doorkeeper 5.8.1 → 5.8.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8364fc5d75f9cbe96cc3ef67c8010dde471eb51ced0cf328f9ca84705553976f
-  data.tar.gz: db817023f41b070185ae9d6fae32b9d9b0eb0fc7abf8bdd99961c80e8bece1dd
+  metadata.gz: de574cec8c17af2fd1026081acc0bf592c71ecbf947d92546df6b4d48ce3b5ce
+  data.tar.gz: eb282ce352bbd4491014b753535ff24e804ca801e02aef8a6ded3f7ca5951e64
 SHA512:
-  metadata.gz: 940f6253760d9117390495e97fa270aa0337a7379d2070d2be5ce2a44cf8148f451ffe7a3ba0451ab88d1cbb5bd4242f6d4a7de90204cf2749a57bdeaa4005ed
-  data.tar.gz: 728ea65c1e37f7f77183e5528c441cf7b9c8a4493428bbafbfe7815dec4b227d8bd033e05c4ee2dde50b9cc252cad7241b5d287d2df28e6631f9ccada5c7afc5
+  metadata.gz: 68b668d79eb5532cb4dbe660eb26269d67eb545b5dbd12bae15c087752c7e5447e1f60326725c0d838189a746de5718e8644605dcdd946d4f2cf29a556297369
+  data.tar.gz: 8ad2d79f707129abd0787710cc86ee563af9887f986dec03edc396c691ffb26e18279b3693bc15658d059e78dd7dc2ce3093a137c03bb16e7858832d9e80c368

data/CHANGELOG.md

@@ -9,6 +9,13 @@ User-visible changes worth mentioning.
 
 Add your entry here.
 
+## 5.8.2
+
+- [#1755] Fix the error message for force_pkce
+- [#1761] Memoize authentication failure
+- [#1762] Allow missing client to trigger invalid client error when force_pkce is enabled
+- [#1767] Make sure error handling happens on a controller level opposed to action level to account for the controller being extended
+
 ## 5.8.1
 
 - [#1752] Bump the range of supported Ruby and Rails versions

data/app/controllers/doorkeeper/tokens_controller.rb

@@ -4,12 +4,14 @@ module Doorkeeper
   class TokensController < Doorkeeper::ApplicationMetalController
     before_action :validate_presence_of_client, only: [:revoke]
 
+    rescue_from Errors::DoorkeeperError do |e|
+      handle_token_exception(e)
+    end
+
     def create
       headers.merge!(authorize_response.headers)
       render json: authorize_response.body,
              status: authorize_response.status
-    rescue Errors::DoorkeeperError => e
-      handle_token_exception(e)
     end
 
     # OAuth 2.0 Token Revocation - https://datatracker.ietf.org/doc/html/rfc7009

data/config/locales/en.yml

@@ -96,6 +96,7 @@ en:
           unknown: 'The request is missing a required parameter, includes an unsupported parameter value, or is otherwise malformed.'
           missing_param: 'Missing required parameter: %{value}.'
           request_not_authorized: 'Request need to be authorized. Required parameter for authorizing request is missing or invalid.'
+          invalid_code_challenge: 'Code challenge is required.'
         invalid_redirect_uri: "The requested redirect uri is malformed or doesn't match client redirect URI."
         unauthorized_client: 'The client is not authorized to perform this request using this method.'
         access_denied: 'The resource owner or authorization server denied the request.'

data/lib/doorkeeper/errors.rb

@@ -68,7 +68,6 @@ module Doorkeeper
     InvalidClient = Class.new(BaseResponseError)
     InvalidScope = Class.new(BaseResponseError)
     InvalidRedirectUri = Class.new(BaseResponseError)
-    InvalidCodeChallenge = Class.new(BaseResponseError)
     InvalidGrant = Class.new(BaseResponseError)
 
     UnauthorizedClient = Class.new(BaseResponseError)

data/lib/doorkeeper/oauth/authorization_code_request.rb

@@ -59,15 +59,11 @@ module Doorkeeper
         Doorkeeper.config.access_grant_model.pkce_supported?
       end
 
-      def confidential?
-        client&.confidential
-      end
-
       def validate_params
         @missing_param =
           if grant&.uses_pkce? && code_verifier.blank?
             :code_verifier
-          elsif !confidential? && Doorkeeper.config.force_pkce? && code_verifier.blank?
+          elsif client && !client.confidential && Doorkeeper.config.force_pkce? && code_verifier.blank?
             :code_verifier
           elsif redirect_uri.blank?
             :redirect_uri

data/lib/doorkeeper/oauth/pre_authorization.rb

@@ -14,12 +14,13 @@ module Doorkeeper
       validate :response_type, error: Errors::UnsupportedResponseType
       validate :response_mode, error: Errors::UnsupportedResponseMode
       validate :scopes, error: Errors::InvalidScope
-      validate :code_challenge, error: Errors::InvalidCodeChallenge
+      validate :code_challenge, error: Errors::InvalidRequest
       validate :code_challenge_method, error: Errors::InvalidCodeChallengeMethod
 
       attr_reader :client, :code_challenge, :code_challenge_method, :missing_param,
                   :redirect_uri, :resource_owner, :response_type, :state,
-                  :authorization_response_flow, :response_mode, :custom_access_token_attributes
+                  :authorization_response_flow, :response_mode, :custom_access_token_attributes,
+                  :invalid_request_reason
 
       def initialize(server, parameters = {}, resource_owner = nil)
         @server = server
@@ -147,7 +148,10 @@ module Doorkeeper
       def validate_code_challenge
         return true unless Doorkeeper.config.force_pkce?
         return true if client.confidential
-        code_challenge.present?
+        return true if code_challenge.present?
+
+        @invalid_request_reason = :invalid_code_challenge
+        false
       end
 
       def validate_code_challenge_method

data/lib/doorkeeper/rails/helpers.rb

@@ -70,7 +70,9 @@ module Doorkeeper
       end
 
       def doorkeeper_token
-        @doorkeeper_token ||= OAuth::Token.authenticate(
+        return @doorkeeper_token if defined?(@doorkeeper_token)
+
+        @doorkeeper_token = OAuth::Token.authenticate(
           request,
           *Doorkeeper.config.access_token_methods,
         )

data/lib/doorkeeper/version.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 8
-    TINY = 1
+    TINY = 2
     PRE = nil
 
     # Full version number

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.8.1
+  version: 5.8.2
 platform: ruby
 authors:
 - Felipe Elias Philipp
@@ -11,7 +11,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-12-09 00:00:00.000000000 Z
+date: 2025-04-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties