rodauth-oauth 0.0.5 → 0.4.0

data/lib/rodauth/features/oauth.rb

@@ -1,16 +1,21 @@
 # frozen-string-literal: true
 
+require "time"
 require "base64"
 require "securerandom"
 require "net/http"
 
 require "rodauth/oauth/ttl_store"
+require "rodauth/oauth/database_extensions"
 
 module Rodauth
   Feature.define(:oauth) do
     # RUBY EXTENSIONS
-    # :nocov:
     unless Regexp.method_defined?(:match?)
+      # If you wonder why this is there: the oauth feature uses a refinement to enhance the
+      # Regexp class locally with #match? , but this is never tested, because ActiveSupport
+      # monkey-patches the same method... Please ActiveSupport, stop being so intrusive!
+      # :nocov:
       module RegexpExtensions
         refine(Regexp) do
           def match?(*args)
@@ -19,6 +24,7 @@ module Rodauth
         end
       end
       using(RegexpExtensions)
+      # :nocov:
     end
 
     unless String.method_defined?(:delete_suffix!)
@@ -37,13 +43,13 @@ module Rodauth
       end
       using(SuffixExtensions)
     end
-    # :nocov:
 
     SCOPES = %w[profile.read].freeze
 
+    SERVER_METADATA = OAuth::TtlStore.new
+
     before "authorize"
     after "authorize"
-    after "authorize_failure"
 
     before "token"
 
@@ -55,15 +61,13 @@ module Rodauth
     before "create_oauth_application"
     after "create_oauth_application"
 
-    error_flash "OAuth Authorization invalid parameters", "oauth_grant_valid_parameters"
-
     error_flash "Please authorize to continue", "require_authorization"
     error_flash "There was an error registering your oauth application", "create_oauth_application"
     notice_flash "Your oauth application has been registered", "create_oauth_application"
 
     notice_flash "The oauth token has been revoked", "revoke_oauth_token"
 
-    view "oauth_authorize", "Authorize", "authorize"
+    view "authorize", "Authorize", "authorize"
     view "oauth_applications", "Oauth Applications", "oauth_applications"
     view "oauth_application", "Oauth Application", "oauth_application"
     view "new_oauth_application", "New Oauth Application", "new_oauth_application"
@@ -73,14 +77,16 @@ module Rodauth
 
     auth_value_method :oauth_grant_expires_in, 60 * 5 # 5 minutes
     auth_value_method :oauth_token_expires_in, 60 * 60 # 60 minutes
+    auth_value_method :oauth_refresh_token_expires_in, 60 * 60 * 24 * 360 # 1 year
     auth_value_method :use_oauth_implicit_grant_type?, false
     auth_value_method :use_oauth_pkce?, true
     auth_value_method :use_oauth_access_type?, true
 
     auth_value_method :oauth_require_pkce, false
     auth_value_method :oauth_pkce_challenge_method, "S256"
+    auth_value_method :oauth_response_mode, "query"
 
-    auth_value_method :oauth_valid_uri_schemes, %w[http https]
+    auth_value_method :oauth_valid_uri_schemes, %w[https]
 
     auth_value_method :oauth_scope_separator, " "
 
@@ -95,6 +101,7 @@ module Rodauth
     button "Register", "oauth_application"
     button "Authorize", "oauth_authorize"
     button "Revoke", "oauth_token_revoke"
+    button "Back to Client Application", "oauth_authorize_post"
 
     # OAuth Token
     auth_value_method :oauth_tokens_path, "oauth-tokens"
@@ -113,6 +120,8 @@ module Rodauth
     auth_value_method :oauth_tokens_token_hash_column, nil
     auth_value_method :oauth_tokens_refresh_token_hash_column, nil
 
+    # Access Token reuse
+    auth_value_method :oauth_reuse_access_token, false
     # OAuth Grants
     auth_value_method :oauth_grants_table, :oauth_grants
     auth_value_method :oauth_grants_id_column, :id
@@ -127,6 +136,7 @@ module Rodauth
 
     auth_value_method :authorization_required_error_status, 401
     auth_value_method :invalid_oauth_response_status, 400
+    auth_value_method :already_in_use_response_status, 409
 
     # OAuth Applications
     auth_value_method :oauth_applications_path, "oauth-applications"
@@ -144,13 +154,13 @@ module Rodauth
       auth_value_method :"oauth_applications_#{column}_column", column
     end
 
+    # Feature options
     auth_value_method :oauth_application_default_scope, SCOPES.first
     auth_value_method :oauth_application_scopes, SCOPES
     auth_value_method :oauth_token_type, "bearer"
+    auth_value_method :oauth_refresh_token_protection_policy, "none" # can be: none, sender_constrained, rotation
 
-    auth_value_method :invalid_request, "Request is missing a required parameter"
-    auth_value_method :invalid_client, "Invalid client"
-    auth_value_method :unauthorized_client, "Unauthorized client"
+    auth_value_method :invalid_client_message, "Invalid client"
     auth_value_method :invalid_grant_type_message, "Invalid grant type"
     auth_value_method :invalid_grant_message, "Invalid grant"
     auth_value_method :invalid_scope_message, "Invalid scope"
@@ -160,6 +170,8 @@ module Rodauth
 
     auth_value_method :unique_error_message, "is already in use"
     auth_value_method :null_error_message, "is not filled"
+    auth_value_method :already_in_use_message, "error generating unique token"
+    auth_value_method :already_in_use_error_code, "invalid_request"
 
     # PKCE
     auth_value_method :code_challenge_required_error_code, "invalid_request"
@@ -177,6 +189,8 @@ module Rodauth
     # Only required to use if the plugin is to be used in a resource server
     auth_value_method :is_authorization_server?, true
 
+    auth_value_method :oauth_unique_id_generation_retries, 3
+
     auth_value_methods(
       :fetch_access_token,
       :oauth_unique_id_generator,
@@ -184,36 +198,231 @@ module Rodauth
       :secret_hash,
       :generate_token_hash,
       :authorization_server_url,
-      :before_introspection_request
+      :before_introspection_request,
+      :require_authorizable_account,
+      :oauth_tokens_unique_columns
     )
 
     auth_value_methods(:only_json?)
 
-    redirect(:oauth_application) do |id|
-      "/#{oauth_applications_path}/#{id}"
+    auth_value_method :json_request_regexp, %r{\bapplication/(?:vnd\.api\+)?json\b}i
+
+    # /token
+    route(:token) do |r|
+      next unless is_authorization_server?
+
+      before_token_route
+      require_oauth_application
+
+      r.post do
+        catch_error do
+          validate_oauth_token_params
+
+          oauth_token = nil
+          transaction do
+            before_token
+            oauth_token = create_oauth_token
+          end
+
+          json_response_success(json_access_token_payload(oauth_token))
+        end
+
+        throw_json_response_error(invalid_oauth_response_status, "invalid_request")
+      end
     end
 
-    redirect(:require_authorization) do
-      if logged_in?
-        oauth_authorize_path
-      elsif respond_to?(:login_redirect)
-        login_redirect
-      else
-        default_redirect
+    # /introspect
+    route(:introspect) do |r|
+      next unless is_authorization_server?
+
+      before_introspect_route
+
+      r.post do
+        catch_error do
+          validate_oauth_introspect_params
+
+          before_introspect
+          oauth_token = case param("token_type_hint")
+                        when "access_token"
+                          oauth_token_by_token(param("token"))
+                        when "refresh_token"
+                          oauth_token_by_refresh_token(param("token"))
+                        else
+                          oauth_token_by_token(param("token")) || oauth_token_by_refresh_token(param("token"))
+                        end
+
+          if oauth_application
+            redirect_response_error("invalid_request") if oauth_token && !token_from_application?(oauth_token, oauth_application)
+          elsif oauth_token
+            @oauth_application = db[oauth_applications_table].where(oauth_applications_id_column =>
+              oauth_token[oauth_tokens_oauth_application_id_column]).first
+          end
+
+          json_response_success(json_token_introspect_payload(oauth_token))
+        end
+
+        throw_json_response_error(invalid_oauth_response_status, "invalid_request")
       end
     end
 
-    auth_value_method :json_request_regexp, %r{\bapplication/(?:vnd\.api\+)?json\b}i
+    # /revoke
+    route(:revoke) do |r|
+      next unless is_authorization_server?
 
-    SERVER_METADATA = OAuth::TtlStore.new
+      before_revoke_route
+      require_oauth_application
+
+      r.post do
+        catch_error do
+          validate_oauth_revoke_params
+
+          oauth_token = nil
+          transaction do
+            before_revoke
+            oauth_token = revoke_oauth_token
+            after_revoke
+          end
+
+          if accepts_json?
+            json_response_success \
+              "token" => oauth_token[oauth_tokens_token_column],
+              "refresh_token" => oauth_token[oauth_tokens_refresh_token_column],
+              "revoked_at" => convert_timestamp(oauth_token[oauth_tokens_revoked_at_column])
+          else
+            set_notice_flash revoke_oauth_token_notice_flash
+            redirect request.referer || "/"
+          end
+        end
+
+        redirect_response_error("invalid_request", request.referer || "/")
+      end
+    end
+
+    # /authorize
+    route(:authorize) do |r|
+      next unless is_authorization_server?
+
+      before_authorize_route
+      require_authorizable_account
+
+      validate_oauth_grant_params
+      try_approval_prompt if use_oauth_access_type? && request.get?
+
+      r.get do
+        authorize_view
+      end
+
+      r.post do
+        redirect_url = URI.parse(redirect_uri)
+
+        params, mode = transaction do
+          before_authorize
+          do_authorize
+        end
+
+        case mode
+        when "query"
+          params = params.map { |k, v| "#{k}=#{v}" }
+          params << redirect_url.query if redirect_url.query
+          redirect_url.query = params.join("&")
+          redirect(redirect_url.to_s)
+        when "fragment"
+          params = params.map { |k, v| "#{k}=#{v}" }
+          params << redirect_url.query if redirect_url.query
+          redirect_url.fragment = params.join("&")
+          redirect(redirect_url.to_s)
+        when "form_post"
+          scope.view layout: false, inline: <<-FORM
+            <html>
+              <head><title>Authorized</title></head>
+              <body onload="javascript:document.forms[0].submit()">
+                <form method="post" action="#{redirect_uri}">
+                  #{
+                    params.map do |name, value|
+                      "<input type=\"hidden\" name=\"#{name}\" value=\"#{scope.h(value)}\" />"
+                    end.join
+                  }
+                  <input type="submit" class="btn btn-outline-primary" value="#{scope.h(oauth_authorize_post_button)}"/>
+                </form>
+              </body>
+            </html>
+          FORM
+        when "none"
+          redirect(redirect_url.to_s)
+        end
+      end
+    end
+
+    def oauth_server_metadata(issuer = nil)
+      request.on(".well-known") do
+        request.on("oauth-authorization-server") do
+          request.get do
+            json_response_success(oauth_server_metadata_body(issuer), true)
+          end
+        end
+      end
+    end
+
+    # /oauth-applications routes
+    def oauth_applications
+      request.on(oauth_applications_path) do
+        require_account
+
+        request.get "new" do
+          new_oauth_application_view
+        end
+
+        request.on(oauth_applications_id_pattern) do |id|
+          oauth_application = db[oauth_applications_table].where(oauth_applications_id_column => id).first
+          next unless oauth_application
+
+          scope.instance_variable_set(:@oauth_application, oauth_application)
+
+          request.is do
+            request.get do
+              oauth_application_view
+            end
+          end
+
+          request.on(oauth_tokens_path) do
+            oauth_tokens = db[oauth_tokens_table].where(oauth_tokens_oauth_application_id_column => id)
+            scope.instance_variable_set(:@oauth_tokens, oauth_tokens)
+            request.get do
+              oauth_tokens_view
+            end
+          end
+        end
+
+        request.get do
+          scope.instance_variable_set(:@oauth_applications, db[oauth_applications_table])
+          oauth_applications_view
+        end
+
+        request.post do
+          catch_error do
+            validate_oauth_application_params
+
+            transaction do
+              before_create_oauth_application
+              id = create_oauth_application
+              after_create_oauth_application
+              set_notice_flash create_oauth_application_notice_flash
+              redirect "#{request.path}/#{id}"
+            end
+          end
+          set_error_flash create_oauth_application_error_flash
+          new_oauth_application_view
+        end
+      end
+    end
 
