rodauth-oauth 0.0.4 → 0.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22808f6f421ce935e5f69301b1f0edc37a286baedf0c4a4039d29b3ff678bf40
-  data.tar.gz: 64305ba438e3035309ca428d4820f00f7b169ca219882575262ee8242a800f50
+  metadata.gz: a809caa12783f20af9ba7b6d4b8710f2b783d11c5c74c0be6cbb129841ebce19
+  data.tar.gz: 928fd524dd2f9ec502deccc96b17eb232119543b2150363a398d04a5008b4d22
 SHA512:
-  metadata.gz: c6302e1e592bf760b9a1a1ac4adc6e9189545f58818553ec85fda0f86299531dcea1e1b59cba65aaa62d607e2cf541fb18ee2a9c2161ce96678b5b2812326a0b
-  data.tar.gz: 689a8e88d89c8fe74b665c65138ff8372cee05d0783e473e8e124b9a9f21d9806bb397d185edf9d0c87ef21cfcd2d81bfa16ab0aaa3da64b9b28d6e5e2e24ab3
+  metadata.gz: 15b98394108c73ba4888bd92835d264750c46194b77322b0b159b45134031f0ac9c264a2a8d0a9991fb0d36b05b85b0d127d94468d77d3f7fb45777ec5bb6002
+  data.tar.gz: 282f53b5fd4eff08fdce56a42a7c42e3ef00cf888ced3acb2a692fd416b8dbb7250c982a53fc3c4a61a83884d8eb1068981580390e3bea2ba35d741165aa2c6a

data/CHANGELOG.md

@@ -2,6 +2,43 @@
 
 ## master
 
+### 0.0.5 (26/6/2020)
+
+#### Features
+
+* new option: `oauth_scope_separator` (default: `" "`), to define how scopes are stored;
+
+##### Resource Server mode
+
+`rodauth-oauth` can now be used in a resource server, i.e. only for authorizing access to resources:
+
+
+```ruby
+plugin :rodauth do
+  enable :oauth
+
+  is_authorization_server? false
+  authorization_server_url "https://auth-server"
+end
+```
+
+It **requires** the authorization to implement the server metadata endpoint (`/.well-known/oauth-authorization-server`), and if using JWS, the JWKs URI endpoint (unless `oauth_jwt_public_key` is defined).
+
+#### Improvements
+
+* Multiple Redirect URIs are now allowed for client applications out-of-the-box. In order to use it in API mode, you can pass the `redirect_uri` with an array of strings (the URLs) as values; in the new client application form, you can add several input fields with name field as `redirect_uri[]`. **ATTENTION!!** When using multiple redirect URIs, passing the desired redirect URI to the authorize form becomes mandatory.
+* store scopes with whitespace instead of comma; set separator as `oauth_scope_separator` option, to keep backwards-compatibility;
+* client application can now store multiple redirect uris; the POST API parameters can accept the redirect_uri param value both as a string or an array of string; internally, they'll be stored in a whitespace-separated string;
+
+#### Bugfixes
+
+* Fixed `RETURNING` support in the databases supporting it (such as postgres).
+
+#### Chore
+
+* option `scopes_param` renamed to `scope_param`;
+*
+
 ## 0.0.4 (13/6/2020)
 
 ### Features

data/lib/rodauth/features/oauth.rb

@@ -1,10 +1,15 @@
 # frozen-string-literal: true
 
 require "base64"
+require "securerandom"
+require "net/http"
+
+require "rodauth/oauth/ttl_store"
 
 module Rodauth
   Feature.define(:oauth) do
     # RUBY EXTENSIONS
+    # :nocov:
     unless Regexp.method_defined?(:match?)
       module RegexpExtensions
         refine(Regexp) do
@@ -32,6 +37,7 @@ module Rodauth
       end
       using(SuffixExtensions)
     end
+    # :nocov:
 
     SCOPES = %w[profile.read].freeze
 
@@ -65,7 +71,7 @@ module Rodauth
 
     auth_value_method :json_response_content_type, "application/json"
 
-    auth_value_method :oauth_grant_expires_in, 60 * 5 # 60 minutes
+    auth_value_method :oauth_grant_expires_in, 60 * 5 # 5 minutes
     auth_value_method :oauth_token_expires_in, 60 * 60 # 60 minutes
     auth_value_method :use_oauth_implicit_grant_type?, false
     auth_value_method :use_oauth_pkce?, true
@@ -76,17 +82,7 @@ module Rodauth
 
     auth_value_method :oauth_valid_uri_schemes, %w[http https]
 
-    # URL PARAMS
-
-    # Authorize / token
-    %w[
-      grant_type code refresh_token client_id client_secret scope
-      state redirect_uri scopes token_type_hint token
-      access_type approval_prompt response_type
-      code_challenge code_challenge_method code_verifier
-    ].each do |param|
-      auth_value_method :"#{param}_param", param
-    end
+    auth_value_method :oauth_scope_separator, " "
 
     # Application
     APPLICATION_REQUIRED_PARAMS = %w[name description scopes homepage_url redirect_uri client_secret].freeze
@@ -94,7 +90,11 @@ module Rodauth
 
     (APPLICATION_REQUIRED_PARAMS + %w[client_id]).each do |param|
       auth_value_method :"oauth_application_#{param}_param", param
+      translatable_method :"#{param}_label", param.gsub("_", " ").capitalize
     end
+    button "Register", "oauth_application"
+    button "Authorize", "oauth_authorize"
+    button "Revoke", "oauth_token_revoke"
 
     # OAuth Token
     auth_value_method :oauth_tokens_path, "oauth-tokens"
@@ -173,11 +173,18 @@ module Rodauth
     auth_value_method :oauth_metadata_op_policy_uri, nil
     auth_value_method :oauth_metadata_op_tos_uri, nil
 
+    # Resource Server params
+    # Only required to use if the plugin is to be used in a resource server
+    auth_value_method :is_authorization_server?, true
+
     auth_value_methods(
       :fetch_access_token,
       :oauth_unique_id_generator,
       :secret_matches?,
-      :secret_hash
+      :secret_hash,
+      :generate_token_hash,
+      :authorization_server_url,
+      :before_introspection_request
     )
 
     auth_value_methods(:only_json?)
@@ -198,6 +205,8 @@ module Rodauth
 
     auth_value_method :json_request_regexp, %r{\bapplication/(?:vnd\.api\+)?json\b}i
 
+    SERVER_METADATA = OAuth::TtlStore.new
+
     def check_csrf?
       case request.path
       when oauth_token_path, oauth_introspect_path
@@ -223,12 +232,14 @@ module Rodauth
     end
 
     unless method_defined?(:json_request?)
+      # :nocov:
       # copied from the jwt feature
       def json_request?
         return @json_request if defined?(@json_request)
 
         @json_request = request.content_type =~ json_request_regexp
       end
+      # :nocov:
     end
 
     def initialize(scope)
@@ -236,38 +247,39 @@ module Rodauth
     end
 
     def state
-      param_or_nil(state_param)
+      param_or_nil("state")
     end
 
     def scopes
-      (param_or_nil(scopes_param) || oauth_application_default_scope).split(" ")
+      (param_or_nil("scope") || oauth_application_default_scope).split(" ")
     end
 
     def client_id
-      param_or_nil(client_id_param)
-    end
-
-    def client_secret
-      param_or_nil(client_secret_param)
+      param_or_nil("client_id")
     end
 
     def redirect_uri
-      param_or_nil(redirect_uri_param) || oauth_application[oauth_applications_redirect_uri_column]
+      param_or_nil("redirect_uri") || begin
+        return unless oauth_application
+
+        redirect_uris = oauth_application[oauth_applications_redirect_uri_column].split(" ")
+        redirect_uris.size == 1 ? redirect_uris.first : nil
+      end
     end
 
     def token_type_hint
-      param_or_nil(token_type_hint_param) || "access_token"
+      param_or_nil("token_type_hint") || "access_token"
     end
 
     def token
-      param_or_nil(token_param)
+      param_or_nil("token")
     end
 
     def oauth_application
       return @oauth_application if defined?(@oauth_application)
 
       @oauth_application = begin
-        client_id = param(client_id_param)
+        client_id = param_or_nil("client_id")
 
         return unless client_id
 
@@ -291,17 +303,36 @@ module Rodauth
       return @authorization_token if defined?(@authorization_token)
 
       # check if there is a token
+      bearer_token = fetch_access_token
+
+      return unless bearer_token
+
       # check if token has not expired
       # check if token has been revoked
-      @authorization_token = oauth_token_by_token(fetch_access_token)
+      @authorization_token = oauth_token_by_token(bearer_token)
     end
 
     def require_oauth_authorization(*scopes)
-      authorization_required unless authorization_token
+      token_scopes = if is_authorization_server?
+                       authorization_required unless authorization_token
+
+                       scopes << oauth_application_default_scope if scopes.empty?
+
+                       authorization_token[oauth_tokens_scopes_column].split(oauth_scope_separator)
+                     else
+                       bearer_token = fetch_access_token
+
+                       authorization_required unless bearer_token
+
+                       scopes << oauth_application_default_scope if scopes.empty?
 
-      scopes << oauth_application_default_scope if scopes.empty?
+                       # where in resource server, NOT the authorization server.
+                       payload = introspection_request("access_token", bearer_token)
 
-      token_scopes = authorization_token[oauth_tokens_scopes_column].split(",")
+                       authorization_required unless payload["active"]
+
+                       payload["scope"].split(oauth_scope_separator)
+                     end
 
       authorization_required unless scopes.any? { |scope| token_scopes.include?(scope) }
     end
@@ -314,6 +345,7 @@ module Rodauth
         request.get "new" do
           new_oauth_application_view
         end
+
         request.on(oauth_applications_id_pattern) do |id|
           oauth_application = db[oauth_applications_table].where(oauth_applications_id_column => id).first
           scope.instance_variable_set(:@oauth_application, oauth_application)
@@ -366,6 +398,64 @@ module Rodauth
 
     private
 
+    def authorization_server_url
+      base_url
+    end
+
+    def authorization_server_metadata
+      auth_url = URI(authorization_server_url)
+
+      server_metadata = SERVER_METADATA[auth_url]
+
+      return server_metadata if server_metadata
+
+      SERVER_METADATA.set(auth_url) do
+        http = Net::HTTP.new(auth_url.host, auth_url.port)
+        http.use_ssl = auth_url.scheme == "https"
+
+        request = Net::HTTP::Get.new("/.well-known/oauth-authorization-server")
+        request["accept"] = json_response_content_type
+        response = http.request(request)
+        authorization_required unless response.code.to_i == 200
+
+        # time-to-live
+        ttl = if response.key?("cache-control")
+                cache_control = response["cache_control"]
+                cache_control[/max-age=(\d+)/, 1]
+              elsif response.key?("expires")
+                Time.httpdate(response["expires"]).utc.to_i - Time.now.utc.to_i
+              end
+
+        [JSON.parse(response.body, symbolize_names: true), ttl]
+      end
+    end
+
+    def introspection_request(token_type_hint, token)
+      auth_url = URI(authorization_server_url)
+      http = Net::HTTP.new(auth_url.host, auth_url.port)
+      http.use_ssl = auth_url.scheme == "https"
+
+      request = Net::HTTP::Post.new(oauth_introspect_path)
+      request["content-type"] = json_response_content_type
+      request["accept"] = json_response_content_type
+      request.body = JSON.dump({ "token_type_hint" => token_type_hint, "token" => token })
+
+      before_introspection_request(request)
+      response = http.request(request)
+      authorization_required unless response.code.to_i == 200
+
+      JSON.parse(response.body)
+    end
+
+    def before_introspection_request(request); end
+
+    def template_path(page)
+      path = File.join(File.dirname(__FILE__), "../../../templates", "#{page}.str")
+      return super unless File.exist?(path)
+
+      path
+    end
+
     # to be used internally. Same semantics as require account, must:
     # fetch an authorization basic header
     # parse client id and secret
@@ -378,8 +468,8 @@ module Rodauth
       if (token = ((v = request.env["HTTP_AUTHORIZATION"]) && v[/\A *Basic (.*)\Z/, 1]))
         client_id, client_secret = Base64.decode64(token).split(/:/, 2)
       else
-        client_id = param_or_nil(client_id_param)
-        client_secret = param_or_nil(client_secret_param)
+        client_id = param_or_nil("client_id")
+        client_secret = param_or_nil("client_secret")
       end
 
       authorization_required unless client_id
@@ -387,7 +477,7 @@ module Rodauth
       @oauth_application = db[oauth_applications_table].where(oauth_applications_client_id_column => client_id).first
 
       # skip if using pkce
-      return if @oauth_application && use_oauth_pkce? && param_or_nil(code_verifier_param)
+      return if @oauth_application && use_oauth_pkce? && param_or_nil("code_verifier")
 
       authorization_required unless @oauth_application && secret_matches?(@oauth_application, client_secret)
     end
@@ -413,22 +503,22 @@ module Rodauth
     end
 
     unless method_defined?(:password_hash)
+      # :nocov:
       # From login_requirements_base feature
       if ENV["RACK_ENV"] == "test"
         def password_hash_cost
           BCrypt::Engine::MIN_COST
         end
       else
-        # :nocov:
         def password_hash_cost
           BCrypt::Engine::DEFAULT_COST
         end
-        # :nocov:
       end
 
       def password_hash(password)
         BCrypt::Password.create(password, cost: password_hash_cost)
       end
+      # :nocov:
     end
 
     def generate_oauth_token(params = {}, should_generate_refresh_token = true)
@@ -466,7 +556,7 @@ module Rodauth
 
       begin
         if ds.supports_returning?(:insert)
-          ds.returning.insert(params)
+          ds.returning.insert(params).first
         else
           id = ds.insert(params)
           ds.where(oauth_tokens_id_column => id).first
@@ -523,11 +613,21 @@ module Rodauth
 
     def validate_oauth_application_params
       oauth_application_params.each do |key, value|
-        if key == oauth_application_homepage_url_param ||
-           key == oauth_application_redirect_uri_param
+        if key == oauth_application_homepage_url_param
+
+          set_field_error(key, invalid_url_message) unless check_valid_uri?(value)
 
-          set_field_error(key, invalid_url_message) unless URI::DEFAULT_PARSER.make_regexp(oauth_valid_uri_schemes).match?(value)
+        elsif key == oauth_application_redirect_uri_param
 
+          if value.respond_to?(:each)
+            value.each do |uri|
+              next if uri.empty?
+
+              set_field_error(key, invalid_url_message) unless check_valid_uri?(uri)
+            end
+          else
+            set_field_error(key, invalid_url_message) unless check_valid_uri?(value)
+          end
         elsif key == oauth_application_scopes_param
 
           value.each do |scope|
@@ -545,10 +645,12 @@ module Rodauth
         oauth_applications_name_column => oauth_application_params[oauth_application_name_param],
         oauth_applications_description_column => oauth_application_params[oauth_application_description_param],
         oauth_applications_scopes_column => oauth_application_params[oauth_application_scopes_param],
-        oauth_applications_homepage_url_column => oauth_application_params[oauth_application_homepage_url_param],
-        oauth_applications_redirect_uri_column => oauth_application_params[oauth_application_redirect_uri_param]
+        oauth_applications_homepage_url_column => oauth_application_params[oauth_application_homepage_url_param]
       }
 
+      redirect_uris = oauth_application_params[oauth_application_redirect_uri_param]
+      redirect_uris = redirect_uris.to_a.reject(&:empty?).join(" ") if redirect_uris.respond_to?(:each)
+      create_params[oauth_applications_redirect_uri_column] = redirect_uris unless redirect_uris.empty?
       # set client ID/secret pairs
 
       create_params.merge! \
@@ -557,25 +659,18 @@ module Rodauth
           secret_hash(oauth_application_params[oauth_application_client_secret_param])
 
       create_params[oauth_applications_scopes_column] = if create_params[oauth_applications_scopes_column]
-                                                          create_params[oauth_applications_scopes_column].join(",")
+                                                          create_params[oauth_applications_scopes_column].join(oauth_scope_separator)
                                                         else
                                                           oauth_application_default_scope
                                                         end
 
-      ds = db[oauth_applications_table]
-
       id = nil
       raised = begin
-        id = if ds.supports_returning?(:insert)
-               ds.returning(oauth_applications_id_column).insert(create_params)
-             else
-               id = db[oauth_applications_table].insert(create_params)
-               db[oauth_applications_table].where(oauth_applications_id_column => id).get(oauth_applications_id_column)
-             end
-        false
+                 id = db[oauth_applications_table].insert(create_params)
+                 false
                rescue Sequel::ConstraintViolation => e
                  e
-      end
+               end
 
       if raised
         field = raised.message[/\.(.*)$/, 1]
@@ -596,6 +691,8 @@ module Rodauth
     end
 
     def validate_oauth_grant_params
+      redirect_response_error("invalid_request", request.referer || default_redirect) unless oauth_application && check_valid_redirect_uri?
+
       unless oauth_application && check_valid_redirect_uri? && check_valid_access_type? &&
              check_valid_approval_prompt? && check_valid_response_type?
         redirect_response_error("invalid_request")
@@ -606,7 +703,7 @@ module Rodauth
     end
 
     def try_approval_prompt
-      approval_prompt = param_or_nil(approval_prompt_param)
+      approval_prompt = param_or_nil("approval_prompt")
 
       return unless approval_prompt && approval_prompt == "auto"
 
@@ -614,7 +711,7 @@ module Rodauth
         oauth_grants_account_id_column => account_id,
         oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
         oauth_grants_redirect_uri_column => redirect_uri,
-        oauth_grants_scopes_column => scopes.join(","),
+        oauth_grants_scopes_column => scopes.join(oauth_scope_separator),
         oauth_grants_access_type_column => "online"
       ).count.zero?
 
@@ -628,14 +725,13 @@ module Rodauth
         oauth_grants_account_id_column => account_id,
         oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
         oauth_grants_redirect_uri_column => redirect_uri,
-        oauth_grants_code_column => oauth_unique_id_generator,
         oauth_grants_expires_in_column => Time.now + oauth_grant_expires_in,
-        oauth_grants_scopes_column => scopes.join(",")
+        oauth_grants_scopes_column => scopes.join(oauth_scope_separator)
       }
 
       # Access Type flow
       if use_oauth_access_type?
-        if (access_type = param_or_nil(access_type_param))
+        if (access_type = param_or_nil("access_type"))
           create_params[oauth_grants_access_type_column] = access_type
         end
       end
@@ -643,8 +739,8 @@ module Rodauth
       # PKCE flow
       if use_oauth_pkce?
 
-        if (code_challenge = param_or_nil(code_challenge_param))
-          code_challenge_method = param_or_nil(code_challenge_method_param)
+        if (code_challenge = param_or_nil("code_challenge"))
+          code_challenge_method = param_or_nil("code_challenge_method")
 
           create_params[oauth_grants_code_challenge_column] = code_challenge
           create_params[oauth_grants_code_challenge_method_column] = code_challenge_method
@@ -656,12 +752,10 @@ module Rodauth
       ds = db[oauth_grants_table]
 
       begin
-        if ds.supports_returning?(:insert)
-          ds.returning(authorize_code_column).insert(create_params)
-        else
-          id = ds.insert(create_params)
-          ds.where(oauth_grants_id_column => id).get(oauth_grants_code_column)
-        end
+        authorization_code = oauth_unique_id_generator
+        create_params[oauth_grants_code_column] = authorization_code
+        ds.insert(create_params)
+        authorization_code
       rescue Sequel::UniqueConstraintViolation
         retry
       end
@@ -674,23 +768,23 @@ module Rodauth
     end
 
     def validate_oauth_token_params
-      unless (grant_type = param_or_nil(grant_type_param))
+      unless (grant_type = param_or_nil("grant_type"))
         redirect_response_error("invalid_request")
       end
 
       case grant_type
       when "authorization_code"
-        redirect_response_error("invalid_request") unless param_or_nil(code_param)
+        redirect_response_error("invalid_request") unless param_or_nil("code")
 
       when "refresh_token"
-        redirect_response_error("invalid_request") unless param_or_nil(refresh_token_param)
+        redirect_response_error("invalid_request") unless param_or_nil("refresh_token")
       else
         redirect_response_error("invalid_request")
       end
     end
 
     def create_oauth_token
-      case param(grant_type_param)
+      case param("grant_type")
       when "authorization_code"
         create_oauth_token_from_authorization_code(oauth_application)
       when "refresh_token"
@@ -703,8 +797,8 @@ module Rodauth
     def create_oauth_token_from_authorization_code(oauth_application)
       # fetch oauth grant
       oauth_grant = db[oauth_grants_table].where(
-        oauth_grants_code_column => param(code_param),
-        oauth_grants_redirect_uri_column => param(redirect_uri_param),
+        oauth_grants_code_column => param("code"),
+        oauth_grants_redirect_uri_column => param("redirect_uri"),
         oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
         oauth_grants_revoked_at_column => nil
       ).where(Sequel[oauth_grants_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
@@ -716,7 +810,7 @@ module Rodauth
       # PKCE
       if use_oauth_pkce?
         if oauth_grant[oauth_grants_code_challenge_column]
-          code_verifier = param_or_nil(code_verifier_param)
+          code_verifier = param_or_nil("code_verifier")
 
           redirect_response_error("invalid_request") unless code_verifier && check_valid_grant_challenge?(oauth_grant, code_verifier)
         elsif oauth_require_pkce
@@ -743,7 +837,7 @@ module Rodauth
 
     def create_oauth_token_from_token(oauth_application)
       # fetch oauth token
-      oauth_token = oauth_token_by_refresh_token(param(refresh_token_param))
+      oauth_token = oauth_token_by_refresh_token(param("refresh_token"))
 
       redirect_response_error("invalid_grant") unless oauth_token && token_from_application?(oauth_token, oauth_application)
 
@@ -764,7 +858,7 @@ module Rodauth
 
       oauth_token = begin
         if ds.supports_returning?(:update)
-          ds.returning.update(update_params)
+          ds.returning.update(update_params).first
         else
           ds.update(update_params)
           ds.first
@@ -787,7 +881,7 @@ module Rodauth
         redirect_response_error("unsupported_token_type") unless TOKEN_HINT_TYPES.include?(token_type_hint)
       end
 
-      redirect_response_error("invalid_request") unless param_or_nil(token_param)
+      redirect_response_error("invalid_request") unless param_or_nil("token")
     end
 
     def json_token_introspect_payload(token)
@@ -795,16 +889,14 @@ module Rodauth
 
       {
         active: true,
-        scope: token[oauth_tokens_scopes_column].gsub(",", " "),
+        scope: token[oauth_tokens_scopes_column],
         client_id: oauth_application[oauth_applications_client_id_column],
         # username
         token_type: oauth_token_type
       }
     end
 
-    def before_introspect
-      require_oauth_application
-    end
+    def before_introspect; end
 
     # Token revocation
 
@@ -816,7 +908,7 @@ module Rodauth
       # check if valid token hint type
       redirect_response_error("unsupported_token_type") unless TOKEN_HINT_TYPES.include?(token_type_hint)
 
-      redirect_response_error("invalid_request") unless param_or_nil(token_param)
+      redirect_response_error("invalid_request") unless param_or_nil("token")
     end
 
     def revoke_oauth_token
@@ -827,14 +919,21 @@ module Rodauth
                       oauth_token_by_refresh_token(token)
                     end
 
-      redirect_response_error("invalid_request") unless oauth_token && token_from_application?(oauth_token, oauth_application)
+      redirect_response_error("invalid_request") unless oauth_token
+
+      if oauth_application
+        redirect_response_error("invalid_request") unless token_from_application?(oauth_token, oauth_application)
+      else
+        @oauth_application = db[oauth_applications_table].where(oauth_applications_id_column =>
+          oauth_token[oauth_tokens_oauth_application_id_column]).first
+      end
 
       update_params = { oauth_tokens_revoked_at_column => Sequel::CURRENT_TIMESTAMP }
 
       ds = db[oauth_tokens_table].where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
 
       oauth_token = if ds.supports_returning?(:update)
-                      ds.returning.update(update_params)
+                      ds.returning.update(update_params).first
                     else
                       ds.update(update_params)
                       ds.first
@@ -854,7 +953,7 @@ module Rodauth
 
     # Response helpers
 
-    def redirect_response_error(error_code, redirect_url = request.referer || default_redirect)
+    def redirect_response_error(error_code, redirect_url = redirect_uri || request.referer || default_redirect)
       if accepts_json?
         throw_json_response_error(invalid_oauth_response_status, error_code)
       else
@@ -903,6 +1002,7 @@ module Rodauth
     end
 
     unless method_defined?(:_json_response_body)
+      # :nocov:
       def _json_response_body(hash)
         if request.respond_to?(:convert_to_json)
           request.send(:convert_to_json, hash)
@@ -910,6 +1010,7 @@ module Rodauth
           JSON.dump(hash)
         end
       end
+      # :nocov:
     end
 
     def authorization_required
@@ -921,14 +1022,18 @@ module Rodauth
       end
     end
 
+    def check_valid_uri?(uri)
+      URI::DEFAULT_PARSER.make_regexp(oauth_valid_uri_schemes).match?(uri)
+    end
+
     def check_valid_scopes?
       return false unless scopes
 
-      (scopes - oauth_application[oauth_applications_scopes_column].split(",")).empty?
+      (scopes - oauth_application[oauth_applications_scopes_column].split(oauth_scope_separator)).empty?
     end
 
     def check_valid_redirect_uri?
-      redirect_uri == oauth_application[oauth_applications_redirect_uri_column]
+      oauth_application[oauth_applications_redirect_uri_column].split(" ").include?(redirect_uri)
     end
 
     ACCESS_TYPES = %w[offline online].freeze
@@ -936,7 +1041,7 @@ module Rodauth
     def check_valid_access_type?
       return true unless use_oauth_access_type?
 
-      access_type = param_or_nil(access_type_param)
+      access_type = param_or_nil("access_type")
       !access_type || ACCESS_TYPES.include?(access_type)
     end
 
@@ -945,12 +1050,12 @@ module Rodauth
     def check_valid_approval_prompt?
       return true unless use_oauth_access_type?
 
