class Client
-      autoload :Credentials, "doorkeeper/oauth/client/credentials"
-    end
-
     module ClientCredentials
       autoload :Validator, "doorkeeper/oauth/client_credentials/validator"
       autoload :Creator, "doorkeeper/oauth/client_credentials/creator"

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -150,6 +150,15 @@ Doorkeeper.configure do
   # token found for the application, resources owner and/or set of scopes.
   # Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383
   #
+  # Matching considers only the application, resource owner, scopes, custom access token
+  # attributes (see +custom_access_token_attributes+) and whether a refresh token is
+  # expected — not the authorization request that produced the token. Separate authorization
+  # grants for the same combination share a single access token, so concurrent sessions of
+  # the same client become interdependent (e.g. refreshing the token in one session revokes
+  # it for the others). If you need independent tokens per session or device, keep this
+  # option disabled or differentiate the sessions with +custom_access_token_attributes+.
+  # See https://github.com/doorkeeper-gem/doorkeeper/issues/1693
+  #
   # You can not enable this option together with +hash_token_secrets+.
   #
   # reuse_access_token
@@ -188,8 +197,8 @@ Doorkeeper.configure do
   #
   # revoke_previous_authorization_code_token
 
-  # Require non-confidential clients to use PKCE when using an authorization code
-  # to obtain an access_token (disabled by default)
+  # Require all clients (including confidential ones) to use PKCE when using an
+  # authorization code to obtain an access_token (disabled by default)
   #
   # force_pkce
 
@@ -277,21 +286,18 @@ Doorkeeper.configure do
   #
   # enforce_configured_scopes
 
-  # Change the way client credentials are retrieved from the request object.
-  # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
-  # falls back to the `:client_id` and `:client_secret` params from the `params` object.
+  # Configure the OAuth client authentication methods (RFC 6749 §2.3) Doorkeeper
+  # will accept and the order in which they are tried. By default it accepts
+  # HTTP Basic auth (`client_secret_basic`), credentials in the request body
+  # (`client_secret_post`), and public clients with no secret (`none`).
   # Check out https://github.com/doorkeeper-gem/doorkeeper/wiki/Changing-how-clients-are-authenticated
   # for more information on customization
   #
-  # NOTE: configuring a callable extractor opts the request out of the RFC 6749
-  # §2.3 checks that reject a request authenticating the client with more than
-  # one method, or presenting more than one client identity. A callable may
-  # legitimately overlap the built-in extractors, and the extractors after the
-  # matching one are never called, so what they would have returned is unknown.
-  # Prefer the symbol extractors unless you need something they cannot express;
-  # a callable has to reject such a request itself.
+  # client_authentication %i[client_secret_basic client_secret_post none]
   #
-  # client_credentials :from_basic, :from_params
+  # The legacy `client_credentials` option is deprecated; `:from_basic` and
+  # `:from_params` are automatically mapped to `:client_secret_basic` and
+  # `:client_secret_post`.
 
   # Change the way access token is authenticated from the request object.
   # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
@@ -316,13 +322,10 @@ Doorkeeper.configure do
   # Specify what redirect URI's you want to block during Application creation.
   # Any redirect URI is allowed by default.
   #
-  # Redirect URIs with a script scheme (`javascript`, `vbscript`, `data`) are
-  # always rejected, regardless of this option.
-  #
-  # You can use this option in order to forbid URI's of a particular host
+  # You can use this option in order to forbid URI's with 'javascript' scheme
   # for example.
   #
-  # forbid_redirect_uri { |uri| uri.host == 'example.com' }
+  # forbid_redirect_uri { |uri| uri.scheme.to_s.downcase == 'javascript' }
 
   # Allows to set blank redirect URIs for Applications in case Doorkeeper configured
   # to use URI-less OAuth grant flows like Client Credentials or Resource Owner
@@ -388,6 +391,9 @@ Doorkeeper.configure do
   # If not specified, Doorkeeper enables authorization_code and
   # client_credentials.
   #
+  # The Refresh Token Grant Flow ("refresh_token") doesn't need to be listed
+  # here: it is enabled automatically when +use_refresh_token+ is configured.
+  #
   # implicit and password grant flows have risks that you should understand
   # before enabling:
   #   https://datatracker.ietf.org/doc/html/rfc6819#section-4.4.2
@@ -552,4 +558,47 @@ Doorkeeper.configure do
   # WWW-Authenticate Realm (default: "Doorkeeper").
   #
   # realm "Doorkeeper"
+
+  # OAuth 2.0 Authorization Server Metadata (RFC 8414).
+  #
+  # Doorkeeper exposes an authorization server metadata document at
+  # `/.well-known/oauth-authorization-server`, built from the configuration
+  # above. The two options below let you customize that document.
+  #
+  # `issuer` is the authorization server's issuer identifier. When left as nil
+  # (the default) the request base URL is used for the metadata `issuer` field
+  # only. Note the asymmetry: RFC 9207 below is gated on an explicitly
+  # configured issuer, so leaving it nil still advertises a metadata `issuer`
+  # (the base URL) while `authorization_response_iss_parameter_supported` stays
+  # false and no `iss` parameter is emitted.
+  #
+  # Configuring an issuer also enables RFC 9207 (Authorization Server Issuer
+  # Identification): the `iss` parameter is added to the authorization
+  # responses redirected back to the client - both successful responses and
+  # error responses such as access_denied - and advertised via the
+  # `authorization_response_iss_parameter_supported` metadata field. Clients
+  # that parse the authorization redirect will start seeing this parameter.
+  # Per RFC 8414 and RFC 9207 the value should be an https URL with no query or
+  # fragment; a non-compliant value logs a warning at boot but is still used.
+  # Prefer a host-only issuer: Doorkeeper serves its metadata only at the root
+  # /.well-known/oauth-authorization-server, so a path-bearing issuer (e.g.
+  # https://auth.example.com/tenant) is not discoverable by RFC 8414 clients and
+  # also logs a warning.
+  #
+  # issuer "https://auth.example.com"
+  #
+  # `custom_metadata` is a Hash that is merged into the metadata response. Use
+  # it to advertise additional or non-default metadata fields, for example a
+  # `userinfo_endpoint` (which Doorkeeper itself leaves null) when pairing with
+  # an OpenID Connect extension.
+  #
+  # The merge happens last, so it can also override computed fields - including
+  # `authorization_response_iss_parameter_supported`, which Doorkeeper derives
+  # from whether `issuer` is set. Overriding a computed field is allowed but is
+  # your responsibility to keep consistent with the server's actual behaviour
+  # (e.g. don't advertise iss support as true if no `issuer` is configured).
+  #
+  # custom_metadata(
+  #   userinfo_endpoint: "https://auth.example.com/oauth/userinfo",
+  # )
 end

metadata

@@ -1,17 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.9.9
+  version: 6.0.0.beta1
 platform: ruby
 authors:
 - Felipe Elias Philipp
 - Tute Costa
 - Jon Moss
 - Nikita Bulai
-autorequire: 
 bindir: bin
 cert_chain: []
-date: 2026-09-24 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -184,6 +183,7 @@ files:
 - app/controllers/doorkeeper/applications_controller.rb
 - app/controllers/doorkeeper/authorizations_controller.rb
 - app/controllers/doorkeeper/authorized_applications_controller.rb
+- app/controllers/doorkeeper/metadata_controller.rb
 - app/controllers/doorkeeper/token_info_controller.rb
 - app/controllers/doorkeeper/tokens_controller.rb
 - app/helpers/doorkeeper/dashboard_helper.rb
@@ -203,6 +203,12 @@ files:
 - app/views/layouts/doorkeeper/application.html.erb
 - config/locales/en.yml
 - lib/doorkeeper.rb
+- lib/doorkeeper/client_authentication.rb
+- lib/doorkeeper/client_authentication/credentials.rb
+- lib/doorkeeper/client_authentication/fallback_method.rb
+- lib/doorkeeper/client_authentication/legacy_callable.rb
+- lib/doorkeeper/client_authentication/method.rb
+- lib/doorkeeper/client_authentication/registry.rb
 - lib/doorkeeper/config.rb
 - lib/doorkeeper/config/abstract_builder.rb
 - lib/doorkeeper/config/option.rb
@@ -240,7 +246,9 @@ files:
 - lib/doorkeeper/oauth/base_request.rb
 - lib/doorkeeper/oauth/base_response.rb
 - lib/doorkeeper/oauth/client.rb
-- lib/doorkeeper/oauth/client/credentials.rb
+- lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb
+- lib/doorkeeper/oauth/client_authentication/client_secret_post.rb
+- lib/doorkeeper/oauth/client_authentication/none.rb
 - lib/doorkeeper/oauth/client_credentials/creator.rb
 - lib/doorkeeper/oauth/client_credentials/issuer.rb
 - lib/doorkeeper/oauth/client_credentials/validator.rb
@@ -256,6 +264,7 @@ files:
 - lib/doorkeeper/oauth/hooks/context.rb
 - lib/doorkeeper/oauth/invalid_request_response.rb
 - lib/doorkeeper/oauth/invalid_token_response.rb
+- lib/doorkeeper/oauth/metadata_response.rb
 - lib/doorkeeper/oauth/nonstandard.rb
 - lib/doorkeeper/oauth/password_access_token_request.rb
 - lib/doorkeeper/oauth/pre_authorization.rb
@@ -330,7 +339,6 @@ metadata:
   bug_tracker_uri: https://github.com/doorkeeper-gem/doorkeeper/issues
   documentation_uri: https://doorkeeper.gitbook.io/guides/
   funding_uri: https://opencollective.com/doorkeeper-gem
-post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -345,8 +353,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.16
-signing_key: 
+rubygems_version: 4.0.11
 specification_version: 4
 summary: OAuth 2 provider for Rails and Grape
 test_files: []

