rodauth-oauth 0.10.4 → 1.0.0.pre.beta1

data/lib/rodauth/features/oidc_dynamic_client_registration.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "rodauth/oauth"
+
 module Rodauth
   Feature.define(:oidc_dynamic_client_registration, :OidcDynamicClientRegistration) do
     depends :oauth_dynamic_client_registration, :oidc
@@ -8,10 +10,6 @@ module Rodauth
 
     private
 
-    def registration_metadata
-      openid_configuration_body
-    end
-
     def validate_client_registration_params
       super
 
@@ -43,11 +41,41 @@ module Rodauth
         else
           register_throw_json_response_error("invalid_client_metadata", register_invalid_application_type_message(type))
         end
-      elsif (value = @oauth_application_params[oauth_applications_subject_type_column])
+      end
+
+      if (value = @oauth_application_params[oauth_applications_sector_identifier_uri_column])
+        uri = URI(value)
+
+        unless uri.scheme == "https" || uri.host == "localhost"
+          register_throw_json_response_error("invalid_redirect_uri", register_invalid_uri_message(uri))
+        end
+      end
+
+      if (value = @oauth_application_params[oauth_applications_subject_type_column])
         unless %w[pairwise public].include?(value)
           register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("subject_type"))
         end
-      elsif (value = @oauth_application_params[oauth_applications_id_token_signed_response_alg_column])
+
+        if value == "pairwise"
+          sector_identifier_uri = @oauth_application_params[oauth_applications_sector_identifier_uri_column]
+
+          if sector_identifier_uri
+            response = http_request(sector_identifier_uri)
+            unless response.code.to_i == 200
+              register_throw_json_response_error("invalid_client_metadata",
+                                                 register_invalid_param_message("sector_identifier_uri"))
+            end
+            uris = JSON.parse(response.body)
+
+            if uris != @oauth_application_params[oauth_applications_redirect_uri_column].split(" ")
+              register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("sector_identifier_uri"))
+            end
+
+          end
+        end
+      end
+
+      if (value = @oauth_application_params[oauth_applications_id_token_signed_response_alg_column])
         if value == "none"
           # The value none MUST NOT be used as the ID Token alg value unless the Client uses only Response Types
           # that return no ID Token from the Authorization Endpoint
@@ -55,41 +83,52 @@ module Rodauth
           if response_types && response_types.include?("id_token")
             register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("id_token_signed_response_alg"))
           end
-        elsif !oauth_jwt_algorithms_supported.include?(value)
+        elsif !oauth_jwt_jws_algorithms_supported.include?(value)
           register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("id_token_signed_response_alg"))
         end
-      elsif (value = @oauth_application_params[oauth_applications_id_token_encrypted_response_alg_column])
-        unless oauth_jwt_jwe_algorithms_supported.include?(value)
-          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("id_token_encrypted_response_alg"))
-        end
-      elsif (value = @oauth_application_params[oauth_applications_id_token_encrypted_response_enc_column])
-        unless oauth_jwt_jwe_encryption_methods_supported.include?(value)
-          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("id_token_encrypted_response_enc"))
-        end
-      elsif (value = @oauth_application_params[oauth_applications_userinfo_signed_response_alg_column])
-        unless oauth_jwt_algorithms_supported.include?(value)
-          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("userinfo_signed_response_alg"))
-        end
-      elsif (value = @oauth_application_params[oauth_applications_userinfo_encrypted_response_alg_column])
-        unless oauth_jwt_jwe_algorithms_supported.include?(value)
-          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("userinfo_encrypted_response_alg"))
-        end
-      elsif (value = @oauth_application_params[oauth_applications_userinfo_encrypted_response_enc_column])
-        unless oauth_jwt_jwe_encryption_methods_supported.include?(value)
-          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("userinfo_encrypted_response_enc"))
-        end
-      elsif (value = @oauth_application_params[oauth_applications_request_object_signing_alg_column])
-        unless oauth_jwt_algorithms_supported.include?(value)
-          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("request_object_signing_alg"))
-        end
-      elsif (value = @oauth_application_params[oauth_applications_request_object_encryption_alg_column])
-        unless oauth_jwt_jwe_algorithms_supported.include?(value)
-          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("request_object_encryption_alg"))
-        end
-      elsif (value = @oauth_application_params[oauth_applications_request_object_encryption_enc_column])
-        unless oauth_jwt_jwe_encryption_methods_supported.include?(value)
-          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("request_object_encryption_enc"))
-        end
+      end
+
+      if (value = @oauth_application_params[oauth_applications_id_token_encrypted_response_alg_column]) &&
+         !oauth_jwt_jwe_algorithms_supported.include?(value)
+        register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("id_token_encrypted_response_alg"))
+      end
+
+      if (value = @oauth_application_params[oauth_applications_id_token_encrypted_response_enc_column]) &&
+         !oauth_jwt_jwe_encryption_methods_supported.include?(value)
+        register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("id_token_encrypted_response_enc"))
+      end
+
+      if (value = @oauth_application_params[oauth_applications_userinfo_signed_response_alg_column]) &&
+         !oauth_jwt_jws_algorithms_supported.include?(value)
+        register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("userinfo_signed_response_alg"))
+      end
+
+      if (value = @oauth_application_params[oauth_applications_userinfo_encrypted_response_alg_column]) &&
+         !oauth_jwt_jwe_algorithms_supported.include?(value)
+        register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("userinfo_encrypted_response_alg"))
+      end
+
+      if (value = @oauth_application_params[oauth_applications_userinfo_encrypted_response_enc_column]) &&
+         !oauth_jwt_jwe_encryption_methods_supported.include?(value)
+        register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("userinfo_encrypted_response_enc"))
+      end
+
+      if defined?(oauth_applications_request_object_signing_alg_column) &&
+         (value = @oauth_application_params[oauth_applications_request_object_signing_alg_column]) &&
+         !oauth_jwt_jws_algorithms_supported.include?(value)
+        register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("request_object_signing_alg"))
+      end
+
+      if defined?(oauth_applications_request_object_encryption_alg_column) &&
+         (value = @oauth_application_params[oauth_applications_request_object_encryption_alg_column]) &&
+         !oauth_jwt_jwe_algorithms_supported.include?(value)
+        register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("request_object_encryption_alg"))
+      end
+
+      if defined?(oauth_applications_request_object_encryption_enc_column) &&
+         (value = @oauth_application_params[oauth_applications_request_object_encryption_enc_column]) &&
+         !oauth_jwt_jwe_encryption_methods_supported.include?(value)
+        register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message("request_object_encryption_enc"))
       end
     end
 
