rodauth-oauth 0.9.2 → 0.9.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2514b45f82f9e8dda98f15dc2c1ccc0eeba306c9d1ee40e6fa47e4999d766c1c
-  data.tar.gz: d68579829772121a157b7bd654fb40999921af46673910caa21892462655ed0e
+  metadata.gz: 79fa7abfcf7ea1c0a2594f92bfd7a59e53769dec5a7221a22f740b37471e6e07
+  data.tar.gz: 9f7e8ce4370d44d985940d46d569e3192c35e53cb6e3841094517e64258b2b1a
 SHA512:
-  metadata.gz: 8121458a789119610c920c835fc99cde76d4eca41fb7bb48acbe9c1e2f4be89f68c9370235335d7dc8c6b3b715b6825a4d77bafbda37551464ebf35a516f55de
-  data.tar.gz: bdd2c1d2bee336459186606b2bfb293cd690333a58c421798155e6bc53e418b71bbd142ac19e48ddcff701f28eaaa6c65c8d045c715a7f84690fb5dd6865ddbe
+  metadata.gz: 520a85416c418f93615a471133201c7ec6dd5c16ff9d697a6ca87b609084b58c7b9799c5d3c7a8d02a4fc68ca9750c9ef41dd07dde17c1e1153f0cec8e58f3c1
+  data.tar.gz: 8e7ebc28ba158f43b5226a2de98fc76de8c81e8a8c87dbaa95a69050eed96793e487666389b60be6694437c298fdf23f183a1df098983eeec5f5549df0321c7c

data/README.md

@@ -1,6 +1,7 @@
 # Rodauth::Oauth
 
-[![pipeline status](https://gitlab.com/honeyryderchuck/rodauth-oauth/badges/master/pipeline.svg)](https://gitlab.com/honeyryderchuck/rodauth-oauth/-/pipelines?page=1&ref=master)
+[![Gem Version](https://badge.fury.io/rb/rodauth-oauth.svg)](http://rubygems.org/gems/rodauth-oauth)
+[![pipeline status](https://gitlab.com/honeyryderchuck/rodauth-oauth/badges/master/pipeline.svg)](https://gitlab.com/honeyryderchuck/rodauth-oauth/pipelines?page=1&scope=all&ref=master)
 [![coverage report](https://gitlab.com/honeyryderchuck/rodauth-oauth/badges/master/coverage.svg?job=coverage)](https://honeyryderchuck.gitlab.io/rodauth-oauth/coverage/#_AllFiles)
 
 This is an extension to the `rodauth` gem which implements the [OAuth 2.0 framework](https://tools.ietf.org/html/rfc6749) for an authorization server.

data/doc/release_notes/0_9_3.md

@@ -0,0 +1,9 @@
+### 0.9.2 (30/05/2022)
+
+#### Bugfixes
+
+* `oauth_jwt`: new access tokens generated via the `"refresh_token"` grant type are now JWT (it was falling back to non JWT behaviour);
+*  `oidc`: a new `id_token` is now generated via the `"refresh_token"` grant type with "rotation" policy (it was being omitted from the response);
+* `oidc`: fixing calculation of `"auth_time"` claim, which (as per RFC) needs to stay the same across first authentication and subsequent `"refresh_token"` requests;
+    * it requires a new db column (default: `"auth_time"`, datetime) in the `"oauth_tokens"` database;
+* hash-column `"refresh_token"` will now expose the refresh token (instead of the hash column version) in the `"refresh_token"` grant type response payload (only happened in "non-rotation" refresh token mode).

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -77,6 +77,7 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.datetime :created_at, null: false, default: -> { "CURRENT_TIMESTAMP" }
       # uncomment to use OIDC nonce
       # t.string :nonce
+      # t.datetime :auth_time
     end
   end
 end

data/lib/rodauth/features/oauth_base.rb

@@ -426,32 +426,40 @@ module Rodauth
       }.merge(params)
 
       rescue_from_uniqueness_error do
-        token = oauth_unique_id_generator
+        access_token = _generate_access_token(create_params)
+        refresh_token = _generate_refresh_token(create_params) if should_generate_refresh_token
+        oauth_token = _store_oauth_token(create_params)
+        oauth_token[oauth_tokens_token_column] = access_token
+        oauth_token[oauth_tokens_refresh_token_column] = refresh_token if refresh_token
+        oauth_token
+      end
+    end
 
-        if oauth_tokens_token_hash_column
-          create_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
-        else
-          create_params[oauth_tokens_token_column] = token
-        end
+    def _generate_access_token(params = {})
+      token = oauth_unique_id_generator
 
-        refresh_token = nil
-        if should_generate_refresh_token
-          refresh_token = oauth_unique_id_generator
+      if oauth_tokens_token_hash_column
+        params[oauth_tokens_token_hash_column] = generate_token_hash(token)
+      else
+        params[oauth_tokens_token_column] = token
+      end
 
-          if oauth_tokens_refresh_token_hash_column
-            create_params[oauth_tokens_refresh_token_hash_column] = generate_token_hash(refresh_token)
-          else
-            create_params[oauth_tokens_refresh_token_column] = refresh_token
-          end
-        end
-        oauth_token = _generate_oauth_token(create_params)
-        oauth_token[oauth_tokens_token_column] = token
-        oauth_token[oauth_tokens_refresh_token_column] = refresh_token if refresh_token
-        oauth_token
+      token
+    end
+
+    def _generate_refresh_token(params)
+      token = oauth_unique_id_generator
+
+      if oauth_tokens_refresh_token_hash_column
+        params[oauth_tokens_refresh_token_hash_column] = generate_token_hash(token)
+      else
+        params[oauth_tokens_refresh_token_column] = token
       end
+
+      token
     end
 
-    def _generate_oauth_token(params = {})
+    def _store_oauth_token(params = {})
       ds = db[oauth_tokens_table]
 
       if __one_oauth_token_per_account
@@ -577,43 +585,24 @@ module Rodauth
 
       rescue_from_uniqueness_error do
         oauth_tokens_ds = db[oauth_tokens_table]
-        token = oauth_unique_id_generator
+        access_token = _generate_access_token(update_params)
 
-        if oauth_tokens_token_hash_column
-          update_params[oauth_tokens_token_hash_column] = generate_token_hash(token)
+        if oauth_refresh_token_protection_policy == "rotation"
+          update_params = {
+            **update_params,
+            oauth_tokens_oauth_token_id_column => oauth_token[oauth_tokens_id_column],
+            oauth_tokens_account_id_column => oauth_token[oauth_tokens_account_id_column],
+            oauth_tokens_scopes_column => oauth_token[oauth_tokens_scopes_column]
+          }
+
+          refresh_token = _generate_refresh_token(update_params)
         else
-          update_params[oauth_tokens_token_column] = token
+          refresh_token = param("refresh_token")
         end
+        oauth_token = __update_and_return__(oauth_tokens_ds, update_params)
 
-        oauth_token = if oauth_refresh_token_protection_policy == "rotation"
-                        insert_params = {
-                          **update_params,
-                          oauth_tokens_oauth_token_id_column => oauth_token[oauth_tokens_id_column],
-                          oauth_tokens_scopes_column => oauth_token[oauth_tokens_scopes_column]
-                        }
-
-                        refresh_token = oauth_unique_id_generator
-
-                        if oauth_tokens_refresh_token_hash_column
-                          insert_params[oauth_tokens_refresh_token_hash_column] = generate_token_hash(refresh_token)
-                        else
-                          insert_params[oauth_tokens_refresh_token_column] = refresh_token
-                        end
-
-                        # revoke the refresh token
-                        oauth_tokens_ds.where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
-                                       .update(oauth_tokens_revoked_at_column => Sequel::CURRENT_TIMESTAMP)
-
-                        insert_params[oauth_tokens_oauth_token_id_column] = oauth_token[oauth_tokens_id_column]
-                        __insert_and_return__(oauth_tokens_ds, oauth_tokens_id_column, insert_params)
-                      else
-                        # includes none
-                        ds = oauth_tokens_ds.where(oauth_tokens_id_column => oauth_token[oauth_tokens_id_column])
-                        __update_and_return__(ds, update_params)
-                      end
-
-        oauth_token[oauth_tokens_token_column] = token
-        oauth_token[oauth_tokens_refresh_token_column] = refresh_token if refresh_token
+        oauth_token[oauth_tokens_token_column] = access_token
+        oauth_token[oauth_tokens_refresh_token_column] = refresh_token
         oauth_token
       end
     end

data/lib/rodauth/features/oauth_jwt.rb

@@ -66,7 +66,6 @@ module Rodauth
       :jwt_encode,
       :jwt_decode,
       :jwks_set,
-      :last_account_login_at,
       :generate_jti
     )
 