-      approval_prompt = param_or_nil(approval_prompt_param)
+      approval_prompt = param_or_nil("approval_prompt")
       !approval_prompt || APPROVAL_PROMPTS.include?(approval_prompt)
     end
 
     def check_valid_response_type?
-      response_type = param_or_nil(response_type_param)
+      response_type = param_or_nil("response_type")
 
       return true if response_type.nil? || response_type == "code"
 
@@ -962,9 +1067,9 @@ module Rodauth
     # PKCE
 
     def validate_pkce_challenge_params
-      if param_or_nil(code_challenge_param)
+      if param_or_nil("code_challenge")
 
-        challenge_method = param_or_nil(code_challenge_method_param)
+        challenge_method = param_or_nil("code_challenge_method")
         redirect_response_error("code_challenge_required") unless oauth_pkce_challenge_method == challenge_method
       else
         return unless oauth_require_pkce
@@ -1054,16 +1159,21 @@ module Rodauth
         catch_error do
           validate_oauth_introspect_params
 
-          oauth_token = case param(token_type_hint_param)
+          oauth_token = case param("token_type_hint")
                         when "access_token"
-                          oauth_token_by_token(param(token_param))
+                          oauth_token_by_token(param("token"))
                         when "refresh_token"
-                          oauth_token_by_refresh_token(param(token_param))
+                          oauth_token_by_refresh_token(param("token"))
                         else
-                          oauth_token_by_token(param(token_param)) || oauth_token_by_refresh_token(param(token_param))
+                          oauth_token_by_token(param("token")) || oauth_token_by_refresh_token(param("token"))
                         end
 
-          redirect_response_error("invalid_request") if oauth_token && !token_from_application?(oauth_token, oauth_application)
+          if oauth_application
+            redirect_response_error("invalid_request") if oauth_token && !token_from_application?(oauth_token, oauth_application)
+          elsif oauth_token
+            @oauth_application = db[oauth_applications_table].where(oauth_applications_id_column =>
+              oauth_token[oauth_tokens_oauth_application_id_column]).first
+          end
 
           json_response_success(json_token_introspect_payload(oauth_token))
         end
@@ -1120,9 +1230,9 @@ module Rodauth
         fragment_params = []
 
         transaction do
-          case param(response_type_param)
+          case param("response_type")
           when "token"
-            redirect_response_error("invalid_request", redirect_uri) unless use_oauth_implicit_grant_type?
+            redirect_response_error("invalid_request") unless use_oauth_implicit_grant_type?
 
             create_params = {
               oauth_tokens_account_id_column => account_id,

data/lib/rodauth/features/oauth_jwt.rb

@@ -1,22 +1,17 @@
 # frozen-string-literal: true
 
+require "rodauth/oauth/ttl_store"
+
 module Rodauth
   Feature.define(:oauth_jwt) do
     depends :oauth
 
-    auth_value_method :grant_type_param, "grant_type"
-    auth_value_method :assertion_param, "assertion"
-
     auth_value_method :oauth_jwt_token_issuer, "Example"
 
     auth_value_method :oauth_jwt_key, nil
     auth_value_method :oauth_jwt_public_key, nil
     auth_value_method :oauth_jwt_algorithm, "HS256"
 
-    auth_value_method :oauth_jwt_jwk_key, nil
-    auth_value_method :oauth_jwt_jwk_public_key, nil
-    auth_value_method :oauth_jwt_jwk_algorithm, "RS256"
-
     auth_value_method :oauth_jwt_jwe_key, nil
     auth_value_method :oauth_jwt_jwe_public_key, nil
     auth_value_method :oauth_jwt_jwe_algorithm, nil
@@ -31,6 +26,8 @@ module Rodauth
       :jwks_set
     )
 
+    JWKS = OAuth::TtlStore.new
+
     def require_oauth_authorization(*scopes)
       authorization_required unless authorization_token
 
@@ -46,28 +43,42 @@ module Rodauth
     def authorization_token
       return @authorization_token if defined?(@authorization_token)
 
-      @authorization_token = jwt_decode(fetch_access_token)
+      @authorization_token = begin
+        bearer_token = fetch_access_token
+
+        return unless bearer_token
+
+        jwt_token = jwt_decode(bearer_token)
+
+        return unless jwt_token
+
+        return if jwt_token["iss"] != oauth_jwt_token_issuer ||
+                  jwt_token["aud"] != oauth_jwt_audience ||
+                  !jwt_token["sub"]
+
+        jwt_token
+      end
     end
 
     # /token
 
     def before_token
       # requset authentication optional for assertions
-      return if param(grant_type_param) == "urn:ietf:params:oauth:grant-type:jwt-bearer"
+      return if param("grant_type") == "urn:ietf:params:oauth:grant-type:jwt-bearer"
 
       super
     end
 
     def validate_oauth_token_params
-      if param(grant_type_param) == "urn:ietf:params:oauth:grant-type:jwt-bearer"
-        redirect_response_error("invalid_client") unless param_or_nil(assertion_param)
+      if param("grant_type") == "urn:ietf:params:oauth:grant-type:jwt-bearer"
+        redirect_response_error("invalid_client") unless param_or_nil("assertion")
       else
         super
       end
     end
 
     def create_oauth_token
-      if param(grant_type_param) == "urn:ietf:params:oauth:grant-type:jwt-bearer"
+      if param("grant_type") == "urn:ietf:params:oauth:grant-type:jwt-bearer"
         create_oauth_token_from_assertion
       else
         super
@@ -75,7 +86,7 @@ module Rodauth
     end
 
     def create_oauth_token_from_assertion
-      claims = jwt_decode(param(assertion_param))
+      claims = jwt_decode(param("assertion"))
 
       redirect_response_error("invalid_grant") unless claims
 
@@ -111,7 +122,7 @@ module Rodauth
 
       oauth_token = _generate_oauth_token(create_params)
 
-      issued_at = Time.current.utc.to_i
+      issued_at = Time.now.utc.to_i
 
       payload = {
         sub: oauth_token[oauth_tokens_account_id_column],
@@ -133,7 +144,7 @@ module Rodauth
 
         # one of the points of using jwt is avoiding database lookups, so we put here all relevant
         # token data.
-        scope: oauth_token[oauth_tokens_scopes_column].gsub(",", " ")
+        scope: oauth_token[oauth_tokens_scopes_column]
       }
 
       token = jwt_encode(payload)
@@ -182,7 +193,42 @@ module Rodauth
     end
 
     def _jwt_key
-      @_jwt_key ||= oauth_jwt_key || oauth_application[oauth_applications_client_secret_column]
+      @_jwt_key ||= oauth_jwt_key || (oauth_application[oauth_applications_client_secret_column] if oauth_application)
+    end
+
+    # Resource Server only!
+    #
+    # returns the jwks set from the authorization server.
+    def auth_server_jwks_set
+      metadata = authorization_server_metadata
+
+      return unless metadata && (jwks_uri = metadata[:jwks_uri])
+
+      jwks_uri = URI(jwks_uri)
+
+      jwks = JWKS[jwks_uri]
+
+      return jwks if jwks
+
+      JWKS.set(jwks_uri) do
+        http = Net::HTTP.new(jwks_uri.host, jwks_uri.port)
+        http.use_ssl = jwks_uri.scheme == "https"
+
+        request = Net::HTTP::Get.new(jwks_uri.request_uri)
+        request["accept"] = json_response_content_type
+        response = http.request(request)
+        authorization_required unless response.code.to_i == 200
+
+        # time-to-live
+        ttl = if response.key?("cache-control")
+                cache_control = response["cache_control"]
+                cache_control[/max-age=(\d+)/, 1]
+              elsif response.key?("expires")
+                Time.httpdate(response["expires"]).utc.to_i - Time.now.utc.to_i
+              end
+
+        [JSON.parse(response.body, symbolize_names: true), ttl]
+      end
     end
 
     if defined?(JSON::JWT)
@@ -191,14 +237,11 @@ module Rodauth
       # json-jwt
       def jwt_encode(payload)
         jwt = JSON::JWT.new(payload)
+        jwk = JSON::JWK.new(_jwt_key)
+
+        jwt = jwt.sign(jwk, oauth_jwt_algorithm)
+        jwt.kid = jwk.thumbprint
 
-        jwt = if oauth_jwt_jwk_key
-                jwk = JSON::JWK.new(oauth_jwt_jwk_key)
-                jwt.kid = jwk.thumbprint
-                jwt.sign(oauth_jwt_jwk_key, oauth_jwt_jwk_algorithm)
-              else
-                jwt.sign(_jwt_key, oauth_jwt_algorithm)
-              end
         if oauth_jwt_jwe_key
           algorithm = oauth_jwt_jwe_algorithm.to_sym if oauth_jwt_jwe_algorithm
           jwt = jwt.encrypt(oauth_jwt_jwe_public_key || oauth_jwt_jwe_key,
@@ -213,11 +256,12 @@ module Rodauth
 
         token = JSON::JWT.decode(token, oauth_jwt_jwe_key).plain_text if oauth_jwt_jwe_key
 
-        @jwt_token = if oauth_jwt_jwk_key
-                       jwk = JSON::JWK.new(oauth_jwt_jwk_public_key || oauth_jwt_jwk_key)
+        jwk = oauth_jwt_public_key || _jwt_key
+
+        @jwt_token = if jwk
                        JSON::JWT.decode(token, jwk)
-                     else
-                       JSON::JWT.decode(token, oauth_jwt_public_key || _jwt_key)
+                     elsif !is_authorization_server? && auth_server_jwks_set
+                       JSON::JWT.decode(token, JSON::JWK::Set.new(auth_server_jwks_set))
                      end
       rescue JSON::JWT::Exception
         nil
@@ -225,10 +269,11 @@ module Rodauth
 
       def jwks_set
         [
-          (JSON::JWK.new(oauth_jwt_jwk_public_key).merge(use: "sig", alg: oauth_jwt_jwk_algorithm) if oauth_jwt_jwk_public_key),
+          (JSON::JWK.new(oauth_jwt_public_key).merge(use: "sig", alg: oauth_jwt_algorithm) if oauth_jwt_public_key),
           (JSON::JWK.new(oauth_jwt_jwe_public_key).merge(use: "enc", alg: oauth_jwt_jwe_algorithm) if oauth_jwt_jwe_public_key)
         ].compact
       end
+
       # :nocov:
     elsif defined?(JWT)
 
@@ -237,18 +282,14 @@ module Rodauth
       def jwt_encode(payload)
         headers = {}
 
-        key, algorithm = if oauth_jwt_jwk_key
-                           jwk_key = JWT::JWK.new(oauth_jwt_jwk_key)
-                           # JWK
-                           # Currently only supports RSA public keys.
-                           headers[:kid] = jwk_key.kid
+        key = _jwt_key
 
-                           [jwk_key.keypair, oauth_jwt_jwk_algorithm]
-                         else
-                           # JWS
+        if key.is_a?(OpenSSL::PKey::RSA)
+          jwk = JWT::JWK.new(_jwt_key)
+          headers[:kid] = jwk.kid
 
-                           [_jwt_key, oauth_jwt_algorithm]
-                         end
+          key = jwk.keypair
+        end
 
         # Use the key and iat to create a unique key per request to prevent replay attacks
         jti_raw = [key, payload[:iat]].join(":").to_s
@@ -256,7 +297,7 @@ module Rodauth
 
         # @see JWT reserved claims - https://tools.ietf.org/html/draft-jones-json-web-token-07#page-7
         payload[:jti] = jti
-        token = JWT.encode(payload, key, algorithm, headers)
+        token = JWT.encode(payload, key, oauth_jwt_algorithm, headers)
 
         if oauth_jwt_jwe_key
           params = {
@@ -278,35 +319,21 @@ module Rodauth
         token = JWE.decrypt(token, oauth_jwt_jwe_key) if oauth_jwt_jwe_key
 
         # decode jwt
-        headers = { algorithms: [oauth_jwt_algorithm] }
-
-        key = if oauth_jwt_jwk_key
-                jwk_key = JWT::JWK.new(oauth_jwt_jwk_public_key || oauth_jwt_jwk_key)
-                # JWK
-                # The jwk loader would fetch the set of JWKs from a trusted source
-                jwk_loader = lambda do |options|
-                  @cached_keys = nil if options[:invalidate] # need to reload the keys
-                  @cached_keys ||= { keys: [jwk_key.export] }
-                end
-
-                headers[:algorithms] = [oauth_jwt_jwk_algorithm]
-                headers[:jwks] = jwk_loader
-
-                nil
-              else
-                # JWS
-                # worst case scenario, the key is the application key
-                oauth_jwt_public_key || _jwt_key
-              end
-        @jwt_token, = JWT.decode(token, key, true, headers)
-        @jwt_token
-      rescue JWT::DecodeError
+        key = oauth_jwt_public_key || _jwt_key
+
+        @jwt_token = if key
+                       JWT.decode(token, key, true, algorithms: [oauth_jwt_algorithm]).first
+                     elsif !is_authorization_server? && auth_server_jwks_set
+                       algorithms = auth_server_jwks_set[:keys].select { |k| k[:use] == "sig" }.map { |k| k[:alg] }
+                       JWT.decode(token, nil, true, jwks: auth_server_jwks_set, algorithms: algorithms).first
+                     end
+      rescue JWT::DecodeError, JWT::JWKError
         nil
       end
 
       def jwks_set
         [
-          (JWT::JWK.new(oauth_jwt_jwk_public_key).export.merge(use: "sig", alg: oauth_jwt_jwk_algorithm) if oauth_jwt_jwk_public_key),
+          (JWT::JWK.new(oauth_jwt_public_key).export.merge(use: "sig", alg: oauth_jwt_algorithm) if oauth_jwt_public_key),
           (JWT::JWK.new(oauth_jwt_jwe_public_key).export.merge(use: "enc", alg: oauth_jwt_jwe_algorithm) if oauth_jwt_jwe_public_key)
         ].compact
       end
@@ -328,7 +355,7 @@ module Rodauth
 
     route(:oauth_jwks) do |r|
       r.get do
-        json_response_success(jwks_set)
+        json_response_success({ keys: jwks_set })
       end
     end
   end

data/lib/rodauth/oauth/ttl_store.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+#
+# The TTL store is a data structure which keeps data by a key, and with a time-to-live.
+# It is specifically designed for data which is static, i.e. for a certain key in a
+# sufficiently large span, the value will be the same.
+#
+# Because of that, synchronizations around reads do not exist, while write synchronizations
+# will be short-circuited by a read.
+#
+class Rodauth::OAuth::TtlStore
+  DEFAULT_TTL = 60 * 60 * 24 # default TTL is one day
+
+  def initialize
+    @store_mutex = Mutex.new
+    @store = Hash.new {}
+  end
+
+  def [](key)
+    lookup(key, now)
+  end
+
+  def set(key, &block)
+    @store_mutex.synchronize do
+      # short circuit
+      return @store[key][:payload] if @store[key] && @store[key][:ttl] < now
+
+      payload, ttl = block.call
+      @store[key] = { payload: payload, ttl: (ttl || (now + DEFAULT_TTL)) }
+
+      @store[key][:payload]
+    end
+  end
+
+  def uncache(key)
+    @store_mutex.synchronize do
+      @store.delete(key)
+    end
+  end
+
+  private
+
+  def now
+    Process.clock_gettime(Process::CLOCK_MONOTONIC)
+  end
+
+  # do not use directly!
+  def lookup(key, ttl)
+    return unless @store.key?(key)
+
+    value = @store[key]
+
+    return if value.empty?
+
+    return unless value[:ttl] > ttl
+
+    value[:payload]
+  end
+end

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "0.0.4"
+    VERSION = "0.0.5"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 0.0.4
+  version: 0.0.5
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-06-13 00:00:00.000000000 Z
+date: 2020-06-28 00:00:00.000000000 Z
 dependencies: []
 description: Implementation of the OAuth 2.0 protocol on top of rodauth.
 email:
@@ -34,6 +34,7 @@ files:
 - lib/rodauth/features/oauth_jwt.rb
 - lib/rodauth/oauth.rb
 - lib/rodauth/oauth/railtie.rb
+- lib/rodauth/oauth/ttl_store.rb
 - lib/rodauth/oauth/version.rb
 homepage: https://gitlab.com/honeyryderchuck/roda-oauth
 licenses: []