@@ -114,27 +153,24 @@ module Rodauth
         return_params["application_type"] = "web"
         "web"
       end
-      create_params[oauth_applications_id_token_signed_response_alg_column] ||= begin
-        return_params["id_token_signed_response_alg"] = oauth_jwt_algorithm
-        oauth_jwt_algorithm
-      end
+      create_params[oauth_applications_id_token_signed_response_alg_column] ||= return_params["id_token_signed_response_alg"] =
+        oauth_jwt_keys.keys.first
+
       if create_params.key?(oauth_applications_id_token_encrypted_response_alg_column)
-        create_params[oauth_applications_id_token_encrypted_response_enc_column] ||= begin
-          return_params["id_token_encrypted_response_enc"] = "A128CBC-HS256"
+        create_params[oauth_applications_id_token_encrypted_response_enc_column] ||= return_params["id_token_encrypted_response_enc"] =
           "A128CBC-HS256"
-        end
+
       end
       if create_params.key?(oauth_applications_userinfo_encrypted_response_alg_column)
-        create_params[oauth_applications_userinfo_encrypted_response_enc_column] ||= begin
-          return_params["userinfo_encrypted_response_enc"] = "A128CBC-HS256"
+        create_params[oauth_applications_userinfo_encrypted_response_enc_column] ||= return_params["userinfo_encrypted_response_enc"] =
           "A128CBC-HS256"
-        end
+
       end
-      if create_params.key?(oauth_applications_request_object_encryption_alg_column)
-        create_params[oauth_applications_request_object_encryption_enc_column] ||= begin
-          return_params["request_object_encryption_enc"] = "A128CBC-HS256"
+      if defined?(oauth_applications_request_object_encryption_alg_column) &&
+         create_params.key?(oauth_applications_request_object_encryption_alg_column)
+        create_params[oauth_applications_request_object_encryption_enc_column] ||= return_params["request_object_encryption_enc"] =
           "A128CBC-HS256"
-        end
+
       end
 
       super(return_params)

data/lib/rodauth/oauth/database_extensions.rb

@@ -30,13 +30,14 @@ module Rodauth
         end
 
         if dataset.respond_to?(:supports_insert_conflict?) && dataset.supports_insert_conflict?
-          def __insert_or_update_and_return__(dataset, pkey, unique_columns, params, conds = nil, exclude_on_update = nil)
-            to_update = params.keys - unique_columns
-            to_update -= exclude_on_update if exclude_on_update
+          def __insert_or_update_and_return__(dataset, pkey, unique_columns, params, conds = nil, to_update_extra = nil)
+            to_update = Hash[(params.keys - unique_columns).map { |attribute| [attribute, Sequel[:excluded][attribute]] }]
+
+            to_update.merge!(to_update_extra) if to_update_extra
 
             dataset = dataset.insert_conflict(
               target: unique_columns,
-              update: Hash[ to_update.map { |attribute| [attribute, Sequel[:excluded][attribute]] } ],
+              update: to_update,
               update_where: conds
             )
 
@@ -51,7 +52,7 @@ module Rodauth
             ) || dataset.where(params).first
           end
         else
-          def __insert_or_update_and_return__(dataset, pkey, unique_columns, params, conds = nil, exclude_on_update = nil)
+          def __insert_or_update_and_return__(dataset, pkey, unique_columns, params, conds = nil, to_update_extra = nil)
             find_params, update_params = params.partition { |key, _| unique_columns.include?(key) }.map { |h| Hash[h] }
 
             dataset_where = dataset.where(find_params)
@@ -67,7 +68,8 @@ module Rodauth
                      end
 
             if record
-              update_params.reject! { |k, _v| exclude_on_update.include?(k) } if exclude_on_update
+              update_params.merge!(to_update_extra) if to_update_extra
+
               __update_and_return__(dataset_where, update_params)
             else
               __insert_and_return__(dataset, pkey, params)

data/lib/rodauth/oauth/http_extensions.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require "uri"
+require "net/http"
+require "rodauth/oauth/ttl_store"
+
+module Rodauth
+  module OAuth
+    module HTTPExtensions
+      REQUEST_CACHE = OAuth::TtlStore.new
+
+      private
+
+      def http_request(uri, form_data = nil)
+        uri = URI(uri)
+
+        http = Net::HTTP.new(uri.host, uri.port)
+        http.use_ssl = uri.scheme == "https"
+
+        if form_data
+          request = Net::HTTP::Post.new(uri.request_uri)
+          request["content-type"] = "application/x-www-form-urlencoded"
+          request.set_form_data(form_data)
+        else
+          request = Net::HTTP::Get.new(uri.request_uri)
+        end
+        request["accept"] = json_response_content_type
+
+        yield request if block_given?
+
+        response = http.request(request)
+        authorization_required unless response.code.to_i == 200
+        response
+      end
+
+      def http_request_with_cache(uri, *args)
+        uri = URI(uri)
+
+        response = http_request_cache[uri]
+
+        return response if response
+
+        http_request_cache.set(uri) do
+          response = http_request(uri, *args)
+          ttl = if response.key?("cache-control")
+                  cache_control = response["cache-control"]
+                  cache_control[/max-age=(\d+)/, 1].to_i
+                elsif response.key?("expires")
+                  Time.parse(response["expires"]).to_i - Time.now.to_i
+                end
+
+          [JSON.parse(response.body, symbolize_names: true), ttl]
+        end
+      end
+
+      def http_request_cache
+        REQUEST_CACHE
+      end
+    end
+  end
+end

data/lib/rodauth/oauth/railtie.rb

@@ -2,7 +2,27 @@
 
 module Rodauth
   module OAuth
+    module ControllerMethods
+      def self.included(controller)
+        # ActionController::API doesn't have helper methods
+        controller.helper_method :current_oauth_account, :current_oauth_application if controller.respond_to?(:helper_method)
+      end
+
+      def current_oauth_account(name = nil)
+        rodauth(name).current_oauth_account
+      end
+
+      def current_oauth_application(name = nil)
+        rodauth(name).current_oauth_application
+      end
+    end
+
     class Railtie < ::Rails::Railtie
+      initializer "rodauth.controller" do
+        ActiveSupport.on_load(:action_controller) do
+          include ControllerMethods
+        end
+      end
     end
   end
 end

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "0.10.4"
+    VERSION = "1.0.0-beta1"
   end
 end

data/lib/rodauth/oauth.rb

@@ -1,7 +1,35 @@
 # frozen_string_literal: true
 
 require "rodauth"
-
 require "rodauth/oauth/version"
 
+module Rodauth
+  module OAuth
+    module FeatureExtensions
+      def auth_server_route(*args, &blk)
+        routes = route(*args, &blk)
+
+        handle_meth = routes.last
+
+        define_method(:"#{handle_meth}_for_auth_server") do
+          next unless is_authorization_server?
+
+          send(:"#{handle_meth}_not_for_auth_server")
+        end
+
+        alias_method :"#{handle_meth}_not_for_auth_server", handle_meth
+        alias_method handle_meth, :"#{handle_meth}_for_auth_server"
+      end
+
+      # override
+      def translatable_method(meth, value)
+        define_method(meth) { |*args| translate(meth, value, *args) }
+        auth_value_methods(meth)
+      end
+    end
+  end
+
+  Feature.prepend OAuth::FeatureExtensions
+end
+
 require "rodauth/oauth/railtie" if defined?(Rails)

data/locales/en.yml

@@ -3,21 +3,29 @@ en:
     require_authorization_error_flash: "Please authorize to continue"
     create_oauth_application_error_flash: "There was an error registering your oauth application"
     create_oauth_application_notice_flash: "Your oauth application has been registered"
-    revoke_unauthorized_account_error_flash: "You are not authorized to revoke this token"
-    revoke_oauth_token_notice_flash: "The oauth token has been revoked"
+    revoke_unauthorized_account_error_flash: "You are not authorized to revoke this grant"
+    revoke_oauth_grant_notice_flash: "The oauth grant has been revoked"
     device_verification_notice_flash: "The device is verified"
     user_code_not_found_error_flash: "No device to authorize with the given user code"
     authorize_page_title: "Authorize"
+    authorize_page_lead: "The application %{name} would like to access your data."
+    oauth_cancel_button: "Cancel"
     oauth_applications_page_title: "Oauth Applications"
     oauth_application_page_title: "Oauth Application"
     new_oauth_application_page_title: "New Oauth Application"
-    oauth_application_oauth_tokens_page_title: "Application Oauth Tokens"
-    oauth_tokens_page_title: "My Oauth Tokens"
+    oauth_application_oauth_grants_page_title: "Application Oauth Grants"
+    oauth_grants_page_title: "My Oauth Grants"
     device_verification_page_title: "Device Verification"
     device_search_page_title: "Device Search"
     oauth_management_pagination_previous_button: "Previous"
     oauth_management_pagination_next_button: "Next"
-    oauth_tokens_scopes_label: "Scopes"
+    oauth_grants_type_label: "Grant Type"
+    oauth_grants_scopes_label: "Scopes"
+    oauth_grants_token_label: "Token"
+    oauth_grants_refresh_token_label: "Refresh Token"
+    oauth_grants_expires_in_label: "Expires In"
+    oauth_grants_revoked_at_label: "Revoked at"
+    oauth_no_grants_text: "No oauth grants yet!"
     oauth_applications_name_label: "Name"
     oauth_applications_description_label: "Description"
     oauth_applications_scopes_label: "Default scopes"
@@ -28,30 +36,32 @@ en:
     oauth_applications_redirect_uri_label: "Redirect URL"
     oauth_applications_client_secret_label: "Client Secret"
     oauth_applications_client_id_label: "Client ID"
+    oauth_no_applications_text: "No oauth applications yet!"
     oauth_grant_user_code_label: "User code"
     oauth_grant_user_jws_jwk_label: "JSON Web Keys"
     oauth_grant_user_jwt_public_key_label: "Public key"
     oauth_application_button: "Register"
     oauth_authorize_button: "Authorize"
-    oauth_token_revoke_button: "Revoke"
+    oauth_grant_revoke_button: "Revoke"
     oauth_authorize_post_button: "Back to Client Application"
+    oauth_device_verification_page_lead: "The device with user code %{user_code} would like to access your data."
     oauth_device_verification_button: "Verify"
+    oauth_device_search_page_lead: "Insert the user code from the device you'd like to authorize."
     oauth_device_search_button: "Search"
-    invalid_client_message: "Client authentication failed"
-    invalid_grant_type_message: "Invalid grant type"
-    invalid_grant_message: "Invalid grant"
-    invalid_scope_message: "Invalid scope"
+    oauth_invalid_client_message: "Client authentication failed"
+    oauth_invalid_grant_type_message: "Invalid grant type"
+    oauth_invalid_grant_message: "Invalid grant"
+    oauth_invalid_scope_message: "Invalid scope"
     invalid_url_message: "Invalid URL"
-    unsupported_token_type_message: "Invalid token type hint"
-    unique_error_message: "is already in use"
+    oauth_unsupported_token_type_message: "Invalid token type hint"
     null_error_message: "is not filled"
-    already_in_use_message: "error generating unique token"
-    expired_token_message: "the device code has expired"
-    access_denied_message: "the authorization request has been denied"
-    authorization_pending_message: "the authorization request is still pending"
-    slow_down_message: "authorization request is still pending but poll interval should be increased"
-    code_challenge_required_message: "code challenge required"
-    unsupported_transform_algorithm_message: "transform algorithm not supported"
-    request_uri_not_supported_message: "request uri is unsupported"
-    invalid_request_object_message: "request object is invalid"
-    invalid_scope_message: "The Access Token expired"
+    oauth_already_in_use_message: "error generating unique token"
+    oauth_expired_token_message: "the device code has expired"
+    oauth_access_denied_message: "the authorization request has been denied"
+    oauth_authorization_pending_message: "the authorization request is still pending"
+    oauth_slow_down_message: "authorization request is still pending but poll interval should be increased"
+    oauth_code_challenge_required_message: "code challenge required"
+    oauth_unsupported_transform_algorithm_message: "transform algorithm not supported"
+    oauth_request_uri_not_supported_message: "request uri is unsupported"
+    oauth_invalid_request_object_message: "request object is invalid"
+    oauth_invalid_scope_message: "The Access Token expired"