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -1,86 +0,0 @@
-# frozen_string_literal: true
-
-module Doorkeeper
-  module OAuth
-    class Client
-      Credentials = Struct.new(:uid, :secret) do
-        class << self
-          # Extracts the client credentials from the request using the
-          # configured extraction methods. The first method that yields
-          # credentials wins, as it always has.
-          #
-          # Raises Errors::MultipleClientAuthMethods when the request
-          # authenticates the client with more than one method, or presents
-          # more than one client identity, which RFC 6749 §2.3 forbids ("The
-          # client MUST NOT use more than one authentication method in each
-          # request").
-          def from_request(request, *credentials_methods)
-            # Callable extractors are opaque: they may legitimately overlap the
-            # built-in methods they are configured with, and evaluating all of
-            # them would also break the existing contract that the extractors
-            # after the matching one are not called. Such configurations keep
-            # the historical behaviour untouched, including the fact that a
-            # request authenticating with more than one method, or presenting
-            # more than one client identity, resolves to the first extracted
-            # credentials instead of being rejected: the extractor that would
-            # have surfaced the second identity is never evaluated. The
-            # +client_credentials+ configuration option documents this.
-            return first_from_request(request, credentials_methods) unless credentials_methods.all?(Symbol)
-
-            credentials = credentials_methods.filter_map { |method| extract(request, method) }
-
-            # Only credentials carrying a secret authenticate the client. A bare
-            # uid is a public client identifying itself (RFC 6749 §2.3 "none"),
-            # not an authentication method of its own, so it doesn't count
-            # towards the single-method rule — RFC 7521 §4.2, for example,
-            # explicitly allows a client_id next to another authentication
-            # method.
-            raise Errors::MultipleClientAuthMethods if credentials.count { |c| c.secret.present? } > 1
-
-            # §4.2 allows that bare client_id because it identifies the *same*
-            # client as the authentication method it accompanies. Credentials
-            # naming two different clients are two client identities in one
-            # request and authenticate neither: without this check the first
-            # extracted uid would win and the other identity would be silently
-            # discarded, so the caller could authenticate as one client while
-            # the request asks to act as another.
-            raise Errors::MultipleClientAuthMethods if credentials.uniq(&:uid).size > 1
-
-            credentials.first
-          end
-
-          def from_params(request)
-            request.parameters.values_at(:client_id, :client_secret)
-          end
-
-          def from_basic(request)
-            authorization = request.authorization
-            if authorization.present? && authorization =~ /^Basic (.*)/im
-              Base64.decode64(Regexp.last_match(1)).split(/:/, 2)
-            end
-          end
-
-          private
-
-          def first_from_request(request, credentials_methods)
-            credentials_methods.inject(nil) do |_, method|
-              credentials = extract(request, method)
-              break credentials if credentials
-            end
-          end
-
-          # Returns the credentials the given method extracts from the request,
-          # or nil when it extracts none.
-          def extract(request, method)
-            method = self.method(method) if method.is_a?(Symbol)
-            Credentials.new(*method.call(request)).presence
-          end
-        end
-
-        # Public clients may have their secret blank, but "credentials" are
-        # still present
-        delegate :blank?, to: :uid
-      end
-    end
-  end
-end