doorkeeper 6.0.0.beta1 → 6.0.0.beta2

data/lib/doorkeeper/document_cache.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  # A small thread-safe, fixed-TTL, in-memory memo keyed by URL. It exists
+  # so one authorization flow (authorize GET, consent POST, token exchange)
+  # does not refetch the same URL several times within a few seconds; it
+  # deliberately implements no HTTP caching semantics.
+  #
+  # Only successfully fetched and validated values may be stored — an error
+  # response or a malformed document must never be cached — which is
+  # guaranteed by callers never yielding anything but a validated value.
+  class DocumentCache
+    DEFAULT_TTL = 60
+    MAX_ENTRIES = 500
+
+    def initialize(ttl: DEFAULT_TTL)
+      @ttl = ttl
+      @mutex = Mutex.new
+      @store = {}
+    end
+
+    # Returns the cached document for the URL, or stores and returns the
+    # block's result. The block's failures (raises, nil) are not cached.
+    def fetch(url)
+      cached = read(url)
+      return cached if cached
+
+      document = yield
+      write(url, document) if document
+      document
+    end
+
+    def clear
+      @mutex.synchronize { @store.clear }
+    end
+
+    private
+
+    def read(url)
+      @mutex.synchronize do
+        entry = @store[url]
+        next nil unless entry
+
+        if entry[:expires_at] <= monotonic_now
+          @store.delete(url)
+          next nil
+        end
+
+        entry[:document]
+      end
+    end
+
+    def write(url, document)
+      @mutex.synchronize do
+        # Deleted first so a rewritten entry moves to the end of the hash's
+        # insertion order, which is the end #prune evicts from. #read
+        # already drops an entry when it finds it expired, so this only
+        # matters when two threads resolve the same URL at once.
+        @store.delete(url)
+        prune
+        @store[url] = { document: document, expires_at: monotonic_now + @ttl }
+      end
+    end
+
+    # Drop expired entries; if the store is still full, drop the oldest
+    # entries so a burst of unique URLs cannot grow the memo unbounded.
+    def prune
+      now = monotonic_now
+      @store.delete_if { |_url, entry| entry[:expires_at] <= now }
+
+      overflow = @store.size - (MAX_ENTRIES - 1)
+      return if overflow <= 0
+
+      @store.keys.first(overflow).each { |url| @store.delete(url) }
+    end
+
+    def monotonic_now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/doorkeeper/errors.rb

@@ -50,6 +50,23 @@ module Doorkeeper
       end
     end
 
+    # Raised when the `scope` parameter is present but not a string — e.g.
+    # `scope[a]=b`, which Rack parses into a Hash. Its octets cannot be split
+    # into scope tokens, so the request is malformed (RFC 6749 §3.3) and must
+    # be answered with `invalid_request` rather than an unhandled 500.
+    class InvalidScopeParameter < DoorkeeperError
+      def type
+        :invalid_request
+      end
+
+      # Maps to `invalid_request.unknown` ("... or is otherwise malformed").
+      # Without a reason the token endpoint would translate `nil` and return a
+      # blank error_description.
+      def reason
+        :unknown
+      end
+    end
+
     class BaseResponseError < DoorkeeperError
       attr_reader :response
 
@@ -77,12 +94,43 @@ module Doorkeeper
     NoOrmCleaner = Class.new(DoorkeeperError)
     MissingConfigurationBuilderClass = Class.new(DoorkeeperError)
 
+    # Raised when resource_indicator_validator is configured but the required
+    # `resource` column has not been added to the database. Provides an
+    # actionable message pointing to the generator.
+    #
+    # `#type` returns `:server_error` so the token endpoint (which rescues
+    # DoorkeeperError and builds an OAuth error response from `#type`) emits a
+    # spec-compliant error code; the actionable message is retained on the
+    # exception for logs rather than being sent as the `error` value.
+    class MissingResourceColumn < DoorkeeperError
+      def initialize(table)
+        super(
+          "resource_indicator_validator is configured but the `resource` column is missing from " \
+          "the #{table} table. Run `rails generate doorkeeper:resource_indicators` and apply the migration.",
+        )
+      end
+
+      def type
+        :server_error
+      end
+    end
+
     InvalidRequest = Class.new(BaseResponseError)
     InvalidToken = Class.new(BaseResponseError)
     InvalidClient = Class.new(BaseResponseError)
     InvalidScope = Class.new(BaseResponseError)
     InvalidRedirectUri = Class.new(BaseResponseError)
     InvalidGrant = Class.new(BaseResponseError)
+    # RFC 8707 error: the requested resource is invalid, missing, unknown, or malformed.
+    # Raised bare (no arguments) as a signal inside ResourceIndicatorValidator,
+    # then rescued and surfaced through the validation framework. Also raised
+    # with a response by ErrorResponse#raise_exception! so that controller
+    # rescue handlers can extract #response for translated error descriptions.
+    class InvalidTarget < BaseResponseError
+      def initialize(response = nil)
+        super
+      end
+    end
 