data/locales/pt.yml

@@ -3,21 +3,29 @@ pt:
     require_authorization_error_flash: "Autorize para continuar"
     create_oauth_application_error_flash: "Aconteceu um erro ao registar o aplicativo oauth"
     create_oauth_application_notice_flash: "O seu aplicativo oauth foi registado com sucesso"
-    revoke_unauthorized_account_error_flash: "Não está autorizado a revogar este token"
-    revoke_oauth_token_notice_flash: "O token oauth foi revogado com sucesso"
+    revoke_unauthorized_account_error_flash: "Não está autorizado a revogar esta concessão"
+    revoke_oauth_grant_notice_flash: "O token oauth foi revogado com sucesso"
     device_verification_notice_flash: "O dispositivo foi verificado com sucesso"
     user_code_not_found_error_flash: "Não existe nenhum dispositivo a ser autorizado com o código de usuário inserido"
     authorize_page_title: "Autorizar"
+    authorize_page_lead: "O aplicativo %{name} gostaria de aceder aos seus dados."
+    oauth_cancel_button: "Cancelar"
     oauth_applications_page_title: "Aplicativos OAuth"
     oauth_application_page_title: "Aplicativo Oauth"
     new_oauth_application_page_title: "Novo Aplicativo Oauth"
-    oauth_application_oauth_tokens_page_title: "Tokens Oauth do Aplicativo"
-    oauth_tokens_page_title: "Os meus Tokens Oauth"
+    oauth_application_oauth_grants_page_title: "Concessões Oauth do Aplicativo"
+    oauth_grants_page_title: "As minhas concessões Oauth"
     device_verification_page_title: "Verificação de dispositivo"
     device_search_page_title: "Pesquisa de dispositivo"
     oauth_management_pagination_previous_button: "Anterior"
     oauth_management_pagination_next_button: "Próxima"
-    oauth_tokens_scopes_label: "Escopos"
+    oauth_grants_type_label: "Tipo de concessão"
+    oauth_grants_scopes_label: "Escopos"
+    oauth_grants_token_label: "Token"
+    oauth_grants_refresh_token_label: "Refresh Token"
+    oauth_grants_expires_in_label: "Expira em"
+    oauth_grants_revoked_at_label: "Revogado a"
+    oauth_no_grants_text: "Nenhuma concessão OAuth ainda!"
     oauth_applications_name_label: "Nome"
     oauth_applications_description_label: "Descrição"
     oauth_applications_scopes_label: "Escopos prédefinidos"
@@ -28,30 +36,32 @@ pt:
     oauth_applications_redirect_uri_label: "URL para redireccionamento"
     oauth_applications_client_secret_label: "Segredo de cliente"
     oauth_applications_client_id_label: "ID do cliente"
+    oauth_no_applications_text: "Nenhum aplicativo OAuth ainda!"
     oauth_grant_user_code_label: "Código do usuário"
     oauth_grant_user_jws_jwk_label: "Chaves JSON Web"
     oauth_grant_user_jwt_public_key_label: "Chave pública"
     oauth_application_button: "Registar"
     oauth_authorize_button: "Autorizar"
-    oauth_token_revoke_button: "Revogar"
+    oauth_grant_revoke_button: "Revogar"
     oauth_authorize_post_button: "Voltar para o aplicativo cliente"
+    oauth_device_verification_page_lead: "O dispositivo com o código de usuário %{user_code} gostaria de aceder aos seus dados."
     oauth_device_verification_button: "Verificar"
+    oauth_device_search_page_lead: "Introduza o código de usuário do dispositivo que gostaria de autorizar."
     oauth_device_search_button: "Pesquisar"
-    invalid_client_message: "A autenticação do cliente falhou"
-    invalid_grant_type_message: "Tipo de atribuição inválida"
-    invalid_grant_message: "Atribuição inválida"
-    invalid_scope_message: "Escopo inválido"
+    oauth_invalid_client_message: "A autenticação do cliente falhou"
+    oauth_invalid_grant_type_message: "Tipo de atribuição inválida"
+    oauth_invalid_grant_message: "Atribuição inválida"
+    oauth_invalid_scope_message: "Escopo inválido"
     invalid_url_message: "URL inválido"
-    unsupported_token_type_message: "Sugestão de tipo de token inválida"
-    unique_error_message: "já está sendo utilizado"
+    oauth_unsupported_token_type_message: "Sugestão de tipo de token inválida"
     null_error_message: "não está preenchido"
-    already_in_use_message: "erro ao gerar token único"
-    expired_token_message: "o código de dispositivo expirou"
-    access_denied_message: "o pedido de autorização foi negado"
-    authorization_pending_message: "o pedido de autorização ainda está pendente"
-    slow_down_message: "o pedido de autorização ainda está pendente mas o intervalo de actualização deve ser aumentado"
-    code_challenge_required_message: "código de negociação necessário"
-    unsupported_transform_algorithm_message: "algoritmo de transformação não suportado"
-    request_uri_not_supported_message: "request_uri não é suportado"
-    invalid_request_object_message: "request_object é inválido"
-    invalid_scope_message: "O Token de acesso expirou"
+    oauth_already_in_use_message: "erro ao gerar token único"
+    oauth_expired_token_message: "o código de dispositivo expirou"
+    oauth_access_denied_message: "o pedido de autorização foi negado"
+    oauth_authorization_pending_message: "o pedido de autorização ainda está pendente"
+    oauth_slow_down_message: "o pedido de autorização ainda está pendente mas o intervalo de actualização deve ser aumentado"
+    oauth_code_challenge_required_message: "código de negociação necessário"
+    oauth_unsupported_transform_algorithm_message: "algoritmo de transformação não suportado"
+    oauth_request_uri_not_supported_message: "request_uri não é suportado"
+    oauth_invalid_request_object_message: "request_object é inválido"
+    oauth_invalid_scope_message: "O Token de acesso expirou"

data/templates/authorize.str

@@ -8,10 +8,14 @@
     end
   }
   <p class="lead">
-    The application
-    <a target="_blank" href="#{h(rodauth.oauth_application[rodauth.oauth_applications_homepage_url_column])}">
-      #{h(rodauth.oauth_application[rodauth.oauth_applications_name_column])}
-    </a> would like to access your data.
+  #{
+    rodauth.authorize_page_lead(name: <<-LINK
+      <a target="_blank" href="#{h(rodauth.oauth_application[rodauth.oauth_applications_homepage_url_column])}">
+        #{h(rodauth.oauth_application[rodauth.oauth_applications_name_column])}
+      </a>
+    LINK
+    )
+  }
   </p>
   <div class="list-group">
   #{
@@ -52,31 +56,20 @@
   }
 
   <div class="form-group">
-    <h1 class="display-6">#{rodauth.oauth_tokens_scopes_label}</h1>
+    <h1 class="display-6">#{rodauth.oauth_grants_scopes_label}</h1>
 
     #{
-      rodauth.scopes.map do |scope|
-        if scope == rodauth.oauth_application_default_scope
-          <<-HTML
-            <div class="form-check">
-              <input id="#{scope}" class="form-check-input" type="checkbox" name="scope[]" value="#{h(scope)}" checked disabled>
-              <label class="form-check-label" for="#{scope}">#{h(scope)}</label>
-              <input type="hidden" name="scope[]" value="#{h(scope)}">
-            </div>
-          HTML
-        else
-          <<-HTML
-            <div class="form-check">
-              <input id="#{scope}" class="form-check-input" type="checkbox" name="scope[]" value="#{h(scope)}">
-              <label class="form-check-label" for="#{scope}">#{h(scope)}</label>
-            </div>
-          HTML
-        end
+      rodauth.authorize_scopes.map do |scope|
+        <<-HTML
+          <div class="form-check">
+            <input id="#{scope}" class="form-check-input" type="checkbox" name="scope[]" value="#{h(scope)}">
+            <label class="form-check-label" for="#{scope}">#{h(scope)}</label>
+          </div>
+        HTML
       end.join
     }
 
     <input type="hidden" name="client_id" value="#{rodauth.param("client_id")}"/>
-
     #{"<input type=\"hidden\" name=\"access_type\" value=\"#{rodauth.param("access_type")}\"/>" if rodauth.param_or_nil("access_type")}
     #{"<input type=\"hidden\" name=\"response_type\" value=\"#{rodauth.param("response_type")}\"/>" if rodauth.param_or_nil("response_type")}
     #{"<input type=\"hidden\" name=\"response_mode\" value=\"#{rodauth.param("response_mode")}\"/>" if rodauth.param_or_nil("response_mode")}
@@ -98,6 +91,8 @@
   </div>
   <p class="text-center">
     <input type="submit" class="btn btn-outline-primary" value="#{h(rodauth.oauth_authorize_button)}"/>
-    <a href="#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{ "&state=#{rodauth.param("state")}" if rodauth.param_or_nil("state")}" class="btn btn-outline-danger">#{rodauth.oauth_cancel_button}</a>
+    <a href="#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{ "&state=#{rodauth.param("state")}" if rodauth.param_or_nil("state")}" class="btn btn-outline-danger">
+      #{rodauth.oauth_cancel_button}
+    </a>
   </p>
 </form>

data/templates/device_search.str

@@ -1,5 +1,5 @@
 <form method="get" action="#{rodauth.device_path}" class="form-horizontal" role="form" id="device-search-form">
-  <p class="lead">Insert the user code from the device you'd like to authorize.</p>
+  <p class="lead">#{rodauth.oauth_device_search_page_lead}</p>
 
   <div class="form-group">
     <label for="user_code">#{rodauth.oauth_grant_user_code_label}</label>

data/templates/device_verification.str

@@ -1,9 +1,9 @@
 <form method="post" action="#{rodauth.device_path}" class="form-horizontal" role="form" id="device-verification-form">
   #{csrf_tag(rodauth.device_path) if respond_to?(:csrf_tag)}
-  <p class="lead">The device with user code #{@oauth_grant[rodauth.oauth_grants_user_code_column]} would like to access your data.</p>
+  <p class="lead">#{rodauth.oauth_device_verification_page_lead(user_code: @oauth_grant[rodauth.oauth_grants_user_code_column])}</p>
 
   <div class="form-group">
-    <h1 class="display-6">#{rodauth.oauth_tokens_scopes_label}</h1>
+    <h1 class="display-6">#{rodauth.oauth_grants_scopes_label}</h1>
 
     <ul class="list-group">
     #{

data/templates/jwks_field.str

@@ -2,3 +2,4 @@
   <label for="name">#{rodauth.oauth_applications_jwks_label}#{rodauth.input_field_label_suffix}</label>
    <textarea id="jwks" class="form-control" name="#{rodauth.oauth_application_jwks_param}" rows="3"></textarea>
 </div>
+#{rodauth.input_field_string(rodauth.oauth_application_jwks_uri_param, "jwks-uri", :type=>"text")}