doorkeeper 5.9.3 → 5.9.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 71a32b8766b44f5eff16fbc128cfff6ab676b5af9104d16d58f060a0ed6d894c
-  data.tar.gz: 864e07764f1ba86d6f52a10e5a081291c2748dcecbfb8bcc60b0f27baa4e616e
+  metadata.gz: d3e4ee342094b7729f29bb64d9045cfd9736d99388c5bb15d68568c6d59a8a54
+  data.tar.gz: e1549e74f00d26b85ed9afedbfaba17adce5a4e8a62c5ee01a8c4ff70c71bbcf
 SHA512:
-  metadata.gz: 4116cfa7e4e06a1bff79489ddeced66af1803dedd6f2e1b1b5edd67db0d90e444922a87cfc2215a4e61357e54ddf988606c3ecce40e50afb24fdd5e06808a2bd
-  data.tar.gz: 558ec2ac88215ba2cde034380a27d44d0c989841942c070e4ea02a746d154944b094ae2aa6a9284c7cca6d310705634fde4f6566fbf8a268a0c1b33e41937107
+  metadata.gz: d91e3f678a7a3d53e94c607b5b88d5a6e695e166a52fd9f5527c8988bd717c60debc292798c159da7356966baa4d26ad22d56a9b922582040e758c37ef26ea96
+  data.tar.gz: e335f698b2a3fe29b139e826fafada70b94fd239a0c2e0f2be762075c27bb73c8dab4c93a9581089214b07f9016af893cd0c70daf0fdc2db9c8b72f7ae848850

data/CHANGELOG.md

@@ -9,6 +9,14 @@ User-visible changes worth mentioning.
 
 - Please add here
 
+## 5.9.5
+
+- [#1901] Reject requests that authenticate the client with more than one method (RFC 6749 §2.3) with an `invalid_request` error, instead of silently authenticating with the first method that matched and discarding the other credentials.
+
+## 5.9.4
+
+- [#1853] Fix `reuse_access_token` reusing a token that was created with `custom_access_token_attributes` values when the new request doesn't specify any custom attributes. Such requests now only match tokens without custom attributes.
+
 ## 5.9.3
 
 - [#1834] Fix default `allow_token_introspection` returning `false` when a custom `application_class` is configured. The default proc compared application objects with `==`, which fails when the authorized client and the introspected token's application are resolved as different classes (e.g. a base `Doorkeeper::Application` vs. a configured subclass) even though they reference the same record. It now compares application ids instead.

data/config/locales/en.yml

@@ -97,6 +97,7 @@ en:
           missing_param: 'Missing required parameter: %{value}.'
           request_not_authorized: 'Request needs to be authorized. Required parameter for authorizing the request is missing or invalid.'
           invalid_code_challenge: 'Code challenge is required.'
+          multiple_client_auth_methods: 'The request utilizes more than one mechanism for authenticating the client.'
         invalid_redirect_uri: "The requested redirect URI is malformed or doesn't match the client redirect URI."
         unauthorized_client: 'The client is not authorized to perform this request using this method.'
         access_denied: 'The resource owner or authorization server denied the request.'

data/lib/doorkeeper/errors.rb

@@ -24,6 +24,19 @@ module Doorkeeper
       end
     end
 
+    # Raised when a request uses more than one client authentication method,
+    # which RFC 6749 §2.3 explicitly forbids ("The client MUST NOT use more
+    # than one authentication method in each request").
+    class MultipleClientAuthMethods < DoorkeeperError
+      def type
+        :invalid_request
+      end
+
+      def reason
+        :multiple_client_auth_methods
+      end
+    end
+
     class MissingRequiredParameter < DoorkeeperError
       attr_reader :missing_param
 

data/lib/doorkeeper/helpers/controller.rb

@@ -56,7 +56,8 @@ module Doorkeeper
           OAuth::InvalidRequestResponse.new(
             name: exception.type,
             state: params[:state],
-            missing_param: exception.missing_param,
+            missing_param: exception.try(:missing_param),
+            reason: exception.try(:reason),
           )
         else
           OAuth::ErrorResponse.new(name: exception.type, state: params[:state])

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -89,7 +89,8 @@ module Doorkeeper
       # @param custom_attributes [Nilable Hash]
       #   A nil value, or hash with keys corresponding to the custom attributes
       #   configured with the `custom_access_token_attributes` config option.
-      #   A nil value will ignore custom attributes.
+      #   A nil value will ignore custom attributes, while an empty hash will
+      #   only match tokens that have no custom attributes set.
       #
       # @return [Doorkeeper::AccessToken, nil] Access Token instance or
       #   nil if matching record was not found
@@ -124,7 +125,8 @@ module Doorkeeper
       # @param custom_attributes [Nilable Hash]
       #   A nil value, or hash with keys corresponding to the custom attributes
       #   configured with the `custom_access_token_attributes` config option.
-      #   A nil value will ignore custom attributes.
+      #   A nil value will ignore custom attributes, while an empty hash will
+      #   only match tokens that have no custom attributes set.
       #
       # @return [Doorkeeper::AccessToken, nil] Access Token instance or
       #   nil if matching record was not found
@@ -220,7 +222,10 @@ module Doorkeeper
         scopes = Doorkeeper::OAuth::Scopes.from_string(scopes) if scopes.is_a?(String)
 
         if Doorkeeper.config.reuse_access_token
-          custom_attributes = extract_custom_attributes(token_attributes).presence
+          # An empty hash must stay distinct from nil here: nil ignores custom
+          # attributes when matching, while an empty hash only matches tokens
+          # that have no custom attributes set.
+          custom_attributes = extract_custom_attributes(token_attributes)
           access_token = matching_token_for(
             application, resource_owner, scopes, custom_attributes: custom_attributes, include_expired: false,
           )

data/lib/doorkeeper/oauth/client/credentials.rb

@@ -5,12 +5,33 @@ module Doorkeeper
     class Client
       Credentials = Struct.new(:uid, :secret) do
         class << self
+          # Extracts the client credentials from the request using the
+          # configured extraction methods. The first method that yields
+          # credentials wins, as it always has.
+          #
+          # Raises Errors::MultipleClientAuthMethods when the request
+          # authenticates the client with more than one method, which RFC 6749
+          # §2.3 forbids ("The client MUST NOT use more than one authentication
+          # method in each request").
           def from_request(request, *credentials_methods)
-            credentials_methods.inject(nil) do |_, method|
-              method = self.method(method) if method.is_a?(Symbol)
-              credentials = Credentials.new(*method.call(request))
-              break credentials if credentials.present?
-            end
+            # Callable extractors are opaque: they may legitimately overlap the
+            # built-in methods they are configured with, and evaluating all of
+            # them would also break the existing contract that the extractors
+            # after the matching one are not called. Such configurations keep
+            # the historical behaviour untouched.
+            return first_from_request(request, credentials_methods) unless credentials_methods.all?(Symbol)
+
+            credentials = credentials_methods.filter_map { |method| extract(request, method) }
+
+            # Only credentials carrying a secret authenticate the client. A bare
+            # uid is a public client identifying itself (RFC 6749 §2.3 "none"),
+            # not an authentication method of its own, so it doesn't count
+            # towards the single-method rule — RFC 7521 §4.2, for example,
+            # explicitly allows a client_id next to another authentication
+            # method.
+            raise Errors::MultipleClientAuthMethods if credentials.count { |c| c.secret.present? } > 1
+
+            credentials.first
           end
 
           def from_params(request)
@@ -23,6 +44,22 @@ module Doorkeeper
               Base64.decode64(Regexp.last_match(1)).split(/:/, 2)
             end
           end
+
+          private
+
+          def first_from_request(request, credentials_methods)
+            credentials_methods.inject(nil) do |_, method|
+              credentials = extract(request, method)
+              break credentials if credentials
+            end
+          end
+
+          # Returns the credentials the given method extracts from the request,
+          # or nil when it extracts none.
+          def extract(request, method)
+            method = self.method(method) if method.is_a?(Symbol)
+            Credentials.new(*method.call(request)).presence
+          end
         end
 
         # Public clients may have their secret blank, but "credentials" are

data/lib/doorkeeper/oauth/client_credentials/creator.rb

@@ -45,8 +45,11 @@ module Doorkeeper
         end
 
         def find_active_existing_token_for(client, scopes, attributes)
+          # An empty hash must stay distinct from nil here: nil ignores custom
+          # attributes when matching, while an empty hash only matches tokens
+          # that have no custom attributes set.
           custom_attributes = Doorkeeper.config.access_token_model
-            .extract_custom_attributes(attributes).presence
+            .extract_custom_attributes(attributes)
           Doorkeeper.config.access_token_model.matching_token_for(
             client, nil, scopes, custom_attributes: custom_attributes, include_expired: false,
           )

data/lib/doorkeeper/oauth/stateless_token.rb

@@ -0,0 +1,139 @@
+# frozen_string_literal: true
+
+module Doorkeeper
+  module OAuth
+    # In-memory representation of a verified JWT access token. Returned by
+    # OAuth::Token.authenticate when stateless_jwt_tokens is enabled, so that
+    # the existing doorkeeper_token / doorkeeper_authorize! helpers work
+    # without any database read.
+    #
+    # Stateless tokens cannot be revoked or refreshed server-side: #revoked?
+    # is always false and #revoke is a no-op. Rely on short token lifetimes
+    # (access_token_expires_in) for early invalidation.
+    class StatelessToken
+      attr_reader :claims, :application, :raw_token
+
+      def initialize(claims:, application: nil, raw_token: nil)
+        @claims = claims
+        @application = application
+        @raw_token = raw_token
+      end
+
+      def token_type
+        "Bearer"
+      end
+
+      # The raw token string. Used by introspection's
+      # authorized_token_matches_introspected? security check.
+      def token
+        @raw_token
+      end
+
+      # Issuance path: the freshly-signed JWT returned to the client.
+      def plaintext_token
+        @raw_token
+      end
+
+      def plaintext_refresh_token
+        nil
+      end
+
+      def resource_owner_id
+        claims["resource_owner_id"] || claims["sub"]
+      end
+
+      def application_id
+        application&.id
+      end
+
+      def scopes_string
+        claims["scope"].to_s
+      end
+
+      def scopes
+        OAuth::Scopes.from_string(scopes_string)
+      end
+
+      def includes_scope?(*required_scopes)
+        required_scopes.blank? || required_scopes.any? { |scope| scopes.exists?(scope.to_s) }
+      end
+
+      def custom_attributes
+        claims.slice(*Doorkeeper.config.custom_access_token_attributes.map(&:to_s))
+      end
+
+      # RFC 8707 resource indicator. Stored as a space-delimited string to
+      # match the AccessToken column shape consumed by token_introspection.
+      def resource
+        aud = claims["aud"]
+        return nil if aud.blank?
+
+        aud.is_a?(Array) ? aud.join(" ") : aud.to_s
+      end
+
+      def created_at
+        Time.at(claims["iat"].to_i).utc
+      end
+
+      def expires_in
+        claims["expires_in"]
+      end
+
+      def expires_at
+        return nil unless claims["exp"]
+
+        Time.at(claims["exp"].to_i).utc
+      end
+
+      def expires_in_seconds
+        return nil unless expires_at
+
+        expires = expires_at - Time.now.utc
+        sec = expires.seconds.round(0)
+        sec > 0 ? sec : 0
+      end
+
+      def expired?
+        return false unless expires_at
+
+        Time.now.utc > expires_at
+      end
+
+      def revoked?
+        false
+      end
+
+      def accessible?
+        !expired? && !revoked?
+      end
+
+      def acceptable?(required_scopes)
+        accessible? && includes_scope?(*required_scopes)
+      end
+
+      def revoke_previous_refresh_token!
+        # no-op: stateless tokens carry no refresh-token chain to revoke.
+      end
+
+      def revoke
+        # no-op: stateless tokens cannot be revoked server-side.
+      end
+
+      def revocable?
+        false
+      end
+
+      def as_json(_options = {})
+        {
+          resource_owner_id: resource_owner_id,
+          scope: scopes,
+          expires_in: expires_in_seconds,
+          application: { uid: application.try(:uid) },
+          created_at: created_at.to_i,
+        }.tap do |json|
+          json[:resource_owner_type] = claims["resource_owner_type"] if Doorkeeper.configuration.polymorphic_resource_owner?
+        end
+      end
+    end
+  end
+end

data/lib/doorkeeper/version.rb

@@ -5,7 +5,7 @@ module Doorkeeper
     # Semantic versioning
     MAJOR = 5
     MINOR = 9
-    TINY = 3
+    TINY = 5
     PRE = nil
 
     # Full version number

metadata

@@ -1,16 +1,17 @@
 --- !ruby/object:Gem::Specification
 name: doorkeeper
 version: !ruby/object:Gem::Version
-  version: 5.9.3
+  version: 5.9.5
 platform: ruby
 authors:
 - Felipe Elias Philipp
 - Tute Costa
 - Jon Moss
 - Nikita Bulai
+autorequire: 
 bindir: bin
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties
@@ -260,6 +261,7 @@ files:
 - lib/doorkeeper/oauth/pre_authorization.rb
 - lib/doorkeeper/oauth/refresh_token_request.rb
 - lib/doorkeeper/oauth/scopes.rb
+- lib/doorkeeper/oauth/stateless_token.rb
 - lib/doorkeeper/oauth/token.rb
 - lib/doorkeeper/oauth/token_introspection.rb
 - lib/doorkeeper/oauth/token_request.rb
@@ -329,6 +331,7 @@ metadata:
   bug_tracker_uri: https://github.com/doorkeeper-gem/doorkeeper/issues
   documentation_uri: https://doorkeeper.gitbook.io/guides/
   funding_uri: https://opencollective.com/doorkeeper-gem
+post_install_message: 
 rdoc_options: []
 require_paths:
 - lib
@@ -343,7 +346,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.11
+rubygems_version: 3.5.16
+signing_key: 
 specification_version: 4
 summary: OAuth 2 provider for Rails and Grape
 test_files: []