doorkeeper 6.0.0.beta2 → 6.0.0.rc2

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -13,9 +13,8 @@ module Doorkeeper
           existing_token = find_revocable_token_for(client, scopes, attributes)
 
           with_revocation(existing_token: existing_token) do
-            application = client.is_a?(Doorkeeper.config.application_model) ? client : client&.application
             Doorkeeper.config.access_token_model.create_for(
-              application: application,
+              application: application_for(client),
               resource_owner: nil,
               scopes: scopes,
               **attributes,
@@ -39,10 +38,25 @@ module Doorkeeper
           end
         end
 
+        # A token that would outlive +public_client_access_token_expires_in+
+        # is not reused, so the cap holds for a public client whatever tokens
+        # it was issued before; a new, capped token is issued instead.
+        #
+        # The cap is checked on the token found rather than inside the lookup
+        # +find_revocable_token_for+ shares: there, an over-cap token must
+        # still be found, so that +revoke_previous_client_credentials_token+
+        # revokes it when the capped token replaces it.
         def find_reusable_token_for(client, scopes, attributes)
           token = find_active_existing_token_for(client, scopes, attributes)
+          return unless token&.reusable?
 
-          token if token&.reusable?
+          token if Authorization::Token.within_public_client_expires_in?(
+            Doorkeeper.config, application_for(client), token,
+          )
+        end
+
+        def application_for(client)
+          client.is_a?(Doorkeeper.config.application_model) ? client : client&.application
         end
 
         def find_revocable_token_for(client, scopes, attributes)

data/lib/doorkeeper/oauth/helpers/uri_checker.rb

@@ -6,6 +6,15 @@ module Doorkeeper
   module OAuth
     module Helpers
       module URIChecker
+        # Schemes a user agent evaluates in the document that navigates to
+        # them instead of fetching a resource from somewhere else. With
+        # `response_mode=form_post` that document is the authorization
+        # server's own page, so a redirect URI with one of these schemes would
+        # run the client's script on the server's origin. None of them can be
+        # a legitimate redirection endpoint (RFC 6749 Section 3.1.2), so they
+        # are refused regardless of the `forbid_redirect_uri` configuration.
+        SCRIPT_SCHEMES = %w[javascript vbscript data].freeze
+
         def self.valid?(url)
           return true if oob_uri?(url)
 
@@ -74,10 +83,15 @@ module Doorkeeper
 
         def self.valid_scheme?(uri)
           return false if uri.scheme.blank?
+          return false if script_scheme?(uri)
 
           %w[localhost].exclude?(uri.scheme)
         end
 
+        def self.script_scheme?(uri)
+          SCRIPT_SCHEMES.include?(uri.scheme.to_s.downcase)
+        end
+
         def self.hypertext_scheme?(uri)
           %w[http https].include?(uri.scheme)
         end

data/lib/doorkeeper/oauth/metadata_response.rb

@@ -155,10 +155,11 @@ module Doorkeeper
         config.pkce_code_challenge_methods_supported
       end
 
+      # The same predicate the endpoints gate on, so the document cannot
+      # advertise a `resource` parameter they would refuse, or stay silent
+      # about one they honour.
       def resource_indicators_supported?
-        config.resource_indicator_validator.present? &&
-          Doorkeeper.config.access_grant_model.resource_indicators_supported? &&
-          Doorkeeper.config.access_token_model.resource_indicators_supported?
+        config.resource_indicator_validator.present? && ResourceIndicatorValidator.storage_ready?
       end
     end
   end

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -5,6 +5,16 @@ module Doorkeeper
     class PreAuthorization
       include Validations
 