     def check_csrf?
       case request.path
-      when oauth_token_path, oauth_introspect_path
+      when token_path, introspect_path
         false
-      when oauth_revoke_path
+      when revoke_path
         !json_request?
-      when oauth_authorize_path, %r{/#{oauth_applications_path}}
+      when authorize_path, %r{/#{oauth_applications_path}}
         only_json? ? false : super
       else
         super
@@ -232,30 +441,28 @@ module Rodauth
     end
 
     unless method_defined?(:json_request?)
-      # :nocov:
       # copied from the jwt feature
       def json_request?
         return @json_request if defined?(@json_request)
 
         @json_request = request.content_type =~ json_request_regexp
       end
-      # :nocov:
     end
 
     def initialize(scope)
       @scope = scope
     end
 
-    def state
-      param_or_nil("state")
-    end
-
     def scopes
-      (param_or_nil("scope") || oauth_application_default_scope).split(" ")
-    end
-
-    def client_id
-      param_or_nil("client_id")
+      scope = request.params["scope"]
+      case scope
+      when Array
+        scope
+      when String
+        scope.split(" ")
+      when nil
+        [oauth_application_default_scope]
+      end
     end
 
     def redirect_uri
@@ -267,14 +474,6 @@ module Rodauth
       end
     end
 
-    def token_type_hint
-      param_or_nil("token_type_hint") || "access_token"
-    end
-
-    def token
-      param_or_nil("token")
-    end
-
     def oauth_application
       return @oauth_application if defined?(@oauth_application)
 
@@ -296,6 +495,8 @@ module Rodauth
 
       return unless scheme.downcase == oauth_token_type
 
+      return if token.empty?
+
       token
     end
 
@@ -337,67 +538,46 @@ module Rodauth
       authorization_required unless scopes.any? { |scope| token_scopes.include?(scope) }
     end
 
-    # /oauth-applications routes
-    def oauth_applications
-      request.on(oauth_applications_path) do
-        require_account
+    def post_configure
+      super
+      self.class.__send__(:include, Rodauth::OAuth::ExtendDatabase(db))
 
-        request.get "new" do
-          new_oauth_application_view
-        end
-
-        request.on(oauth_applications_id_pattern) do |id|
-          oauth_application = db[oauth_applications_table].where(oauth_applications_id_column => id).first
-          scope.instance_variable_set(:@oauth_application, oauth_application)
-
-          request.is do
-            request.get do
-              oauth_application_view
-            end
-          end
-
-          request.on(oauth_tokens_path) do
-            oauth_tokens = db[oauth_tokens_table].where(oauth_tokens_oauth_application_id_column => id)
-            scope.instance_variable_set(:@oauth_tokens, oauth_tokens)
-            oauth_tokens_view
-          end
+      # Check whether we can reutilize db entries for the same account / application pair
+      one_oauth_token_per_account = begin
+        db.indexes(oauth_tokens_table).values.any? do |definition|
+          definition[:unique] &&
+            definition[:columns] == oauth_tokens_unique_columns
         end
+      end
+      self.class.send(:define_method, :__one_oauth_token_per_account) { one_oauth_token_per_account }
+    end
 
-        request.get do
-          scope.instance_variable_set(:@oauth_applications, db[:oauth_applications])
-          oauth_applications_view
-        end
+    def use_date_arithmetic?
+      true
+    end
 
-        request.post do
-          catch_error do
-            validate_oauth_application_params
+    private
 
-            transaction do
-              before_create_oauth_application
-              id = create_oauth_application
-              after_create_oauth_application
-              set_notice_flash create_oauth_application_notice_flash
-              redirect oauth_application_redirect(id)
-            end
-          end
-          set_error_flash create_oauth_application_error_flash
-          new_oauth_application_view
-        end
+    def rescue_from_uniqueness_error(&block)
+      retries = oauth_unique_id_generation_retries
+      begin
+        transaction(savepoint: :only, &block)
+      rescue Sequel::UniqueConstraintViolation
+        redirect_response_error("already_in_use") if retries.zero?
+        retries -= 1
+        retry
       end
     end
 
-    def oauth_server_metadata(issuer = nil)
-      request.on(".well-known") do
-        request.on("oauth-authorization-server") do
-          request.get do
-            json_response_success(oauth_server_metadata_body(issuer))
-          end
-        end
-      end
+    # OAuth Token Unique/Reuse
+    def oauth_tokens_unique_columns
+      [
+        oauth_tokens_oauth_application_id_column,
+        oauth_tokens_account_id_column,
+        oauth_tokens_scopes_column
+      ]
     end
 
-    private
-
     def authorization_server_url
       base_url
     end
@@ -420,10 +600,10 @@ module Rodauth
 
         # time-to-live
         ttl = if response.key?("cache-control")
-                cache_control = response["cache_control"]
-                cache_control[/max-age=(\d+)/, 1]
+                cache_control = response["cache-control"]
+                cache_control[/max-age=(\d+)/, 1].to_i
               elsif response.key?("expires")
-                Time.httpdate(response["expires"]).utc.to_i - Time.now.utc.to_i
+                Time.parse(response["expires"]).to_i - Time.now.to_i
               end
 
         [JSON.parse(response.body, symbolize_names: true), ttl]
@@ -435,7 +615,7 @@ module Rodauth
       http = Net::HTTP.new(auth_url.host, auth_url.port)
       http.use_ssl = auth_url.scheme == "https"
 
-      request = Net::HTTP::Post.new(oauth_introspect_path)
+      request = Net::HTTP::Post.new(introspect_path)
       request["content-type"] = json_response_content_type
       request["accept"] = json_response_content_type
       request.body = JSON.dump({ "token_type_hint" => token_type_hint, "token" => token })
@@ -491,7 +671,7 @@ module Rodauth
     end
 
     def oauth_unique_id_generator
-      SecureRandom.hex(32)
+      SecureRandom.urlsafe_base64(32)
     end
 
     def generate_token_hash(token)
@@ -503,89 +683,106 @@ module Rodauth
     end
 
     unless method_defined?(:password_hash)
-      # :nocov:
       # From login_requirements_base feature
-      if ENV["RACK_ENV"] == "test"
-        def password_hash_cost
-          BCrypt::Engine::MIN_COST
-        end
-      else
-        def password_hash_cost
-          BCrypt::Engine::DEFAULT_COST
-        end
-      end
 
       def password_hash(password)
-        BCrypt::Password.create(password, cost: password_hash_cost)
+        BCrypt::Password.create(password, cost: BCrypt::Engine::DEFAULT_COST)
       end
-      # :nocov:
     end
 
     def generate_oauth_token(params = {}, should_generate_refresh_token = true)
       create_params = {
-        oauth_grants_expires_in_column => Time.now + oauth_token_expires_in
+        oauth_grants_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_token_expires_in)
       }.merge(params)
 
-      token = oauth_unique_id_generator
-      refresh_token = nil
+      rescue_from_uniqueness_error do
+        token = oauth_unique_id_generator
 
-      if oauth_tokens_token_hash_column
-        create_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
-      else
-        create_params[oauth_tokens_token_column] = token
-      end
+        if oauth_tokens_token_hash_column
+          create_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
+        else
+          create_params[oauth_tokens_token_column] = token
+        end
 
-      if should_generate_refresh_token
-        refresh_token = oauth_unique_id_generator
+        refresh_token = nil
+        if should_generate_refresh_token
+          refresh_token = oauth_unique_id_generator
 
-        if oauth_tokens_refresh_token_hash_column
-          create_params[oauth_tokens_refresh_token_hash_column] = generate_token_hash(refresh_token)
-        else
-          create_params[oauth_tokens_refresh_token_column] = refresh_token
+          if oauth_tokens_refresh_token_hash_column
+            create_params[oauth_tokens_refresh_token_hash_column] = generate_token_hash(refresh_token)
+          else
+            create_params[oauth_tokens_refresh_token_column] = refresh_token
+          end
         end
+        oauth_token = _generate_oauth_token(create_params)
+        oauth_token[oauth_tokens_token_column] = token
+        oauth_token[oauth_tokens_refresh_token_column] = refresh_token if refresh_token
+        oauth_token
       end
-      oauth_token = _generate_oauth_token(create_params)
-
-      oauth_token[oauth_tokens_token_column] = token
-      oauth_token[oauth_tokens_refresh_token_column] = refresh_token if refresh_token
-      oauth_token
     end
 
     def _generate_oauth_token(params = {})
       ds = db[oauth_tokens_table]
 
-      begin
-        if ds.supports_returning?(:insert)
-          ds.returning.insert(params).first
-        else
-          id = ds.insert(params)
-          ds.where(oauth_tokens_id_column => id).first
+      if __one_oauth_token_per_account
+
+        token = __insert_or_update_and_return__(
+          ds,
+          oauth_tokens_id_column,
+          oauth_tokens_unique_columns,
+          params,
+          Sequel.expr(Sequel[oauth_tokens_table][oauth_tokens_expires_in_column]) > Sequel::CURRENT_TIMESTAMP,
+          ([oauth_tokens_token_column, oauth_tokens_refresh_token_column] if oauth_reuse_access_token)
+        )
+
+        # if the previous operation didn't return a row, it means that the conditions
+        # invalidated the update, and the existing token is still valid.
+        token || ds.where(
+          oauth_tokens_account_id_column => params[oauth_tokens_account_id_column],
+          oauth_tokens_oauth_application_id_column => params[oauth_tokens_oauth_application_id_column]
+        ).first
+      else
+        if oauth_reuse_access_token
+          unique_conds = Hash[oauth_tokens_unique_columns.map { |column| [column, params[column]] }]
+          valid_token = ds.where(Sequel.expr(Sequel[oauth_tokens_table][oauth_tokens_expires_in_column]) > Sequel::CURRENT_TIMESTAMP)
+                          .where(unique_conds).first
+          return valid_token if valid_token
         end
-      rescue Sequel::UniqueConstraintViolation
-        retry
+        __insert_and_return__(ds, oauth_tokens_id_column, params)
       end
     end
 
-    def oauth_token_by_token(token, dataset = db[oauth_tokens_table])
+    def oauth_token_by_token(token)
+      ds = db[oauth_tokens_table]
+
       ds = if oauth_tokens_token_hash_column
-             dataset.where(oauth_tokens_token_hash_column => generate_token_hash(token))
+             ds.where(oauth_tokens_token_hash_column => generate_token_hash(token))
            else
-             dataset.where(oauth_tokens_token_column => token)
+             ds.where(oauth_tokens_token_column => token)
            end
 
       ds.where(Sequel[oauth_tokens_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
         .where(oauth_tokens_revoked_at_column => nil).first
     end
 
-    def oauth_token_by_refresh_token(token, dataset = db[oauth_tokens_table])
+    def oauth_token_by_refresh_token(token, revoked: false)
+      ds = db[oauth_tokens_table]
+      #
+      # filter expired refresh tokens out.
+      # an expired refresh token is a token whose access token expired for a period longer than the
+      # refresh token expiration period.
+      #
+      ds = ds.where(Sequel.date_add(oauth_tokens_expires_in_column, seconds: oauth_refresh_token_expires_in) >= Sequel::CURRENT_TIMESTAMP)
+
       ds = if oauth_tokens_refresh_token_hash_column
-             dataset.where(oauth_tokens_refresh_token_hash_column => generate_token_hash(token))
+             ds.where(oauth_tokens_refresh_token_hash_column => generate_token_hash(token))
            else
-             dataset.where(oauth_tokens_refresh_token_column => token)
+             ds.where(oauth_tokens_refresh_token_column => token)
            end
 
-      ds.where(Sequel[oauth_tokens_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
-        .where(oauth_tokens_revoked_at_column => nil).first
+      ds = ds.where(oauth_tokens_revoked_at_column => nil) unless revoked
+
+      ds.first
     end
 
     def json_access_token_payload(oauth_token)
@@ -654,7 +851,6 @@ module Rodauth
       # set client ID/secret pairs
 
       create_params.merge! \
-        oauth_applications_client_id_column => oauth_unique_id_generator,
         oauth_applications_client_secret_column => \
           secret_hash(oauth_application_params[oauth_application_client_secret_param])
 
@@ -664,29 +860,14 @@ module Rodauth
                                                           oauth_application_default_scope
                                                         end
 
-      id = nil
-      raised = begin
-                 id = db[oauth_applications_table].insert(create_params)
-                 false
-               rescue Sequel::ConstraintViolation => e
-                 e
-               end
-
-      if raised
-        field = raised.message[/\.(.*)$/, 1]
-        case raised
-        when Sequel::UniqueConstraintViolation
-          throw_error(field, unique_error_message)
-        when Sequel::NotNullConstraintViolation
-          throw_error(field, null_error_message)
-        end
+      rescue_from_uniqueness_error do
+        create_params[oauth_applications_client_id_column] = oauth_unique_id_generator
+        db[oauth_applications_table].insert(create_params)
       end
-
-      !raised && id
     end
 
     # Authorize
-    def before_authorize
+    def require_authorizable_account
       require_account
     end
 
@@ -699,6 +880,9 @@ module Rodauth
       end
       redirect_response_error("invalid_scope") unless check_valid_scopes?
 
+      if (response_mode = param_or_nil("response_mode")) && response_mode != "form_post"
+        redirect_response_error("invalid_request")
+      end
       validate_pkce_challenge_params if use_oauth_pkce?
     end
 
@@ -716,57 +900,79 @@ module Rodauth
       ).count.zero?
 
       # if there's a previous oauth grant for the params combo, it means that this user has approved before.
-
       request.env["REQUEST_METHOD"] = "POST"
     end
 
-    def create_oauth_grant
-      create_params = {
+    def create_oauth_grant(create_params = {})
+      create_params.merge!(
         oauth_grants_account_id_column => account_id,
         oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
         oauth_grants_redirect_uri_column => redirect_uri,
-        oauth_grants_expires_in_column => Time.now + oauth_grant_expires_in,
+        oauth_grants_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_grant_expires_in),
         oauth_grants_scopes_column => scopes.join(oauth_scope_separator)
-      }
+      )
 
       # Access Type flow
-      if use_oauth_access_type?
-        if (access_type = param_or_nil("access_type"))
-          create_params[oauth_grants_access_type_column] = access_type
-        end
+      if use_oauth_access_type? && (access_type = param_or_nil("access_type"))
+        create_params[oauth_grants_access_type_column] = access_type
       end
 
       # PKCE flow
-      if use_oauth_pkce?
+      if use_oauth_pkce? && (code_challenge = param_or_nil("code_challenge"))
+        code_challenge_method = param_or_nil("code_challenge_method")
 
-        if (code_challenge = param_or_nil("code_challenge"))
-          code_challenge_method = param_or_nil("code_challenge_method")
-
-          create_params[oauth_grants_code_challenge_column] = code_challenge
-          create_params[oauth_grants_code_challenge_method_column] = code_challenge_method
-        elsif oauth_require_pkce
-          redirect_response_error("code_challenge_required")
-        end
+        create_params[oauth_grants_code_challenge_column] = code_challenge
+        create_params[oauth_grants_code_challenge_method_column] = code_challenge_method
       end
 
       ds = db[oauth_grants_table]
 
-      begin
-        authorization_code = oauth_unique_id_generator
-        create_params[oauth_grants_code_column] = authorization_code
-        ds.insert(create_params)
-        authorization_code
-      rescue Sequel::UniqueConstraintViolation
-        retry
+      rescue_from_uniqueness_error do
+        create_params[oauth_grants_code_column] = oauth_unique_id_generator
+        __insert_and_return__(ds, oauth_grants_id_column, create_params)
+      end
+      create_params[oauth_grants_code_column]
+    end
+
+    def do_authorize(response_params = {}, response_mode = param_or_nil("response_mode"))
+      case param("response_type")
+      when "token"
+        redirect_response_error("invalid_request") unless use_oauth_implicit_grant_type?
+
+        response_mode ||= "fragment"
+        response_params.replace(_do_authorize_token)
+      when "code"
+        response_mode ||= "query"
+        response_params.replace(_do_authorize_code)
+      when "none"
+        response_mode ||= "none"
+      when "", nil
+        response_mode ||= oauth_response_mode
+        response_params.replace(_do_authorize_code)
       end
+
+      response_params["state"] = param("state") if param_or_nil("state")
+
+      [response_params, response_mode]
     end
 