     UnauthorizedClient = Class.new(BaseResponseError)
     UnsupportedResponseType = Class.new(BaseResponseError)

data/lib/doorkeeper/http_fetcher.rb

@@ -0,0 +1,232 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "net/http"
+require "resolv"
+require "uri"
+
+module Doorkeeper
+  # Fetches a small operator-untrusted JSON document — a client's jwks_uri
+  # today — over HTTPS: redirects are never followed and any status other
+  # than 200 OK is an error.
+  #
+  # SSRF hardening: the host is resolved up front and the request is refused
+  # when any resolved address falls into an RFC 6890 special-use range
+  # (loopback, private-use, link-local, ...). The connection is then pinned
+  # to the vetted address via Net::HTTP#ipaddr= so a second, post-check DNS
+  # resolution (DNS rebinding) cannot redirect the request; TLS is still
+  # negotiated and verified against the original hostname. An exception for
+  # authorization servers themselves running on a loopback interface is
+  # intentionally not implemented. These rules follow the fetch hardening of
+  # draft-ietf-oauth-client-id-metadata-document (Sections 6.5 / 6.6), which
+  # fetches documents from the same kind of client-chosen URL.
+  #
+  # The response body is bounded and so is the total time spent reading it:
+  # a per-read timeout alone does not stop a server that dribbles bytes out
+  # indefinitely.
+  #
+  # Everything about the response is chosen by whoever hosts the document —
+  # which is whoever supplied the URL — so no failure mode here may escape
+  # as anything other than a FetchError.
+  class HttpFetcher
+    OPEN_TIMEOUT = 5
+    READ_TIMEOUT = 5
+
+    # draft-ietf-oauth-client-id-metadata-document Section 6.6 recommends a
+    # maximum response size of 5 kilobytes for a document like this.
+    MAX_RESPONSE_SIZE = 5 * 1024
+
+    # Ceiling on the whole exchange, so a body delivered one byte per
+    # READ_TIMEOUT cannot hold the connection (and the thread) for hours.
+    MAX_TOTAL_TIME = 10
+
+    # The document is served as JSON, either "application/json" or an
+    # "application/<more specific>+json" variant. A response declaring
+    # anything else plainly serves something other than the document sought
+    # and is refused without being parsed. A response declaring no media type
+    # at all is tolerated — the check is there to catch such a URL early, not
+    # as a security control, since the body still has to parse and validate
+    # in the caller.
+    JSON_MEDIA_TYPE = %r{\Aapplication/([\w.+-]+\+)?json\z}i
+
+    # RFC 6890 special-purpose IPv4/IPv6 registries, plus multicast ranges
+    # (224.0.0.0/4, ff00::/8), which are equally unfit as a document origin.
+    SPECIAL_USE_RANGES = [
+      "0.0.0.0/8",          # "this host on this network"
+      "10.0.0.0/8",         # private-use
+      "100.64.0.0/10",      # shared address space (CGN)
+      "127.0.0.0/8",        # loopback
+      "169.254.0.0/16",     # link-local
+      "172.16.0.0/12",      # private-use
+      "192.0.0.0/24",       # IETF protocol assignments
+      "192.0.2.0/24",       # documentation (TEST-NET-1)
+      "192.88.99.0/24",     # 6to4 relay anycast
+      "192.168.0.0/16",     # private-use
+      "198.18.0.0/15",      # benchmarking
+      "198.51.100.0/24",    # documentation (TEST-NET-2)
+      "203.0.113.0/24",     # documentation (TEST-NET-3)
+      "224.0.0.0/4",        # multicast
+      "240.0.0.0/4",        # reserved (includes limited broadcast)
+      "::/128",             # unspecified
+      "::1/128",            # loopback
+      # IPv4-compatible addresses (::a.b.c.d), deprecated by RFC 4291
+      # Section 2.5.5.1. Unlike the IPv4-mapped form handled in
+      # .special_use? these carry no ::ffff: marker, so they are refused
+      # wholesale rather than delegated to the embedded IPv4 address. The
+      # range also covers the two entries above.
+      "::/96",
+      "64:ff9b::/96",       # IPv4-IPv6 translation
+      "100::/64",           # discard-only
+      "2001::/23",          # IETF protocol assignments (TEREDO, ORCHID, ...)
+      "2001:db8::/32",      # documentation
+      "2002::/16",          # 6to4
+      "fc00::/7",           # unique-local
+      "fe80::/10",          # link-local
+      "ff00::/8",           # multicast
+    ].map { |cidr| IPAddr.new(cidr) }.freeze
+
+    FetchError = Class.new(StandardError)
+
+    # Everything a host can fail at while answering, so that it surfaces as
+    # a rejected client rather than an exception out of the endpoint.
+    #
+    # Net::HTTPBadResponse and Net::HTTPHeaderSyntaxError are listed
+    # explicitly because they descend straight from StandardError, *not*
+    # from Net::ProtocolError: a host answering with a mangled status line
+    # or header field raises them out of Net::HTTP.
+    TRANSPORT_ERRORS = [