+      # The validations that identify the client and its redirect URI. None of
+      # them depend on the resource owner, so the authorization endpoint can
+      # run them before authenticating anyone and spare the user a login that
+      # can only end on an error page. RFC 6749 Section 4.1.2.1 (Section 4.2.2.1
+      # for the implicit flow) asks for the resource owner to be informed when
+      # the client_id is missing or invalid, and Section 3.1.2.4 asks the same
+      # for the redirect URI; running these first is what lets the endpoint
+      # inform them without a detour through the login form.
+      CLIENT_VALIDATIONS = %i[client_id client redirect_uri].freeze
+
       validate :client_id, error: Errors::InvalidRequest
       validate :client, error: Errors::InvalidClient
       validate :redirect_uri, error: Errors::InvalidRedirectUri
@@ -17,6 +27,9 @@ module Doorkeeper
       validate :code_challenge, error: Errors::InvalidRequest
       validate :code_challenge_method, error: Errors::InvalidCodeChallengeMethod
       validate :resource_indicators, error: Errors::InvalidTarget
+      # Runs after :resource_indicators so a malformed target is still answered
+      # as the client's error rather than the server's.
+      validate :resource_indicator_storage, error: Errors::ServerError
 
       attr_reader :client, :code_challenge, :code_challenge_method, :missing_param,
                   :redirect_uri, :resource_owner, :response_type, :state,
@@ -42,6 +55,24 @@ module Doorkeeper
         valid?
       end
 
+      # Runs only CLIENT_VALIDATIONS, in declared order, so a request
+      # from an unknown client or with an invalid redirect URI can be refused
+      # without a resource owner. Error precedence matches a full #validate
+      # run because these are the first validations declared.
+      def client_valid?
+        @error = nil
+        @missing_param = nil
+
+        self.class.validations.each do |validation|
+          next unless CLIENT_VALIDATIONS.include?(validation[:attribute])
+
+          @error = validation[:options][:error] unless send("validate_#{validation[:attribute]}")
+          break if @error
+        end
+
+        @error.nil?
+      end
+
       def scopes
         Scopes.from_string(scope)
       end
@@ -207,6 +238,25 @@ module Doorkeeper
         false
       end
 
+      # A client asking for a resource this server cannot record the audience
+      # of is a misconfiguration — resource_indicator_validator is set, but the
+      # `resource` column the doorkeeper:resource_indicators generator adds is
+      # not there. Issuing the grant would raise MissingResourceColumn out of
+      # Authorization::Code, which the authorization endpoint does not rescue,
+      # so the misconfiguration reached the client as a 500. Answering
+      # server_error here instead matches what the token endpoint already makes
+      # of the same exception, and RFC 6749 Section 4.1.2.1 lists server_error
+      # among the errors returned through the redirection URI.
+      #
+      # Only requests that actually ask for a resource are refused: without the
+      # parameter there is nothing to record, and a misconfigured server would
+      # otherwise stop authorizing anyone at all.
+      def validate_resource_indicator_storage
+        return true if @resource_indicators.blank?
+
+        ResourceIndicatorValidator.storage_ready?
+      end
+
       def response_on_fragment?
         return response_type == "token" if response_mode.nil?
 

data/lib/doorkeeper/oauth/refresh_token_request.rb

@@ -65,20 +65,34 @@ module Doorkeeper
         Doorkeeper.config.access_token_model.refresh_token_revoked_on_use?
       end
 
+      # RFC 6749 §6: a `scope` parameter that is omitted "is treated as equal
+      # to the scope originally granted by the resource owner", and a
+      # requested scope must not exceed it. Both are the scope the presented
+      # refresh token carries, not the scope of the access token issued with
+      # it, which the client may have narrowed on an earlier refresh.
       def default_scopes
-        refresh_token.scopes
+        granted_scopes
+      end
+
+      # Scope of the presented refresh token. Without the
+      # `refresh_token_scopes` column the model reports the access token
+      # scope here, which is the behavior Doorkeeper had before the column
+      # existed. An access token model that does not implement
+      # `refresh_token_scopes` at all (the Sequel and MongoDB adapters ship
+      # their own mixins) gets that same behavior.
+      def granted_scopes
+        @granted_scopes ||= refresh_token.try(:refresh_token_scopes) || refresh_token.scopes
+      end
+
+      # True when the access token model implements the granted-scope API
+      # and has the column to store it.
+      def refresh_token_scopes_supported?
+        Doorkeeper.config.access_token_model.try(:refresh_token_scopes_supported?)
       end
 
       def create_access_token
         attributes = {}.merge(custom_token_attributes_with_data)
 
-        resource_owner =
-          if Doorkeeper.config.polymorphic_resource_owner?
-            refresh_token.resource_owner
-          else
-            refresh_token.resource_owner_id
-          end
-
         if refresh_token_revoked_on_use?
           attributes[:previous_refresh_token] = refresh_token.refresh_token
         end
@@ -96,29 +110,69 @@ module Doorkeeper
           attributes[:resource] = refresh_token.resource
         end
 
-        # RFC6749
-        # 1.5.  Refresh Token
-        #
-        # Refresh tokens are issued to the client by the authorization server and are
-        # used to obtain a new access token when the current access token
-        # becomes invalid or expires, or to obtain additional access tokens
-        # with identical or narrower scope (access tokens may have a shorter
-        # lifetime and fewer permissions than authorized by the resource
-        # owner).
-        #
-        # Here we assume that TTL of the token received after refreshing should be
-        # the same as that of the original token.
-        #
+        # RFC 6749 §6: "If a new refresh token is issued, the refresh token
+        # scope MUST be identical to that of the refresh token included by
+        # the client in the request." Carried explicitly so that a narrowed
+        # access token does not narrow the refresh token issued with it.
+        attributes[:refresh_token_scopes] = granted_scopes.to_s if refresh_token_scopes_supported?
+
         @access_token = Doorkeeper.config.access_token_model.create_for(
           application: refresh_token.application,
           resource_owner: resource_owner,
           scopes: scopes,
-          expires_in: refresh_token.expires_in,
+          expires_in: access_token_expires_in,
           use_refresh_token: true,
           **attributes,
         )
       end
 
+      def resource_owner
+        if Doorkeeper.config.polymorphic_resource_owner?
+          refresh_token.resource_owner
+        else
+          refresh_token.resource_owner_id
+        end
+      end
+
+      # RFC6749
+      # 1.5.  Refresh Token
+      #
+      # Refresh tokens are issued to the client by the authorization server and are
+      # used to obtain a new access token when the current access token
+      # becomes invalid or expires, or to obtain additional access tokens
+      # with identical or narrower scope (access tokens may have a shorter
+      # lifetime and fewer permissions than authorized by the resource
+      # owner).
+      #
+      # The TTL of the refreshed token is therefore that of the original token,
+      # so that a lifetime given to the grant the token was first issued with
+      # survives refreshing (#1364). +custom_access_token_expires_in+ is still
+      # consulted, with +Doorkeeper::OAuth::REFRESH_TOKEN+ as the grant type,
+      # so a host can decide the TTL of refreshed tokens explicitly; the TTL
+      # of the original token is only inherited when the callable returns nil
+      # for this grant (or none is configured).
+      #
+      # The context carries the resource owner record only with a polymorphic
+      # resource owner; otherwise the refresh token stores its id alone, and
+      # +resource_owner+ is nil as in the client_credentials grant.
+      #
+      # The context is built directly rather than through
+      # +Authorization::Token.build_context+, which unwraps its argument
+      # through #application or #client: that suits the OAuth client the other
+      # grants pass, but would replace this application record with whatever
+      # an application model responding to either method returns (a
+      # +belongs_to :client+ association, say).
+      def access_token_expires_in
+        context = Authorization::Context.new(
+          client: refresh_token.application,
+          grant_type: grant_type,
+          scopes: scopes,
+          resource_owner: Doorkeeper.config.polymorphic_resource_owner? ? resource_owner : nil,
+        )
+
+        Authorization::Token.access_token_expires_in(server, context) { refresh_token.expires_in }
+      end
+
       def validate_token_presence
         @missing_param = :refresh_token if refresh_token.blank? && @refresh_token_parameter.blank?
 
@@ -147,7 +201,7 @@ module Doorkeeper
         if @original_scopes.present?
           ScopeChecker.valid?(
             scope_str: @original_scopes,
-            server_scopes: refresh_token.scopes,
+            server_scopes: granted_scopes,
           )
         else
           true
@@ -171,10 +225,13 @@ module Doorkeeper
         # enforce against. Ignore the `resource` parameter.
         return true if validator.nil? && original_resources.blank?
 
+        # The validator receives the OAuth client, as it does at the
+        # authorization endpoint and for every other grant, rather than the
+        # application record #client holds here.
         @resolved_resource_indicators = ResourceIndicatorValidator.validate!(
           @raw_resource_indicators,
           config_validator: validator,
-          client: client,
+          client: client && Doorkeeper::OAuth::Client.new(client),
           grant_resource_indicators: original_resources,
         )
         true

data/lib/doorkeeper/oauth/resource_indicator_validator.rb

@@ -13,6 +13,16 @@ module Doorkeeper
     module ResourceIndicatorValidator
       module_function
 
+      # Whether there is anywhere to record the audience a token was restricted
+      # to: the `resource` column the doorkeeper:resource_indicators generator
+      # adds to both tables. RFC 8707 also needs a policy deciding which
+      # resources are acceptable (resource_indicator_validator), so callers
+      # asking whether the extension is usable check both.
+      def storage_ready?
+        Doorkeeper.config.access_grant_model.resource_indicators_supported? &&
+          Doorkeeper.config.access_token_model.resource_indicators_supported?
+      end
+
       # Validates and normalizes an array of resource indicator values.
       #
       # @param resource_indicators [Array<String>, String, nil] One or more resource URIs

data/lib/doorkeeper/oauth/token.rb

@@ -3,8 +3,53 @@
 module Doorkeeper
   module OAuth
     class Token
+      # Built-in extractors that read a request parameter, and the parameter
+      # each of them reads. RFC 6750 treats the form-encoded body (§2.2) and
+      # the URI query string (§2.3) as two distinct transmission methods, but
+      # Rack and ActionDispatch both collapse them into a single parameter
+      # hash — ActionDispatch lets the query win, Rack lets the body win — so
+      # a request carrying the parameter in both would present a single value
+      # to the extractor and never be refused. The multi-method check reads
+      # the two sources separately for these extractors; selection keeps
+      # using the extractor, so which one wins is unchanged.
+      PARAMETER_EXTRACTORS = {
+        from_access_token_param: "access_token",
+        from_bearer_param: "bearer_token",
+      }.freeze
+
       class << self
+        # RFC 6750 §2: "Clients MUST NOT use more than one method to transmit
+        # the token in each request", and §3.1 lists using more than one method
+        # among the conditions an invalid_request answers. Returning the first
+        # method that yields a value would discard every other token presented
+        # in the same request with no error, warning or log entry, leaving
+        # which token authorizes the request to be decided by the configured
+        # order of +access_token_methods+ rather than by what the caller sent —
+        # so a layer in front of Doorkeeper that reads a different one of them
+        # can reach a different verdict about the very same request.
+        #
+        # What §2 forbids is using more than one method, so the check counts
+        # transmission methods rather than comparing the tokens they carry:
+        # the same value presented twice is still two methods, and is refused
+        # by raising Errors::MultipleAccessTokenMethods so callers can answer
+        # with the invalid_request (400) response §3.1 prescribes — the same
+        # shape Request.client_authentication_method gives the client
+        # authentication side with Errors::MultipleClientAuthMethods.
+        #
+        # Only the built-in extractors — symbols naming methods on this class,
+        # all of them side-effect-free reads of the request — take part in
+        # that check. A custom callable extractor is a configuration adapter
+        # rather than a transmission method: it keeps the historical
+        # first-wins selection and is never invoked more than once, the same
+        # exemption client authentication gives its legacy callable
+        # extractors (Request#validate_client_authentication!).
         def from_request(request, *methods)
+          used = methods.sum do |method|
+            method.is_a?(Symbol) ? transmission_methods_used(request, method) : 0
+          end
+
+          raise Errors::MultipleAccessTokenMethods if used > 1
+
           methods.inject(nil) do |_, method|
             method = self.method(method) if method.is_a?(Symbol)
             credentials = method.call(request)
@@ -23,11 +68,11 @@ module Doorkeeper
         end
 
