doorkeeper 6.0.0.beta1 → 6.0.0.beta2

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -15,27 +15,42 @@ module Doorkeeper
           false
         end
 
+        # RFC6749, Section 3.1.2.3 requires the requested redirect URI to be
+        # compared to the registered redirect URIs using the simple string
+        # comparison defined in RFC3986, Section 6.2.1.
+        # @see https://datatracker.ietf.org/doc/html/rfc6749#section-3.1.2.3
         def self.matches?(url, client_url)
+          return true if url == client_url
+
+          # RFC8252, Paragraph 7.3 allows the port of loopback interface
+          # redirect URIs to vary at runtime, so it is ignored when both
+          # URIs point to the loopback interface.
+          # @see https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
           url = as_uri(url)
           client_url = as_uri(client_url)
 
-          unless client_url.query.nil?
-            return false unless query_matches?(url.query, client_url.query)
-
-            # Clear out queries so rest of URI can be tested. This allows query
-            # params to be in the request but order not mattering.
-            client_url.query = nil
-          end
+          return false unless loopback_uri?(url) && loopback_uri?(client_url)
 
-          # RFC8252, Paragraph 7.3
-          # @see https://datatracker.ietf.org/doc/html/rfc8252#section-7.3
-          if loopback_uri?(url) && loopback_uri?(client_url)
-            url.port = nil
-            client_url.port = nil
-          end
+          urls_match?(url, client_url)
+        rescue URI::InvalidURIError
+          false
+        end
 
-          url.query = nil
-          url == client_url
+        # RFC 8252 §7.3 lets only the PORT of a loopback redirect URI vary at
+        # runtime. Compare every other component explicitly instead of blanking
+        # the port and comparing the reassembled strings: `URI#port=` also
+        # clears the userinfo on Ruby >= 4.0, which would let
+        # `http://attacker@127.0.0.1/cb` match a registered
+        # `http://127.0.0.1/cb`. Comparing components (not `URI#==`) also keeps
+        # the exception from widening past the port — e.g. an empty path is not
+        # treated as equal to "/".
+        def self.urls_match?(url, client_url)
+          url.scheme == client_url.scheme &&
+            url.userinfo == client_url.userinfo &&
+            url.host == client_url.host &&
+            url.path == client_url.path &&
+            url.query == client_url.query &&
+            url.fragment == client_url.fragment
         end
 
         def self.loopback_uri?(uri)
@@ -45,6 +60,11 @@ module Doorkeeper
         end
 
         def self.valid_for_authorization?(url, client_url)
+          # client_url is blank when the application was registered without a
+          # redirect URI (allow_blank_redirect_uri) — no possible match for
+          # redirection based OAuth flows, not an error.
+          return false if client_url.blank?
+
           valid?(url) && client_url.split.any? { |other_url| matches?(url, other_url) }
         end
 
@@ -52,14 +72,6 @@ module Doorkeeper
           URI.parse(url)
         end
 
-        def self.query_matches?(query, client_query)
-          return true if client_query.blank? && query.blank?
-          return false if client_query.nil? || query.nil?
-
-          # Will return true independent of query order
-          client_query.split("&").sort == query.split("&").sort
-        end
-
         def self.valid_scheme?(uri)
           return false if uri.scheme.blank?
 

data/lib/doorkeeper/oauth/metadata_response.rb

@@ -35,6 +35,8 @@ module Doorkeeper
             # condition under which the iss parameter is emitted. false survives
             # the compaction below, so it is advertised explicitly.
             authorization_response_iss_parameter_supported: config.issuer.present?,
+            # RFC 8707: advertise resource indicator support when configured.
+            resource_indicators_supported: resource_indicators_supported?,
           }
           data.compact!
 
@@ -152,6 +154,12 @@ module Doorkeeper
       def code_challenge_methods_supported
         config.pkce_code_challenge_methods_supported
       end
+
+      def resource_indicators_supported?
+        config.resource_indicator_validator.present? &&
+          Doorkeeper.config.access_grant_model.resource_indicators_supported? &&
+          Doorkeeper.config.access_token_model.resource_indicators_supported?
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/password_access_token_request.rb

@@ -9,10 +9,12 @@ module Doorkeeper
       validate :client_supports_grant_flow, error: Errors::UnauthorizedClient
       validate :resource_owner, error: Errors::InvalidGrant
       validate :scopes, error: Errors::InvalidScope
+      validate :resource_indicators, error: Errors::InvalidTarget
 
       attr_reader :client, :credentials, :resource_owner, :parameters, :access_token
 
       def initialize(server, client, credentials, resource_owner, parameters = {})
+        super()
         @server          = server
         @resource_owner  = resource_owner
         @client          = client
@@ -20,12 +22,21 @@ module Doorkeeper
         @parameters      = parameters
         @original_scopes = parameters[:scope]
         @grant_type      = Doorkeeper::OAuth::PASSWORD
+        @raw_resource_indicators = parameters[:resource]
       end
 
       private
 
       def before_successful_response
-        find_or_create_access_token(client, resource_owner, scopes, {}, server)
+        token_attributes = {}
+        if @resolved_resource_indicators.present?
+          unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+            raise Errors::MissingResourceColumn, "oauth_access_tokens"
+          end
+
+          token_attributes[:resource] = @resolved_resource_indicators.join(" ")
+        end
+        find_or_create_access_token(client, resource_owner, scopes, token_attributes, server)
         super
       end
 
@@ -70,6 +81,21 @@ module Doorkeeper
       def validate_client_supports_grant_flow
         Doorkeeper.config.allow_grant_flow_for_client?(grant_type, client&.application)
       end
+
+      # RFC 8707: validate resource indicators against server policy.
+      def validate_resource_indicators
+        validator = Doorkeeper.config.resource_indicator_validator
+        return true unless validator
+
+        @resolved_resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+        )
+        true
+      rescue Errors::InvalidTarget
+        false
+      end
     end
   end
 end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -16,11 +16,12 @@ module Doorkeeper
       validate :scopes, error: Errors::InvalidScope
       validate :code_challenge, error: Errors::InvalidRequest
       validate :code_challenge_method, error: Errors::InvalidCodeChallengeMethod
+      validate :resource_indicators, error: Errors::InvalidTarget
 
       attr_reader :client, :code_challenge, :code_challenge_method, :missing_param,
                   :redirect_uri, :resource_owner, :response_type, :state,
                   :authorization_response_flow, :response_mode, :custom_access_token_attributes,
-                  :invalid_request_reason
+                  :invalid_request_reason, :resource_indicators
 
       def initialize(server, parameters = {}, resource_owner = nil)
         @server = server
@@ -34,6 +35,7 @@ module Doorkeeper
         @code_challenge_method = parameters[:code_challenge_method]
         @resource_owner = resource_owner
         @custom_access_token_attributes = parameters.slice(*Doorkeeper.config.custom_access_token_attributes).to_h
+        @raw_resource_indicators = parameters[:resource]
       end
 
       def authorizable?
@@ -84,7 +86,7 @@ module Doorkeeper
         if client_scopes.blank?
           server.default_scopes.to_s
         else
-          server.default_scopes.allowed(client_scopes).to_s
+          server.default_scopes.common(client_scopes).to_s
         end
       end
 
@@ -123,7 +125,21 @@ module Doorkeeper
                            :scope
                          end
 
-        @missing_param.nil?
+        return false unless @missing_param.nil?
+
+        # A structured `scope` (e.g. `scope[a]=b`, parsed by Rack into a Hash)
+        # is malformed (RFC 6749 §3.3). Reject it here — before validate_scopes
+        # reaches Scopes.from_string — so the authorization endpoint answers
+        # invalid_request instead of letting the raised error surface as a 500.
+        # Set a reason so the error_description is not translated from nil.
+        return true if scope_param_well_formed?
+
+        @invalid_request_reason = :unknown
+        false
+      end
+
+      def scope_param_well_formed?
+        @scope.nil? || @scope.is_a?(String)
       end
 
       def validate_response_type
@@ -155,6 +171,14 @@ module Doorkeeper
 
       def validate_code_challenge
         return true unless Doorkeeper.config.force_pkce?
+        # PKCE (RFC 7636) protects the exchange of an authorization code, so
+        # a code_challenge is only required from response types that issue one
+        # ("code" and code-carrying hybrid types like "code id_token"). For
+        # response types that never issue a code (e.g. "token" or an OIDC
+        # extension's "id_token"), there is no token-endpoint exchange where a
+        # verifier could ever be checked, so requiring a challenge would
+        # reject those requests over a parameter that cannot be validated.
+        return true unless code_issuing_response_type?
         return true if code_challenge.present?
 
         @invalid_request_reason = :invalid_code_challenge
@@ -168,6 +192,21 @@ module Doorkeeper
           (code_challenge_method.present? && Doorkeeper.config.pkce_code_challenge_methods_supported.include?(code_challenge_method))
       end
 
+      def validate_resource_indicators
+        validator = Doorkeeper.config.resource_indicator_validator
+        # When no validator is configured, resource indicators are ignored (feature disabled)
+        return true unless validator
+
+        @resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+        )
+        true
+      rescue Errors::InvalidTarget
+        false
+      end
+
       def response_on_fragment?
         return response_type == "token" if response_mode.nil?
 
@@ -178,6 +217,15 @@ module Doorkeeper
         response_type == "code" ? AUTHORIZATION_CODE : IMPLICIT
       end
 
+      # Whether the requested response type issues an authorization code.
+      # Multi-valued response types (OIDC hybrid flows registered by
+      # extensions, e.g. "code id_token") are space-delimited per OAuth 2.0
+      # Multiple Response Type Encoding Practices, so a token-wise check also
+      # covers response types Doorkeeper itself does not ship.
+      def code_issuing_response_type?
+        response_type.to_s.split.include?("code")
+      end
+
       def pre_auth_hash
         {
           client_id: client.uid,

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -10,6 +10,7 @@ module Doorkeeper
       validate :client,       error: Errors::InvalidClient
       validate :client_match, error: Errors::InvalidGrant
       validate :scope,        error: Errors::InvalidScope
+      validate :resource_indicators, error: Errors::InvalidTarget
 
       attr_reader :access_token, :client, :credentials, :refresh_token
       attr_reader :missing_param
@@ -21,13 +22,21 @@ module Doorkeeper
         @grant_type = Doorkeeper::OAuth::REFRESH_TOKEN
         @original_scopes = parameters[:scope] || parameters[:scopes]
         @refresh_token_parameter = parameters[:refresh_token]
+        @raw_resource_indicators = parameters[:resource]
         @client = load_client(credentials) if credentials
       end
 
       private
 
+      # Resolved through +OAuth::Client+ rather than by looking the row up
+      # directly, so this grant applies the same rules the other token
+      # endpoint grants do: credentials that carry no secret because their
+      # authentication method already proved the client's identity
+      # (private_key_jwt) resolve by uid alone. The application record is
+      # what is returned, since that is what +#client+ has always exposed
+      # here.
       def load_client(credentials)
-        Doorkeeper.config.application_model.by_uid_and_secret(credentials.uid, credentials.secret)
+        Doorkeeper::OAuth::Client.authenticate(credentials)&.application
       end
 
       def before_successful_response
@@ -74,6 +83,19 @@ module Doorkeeper
           attributes[:previous_refresh_token] = refresh_token.refresh_token
         end
 
+        # RFC 8707: carry resource indicators to the new access token.
+        # If the refresh request specified a (subset of) resource(s), use those;
+        # otherwise inherit from the refresh token itself.
+        if @resolved_resource_indicators.present?
+          unless Doorkeeper.config.access_token_model.resource_indicators_supported?
+            raise Errors::MissingResourceColumn, "oauth_access_tokens"
+          end
+
+          attributes[:resource] = @resolved_resource_indicators.join(" ")
+        elsif refresh_token.try(:resource).present?
+          attributes[:resource] = refresh_token.resource
+        end
+
         # RFC6749
         # 1.5.  Refresh Token
         #
@@ -132,6 +154,34 @@ module Doorkeeper
         end
       end
 
+      # RFC 8707: resource indicators on refresh must be a subset of those
+      # bound to the original refresh token (which inherited from the grant).
+      #
+      # Subset and syntax enforcement run even when no validator is configured
+      # as long as the original token is already audience-restricted: a refresh
+      # must never widen the audience beyond what the original token carried.
+      # Only when the feature is disabled AND the original token has no stored
+      # resources is the `resource` parameter ignored entirely.
+      def validate_resource_indicators
+        original_resources = refresh_token.try(:resource)&.split
+
+        validator = Doorkeeper.config.resource_indicator_validator
+
+        # Feature effectively off: no validator and nothing already bound to
+        # enforce against. Ignore the `resource` parameter.
+        return true if validator.nil? && original_resources.blank?
+
+        @resolved_resource_indicators = ResourceIndicatorValidator.validate!(
+          @raw_resource_indicators,
+          config_validator: validator,
+          client: client,
+          grant_resource_indicators: original_resources,
+        )
+        true
+      rescue Errors::InvalidTarget
+        false
+      end
+
       def custom_token_attributes_with_data
         refresh_token
           .attributes

data/lib/doorkeeper/oauth/resource_indicator_validator.rb

@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+require "uri"
+
+module Doorkeeper
+  module OAuth
+    # Validates the `resource` parameter per RFC 8707.
+    #
+    # The `resource` value MUST be an absolute URI without a fragment component.
+    # Multiple `resource` parameters MAY be present.
+    #
+    # @see https://datatracker.ietf.org/doc/html/rfc8707#section-2
+    module ResourceIndicatorValidator
+      module_function
+
+      # Validates and normalizes an array of resource indicator values.
+      #
+      # @param resource_indicators [Array<String>, String, nil] One or more resource URIs
+      # @param config_validator [Proc, nil] Custom validator from configuration
+      # @param client [Doorkeeper::OAuth::Client, nil] The requesting client
+      # @param grant_resource_indicators [Array<String>, nil] Resource indicators from the
+      #   original authorization grant (for subset enforcement on token requests)
+      #
+      # @return [Array<String>] Validated resource indicator URIs
+      # @raise [Doorkeeper::Errors::InvalidTarget] When validation fails
+      def validate!(resource_indicators, config_validator: nil, client: nil, grant_resource_indicators: nil)
+        return [] if resource_indicators.blank?
+
+        indicators = Array.wrap(resource_indicators).reject(&:blank?).uniq
+        return [] if indicators.empty?
+
+        indicators.each { |uri| validate_uri!(uri) }
+
+        # If the token request specifies resources, they must be a subset of those
+        # originally granted (RFC 8707 §2.2).
+        raise Errors::InvalidTarget if grant_resource_indicators.present? && (indicators - grant_resource_indicators).any?
+
+        # Custom server policy validation
+        raise Errors::InvalidTarget if config_validator && !config_validator.call(indicators, client)
+
+        indicators
+      end
+
+      # @return [Boolean] true when the values are syntactically valid
+      def valid?(resource_indicators)
+        return true if resource_indicators.blank?
+
+        Array(resource_indicators).reject(&:blank?).all? { |uri| valid_uri?(uri) }
+      end
+
+      def valid_uri?(uri)
+        return false unless uri.is_a?(String)
+
+        parsed = URI.parse(uri)
+        # MUST be absolute URI
+        return false unless parsed.absolute?
+        # MUST NOT include a fragment
+        return false if parsed.fragment
+
+        true
+      rescue URI::InvalidURIError, TypeError
+        false
+      end
+
+      def validate_uri!(uri)
+        raise Errors::InvalidTarget unless valid_uri?(uri)
+      end
+    end
+  end
+end