+      Timeout::Error,
+      SystemCallError,
+      SocketError,
+      IOError,
+      OpenSSL::SSL::SSLError,
+      Net::ProtocolError,
+      Net::HTTPBadResponse,
+      Net::HTTPHeaderSyntaxError,
+      Resolv::ResolvError,
+      # Only reachable if a body is decompressed despite the identity
+      # Accept-Encoding requested below. Ruby can be built without zlib.
+      (Zlib::Error if defined?(::Zlib::Error)),
+    ].compact.freeze
+
+    def initialize(resolver: Resolv)
+      @resolver = resolver
+    end
+
+    # @param url [String] an already validated https:// URL
+    # @return [String] the response body
+    # @raise [FetchError] on resolution, transport or non-200 failures
+    def fetch(url)
+      uri = URI.parse(url)
+      # URI.parse("https:foo") yields a URI::HTTPS whose host is nil, so a
+      # caller's is_a?(URI::HTTPS) validation does not guarantee a host —
+      # and Resolv raises ArgumentError, not ResolvError, when handed nil.
+      raise FetchError, "#{url.inspect} has no host" if uri.host.blank?
+
+      address = vetted_address_for(uri.host)
+
+      perform_request(uri, address)
+    rescue *TRANSPORT_ERRORS => e
+      raise FetchError, "#{e.class}: #{e.message}"
+    end
+
+    def self.special_use?(address)
+      ip = address.is_a?(IPAddr) ? address : IPAddr.new(address.to_s)
+      # An IPv4-mapped IPv6 address is exactly as special-use as its
+      # embedded IPv4 address: ::ffff:127.0.0.1 must be refused while a
+      # mapped form of a public address stays reachable.
+      return special_use?(ip.native) if ip.ipv4_mapped?
+
+      SPECIAL_USE_RANGES.any? { |range| range.include?(ip) }
+    rescue IPAddr::InvalidAddressError
+      true
+    end
+
+    private
+
+    def vetted_address_for(host)
+      addresses = @resolver.getaddresses(host)
+      raise FetchError, "could not resolve #{host}" if addresses.empty?
+
+      # Every resolved address must be acceptable: pinning to one vetted
+      # address below keeps the connection off the others, but a host that
+      # mixes public and special-use records is treated as hostile.
+      if addresses.any? { |address| self.class.special_use?(address) }
+        raise FetchError, "#{host} resolves to a special-use address (RFC 6890)"
+      end
+
+      addresses.first.to_s
+    end
+
+    def perform_request(uri, address)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = true
+      http.ipaddr = address
+      http.open_timeout = OPEN_TIMEOUT
+      http.read_timeout = READ_TIMEOUT
+
+      request = Net::HTTP::Get.new(
+        uri.request_uri,
+        # Without an explicit Accept-Encoding, Net::HTTP negotiates gzip and
+        # inflates the body itself, which would both feed attacker-chosen
+        # bytes to zlib and turn the Content-Length check below into a check
+        # on the compressed size. A 5 kilobyte document does not need it.
+        { "Accept" => "application/json", "Accept-Encoding" => "identity" },
+      )
+      deadline = monotonic_now + MAX_TOTAL_TIME
+      body = nil
+
+      http.start do |connection|
+        # Net::HTTP never follows redirects on its own; a 3xx just fails
+        # the status check below.
+        connection.request(request) do |response|
+          raise FetchError, "expected 200 OK from #{uri.host}, got #{response.code}" unless response.is_a?(Net::HTTPOK)
+
+          verify_media_type!(response, uri.host)
+          body = bounded_body(response, uri.host, deadline)
+        end
+      end
+
+      body
+    end
+
+    def verify_media_type!(response, host)
+      declared = response["Content-Type"]
+      return if declared.blank?
+
+      media_type = declared.split(";").first.to_s.strip
+      return if JSON_MEDIA_TYPE.match?(media_type)
+
+      raise FetchError, "#{host} served #{media_type.inspect}, which is not a JSON media type"
+    end
+
+    # Reads the response in chunks so an oversized (or endlessly dribbled)
+    # body is abandoned instead of buffered in full. Raising here unwinds
+    # out of Net::HTTP#start, which closes the connection.
+    def bounded_body(response, host, deadline)
+      declared = response["Content-Length"]
+      if declared && declared.to_i > MAX_RESPONSE_SIZE
+        raise FetchError, "#{host} declares a #{declared} byte document, over the " \
+                          "#{MAX_RESPONSE_SIZE} byte limit"
+      end
+
+      body = +""
+
+      response.read_body do |chunk|
+        body << chunk
+
+        if body.bytesize > MAX_RESPONSE_SIZE
+          raise FetchError, "the document from #{host} exceeds #{MAX_RESPONSE_SIZE} bytes"
+        elsif monotonic_now > deadline
+          raise FetchError, "reading the document from #{host} took too long"
+        end
+      end
+
+      body
+    end
+
+    def monotonic_now
+      Process.clock_gettime(Process::CLOCK_MONOTONIC)
+    end
+  end
+end

data/lib/doorkeeper/models/access_grant_mixin.rb

@@ -100,6 +100,22 @@ module Doorkeeper
         column_names.include?("code_challenge")
       end
 
+      # RFC 8707: resource indicators are supported only when the
+      # `resource` column exists (added by the
+      # `doorkeeper:resource_indicators` generator).
+      def resource_indicators_supported?
+        column_names.include?("resource")
+      end
+
+      # Replay protection for authorization codes (RFC 6749 §4.1.2, §10.5)
+      # is active only when the `access_token_id` column exists (added by
+      # the `doorkeeper:grant_reuse_revocation` generator): the column
+      # records the access token issued when the code was exchanged, so a
+      # second exchange attempt can revoke it.
+      def access_token_revoked_on_reuse?
+        column_names.include?("access_token_id")
+      end
+
       ##
       # Determines the secret storing transformer
       # Unless configured otherwise, uses the plain secret strategy

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -229,6 +229,39 @@ module Doorkeeper
         end
       end
 
+      # RFC 8707: checks whether an existing token's audience matches the
+      # requested resource indicators. Used during token reuse to prevent
+      # returning a token audience-restricted to one resource for a request
+      # targeting a different resource.
+      #
+      # The comparison runs whenever either side carries a resource, even when
+      # no validator is configured: a grant bound to resources still restricts
+      # the token's audience (see AuthorizationCodeRequest), so reuse must not
+      # silently widen it by matching an unrestricted or differently-scoped
+      # token. When both sides are blank the tokens are unrestricted and match.
+      #
+      # @param token [Doorkeeper::AccessToken] existing token
+      # @param requested_resource [String, nil] space-delimited resource URIs
+      # @return [Boolean]
+      def resource_indicators_match?(token, requested_resource)
+        token_resource = token.try(:resource)
+
+        # Both blank — neither is audience-restricted, match.
+        return true if token_resource.blank? && requested_resource.blank?
+        # One blank, the other not — mismatch.
+        return false if token_resource.blank? || requested_resource.blank?
+
+        # Both present — compare as sorted sets.
+        token_resource.split.sort == requested_resource.split.sort
+      end
+
+      # RFC 8707: resource indicators are supported only when the
+      # `resource` column exists (added by the
+      # `doorkeeper:resource_indicators` generator).
+      def resource_indicators_supported?
+        column_names.include?("resource")
+      end
+
       # Looking for not expired AccessToken record with a matching set of
       # scopes that belongs to specific Application and Resource Owner.
       # If it doesn't exists - then creates it.
@@ -261,9 +294,17 @@ module Doorkeeper
           # matching token may carry the wrong refresh token presence (e.g. it
           # was issued through a grant with a different `use_refresh_token`)
           # while an older token satisfies the request and can still be reused.
+          #
+          # RFC 8707: resource indicators must also match so that a token
+          # audience-restricted to one resource is never reused for another.
+          requested_resource = token_attributes[:resource]
+
           access_token = matching_token_for(
             application, resource_owner, scopes, custom_attributes: custom_attributes, include_expired: false,
-          ) { |token| refresh_token_matches?(token, token_attributes) }
+          ) do |token|
+            refresh_token_matches?(token, token_attributes) &&
+              resource_indicators_match?(token, requested_resource)
+          end
 
           return access_token if access_token&.reusable?
         end

data/lib/doorkeeper/oauth/authorization/code.rb

@@ -47,6 +47,16 @@ module Doorkeeper
             attributes[:resource_owner_id] = resource_owner.id
           end
 
+          # RFC 8707: persist resource indicators so they can be enforced at
+          # the token endpoint (subset validation) and carried to the token.
+          if pre_auth.respond_to?(:resource_indicators) && pre_auth.resource_indicators.present?
+            unless Doorkeeper.config.access_grant_model.resource_indicators_supported?
+              raise Doorkeeper::Errors::MissingResourceColumn, "oauth_access_grants"
+            end
+
+            attributes[:resource] = pre_auth.resource_indicators.join(" ")
+          end
+
           pkce_attributes.merge(attributes).merge(custom_attributes)
         end
 

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -59,13 +59,24 @@ module Doorkeeper
             resource_owner,
           )
 
-          @token = Doorkeeper.config.access_token_model.find_or_create_for(
+          token_attributes = {
             application: application,
             resource_owner: resource_owner,
             scopes: pre_auth.scopes,
             expires_in: self.class.access_token_expires_in(Doorkeeper.config, context),
             use_refresh_token: false,
-          )
+          }
+
+          # RFC 8707: carry resource indicators to the access token
+          if pre_auth.respond_to?(:resource_indicators) && pre_auth.resource_indicators.present?
+            unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+              raise Doorkeeper::Errors::MissingResourceColumn, "oauth_access_tokens"
+            end
+
+            token_attributes[:resource] = pre_auth.resource_indicators.join(" ")
+          end
+
+          @token = Doorkeeper.config.access_token_model.find_or_create_for(**token_attributes)
         end
 
         def application

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -9,6 +9,10 @@ module Doorkeeper
       # @see https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
       validate :redirect_uri, error: Errors::InvalidGrant
       validate :code_verifier, error: Errors::InvalidGrant
+      # Runs last, so the single-use enforcement it performs only acts once
+      # the caller has proven possession of the code (redirect_uri + PKCE).
+      validate :grant_accessible, error: Errors::InvalidGrant
+      validate :resource_indicators, error: Errors::InvalidTarget
 
       attr_reader :grant, :client, :redirect_uri, :access_token, :code_verifier,
                   :invalid_request_reason, :missing_param
@@ -24,6 +28,7 @@ module Doorkeeper
         @grant_type = Doorkeeper::OAuth::AUTHORIZATION_CODE
         @redirect_uri = parameters[:redirect_uri]
         @code_verifier = parameters[:code_verifier]
+        @raw_resource_indicators = parameters[:resource]
       end
 
       private
@@ -39,16 +44,40 @@ module Doorkeeper
 
           grant.revoke
 
+          token_attributes = custom_token_attributes_with_data
+          # RFC 8707 §2.2: audience-restrict the access token to the resources
+          # bound to the grant. When the token request specifies a (valid)
+          # subset, use that subset; when it omits `resource`, inherit the
+          # grant's full resource set so the token is never issued without an
+          # audience restriction.
+          effective_resources = resolved_resource_indicators.presence || grant_resource_indicators
+          if effective_resources.present?
+            unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+              raise Errors::MissingResourceColumn, "oauth_access_tokens"
+            end
+
+            token_attributes[:resource] = effective_resources.join(" ")
+          end
+
           find_or_create_access_token(
             client,
             resource_owner,
             grant.scopes,
-            custom_token_attributes_with_data,
+            token_attributes,
             server,
           )
+
+          link_access_token_to_grant
         end
 
         super
+      rescue Errors::InvalidGrantReuse
+        # A concurrent exchange of the same code won the race: the raise
+        # rolled this transaction back, so the revocation must happen
+        # outside of it. `lock!` reloaded the grant after the winning
+        # exchange committed, so the token linkage is visible here.
+        revoke_token_issued_for_grant
+        raise
       end
 
       def resource_owner
@@ -81,7 +110,16 @@ module Doorkeeper
       end
 
       def validate_grant
-        return false unless grant && grant.application_id == client.id
+        grant && grant.application_id == client.id
+      end
+
+      # Checked after redirect_uri and PKCE so that a caller who cannot prove
+      # possession of the code never reaches the reuse handling below.
+      def validate_grant_accessible
+        # Authorization codes are single-use (RFC 6749 §4.1.2): observing a
+        # second exchange attempt denies the request and revokes the tokens
+        # already issued for the code (§10.5).
+        revoke_token_issued_for_grant if grant.revoked?
 
         grant.accessible?
       end
@@ -120,9 +158,92 @@ module Doorkeeper
           .symbolize_keys
       end
 
+      # RFC 8707: validate resource indicators on the token request.
+      # If the grant carries resource indicators, the token request's resource
+      # parameter must be a subset. If no grant resource is present, the
+      # validator checks the request resource against server policy.
+      #
+      # Subset and syntax enforcement run even when no validator is configured
+      # as long as the grant is already audience-restricted: a grant bound to
+      # resources must never be exchanged for a token whose audience widens
+      # beyond it. Only when the feature is disabled AND the grant has no
+      # stored resources is the `resource` parameter ignored entirely.
+      def validate_resource_indicators
+        @grant_resource_indicators = grant&.try(:resource)&.split
+
+        validator = Doorkeeper.config.resource_indicator_validator
+
+        # Feature effectively off: no validator and nothing already bound to
+        # enforce against. Ignore the `resource` parameter.
+        return true if validator.nil? && @grant_resource_indicators.blank?
+
+        @resolved_resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+          grant_resource_indicators: @grant_resource_indicators,
+        )
+        true
+      rescue Errors::InvalidTarget
+        false
+      end
+
+      def resolved_resource_indicators
+        @resolved_resource_indicators || []
+      end
+
+      def grant_resource_indicators
+        @grant_resource_indicators || []
+      end
+
       def revoke_previous_tokens(application, resource_owner)
         Doorkeeper.config.access_token_model.revoke_all_for(application.id, resource_owner)
       end
+
+      def link_access_token_to_grant
+        return unless grant.class.access_token_revoked_on_reuse?
+
+        grant.class.with_primary_role do
+          grant.update_column(:access_token_id, access_token.id)
+        end
+      end
+
+      def revoke_token_issued_for_grant
+        return unless grant.class.access_token_revoked_on_reuse?
+        return if grant.access_token_id.blank?
+
+        # Look the token up on the primary too: a lagging read replica may not
+        # have it yet, which would silently skip the revocation.
+        Doorkeeper.config.access_token_model.with_primary_role do
+          token = Doorkeeper.config.access_token_model.find_by(id: grant.access_token_id)
+          next if token.nil?
+
+          # With `reuse_access_token` the same token can back several grants
+          # (find_or_create returns a shared one). Revoking it on a replay of
+          # this grant's code would take down another valid session that still
+          # holds it. Only revoke when no other grant references the token, so
+          # the single-use revocation reaches a token unique to the replayed
+          # code and never collaterally revokes a reused, shared one.
+          next if token_shared_with_other_grant?(token)
+
+          token.revoke
+        end
+      end
+
+      # Reads the grant -> token link, which lives in the optional
+      # `oauth_access_grants.access_token_id` column: new installs get it from
+      # the generated migration, existing apps add it with the
+      # `doorkeeper:grant_reuse_revocation` generator. Callers must therefore
+      # guard with `access_token_revoked_on_reuse?` (as
+      # `link_access_token_to_grant` and `revoke_token_issued_for_grant` do),
+      # so an app that never ran the generator returns early and never queries
+      # a column it does not have.
+      def token_shared_with_other_grant?(token)
+        grant.class
+          .where(access_token_id: token.id)
+          .where.not(id: grant.id)
+          .exists?
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/base_request.rb

@@ -59,8 +59,7 @@ module Doorkeeper
           client_scopes = @client&.scopes
           return default_scopes if client_scopes.blank?
 
-          # Avoid using Scope#& for dynamic scopes
-          client_scopes.allowed(default_scopes)
+          client_scopes.common(default_scopes)
         end
       end
     end