@@ -99,12 +98,6 @@ module Rodauth
 
     private
 
-    unless method_defined?(:last_account_login_at)
-      def last_account_login_at
-        nil
-      end
-    end
-
     def issuer
       @issuer ||= oauth_jwt_token_issuer || authorization_server_url
     end
@@ -175,41 +168,38 @@ module Rodauth
 
     # /token
 
-    def generate_oauth_token(params = {}, should_generate_refresh_token = true)
-      create_params = {
-        oauth_grants_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_token_expires_in)
-      }.merge(params)
-
-      oauth_token = rescue_from_uniqueness_error do
-        if should_generate_refresh_token
-          refresh_token = oauth_unique_id_generator
-
-          if oauth_tokens_refresh_token_hash_column
-            create_params[oauth_tokens_refresh_token_hash_column] = generate_token_hash(refresh_token)
-          else
-            create_params[oauth_tokens_refresh_token_column] = refresh_token
-          end
-        end
+    def create_oauth_token_from_token(oauth_token, update_params)
+      otoken = super
+      access_token = _generate_jwt_access_token(otoken)
+      otoken[oauth_tokens_token_column] = access_token
+      otoken
+    end
 
-        _generate_oauth_token(create_params)
-      end
+    def generate_oauth_token(params = {}, should_generate_refresh_token = true)
+      oauth_token = super
+      access_token = _generate_jwt_access_token(oauth_token)
+      oauth_token[oauth_tokens_token_column] = access_token
+      oauth_token
+    end
 
+    def _generate_jwt_access_token(oauth_token)
       claims = jwt_claims(oauth_token)
 
       # one of the points of using jwt is avoiding database lookups, so we put here all relevant
       # token data.
       claims[:scope] = oauth_token[oauth_tokens_scopes_column]
 
-      token = jwt_encode(claims)
+      jwt_encode(claims)
+    end
 
-      oauth_token[oauth_tokens_token_column] = token
-      oauth_token
+    def _generate_access_token(*)
+      # no op
     end
 
     def jwt_claims(oauth_token)
       issued_at = Time.now.to_i
 
-      claims = {
+      {
         iss: issuer, # issuer
         iat: issued_at, # issued at
         #
@@ -227,10 +217,6 @@ module Rodauth
         exp: issued_at + oauth_token_expires_in,
         aud: (oauth_jwt_audience || oauth_application[oauth_applications_client_id_column])
       }
-
-      claims[:auth_time] = last_account_login_at.to_i if last_account_login_at
-
-      claims
     end
 
     def jwt_subject(oauth_token)

data/lib/rodauth/features/oidc.rb

@@ -74,6 +74,7 @@ module Rodauth
 
     auth_value_method :oauth_grants_nonce_column, :nonce
     auth_value_method :oauth_tokens_nonce_column, :nonce
+    auth_value_method :oauth_tokens_auth_time_column, :auth_time
 
     translatable_method :invalid_scope_message, "The Access Token expired"
 
@@ -341,8 +342,7 @@ module Rodauth
 
       # Time when the End-User authentication occurred.
       #
-      # Sounds like the same as issued at claim.
-      id_token_claims[:auth_time] = id_token_claims[:iat]
+      id_token_claims[:auth_time] = oauth_token[oauth_tokens_auth_time_column].to_i
 
       account = db[accounts_table].where(account_id_column => oauth_token[oauth_tokens_account_id_column]).first
 
@@ -488,7 +488,7 @@ module Rodauth
         end
       end
 
-      scope_claims.unshift("auth_time") if last_account_login_at
+      scope_claims.unshift("auth_time")
 
       response_types_supported = metadata[:response_types_supported]
 

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "0.9.2"
+    VERSION = "0.9.3"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 0.9.2
+  version: 0.9.3
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2022-05-11 00:00:00.000000000 Z
+date: 2022-05-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rodauth
@@ -59,6 +59,7 @@ extra_rdoc_files:
 - doc/release_notes/0_9_0.md
 - doc/release_notes/0_9_1.md
 - doc/release_notes/0_9_2.md
+- doc/release_notes/0_9_3.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -89,6 +90,7 @@ files:
 - doc/release_notes/0_9_0.md
 - doc/release_notes/0_9_1.md
 - doc/release_notes/0_9_2.md
+- doc/release_notes/0_9_3.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb