doorkeeper 6.0.0.beta1 → 6.0.0.beta2

data/lib/generators/doorkeeper/templates/initializer.rb

@@ -298,6 +298,40 @@ Doorkeeper.configure do
   # The legacy `client_credentials` option is deprecated; `:from_basic` and
   # `:from_params` are automatically mapped to `:client_secret_basic` and
   # `:client_secret_post`.
+  #
+  # A `private_key_jwt` method (RFC 7523 / OIDC Core §9) is also registered
+  # but not enabled by default — add it to the list above to accept it. It
+  # requires the `jwt` gem (>= 2.7) in your bundle, and verifies assertions
+  # against the client's published public keys: `jwks` / `jwks_uri`
+  # attributes you define on your Application model (Doorkeeper does not add
+  # these columns itself). Assertions must carry iss = sub =
+  # client_id, an aud of your `issuer` (or the token endpoint URL), a bounded
+  # exp (at most 1 hour ahead), a kid header, and a single-use jti.
+  #
+  # jti replay is tracked in process-local memory by default (bounded at
+  # 10 000 entries, each held at most 1 hour), so an assertion replayed to a
+  # different server process is not caught. To share the tracking across
+  # processes, supply your own store (e.g. backed by Redis):
+  #
+  # private_key_jwt_replay_guard MyRedisReplayGuard.new
+  #
+  # JWK Sets fetched from a `jwks_uri` are cached in process-local memory
+  # for 60 seconds; to change the TTL or share the cache across processes:
+  #
+  # private_key_jwt_jwks_cache Doorkeeper::DocumentCache.new(ttl: 300)
+  #
+  # The accepted audiences are built from your `issuer` or from Rails'
+  # `default_url_options`; set at least one of them, otherwise Doorkeeper has
+  # nothing but the request's Host header to identify itself with and the
+  # audience check cannot tell your server apart from another one.
+  #
+  # A client's `jwks_uri` is fetched with a hardened HTTP client (HTTPS
+  # only, no redirects, hosts resolving to RFC 6890 special-use addresses
+  # refused), so a jwks_uri on a private network or on localhost is refused
+  # even though you configured it yourself; inline `jwks` has no such
+  # restriction.
+  #
+  # client_authentication %i[client_secret_basic client_secret_post none private_key_jwt]
 
   # Change the way access token is authenticated from the request object.
   # By default it retrieves first from the `HTTP_AUTHORIZATION` header, then
@@ -333,6 +367,9 @@ Doorkeeper.configure do
   # types, but you **need** to manually drop `NOT NULL` constraint from `redirect_uri`
   # column for `oauth_applications` database table.
   #
+  # You almost certainly do not want to change this. There are very, very few cases
+  # where you want to change this configuration value.
+  #
   # You can completely disable this feature with:
   #
   # allow_blank_redirect_uri false
@@ -601,4 +638,32 @@ Doorkeeper.configure do
   # custom_metadata(
   #   userinfo_endpoint: "https://auth.example.com/oauth/userinfo",
   # )
+
+  # Resource Indicators for OAuth 2.0 (RFC 8707)
+  #
+  # When configured with a callable, enables RFC 8707 support. The callable
+  # receives an array of resource indicator URIs and the OAuth client, and must
+  # return true if the resources are acceptable, or false to reject with
+  # `invalid_target`.
+  #
+  # Clients may then include one or more `resource` parameters in authorization
+  # and token requests to signal which protected resource(s) they intend to
+  # access. The authorization server will:
+  #   - Validate resource URIs (must be absolute, no fragment)
+  #   - Store resource indicators on grants and tokens
+  #   - Enforce subset restrictions on token/refresh requests
+  #   - Include `aud` in token introspection responses
+  #
+  # NOTE: RFC 8707 specifies repeated query parameters (?resource=…&resource=…)
+  # for multiple values, but Rack collapses repeated keys to the last value.
+  # Clients must use the Rails bracket syntax (resource[]=…&resource[]=…) to
+  # send multiple resource indicators. A single resource=… works as-is.
+  #
+  # To use this feature, first run `rails generate doorkeeper:resource_indicators`
+  # to add the required `resource` column to the access grants and tokens tables.
+  #
+  # resource_indicator_validator ->(resource_indicators, client) {
+  #   allowed = %w[https://api.example.com/ https://calendar.example.com/]
+  #   resource_indicators.all? { |r| allowed.include?(r) }
+  # }
 end

data/lib/generators/doorkeeper/templates/migration.rb.erb

@@ -28,6 +28,19 @@ class CreateDoorkeeperTables < ActiveRecord::Migration<%= migration_version %>
       t.string   :scopes,            null: false, default: ''
       t.datetime :created_at,        null: false
       t.datetime :revoked_at
+
+      # Authorization codes are single-use (RFC 6749 §4.1.2). Doorkeeper
+      # records the access token issued when the code is exchanged, so that
+      # a second exchange attempt revokes the previously issued tokens as
+      # recommended by RFC 6749 §10.5.
+      #
+      # Comment out this line if you don't want a reused authorization code
+      # to revoke the tokens already issued for it.
+      #
+      # Indexed: when a code is replayed, the revocation checks whether the
+      # issued token is still referenced by another grant, which filters
+      # this table by access_token_id.
+      t.references :access_token,    index: true
     end
 
     add_index :oauth_access_grants, :token, unique: true

metadata

@@ -1,16 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 6.0.0.beta1
+  version: 6.0.0.beta2
 platform: ruby
 authors:
 - Felipe Elias Philipp
 - Tute Costa
 - Jon Moss
 - Nikita Bulai
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -124,6 +125,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: jwt
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.7'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -166,6 +181,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Doorkeeper is an OAuth 2 provider for Rails and Grape.
 email:
 - bulaj.nikita@gmail.com
@@ -209,10 +238,12 @@ files:
 - lib/doorkeeper/client_authentication/legacy_callable.rb
 - lib/doorkeeper/client_authentication/method.rb
 - lib/doorkeeper/client_authentication/registry.rb
+- lib/doorkeeper/client_authentication/verified_credentials.rb
 - lib/doorkeeper/config.rb
 - lib/doorkeeper/config/abstract_builder.rb
 - lib/doorkeeper/config/option.rb
 - lib/doorkeeper/config/validations.rb
+- lib/doorkeeper/document_cache.rb
 - lib/doorkeeper/engine.rb
 - lib/doorkeeper/errors.rb
 - lib/doorkeeper/grant_flow.rb
@@ -222,6 +253,7 @@ files:
 - lib/doorkeeper/grape/authorization_decorator.rb
 - lib/doorkeeper/grape/helpers.rb
 - lib/doorkeeper/helpers/controller.rb
+- lib/doorkeeper/http_fetcher.rb
 - lib/doorkeeper/models/access_grant_mixin.rb
 - lib/doorkeeper/models/access_token_mixin.rb
 - lib/doorkeeper/models/application_mixin.rb
@@ -249,6 +281,9 @@ files:
 - lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb
 - lib/doorkeeper/oauth/client_authentication/client_secret_post.rb
 - lib/doorkeeper/oauth/client_authentication/none.rb
+- lib/doorkeeper/oauth/client_authentication/private_key_jwt.rb
+- lib/doorkeeper/oauth/client_authentication/private_key_jwt/key_resolver.rb
+- lib/doorkeeper/oauth/client_authentication/private_key_jwt/replay_guard.rb
 - lib/doorkeeper/oauth/client_credentials/creator.rb
 - lib/doorkeeper/oauth/client_credentials/issuer.rb
 - lib/doorkeeper/oauth/client_credentials/validator.rb
@@ -269,6 +304,7 @@ files:
 - lib/doorkeeper/oauth/password_access_token_request.rb
 - lib/doorkeeper/oauth/pre_authorization.rb
 - lib/doorkeeper/oauth/refresh_token_request.rb
+- lib/doorkeeper/oauth/resource_indicator_validator.rb
 - lib/doorkeeper/oauth/scopes.rb
 - lib/doorkeeper/oauth/token.rb
 - lib/doorkeeper/oauth/token_introspection.rb
@@ -313,17 +349,21 @@ files:
 - lib/generators/doorkeeper/application_owner_generator.rb
 - lib/generators/doorkeeper/confidential_applications_generator.rb
 - lib/generators/doorkeeper/enable_polymorphic_resource_owner_generator.rb
+- lib/generators/doorkeeper/grant_reuse_revocation_generator.rb
 - lib/generators/doorkeeper/install_generator.rb
 - lib/generators/doorkeeper/migration_generator.rb
 - lib/generators/doorkeeper/pkce_generator.rb
 - lib/generators/doorkeeper/previous_refresh_token_generator.rb
 - lib/generators/doorkeeper/remove_applications_secret_not_null_constraint_generator.rb
+- lib/generators/doorkeeper/resource_indicators_generator.rb
 - lib/generators/doorkeeper/templates/README
+- lib/generators/doorkeeper/templates/add_access_token_to_access_grants.rb.erb
 - lib/generators/doorkeeper/templates/add_confidential_to_applications.rb.erb
 - lib/generators/doorkeeper/templates/add_owner_to_application_migration.rb.erb
 - lib/generators/doorkeeper/templates/add_previous_refresh_token_to_access_tokens.rb.erb
 - lib/generators/doorkeeper/templates/enable_pkce_migration.rb.erb
 - lib/generators/doorkeeper/templates/enable_polymorphic_resource_owner_migration.rb.erb
+- lib/generators/doorkeeper/templates/enable_resource_indicators_migration.rb.erb
 - lib/generators/doorkeeper/templates/initializer.rb
 - lib/generators/doorkeeper/templates/migration.rb.erb
 - lib/generators/doorkeeper/templates/remove_applications_secret_not_null_constraint.rb.erb
@@ -339,6 +379,7 @@ metadata:
   bug_tracker_uri: https://github.com/doorkeeper-gem/doorkeeper/issues
   documentation_uri: https://doorkeeper.gitbook.io/guides/
   funding_uri: https://opencollective.com/doorkeeper-gem
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -353,7 +394,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.11
+rubygems_version: 3.5.16
+signing_key: 
 specification_version: 4
 summary: OAuth 2 provider for Rails and Grape
 test_files: []