data/lib/doorkeeper/oauth/scopes.rb

@@ -10,6 +10,14 @@ module Doorkeeper
 
       def self.from_string(string)
         string ||= ""
+
+        # A non-string scope (e.g. `scope[a]=b`, parsed by Rack into a Hash)
+        # has no octets to split into tokens. Reject it as a malformed request
+        # (RFC 6749 §3.3); at the token endpoint TokensController's rescue_from
+        # turns this into invalid_request. Callers that always pass a string
+        # (the model layer) never hit this.
+        raise Errors::InvalidScopeParameter, "scope must be a String" unless string.is_a?(String)
+
         new.tap do |scope|
           scope.add(*string.split)
         end
@@ -92,6 +100,23 @@ module Doorkeeper
         self.class.from_array(filtered_scopes)
       end
 
+      # Returns the scopes present in both sets, taking dynamic scopes
+      # into account: a dynamic scope pattern (e.g. `user:*`) on either
+      # side matches the concrete scope (e.g. `user:1`) on the other,
+      # and the concrete scope is what ends up in the result. Unlike
+      # #allowed, the same scopes are returned regardless of which set is
+      # the receiver, though the order may differ: scopes matched from the
+      # argument come first, followed by any scope only the receiver
+      # contributes (a concrete scope matched by a pattern in the argument).
+      #
+      # @param other The set of scopes to intersect with
+      def common(other)
+        other = self.class.from_array(to_array(other))
+        matched = other.select { |scope| exists?(scope) } +
+                  select { |scope| other.exists?(scope) }
+        self.class.from_array(matched)
+      end
+
       private
 
       def dynamic_scopes_enabled?

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -113,6 +113,12 @@ module Doorkeeper
           iat: @token.created_at.to_i,
         }
 
+        # RFC 8707: include audience restriction when resource indicators are present
+        if @token.try(:resource).present?
+          aud = @token.resource.split
+          response[:aud] = aud.length == 1 ? aud.first : aud
+        end
+
         # `token_type` (RFC 6749 §7.1) and `exp` describe the access token:
         # a refresh token is not a Bearer credential and has no expiry of its
         # own, so both are omitted (they are OPTIONAL per RFC 7662 §2.2) when

data/lib/doorkeeper/version.rb

@@ -6,7 +6,7 @@ module Doorkeeper
     MAJOR = 6
     MINOR = 0
     TINY = 0
-    PRE = "beta1"
+    PRE = "beta2"
 
     # Full version number
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")

data/lib/doorkeeper.rb

@@ -8,7 +8,9 @@ require "doorkeeper/engine"
 module Doorkeeper
   autoload :Errors, "doorkeeper/errors"
   autoload :ClientAuthentication, "doorkeeper/client_authentication"
+  autoload :DocumentCache, "doorkeeper/document_cache"
   autoload :GrantFlow, "doorkeeper/grant_flow"
+  autoload :HttpFetcher, "doorkeeper/http_fetcher"
   autoload :OAuth, "doorkeeper/oauth"
   autoload :Rake, "doorkeeper/rake"
   autoload :Request, "doorkeeper/request"
@@ -58,6 +60,7 @@ module Doorkeeper
     autoload :PasswordAccessTokenRequest, "doorkeeper/oauth/password_access_token_request"
     autoload :PreAuthorization, "doorkeeper/oauth/pre_authorization"
     autoload :RefreshTokenRequest, "doorkeeper/oauth/refresh_token_request"
+    autoload :ResourceIndicatorValidator, "doorkeeper/oauth/resource_indicator_validator"
     autoload :Scopes, "doorkeeper/oauth/scopes"
     autoload :Token, "doorkeeper/oauth/token"
     autoload :TokenIntrospection, "doorkeeper/oauth/token_introspection"
@@ -68,6 +71,7 @@ module Doorkeeper
       autoload :None, "doorkeeper/oauth/client_authentication/none"
       autoload :ClientSecretBasic, "doorkeeper/oauth/client_authentication/client_secret_basic"
       autoload :ClientSecretPost, "doorkeeper/oauth/client_authentication/client_secret_post"
+      autoload :PrivateKeyJwt, "doorkeeper/oauth/client_authentication/private_key_jwt"
     end
 
     module Authorization

data/lib/generators/doorkeeper/grant_reuse_revocation_generator.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module Doorkeeper
+  # Generates migration to add the access token reference column to the
+  # access grants table, enabling revocation of previously issued tokens
+  # when an authorization code is reused (RFC 6749 §4.1.2, §10.5).
+  #
+  class GrantReuseRevocationGenerator < ::Rails::Generators::Base
+    include ::Rails::Generators::Migration
+    source_root File.expand_path("templates", __dir__)
+    desc "Support revoking issued tokens on authorization code reuse"
+
+    def self.next_migration_number(path)
+      ActiveRecord::Generators::Base.next_migration_number(path)
+    end
+
+    def grant_reuse_revocation
+      return unless no_access_token_id_column?
+
+      migration_template(
+        "add_access_token_to_access_grants.rb.erb",
+        "db/migrate/add_access_token_to_access_grants.rb",
+        migration_version: migration_version,
+      )
+    end
+
+    private
+
+    def migration_version
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+    end
+
+    def no_access_token_id_column?
+      !ActiveRecord::Base.connection.column_exists?(
+        :oauth_access_grants,
+        :access_token_id,
+      )
+    end
+  end
+end

data/lib/generators/doorkeeper/resource_indicators_generator.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "rails/generators"
+require "rails/generators/active_record"
+
+module Doorkeeper
+  # Generates migration with the `resource` column for access grants and
+  # access tokens, required for RFC 8707 Resource Indicators support.
+  #
+  class ResourceIndicatorsGenerator < ::Rails::Generators::Base
+    include ::Rails::Generators::Migration
+    source_root File.expand_path("templates", __dir__)
+    desc "Add resource indicators support (RFC 8707) to Doorkeeper tables."
+
+    def resource_indicators
+      migration_template(
+        "enable_resource_indicators_migration.rb.erb",
+        "db/migrate/enable_resource_indicators.rb",
+        migration_version: migration_version,
+      )
+    end
+
+    def self.next_migration_number(dirname)
+      ActiveRecord::Generators::Base.next_migration_number(dirname)
+    end
+
+    private
+
+    def migration_version
+      "[#{ActiveRecord::VERSION::MAJOR}.#{ActiveRecord::VERSION::MINOR}]"
+    end
+  end
+end

data/lib/generators/doorkeeper/templates/add_access_token_to_access_grants.rb.erb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddAccessTokenToAccessGrants < ActiveRecord::Migration<%= migration_version %>
+  def change
+    # Indexed: when a code is replayed, the revocation checks whether the
+    # issued token is still referenced by another grant, which filters
+    # oauth_access_grants by access_token_id.
+    add_reference :oauth_access_grants, :access_token, index: true
+  end
+end

data/lib/generators/doorkeeper/templates/enable_resource_indicators_migration.rb.erb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class EnableResourceIndicators < ActiveRecord::Migration<%= migration_version %>
+  def change
+    add_column :oauth_access_grants, :resource, :text, null: true
+    add_column :oauth_access_tokens, :resource, :text, null: true
+  end
+end