-    # Access Tokens
+    def _do_authorize_code
+      { "code" => create_oauth_grant }
+    end
 
-    def before_token
-      require_oauth_application
+    def _do_authorize_token
+      create_params = {
+        oauth_tokens_account_id_column => account_id,
+        oauth_tokens_oauth_application_id_column => oauth_application[oauth_applications_id_column],
+        oauth_tokens_scopes_column => scopes
+      }
+      oauth_token = generate_oauth_token(create_params, false)
+
+      json_access_token_payload(oauth_token)
     end
 
+    # Access Tokens
+
     def validate_oauth_token_params
       unless (grant_type = param_or_nil("grant_type"))
         redirect_response_error("invalid_request")
@@ -786,27 +992,56 @@ module Rodauth
     def create_oauth_token
       case param("grant_type")
       when "authorization_code"
-        create_oauth_token_from_authorization_code(oauth_application)
+        # fetch oauth grant
+        oauth_grant = db[oauth_grants_table].where(
+          oauth_grants_code_column => param("code"),
+          oauth_grants_redirect_uri_column => param("redirect_uri"),
+          oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
+          oauth_grants_revoked_at_column => nil
+        ).where(Sequel[oauth_grants_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
+                                            .for_update
+                                            .first
+
+        redirect_response_error("invalid_grant") unless oauth_grant
+
+        create_params = {
+          oauth_tokens_account_id_column => oauth_grant[oauth_grants_account_id_column],
+          oauth_tokens_oauth_application_id_column => oauth_grant[oauth_grants_oauth_application_id_column],
+          oauth_tokens_oauth_grant_id_column => oauth_grant[oauth_grants_id_column],
+          oauth_tokens_scopes_column => oauth_grant[oauth_grants_scopes_column]
+        }
+        create_oauth_token_from_authorization_code(oauth_grant, create_params)
       when "refresh_token"
-        create_oauth_token_from_token(oauth_application)
-      else
-        redirect_response_error("invalid_grant")
+        # fetch potentially revoked oauth token
+        oauth_token = oauth_token_by_refresh_token(param("refresh_token"), revoked: true)
+
+        if !oauth_token
+          redirect_response_error("invalid_grant")
+        elsif oauth_token[oauth_tokens_revoked_at_column]
+          if oauth_refresh_token_protection_policy == "rotation"
+            # https://tools.ietf.org/html/draft-ietf-oauth-v2-1-00#section-6.1
+            #
+            # If a refresh token is compromised and subsequently used by both the attacker and the legitimate
+            # client, one of them will present an invalidated refresh token, which will inform the authorization
+            # server of the breach.  The authorization server cannot determine which party submitted the invalid
+            # refresh token, but it will revoke the active refresh token.  This stops the attack at the cost of
+            # forcing the legitimate client to obtain a fresh authorization grant.
+
+            db[oauth_tokens_table].where(oauth_tokens_oauth_token_id_column => oauth_token[oauth_tokens_id_column])
+                                  .update(oauth_tokens_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
+          end
+          redirect_response_error("invalid_grant")
+        end
+
+        update_params = {
+          oauth_tokens_oauth_application_id_column => oauth_token[oauth_grants_oauth_application_id_column],
+          oauth_tokens_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_token_expires_in)
+        }
+        create_oauth_token_from_token(oauth_token, update_params)
       end
     end
 
-    def create_oauth_token_from_authorization_code(oauth_application)
-      # fetch oauth grant
-      oauth_grant = db[oauth_grants_table].where(
-        oauth_grants_code_column => param("code"),
-        oauth_grants_redirect_uri_column => param("redirect_uri"),
-        oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
-        oauth_grants_revoked_at_column => nil
-      ).where(Sequel[oauth_grants_expires_in_column] >= Sequel::CURRENT_TIMESTAMP)
-                                          .for_update
-                                          .first
-
-      redirect_response_error("invalid_grant") unless oauth_grant
-
+    def create_oauth_token_from_authorization_code(oauth_grant, create_params)
       # PKCE
       if use_oauth_pkce?
         if oauth_grant[oauth_grants_code_challenge_column]
@@ -818,13 +1053,6 @@ module Rodauth
         end
       end
 
-      create_params = {
-        oauth_tokens_account_id_column => oauth_grant[oauth_grants_account_id_column],
-        oauth_tokens_oauth_application_id_column => oauth_grant[oauth_grants_oauth_application_id_column],
-        oauth_tokens_oauth_grant_id_column => oauth_grant[oauth_grants_id_column],
-        oauth_tokens_scopes_column => oauth_grant[oauth_grants_scopes_column]
-      }
-
       # revoke oauth grant
       db[oauth_grants_table].where(oauth_grants_id_column => oauth_grant[oauth_grants_id_column])
                             .update(oauth_grants_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
@@ -835,40 +1063,41 @@ module Rodauth
       generate_oauth_token(create_params, should_generate_refresh_token)
     end
 
-    def create_oauth_token_from_token(oauth_application)
-      # fetch oauth token
-      oauth_token = oauth_token_by_refresh_token(param("refresh_token"))
+    def create_oauth_token_from_token(oauth_token, update_params)
+      redirect_response_error("invalid_grant") unless token_from_application?(oauth_token, oauth_application)
 
-      redirect_response_error("invalid_grant") unless oauth_token && token_from_application?(oauth_token, oauth_application)
-
-      token = oauth_unique_id_generator
-
-      update_params = {
-        oauth_tokens_oauth_application_id_column => oauth_token[oauth_grants_oauth_application_id_column],
-        oauth_tokens_expires_in_column => Time.now + oauth_token_expires_in
-      }
+      rescue_from_uniqueness_error do
+        oauth_tokens_ds = db[oauth_tokens_table]
+        token = oauth_unique_id_generator
 
-      if oauth_tokens_token_hash_column
-        update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
-      else
-        update_params[oauth_tokens_token_column] = token
-      end
-
-      ds = db[oauth_tokens_table].where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
-
-      oauth_token = begin
-        if ds.supports_returning?(:update)
-          ds.returning.update(update_params).first
+        if oauth_tokens_token_hash_column
+          update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
         else
-          ds.update(update_params)
-          ds.first
+          update_params[oauth_tokens_token_column] = token
         end
-                    rescue Sequel::UniqueConstraintViolation
-                      retry
-      end
 
-      oauth_token[oauth_tokens_token_column] = token
-      oauth_token
+        oauth_token = if oauth_refresh_token_protection_policy == "rotation"
+                        insert_params = {
+                          **update_params,
+                          oauth_tokens_oauth_token_id_column => oauth_token[oauth_tokens_id_column],
+                          oauth_tokens_scopes_column => oauth_token[oauth_tokens_scopes_column]
+                        }
+
+                        # revoke the refresh token
+                        oauth_tokens_ds.where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
+                                       .update(oauth_tokens_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
+
+                        insert_params[oauth_tokens_oauth_token_id_column] = oauth_token[oauth_tokens_id_column]
+                        __insert_and_return__(oauth_tokens_ds, oauth_tokens_id_column, insert_params)
+                      else
+                        # includes none
+                        ds = oauth_tokens_ds.where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
+                        __update_and_return__(ds, update_params)
+                      end
+
+        oauth_token[oauth_tokens_token_column] = token
+        oauth_token
+      end
     end
 
     TOKEN_HINT_TYPES = %w[access_token refresh_token].freeze
@@ -877,8 +1106,8 @@ module Rodauth
 
     def validate_oauth_introspect_params
       # check if valid token hint type
-      if token_type_hint
-        redirect_response_error("unsupported_token_type") unless TOKEN_HINT_TYPES.include?(token_type_hint)
+      if param_or_nil("token_type_hint") && !TOKEN_HINT_TYPES.include?(param("token_type_hint"))
+        redirect_response_error("unsupported_token_type")
       end
 
       redirect_response_error("invalid_request") unless param_or_nil("token")
@@ -896,48 +1125,35 @@ module Rodauth
       }
     end
 
-    def before_introspect; end
-
     # Token revocation
 
-    def before_revoke
-      require_oauth_application
-    end
-
     def validate_oauth_revoke_params
       # check if valid token hint type
-      redirect_response_error("unsupported_token_type") unless TOKEN_HINT_TYPES.include?(token_type_hint)
+      if param_or_nil("token_type_hint") && !TOKEN_HINT_TYPES.include?(param("token_type_hint"))
+        redirect_response_error("unsupported_token_type")
+      end
 
       redirect_response_error("invalid_request") unless param_or_nil("token")
     end
 
     def revoke_oauth_token
-      oauth_token = case token_type_hint
-                    when "access_token"
-                      oauth_token_by_token(token)
-                    when "refresh_token"
+      token = param("token")
+
+      oauth_token = if param("token_type_hint") == "refresh_token"
                       oauth_token_by_refresh_token(token)
+                    else
+                      oauth_token_by_token(token)
                     end
 
       redirect_response_error("invalid_request") unless oauth_token
 
-      if oauth_application
-        redirect_response_error("invalid_request") unless token_from_application?(oauth_token, oauth_application)
-      else
-        @oauth_application = db[oauth_applications_table].where(oauth_applications_id_column =>
-          oauth_token[oauth_tokens_oauth_application_id_column]).first
-      end
+      redirect_response_error("invalid_request") unless token_from_application?(oauth_token, oauth_application)
 
       update_params = { oauth_tokens_revoked_at_column => Sequel::CURRENT_TIMESTAMP }
 
       ds = db[oauth_tokens_table].where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
 
-      oauth_token = if ds.supports_returning?(:update)
-                      ds.returning.update(update_params).first
-                    else
-                      ds.update(update_params)
-                      ds.first
-                    end
+      oauth_token = __update_and_return__(ds, update_params)
 
       oauth_token[oauth_tokens_token_column] = token
       oauth_token
@@ -955,7 +1171,13 @@ module Rodauth
 
     def redirect_response_error(error_code, redirect_url = redirect_uri || request.referer || default_redirect)
       if accepts_json?
-        throw_json_response_error(invalid_oauth_response_status, error_code)
+        status_code = if respond_to?(:"#{error_code}_response_status")
+                        send(:"#{error_code}_response_status")
+                      else
+                        invalid_oauth_response_status
+                      end
+
+        throw_json_response_error(status_code, error_code)
       else
         redirect_url = URI.parse(redirect_url)
         query_params = []
@@ -977,9 +1199,17 @@ module Rodauth
       end
     end
 
-    def json_response_success(body)
+    def json_response_success(body, cache = false)
       response.status = 200
       response["Content-Type"] ||= json_response_content_type
+      if cache
+        # defaulting to 1-day for everyone, for now at least
+        max_age = 60 * 60 * 24
+        response["Cache-Control"] = "private, max-age=#{max_age}"
+      else
+        response["Cache-Control"] = "no-store"
+        response["Pragma"] = "no-cache"
+      end
       json_payload = _json_response_body(body)
       response.write(json_payload)
       request.halt
@@ -1002,7 +1232,6 @@ module Rodauth
     end
 
     unless method_defined?(:_json_response_body)
-      # :nocov:
       def _json_response_body(hash)
         if request.respond_to?(:convert_to_json)
           request.send(:convert_to_json, hash)
@@ -1010,7 +1239,6 @@ module Rodauth
           JSON.dump(hash)
         end
       end
-      # :nocov:
     end
 
     def authorization_required
@@ -1018,7 +1246,7 @@ module Rodauth
         throw_json_response_error(authorization_required_error_status, "invalid_client")
       else
         set_redirect_error_flash(require_authorization_error_flash)
-        redirect(require_authorization_redirect)
+        redirect(authorize_path)
       end
     end
 