         def from_access_token_param(request)
-          request.parameters[:access_token]
+          parameters(request)[:access_token]
         end
 
         def from_bearer_param(request)
-          request.parameters[:bearer_token]
+          parameters(request)[:bearer_token]
         end
 
         def from_bearer_authorization(request)
@@ -44,6 +89,53 @@ module Doorkeeper
 
         private
 
+        # How many transmission methods the given built-in extractor finds a
+        # token in. Usually one, or none — but for the parameter extractors
+        # above it is the body and the query counted separately, since the
+        # parameter hash collapsed them into the single value the extractor
+        # reads. That value is counted on its own only when neither raw source
+        # explains it, so a token reaching the extractor by some other route —
+        # an :access_token path segment, or a host that overrode the extractor
+        # — is still counted exactly once rather than twice.
+        def transmission_methods_used(request, method)
+          value = self.method(method).call(request).presence
+
+          parameter = PARAMETER_EXTRACTORS[method]
+          return value ? 1 : 0 unless parameter
+
+          sources = parameter_sources(request, parameter)
+          sources.size + (value && !sources.include?(value) ? 1 : 0)
+        end
+
+        # The form-encoded body (§2.2) and the URI query (§2.3) as Rack
+        # exposes them, for a request object that keeps the two apart.
+        def parameter_sources(request, parameter)
+          return [] unless request.respond_to?(:GET) && request.respond_to?(:POST)
+
+          query = request.GET
+          body = body_parameters(request)
+          return [] unless query.is_a?(Hash) && body.is_a?(Hash)
+
+          [query[parameter], body[parameter]].filter_map(&:presence)
+        end
+
+        # A body ActionDispatch cannot parse — malformed JSON under a JSON
+        # content type, say — carries no token. Reading it must not raise out
+        # of the extractors, which host apps call from places that run after
+        # their own ParseError handling (instrumentation, exception apps), the
+        # same way ActionDispatch's own #filtered_parameters treats that error.
+        def parameters(request)
+          request.parameters
+        rescue ActionDispatch::Http::Parameters::ParseError
+          {}
+        end
+
+        def body_parameters(request)
+          request.POST
+        rescue ActionDispatch::Http::Parameters::ParseError
+          {}
+        end
+
         def token_from_basic_header(header, pattern)
           encoded_header = token_from_header(header, pattern)
           decode_basic_credentials_token(encoded_header)

data/lib/doorkeeper/oauth/token_introspection.rb

@@ -108,7 +108,7 @@ module Doorkeeper
       def success_response
         response = {
           active: true,
-          scope: @token.scopes_string,
+          scope: scopes_string,
           client_id: @token.try(:application).try(:uid),
           iat: @token.created_at.to_i,
         }
@@ -207,6 +207,19 @@ module Doorkeeper
         @token_type == :refresh_token
       end
 
+      # RFC 7662 §2.2: `scope` describes the presented token. A refresh token
+      # carries the scope originally granted by the resource owner
+      # (RFC 6749 §6), which can be wider than the scope of the access token
+      # it was issued with when the client narrowed that one on a refresh.
+      # Models without a stored granted scope (no `refresh_token_scopes`
+      # column, or a row created before its migration) report the access
+      # token scope, as before.
+      def scopes_string
+        return @token.scopes_string unless refresh_token_presented?
+
+        @token.try(:refresh_token_scopes_string).presence || @token.scopes_string
+      end
+
       def valid_authorized_token?
         !authorized_token_matches_introspected? &&
           authorized_token.accessible? &&

data/lib/doorkeeper/orm/active_record/mixins/access_grant.rb

@@ -9,6 +9,7 @@ module Doorkeeper::Orm::ActiveRecord::Mixins
       self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
 
       include ::Doorkeeper::AccessGrantMixin
+      include ::Doorkeeper::Orm::ActiveRecord::Mixins::SecretStorable
       include ::Doorkeeper::Models::PolymorphicResourceOwner::ForAccessGrant
 
       belongs_to :application, class_name: Doorkeeper.config.application_class.to_s,

data/lib/doorkeeper/orm/active_record/mixins/access_token.rb

@@ -9,6 +9,7 @@ module Doorkeeper::Orm::ActiveRecord::Mixins
       self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
 
       include ::Doorkeeper::AccessTokenMixin
+      include ::Doorkeeper::Orm::ActiveRecord::Mixins::SecretStorable
       include ::Doorkeeper::Models::PolymorphicResourceOwner::ForAccessToken
 
       belongs_to :application, class_name: Doorkeeper.config.application_class.to_s,

data/lib/doorkeeper/orm/active_record/mixins/application.rb

@@ -9,6 +9,7 @@ module Doorkeeper::Orm::ActiveRecord::Mixins
       self.strict_loading_by_default = false if respond_to?(:strict_loading_by_default)
 
       include ::Doorkeeper::ApplicationMixin
+      include ::Doorkeeper::Orm::ActiveRecord::Mixins::SecretStorable
       # `enable_application_owner?` is read once, at parent-class autoload
       # time (#1831): with the feature off the model exposes no `:owner`
       # association — avoiding a misleading reflection on schemas that lack

data/lib/doorkeeper/orm/active_record/mixins/secret_storable.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+module Doorkeeper::Orm::ActiveRecord::Mixins
+  # Active Record implementation of the SecretStorable write hook: the
+  # fallback secret upgrade only writes while the column still holds the
+  # value the lookup matched, so losing a race against a concurrent write —
+  # another request renewing the secret, or the application replacing it —
+  # cannot put the superseded secret back.
+  #
+  # The write is a single conditional statement, so unlike the historical
+  # `#update` it runs no model callbacks: what it writes is the value the
+  # lookup already matched, re-encoded into the current storage format.
+  module SecretStorable
+    extend ActiveSupport::Concern
+
+    class_methods do
+      # Writes the upgraded secret over +matched+ on +instance+'s row,
+      # conditional on +attr+ still holding +matched+, and answers whether
+      # the row was written.
+      def write_upgraded_secret(instance, attr, matched, _upgraded)
+        # The value written is the one `store_secret` left on the instance:
+        # it assigns through the attribute writer, which `#update` then ran
+        # again on assignment, so a custom writer override reached storage.
+        # `update_all` does not go through writers, so writing the strategy's
+        # pre-writer return value would both skip the override and leave the
+        # instance out of step with its row.
+        upgraded = instance.read_attribute(attr)
+
+        # `update_all` does not maintain timestamps, which `#update` did —
+        # see `upgrade_timestamps` for the terms it did that on.
+        changes = { attr => upgraded }.merge!(upgrade_timestamps(instance))
+
+        scope = where(primary_key_conditions(instance).merge(attr => matched))
+
+        # Under optimistic locking, `update_all` bumps the lock column on
+        # its own, which would leave the instance stale and have its next
+        # `save` refused. Write the bump explicitly instead — `update_all`
+        # leaves the column alone when it is among the changes — so that the
+        # instance can be brought in step below, and make the write
+        # conditional on the version too: bumping from a version the row no
+        # longer holds would set it backwards.
+        if locking_enabled?
+          version = instance.public_send(locking_column) || 0
+          scope = scope.where(locking_column => version)
+          changes[locking_column] = version + 1
+        end
+
+        # The write must reach the primary database when automatic role
+        # switching would route the surrounding request to a read replica.
+        written = with_primary_role { scope.update_all(changes) }
+        return false if written.zero?
+
+        sync_upgraded_instance(instance, changes)
+        true
+      end
+
+      # Restores +matched+ on the attribute directly, past any custom
+      # writer: re-running a writer that transforms its input would leave
+      # the attribute dirty with a value the row never held, and a later
+      # save would write that over whatever replaced the matched secret.
+      # The change is then cleared — the attribute holds what it held when
+      # the row was read, so there is nothing left to save.
+      def restore_matched_secret(instance, attr, matched)
+        instance.write_attribute(attr, matched)
+        instance.clear_attribute_changes([attr])
+      end
+
+      private
+
+      # The columns identifying +instance+'s row and the values it holds in
+      # them, taken from the configured primary key: it may be named
+      # something other than `id`, or be composed of several columns. A
+      # model with no primary key at all is left to the value condition
+      # alone, which reaches every row still holding the matched secret.
+      def primary_key_conditions(instance)
+        # Spelled without `index_with`, which the gemspec's Rails floor
+        # predates.
+        Array(primary_key).to_h { |key| [key, instance.public_send(key)] } # rubocop:disable Rails/IndexWith
+      end
+
+      # The timestamps `#update` maintained for this write, derived on its
+      # terms through Active Record's own helpers: the model's actual update
+      # timestamp columns (`updated_on` and aliased names as well as
+      # `updated_at`), the connection's timezone, and `record_timestamps`
+      # read on the instance, where a model that stamps its own timestamps
+      # can turn it off per record. A timestamp the caller had already
+      # changed is left out entirely, as `#update` leaves it to the caller —
+      # stamping it and then marking it clean below would silently drop that
+      # pending change.
+      def upgrade_timestamps(instance)
+        return {} unless instance.record_timestamps
+
+        touch_attributes_with_time.reject do |column, _time|
+          instance.will_save_change_to_attribute?(column)
+        end
+      end
+
+      # The row was written past the instance, so bring it back in step:
+      # left as it is, a caller that later saves or locks the record is
+      # refused over a change that is already persisted. Only what was
+      # written is marked clean — a `reload` would also discard every
+      # unrelated unsaved change the caller had on the instance, and this is
+      # nominally a read path.
+      def sync_upgraded_instance(instance, changes)
+        timestamp_attributes_for_update_in_model.each do |column|
+          instance.public_send(:"#{column}=", changes[column]) if changes.key?(column)
+        end
+        instance.public_send(:"#{locking_column}=", changes[locking_column]) if locking_enabled?
+        instance.clear_attribute_changes(changes.keys)
+      end
+    end
+  end
+end

data/lib/doorkeeper/orm/active_record/redirect_uri_validator.rb

@@ -34,8 +34,12 @@ module Doorkeeper
       Doorkeeper::OAuth::NonStandard::IETF_WG_OAUTH2_OOB_METHODS.include?(uri)
     end
 
+    # Script schemes are refused before the host application's rule is
+    # consulted, so a `forbid_redirect_uri` that rejects them too does not
+    # report the error twice.
     def forbidden_uri?(uri)
-      Doorkeeper.config.forbid_redirect_uri.call(uri)
+      Doorkeeper::OAuth::Helpers::URIChecker.script_scheme?(uri) ||
+        Doorkeeper.config.forbid_redirect_uri.call(uri)
     end
 
     def unspecified_scheme?(uri)

data/lib/doorkeeper/orm/active_record.rb

@@ -26,6 +26,7 @@ module Doorkeeper
         autoload :AccessGrant, "doorkeeper/orm/active_record/mixins/access_grant"
         autoload :AccessToken, "doorkeeper/orm/active_record/mixins/access_token"
         autoload :Application, "doorkeeper/orm/active_record/mixins/application"
+        autoload :SecretStorable, "doorkeeper/orm/active_record/mixins/secret_storable"
       end
 
       # Kept as a no-op so `Doorkeeper.run_orm_hooks` (and any plugin that