@@ -1098,10 +1326,10 @@ module Rodauth
 
     def oauth_server_metadata_body(path)
       issuer = base_url
-      issuer += "/#{path}" if issuer
+      issuer += "/#{path}" if path
 
       responses_supported = %w[code]
-      response_modes_supported = %w[query]
+      response_modes_supported = %w[query form_post]
       grant_types_supported = %w[authorization_code]
 
       if use_oauth_implicit_grant_type?
@@ -1109,11 +1337,12 @@ module Rodauth
         response_modes_supported << "fragment"
         grant_types_supported << "implicit"
       end
+
       {
         issuer: issuer,
-        authorization_endpoint: oauth_authorize_url,
-        token_endpoint: oauth_token_url,
-        registration_endpoint: "#{base_url}/#{oauth_applications_path}",
+        authorization_endpoint: authorize_url,
+        token_endpoint: token_url,
+        registration_endpoint: route_url(oauth_applications_path),
         scopes_supported: oauth_application_scopes,
         response_types_supported: responses_supported,
         response_modes_supported: response_modes_supported,
@@ -1123,143 +1352,12 @@ module Rodauth
         ui_locales_supported: oauth_metadata_ui_locales_supported,
         op_policy_uri: oauth_metadata_op_policy_uri,
         op_tos_uri: oauth_metadata_op_tos_uri,
-        revocation_endpoint: oauth_revoke_url,
+        revocation_endpoint: revoke_url,
         revocation_endpoint_auth_methods_supported: nil, # because it's client_secret_basic
-        introspection_endpoint: oauth_introspect_url,
+        introspection_endpoint: introspect_url,
         introspection_endpoint_auth_methods_supported: %w[client_secret_basic],
         code_challenge_methods_supported: (use_oauth_pkce? ? oauth_pkce_challenge_method : nil)
       }
     end
-
-    # /oauth-token
-    route(:oauth_token) do |r|
-      before_token
-
-      r.post do
-        catch_error do
-          validate_oauth_token_params
-
-          oauth_token = nil
-          transaction do
-            oauth_token = create_oauth_token
-          end
-
-          json_response_success(json_access_token_payload(oauth_token))
-        end
-
-        throw_json_response_error(invalid_oauth_response_status, "invalid_request")
-      end
-    end
-
-    # /oauth-introspect
-    route(:oauth_introspect) do |r|
-      before_introspect
-
-      r.post do
-        catch_error do
-          validate_oauth_introspect_params
-
-          oauth_token = case param("token_type_hint")
-                        when "access_token"
-                          oauth_token_by_token(param("token"))
-                        when "refresh_token"
-                          oauth_token_by_refresh_token(param("token"))
-                        else
-                          oauth_token_by_token(param("token")) || oauth_token_by_refresh_token(param("token"))
-                        end
-
-          if oauth_application
-            redirect_response_error("invalid_request") if oauth_token && !token_from_application?(oauth_token, oauth_application)
-          elsif oauth_token
-            @oauth_application = db[oauth_applications_table].where(oauth_applications_id_column =>
-              oauth_token[oauth_tokens_oauth_application_id_column]).first
-          end
-
-          json_response_success(json_token_introspect_payload(oauth_token))
-        end
-
-        throw_json_response_error(invalid_oauth_response_status, "invalid_request")
-      end
-    end
-
-    # /oauth-revoke
-    route(:oauth_revoke) do |r|
-      before_revoke
-
-      # access-token
-      r.post do
-        catch_error do
-          validate_oauth_revoke_params
-
-          oauth_token = nil
-          transaction do
-            oauth_token = revoke_oauth_token
-            after_revoke
-          end
-
-          if accepts_json?
-            json_response_success \
-              "token" => oauth_token[oauth_tokens_token_column],
-              "refresh_token" => oauth_token[oauth_tokens_refresh_token_column],
-              "revoked_at" => oauth_token[oauth_tokens_revoked_at_column]
-          else
-            set_notice_flash revoke_oauth_token_notice_flash
-            redirect request.referer || "/"
-          end
-        end
-
-        throw_json_response_error(invalid_oauth_response_status, "invalid_request")
-      end
-    end
-
-    # /oauth-authorize
-    route(:oauth_authorize) do |r|
-      require_account
-      validate_oauth_grant_params
-      try_approval_prompt if use_oauth_access_type? && request.get?
-
-      before_authorize
-
-      r.get do
-        authorize_view
-      end
-
-      r.post do
-        code = nil
-        query_params = []
-        fragment_params = []
-
-        transaction do
-          case param("response_type")
-          when "token"
-            redirect_response_error("invalid_request") unless use_oauth_implicit_grant_type?
-
-            create_params = {
-              oauth_tokens_account_id_column => account_id,
-              oauth_tokens_oauth_application_id_column => oauth_application[oauth_applications_id_column],
-              oauth_tokens_scopes_column => scopes
-            }
-            oauth_token = generate_oauth_token(create_params, false)
-
-            token_payload = json_access_token_payload(oauth_token)
-            fragment_params.replace(token_payload.map { |k, v| "#{k}=#{v}" })
-          when "code", "", nil
-            code = create_oauth_grant
-            query_params << "code=#{code}"
-          else
-            redirect_response_error("invalid_request")
-          end
-          after_authorize
-        end
-
-        redirect_url = URI.parse(redirect_uri)
-        query_params << "state=#{state}" if state
-        query_params << redirect_url.query if redirect_url.query
-        redirect_url.query = query_params.join("&") unless query_params.empty?
-        redirect_url.fragment = fragment_params.join("&") unless fragment_params.empty?
-
-        redirect(redirect_url.to_s)
-      end
-    end
   end
 end