rodauth-oauth 1.1.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12c86242a8a2001fba629cb6bd8e25886b8805fce5d0965ebc70377824e25e91
-  data.tar.gz: 2fdc78f81b737c9c0d0086f258a86807f8855d3f0bc9be89bffb6d6a90946ed3
+  metadata.gz: aa95c4db43b0068e5a7c1f8af1d904a26351a007f203be233803bae0ed471f32
+  data.tar.gz: fe0da3df41a98b6411fd20378eb41f22e5c4766cf42fd3061a45d0c6b8606bcf
 SHA512:
-  metadata.gz: be15b77c46a135d213cd6e6e6bc7000b961e036febdb8f75bb922f09554d68ab757d5094fe96816c83c5966a3094daa32ecbbee798b2a8bb72417df9506ac3b3
-  data.tar.gz: a5fec610e9193d449ef49fbfde36688398c9e4e576da5ea579165c306ecc51bc910d0d758c923a9bece59ef4e7651347f9ebb7951504f3354b101fe5f845173a
+  metadata.gz: 910bb63ff3a0be7cb035d54ed4eb48916b2137d886523403154d0eefd5d72bdb4375a268e8c94eb8047592bddfb2dd79b7022611243e18902ec33f467450e013
+  data.tar.gz: 332125982a596d3ea0c773c7e84e5a4e4cdeed2bc9de0069f742d9b2a10de0b2182fcaea69c658fefe88b1a67e4c8b81c2dbafa3dc4c155d0100a64b1d444bb9

data/README.md

@@ -24,7 +24,7 @@ This is an extension to the `rodauth` gem which implements the [OAuth 2.0 framew
 
 This gem implements the following RFCs and features of OAuth:
 
-* `oauth` - [The OAuth 2.0 protocol framework](https://tools.ietf.org/html/rfc6749):
+* `oauth` - [The OAuth 2.0 protocol framework](-/wikis/home#oauth-20-protocol-framework):
   * [Access Token generation](https://tools.ietf.org/html/rfc6749#section-1.4);
   * [Access Token refresh token grant](https://tools.ietf.org/html/rfc6749#section-1.5);
   * `oauth_authorization_code_grant` - [Authorization code grant](https://tools.ietf.org/html/rfc6749#section-1.3);
@@ -33,8 +33,10 @@ This gem implements the following RFCs and features of OAuth:
   * `oauth_device_code_grant` - [Device code grant (off by default)](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-device-flow-15);
   * `oauth_token_revocation` - [Token revocation](https://tools.ietf.org/html/rfc7009);
   * `oauth_token_introspection` - [Token introspection](https://tools.ietf.org/html/rfc7662);
+  * `oauth_pushed_authorization_request` - [Pushed Authorization Request](https://datatracker.ietf.org/doc/html/rfc9126);
   * [Authorization Server Metadata](https://tools.ietf.org/html/rfc8414);
   * `oauth_pkce` - [PKCE](https://tools.ietf.org/html/rfc7636);
+  * `oauth_tls_client_auth` - [Mutual-TLS Client Authentication](https://datatracker.ietf.org/doc/html/rfc8705);
   * `oauth_jwt` - [JWT Access Tokens](https://tools.ietf.org/html/draft-ietf-oauth-access-token-jwt-07);
   * `oauth_jwt_secured_authorization_request` - [JWT Secured Authorization Request](https://tools.ietf.org/html/draft-ietf-oauth-jwsreq-20);
   * `oauth_resource_indicators` - [Resource Indicators](https://datatracker.ietf.org/doc/html/rfc8707);
@@ -44,18 +46,17 @@ This gem implements the following RFCs and features of OAuth:
   * `oauth_saml_bearer_grant` - [SAML 2.0 Bearer Assertion](https://datatracker.ietf.org/doc/html/rfc7522);
   * `oauth_jwt_bearer_grant` - [JWT Bearer Assertion](https://datatracker.ietf.org/doc/html/rfc7523);
 
-* `oauth_dynamic_client_registration` - [Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591);
+* `oauth_dynamic_client_registration` - [Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) and [Dynamic Client Registration Management](https://www.rfc-editor.org/rfc/rfc7592);
 * OAuth application and token management dashboards;
 *  The recommendations for [Native Apps](https://www.rfc-editor.org/rfc/rfc8252);
 
 It also implements the [OpenID Connect layer](https://openid.net/connect/) (via the `openid` feature) on top of the OAuth features it provides, including:
 
-* `oidc`
-  * [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html);
-  * [OpenID Connect Discovery](https://openid.net/specs/openid-connect-discovery-1_0-29.html);
-  * [OpenID Multiple Response Types](https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html);
-* `oidc_dynamic_client_registration` - [OpenID Connect Dynamic Client Registration](https://openid.net/specs/openid-connect-registration-1_0.html);
-* `oidc_rp_initiated_logout` - [RP Initiated Logout](https://openid.net/specs/openid-connect-rpinitiated-1_0.html);
+* [OpenID Connect Core](https://gitlab.com/os85/rodauth-oauth/-/wikis/Id-Token-Authentication);
+* [OpenID Connect Discovery](https://gitlab.com/os85/rodauth-oauth/-/wikis/OIDC-Dynamic-Client-Registration);
+* [OpenID Multiple Response Types](https://gitlab.com/os85/rodauth-oauth/-/wikis/Hybrid-flow);
+* [OpenID Connect Dynamic Client Registration](https://gitlab.com/os85/rodauth-oauth/-/wikis/OIDC-Dynamic-Client-Registration);
+* [RP Initiated Logout](https://gitlab.com/os85/rodauth-oauth/-/wikis/RP-Initiated-Logout);
 
 This gem supports also rails (through [rodauth-rails]((https://github.com/janko/rodauth-rails))).
 

data/doc/release_notes/1_2_0.md

@@ -0,0 +1,36 @@
+## 1.2.0 (13/02/2023)
+
+### Features
+
+#### Pushed Authorization Requests (PAR)
+
+RFC: https://datatracker.ietf.org/doc/html/rfc9126
+
+`rodauth-oauth` supports Pushed Authorization Requests, via the `:oauth_pushed_authorization_request` feature.
+
+More info about the feature [in the wiki](https://gitlab.com/os85/rodauth-oauth/-/wikis/Pushed-Authorization-Requests).
+
+#### mTLS Client Auth (+ certificate-bound access tokens)
+
+RFC: https://www.rfc-editor.org/rfc/rfc8705
+
+The `:oauth_tls_client_auth` feature adds support for the variants of mTLS Client Authentication "PKI Mutual-TLS Method" and 2Self-Signed Certificate Mutual-TLS Method". It also supports client certificate bound access tokens.
+
+More about it [in the wiki](https://gitlab.com/os85/rodauth-oauth/-/wikis/mTLS-Client-Authentication).
+
+#### Dynamic Client Registration management
+
+RFC: https://www.rfc-editor.org/rfc/rfc7592
+
+Support for dynamci client registration management was added to the `:oauth_dynamic_client_registration` feature.
+
+More info about it [in the wiki](https://gitlab.com/os85/rodauth-oauth/-/wikis/Dynamic-Client-Registration#getputdelete-registerclient_id).
+
+### Improvements
+
+* Support for 3rd-party initiated login was added, by including support for the `initiate_login_uri` attribute in the register route from the `:oauth_dynamic_client_registration` feature.
+* Support for multitenant resource ownership was added, here's a [description from the wiki](https://gitlab.com/os85/rodauth-oauth/-/wikis/How-to#scoping-grants-from-the-same-resource-owner).
+
+### Bugfixes
+
+* oidc: userinfo claims were not including claims with value `false`, such as `"email_verified"`. This behaviour has been fixed, and only claims of value `null` are omitted.

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -9,6 +9,7 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :redirect_uri, null: false
       t.string :client_id, null: false, index: { unique: true }
       t.string :client_secret, null: false, index: { unique: true }
+      t.string :registration_access_token, null: true
       t.string :scopes, null: false
       t.datetime :created_at, null: false, default: -> { "CURRENT_TIMESTAMP" }
 
@@ -29,6 +30,7 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       # :oidc_dynamic_client_configuration enabled, extra optional params
       t.string :sector_identifier_uri, null: true
       t.string :application_type, null: true
+      t.string :initiate_login_uri, null: true
 
       # :oidc enabled
       t.string :subject_type, null: true
@@ -44,6 +46,15 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :request_object_encryption_alg, null: true
       t.string :request_object_encryption_enc, null: true
       t.string :request_uris, null: true
+      t.boolean :require_pushed_authorization_requests, null: false, default: false
+
+      # :oauth_tls_client_auth
+      t.string :tls_client_auth_subject_dn, null: true
+      t.string :tls_client_auth_san_dns, null: true
+      t.string :tls_client_auth_san_uri, null: true
+      t.string :tls_client_auth_san_ip, null: true
+      t.string :tls_client_auth_san_email, null: true
+      t.boolean :tls_client_certificate_bound_access_tokens, default: false
 
       # :oidc_rp_initiated_logout enabled
       t.string :post_logout_redirect_uris, null: false
@@ -74,6 +85,9 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :user_code, null: true, unique: true
       t.datetime :last_polled_at, null: true
 
+      # :oauth_tls_client_auth
+      t.string :certificate_thumbprint, null: true
+
       # :resource_indicators enabled
       t.string :resource
 
@@ -83,5 +97,13 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :claims_locales
       t.string :claims
     end
+
+    create_table :oauth_pushed_requests do |t|
+      t.integer :oauth_application_id
+      t.foreign_key :oauth_applications, column: :oauth_application_id
+      t.string :params, null: false
+      t.datetime :expires_in, null: false
+      t.index %i[oauth_application_id code], unique: true
+    end
   end
 end

data/lib/rodauth/features/oauth_authorization_code_grant.rb

@@ -57,7 +57,7 @@ module Rodauth
     def _do_authorize_code
       create_params = {
         oauth_grants_type_column => "authorization_code",
-        oauth_grants_account_id_column => account_id
+        **resource_owner_params
       }
 
       { "code" => create_oauth_grant(create_params) }

data/lib/rodauth/features/oauth_authorize_base.rb

@@ -28,6 +28,11 @@ module Rodauth
     translatable_method :oauth_unsupported_response_type_message, "Unsupported response type"
     translatable_method :oauth_authorize_parameter_required, "Invalid or missing '%<parameter>s'"
 
+    auth_value_methods(
+      :resource_owner_params,
+      :oauth_grants_resource_owner_columns
+    )
+
     # /authorize
     auth_server_route(:authorize) do |r|
       require_authorizable_account
@@ -73,7 +78,9 @@ module Rodauth
 
       if (redirect_uri = param_or_nil("redirect_uri"))
         normalized_redirect_uri = normalize_redirect_uri_for_comparison(redirect_uri)
-        redirect_authorize_error("redirect_uri") unless redirect_uris.include?(normalized_redirect_uri)
+        unless redirect_uris.include?(normalized_redirect_uri) || redirect_uris.include?(redirect_uri)
+          redirect_authorize_error("redirect_uri")
+        end
       elsif redirect_uris.size > 1
         redirect_authorize_error("redirect_uri")
       end
@@ -109,13 +116,20 @@ module Rodauth
       !approval_prompt || APPROVAL_PROMPTS.include?(approval_prompt)
     end
 
+    def resource_owner_params
+      { oauth_grants_account_id_column => account_id }
+    end
+
+    def oauth_grants_resource_owner_columns
+      [oauth_grants_account_id_column]
+    end
+
     def try_approval_prompt
       approval_prompt = param_or_nil("approval_prompt")
 
       return unless approval_prompt && approval_prompt == "auto"
 
-      return if db[oauth_grants_table].where(
-        oauth_grants_account_id_column => account_id,
+      return if db[oauth_grants_table].where(resource_owner_params).where(
         oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
         oauth_grants_redirect_uri_column => redirect_uri,
         oauth_grants_scopes_column => scopes.join(oauth_scope_separator),

data/lib/rodauth/features/oauth_device_code_grant.rb

@@ -193,9 +193,8 @@ module Rodauth
 
       # do not clean up device code just yet
       update_params.delete(oauth_grants_code_column)
-
       update_params[oauth_grants_user_code_column] = nil
-      update_params[oauth_grants_account_id_column] = account_id
+      update_params.merge!(resource_params)
 
       super(grant_params, update_params)
     end

data/lib/rodauth/features/oauth_dynamic_client_registration.rb

@@ -9,16 +9,78 @@ module Rodauth
     before "register"
 
     auth_value_method :oauth_client_registration_required_params, %w[redirect_uris client_name]
+    auth_value_method :oauth_applications_registration_access_token_column, :registration_access_token
+    auth_value_method :registration_client_uri_route, "register"
 
     PROTECTED_APPLICATION_ATTRIBUTES = %w[account_id client_id].freeze
 
+    def load_registration_client_uri_routes
+      request.on(registration_client_uri_route) do
+        # CLIENT REGISTRATION URI
+        request.on(String) do |client_id|
+          (token = ((v = request.env["HTTP_AUTHORIZATION"]) && v[/\A *Bearer (.*)\Z/, 1]))
+
+          next unless token
+
+          oauth_application = db[oauth_applications_table]
+                              .where(oauth_applications_client_id_column => client_id)
+                              .first
+          next unless oauth_application
+
+          authorization_required unless password_hash_match?(oauth_application[oauth_applications_registration_access_token_column], token)
+
+          request.is do
+            request.get do
+              json_response_oauth_application(oauth_application)
+            end
+            request.on method: :put do
+              %w[client_id registration_access_token registration_client_uri client_secret_expires_at
+                 client_id_issued_at].each do |prohibited_param|
+                if request.params.key?(prohibited_param)
+                  register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(prohibited_param))
+                end
+              end
+              validate_client_registration_params
+
+              # if the client includes the "client_secret" field in the request, the value of this field MUST match the currently
+              # issued client secret for that client.  The client MUST NOT be allowed to overwrite its existing client secret with
+              # its own chosen value.
+              authorization_required if request.params.key?("client_secret") && secret_matches?(oauth_application,
+                                                                                                request.params["client_secret"])
+
+              oauth_application = transaction do
+                applications_ds = db[oauth_applications_table]
+                __update_and_return__(applications_ds, @oauth_application_params)
+              end
+              json_response_oauth_application(oauth_application)
+            end
+
+            request.on method: :delete do
+              applications_ds = db[oauth_applications_table]
+              applications_ds.where(oauth_applications_client_id_column => client_id).delete
+              response.status = 204
+              response["Cache-Control"] = "no-store"
+              response["Pragma"] = "no-cache"
+              response.finish
+            end
+          end
+        end
+      end
+    end
+
     # /register
     auth_server_route(:register) do |r|
       before_register_route
 
-      validate_client_registration_params
-
       r.post do
+        oauth_client_registration_required_params.each do |required_param|
+          unless request.params.key?(required_param)
+            register_throw_json_response_error("invalid_client_metadata", register_required_param_message(required_param))
+          end
+        end
+
+        validate_client_registration_params
+
         response_params = transaction do
           before_register
           do_register
@@ -57,12 +119,6 @@ module Rodauth
     end
 
     def validate_client_registration_params
-      oauth_client_registration_required_params.each do |required_param|
-        unless request.params.key?(required_param)
-          register_throw_json_response_error("invalid_client_metadata", register_required_param_message(required_param))
-        end
-      end
-
       @oauth_application_params = request.params.each_with_object({}) do |(key, value), params|
         case key
         when "redirect_uris"
@@ -96,7 +152,7 @@ module Rodauth
           key = oauth_applications_grant_types_column
         when "response_types"
           if value.is_a?(Array)
-            grant_types = request.params["grant_types"] || oauth_grant_types_supported
+            grant_types = request.params["grant_types"] || %w[authorization_code]
             value = value.each do |response_type|
               unless oauth_response_types_supported.include?(response_type)
                 register_throw_json_response_error("invalid_client_metadata",
@@ -114,7 +170,7 @@ module Rodauth
           register_throw_json_response_error("invalid_client_metadata", register_invalid_uri_message(value)) unless check_valid_uri?(value)
           case key
           when "client_uri"
-            key = "homepage_url"
+            key = oauth_applications_homepage_url_column
           when "jwks_uri"
             if request.params.key?("jwks")
               register_throw_json_response_error("invalid_client_metadata",
@@ -132,6 +188,7 @@ module Rodauth
           key = oauth_applications_jwks_column
           value = JSON.dump(value)
         when "scope"
+          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(value)) unless value.is_a?(String)
           scopes = value.split(" ") - oauth_application_scopes
           register_throw_json_response_error("invalid_client_metadata", register_invalid_scopes_message(value)) unless scopes.empty?
           key = oauth_applications_scopes_column
@@ -141,7 +198,37 @@ module Rodauth
           value = value.join(" ")
           key = oauth_applications_contacts_column
         when "client_name"
+          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(value)) unless value.is_a?(String)
           key = oauth_applications_name_column
+        when "require_pushed_authorization_requests"
+          unless respond_to?(:oauth_applications_require_pushed_authorization_requests_column)
+            register_throw_json_response_error("invalid_client_metadata",
+                                               register_invalid_param_message(key))
+          end
+          request.params[key] = value = convert_to_boolean(key, value)
+
+          key = oauth_applications_require_pushed_authorization_requests_column
+        when "tls_client_certificate_bound_access_tokens"
+          property = :oauth_applications_tls_client_certificate_bound_access_tokens_column
+          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(key)) unless respond_to?(property)
+
+          request.params[key] = value = convert_to_boolean(key, value)
+
+          key = oauth_applications_tls_client_certificate_bound_access_tokens_column
+        when /\Atls_client_auth_/
+          unless respond_to?(:"oauth_applications_#{key}_column")
+            register_throw_json_response_error("invalid_client_metadata",
+                                               register_invalid_param_message(key))
+          end
+
+          #  client using the tls_client_auth authentication method MUST use exactly one of the below metadata
+          # parameters to indicate the certificate subject value that the authorization server is to expect when
+          # authenticating the respective client.
+          if params.any? { |k, _| k.to_s.start_with?("tls_client_auth_") }
+            register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(key))
+          end
+
+          key = __send__(:"oauth_applications_#{key}_column")
         else
           if respond_to?(:"oauth_applications_#{key}_column")
             if PROTECTED_APPLICATION_ATTRIBUTES.include?(key)
@@ -183,42 +270,60 @@ module Rodauth
 
       # set defaults
       create_params = @oauth_application_params
+
+      # If omitted, an authorization server MAY register a client with a default set of scopes
       create_params[oauth_applications_scopes_column] ||= return_params["scopes"] = oauth_application_scopes.join(" ")
+
+      # https://datatracker.ietf.org/doc/html/rfc7591#section-2
       if create_params[oauth_applications_grant_types_column] ||= begin
+        # If omitted, the default behavior is that the client will use only the "authorization_code" Grant Type.
         return_params["grant_types"] = %w[authorization_code] # rubocop:disable Lint/AssignmentInCondition
         "authorization_code"
       end
         create_params[oauth_applications_token_endpoint_auth_method_column] ||= begin
+          # If unspecified or omitted, the default is "client_secret_basic", denoting the HTTP Basic
+          # authentication scheme as specified in Section 2.3.1 of OAuth 2.0.
           return_params["token_endpoint_auth_method"] = "client_secret_basic"
           "client_secret_basic"
         end
       end
       create_params[oauth_applications_response_types_column] ||= begin
+        # If omitted, the default is that the client will use only the "code" response type.
         return_params["response_types"] = %w[code]
         "code"
       end
       rescue_from_uniqueness_error do
-        client_id = oauth_unique_id_generator
-        create_params[oauth_applications_client_id_column] = client_id
-        return_params["client_id"] = client_id
-        return_params["client_id_issued_at"] = Time.now.utc.iso8601
-        if create_params.key?(oauth_applications_client_secret_column)
-          set_client_secret(create_params, create_params[oauth_applications_client_secret_column])
-          return_params.delete("client_secret")
-        else
-          client_secret = oauth_unique_id_generator
-          set_client_secret(create_params, client_secret)
-          return_params["client_secret"] = client_secret
-          return_params["client_secret_expires_at"] = 0
-
-          create_params.delete_if { |k, _| !application_columns.include?(k) }
-        end
+        initialize_register_params(create_params, return_params)
+        create_params.delete_if { |k, _| !application_columns.include?(k) }
         applications_ds.insert(create_params)
       end
 
       return_params
     end
 
+    def initialize_register_params(create_params, return_params)
+      client_id = oauth_unique_id_generator
+      create_params[oauth_applications_client_id_column] = client_id
+      return_params["client_id"] = client_id
+      return_params["client_id_issued_at"] = Time.now.utc.iso8601
+
+      registration_access_token = oauth_unique_id_generator
+      create_params[oauth_applications_registration_access_token_column] = secret_hash(registration_access_token)
+      return_params["registration_access_token"] = registration_access_token
+      return_params["registration_client_uri"] = "#{base_url}/#{registration_client_uri_route}/#{return_params['client_id']}"
+
+      if create_params.key?(oauth_applications_client_secret_column)
+        set_client_secret(create_params, create_params[oauth_applications_client_secret_column])
+        return_params.delete("client_secret")
+      else
+        client_secret = oauth_unique_id_generator
+        set_client_secret(create_params, client_secret)
+        return_params["client_secret"] = client_secret
+        return_params["client_secret_expires_at"] = 0
+
+      end
+    end
+
     def register_throw_json_response_error(code, message)
       throw_json_response_error(oauth_invalid_response_status, code, message)
     end
@@ -264,6 +369,54 @@ module Rodauth
         "type '#{response_type}' to be allowed."
     end
 
+    def convert_to_boolean(key, value)
+      case value
+      when "true" then true
+      when "false" then false
+      else
+        register_throw_json_response_error(
+          "invalid_client_metadata",
+          register_invalid_param_message(key)
+        )
+      end
+    end
+
+    def json_response_oauth_application(oauth_application)
+      params = methods.map { |k| k.to_s[/\Aoauth_applications_(\w+)_column\z/, 1] }.compact
+
+      body = params.each_with_object({}) do |k, hash|
+        next if %w[id account_id client_id client_secret cliennt_secret_hash].include?(k)
+
+        value = oauth_application[__send__(:"oauth_applications_#{k}_column")]
+
+        next unless value
+
+        case k
+        when "redirect_uri"
+          hash["redirect_uris"] = value.split(" ")
+        when "token_endpoint_auth_method", "grant_types", "response_types", "request_uris", "post_logout_redirect_uris"
+          hash[k] = value.split(" ")
+        when "scopes"
+          hash["scope"] = value
+        when "jwks"
+          hash[k] = value.is_a?(String) ? JSON.parse(value) : value
+        when "homepage_url"
+          hash["client_uri"] = value
+        when "name"
+          hash["client_name"] = value
+        else
+          hash[k] = value
+        end
+      end
+
+      response.status = 200
+      response["Content-Type"] ||= json_response_content_type
+      response["Cache-Control"] = "no-store"
+      response["Pragma"] = "no-cache"
+      json_payload = _json_response_body(body)
+      return_response(json_payload)
+    end
+
     def oauth_server_metadata_body(*)
       super.tap do |data|
         data[:registration_endpoint] = register_url

data/lib/rodauth/features/oauth_implicit_grant.rb

@@ -42,7 +42,7 @@ module Rodauth
         oauth_grants_type_column => "implicit",
         oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
         oauth_grants_scopes_column => scopes,
-        oauth_grants_account_id_column => account_id
+        **resource_owner_params
       }.merge(grant_params)
 
       generate_token(grant_params, false)

data/lib/rodauth/features/oauth_jwt.rb

@@ -9,6 +9,8 @@ module Rodauth
 
     auth_value_method :oauth_jwt_access_tokens, true
 
+    auth_value_methods(:jwt_claims)
+
     def require_oauth_authorization(*scopes)
       return super unless oauth_jwt_access_tokens
 

data/lib/rodauth/features/oauth_jwt_base.rb

@@ -24,7 +24,8 @@ module Rodauth
       :jwt_decode_no_key,
       :generate_jti,
       :oauth_jwt_issuer,
-      :oauth_jwt_audience
+      :oauth_jwt_audience,
+      :resource_owner_params_from_jwt_claims
     )
 
     private
@@ -70,6 +71,10 @@ module Rodauth
       client_application[oauth_applications_client_id_column]
     end
 
+    def resource_owner_params_from_jwt_claims(claims)
+      { oauth_grants_account_id_column => claims["sub"] }
+    end
+
     def oauth_server_metadata_body(path = nil)
       metadata = super
       metadata.merge! \
@@ -81,14 +86,6 @@ module Rodauth
       @_jwt_key ||= (oauth_application_jwks(oauth_application) if oauth_application)
     end
 
-    def _jwt_public_key
-      @_jwt_public_key ||= if oauth_application
-                             oauth_application_jwks(oauth_application)
-                           else
-                             _jwt_key
-                           end
-    end
-
     # Resource Server only!
     #
     # returns the jwks set from the authorization server.
@@ -152,10 +149,28 @@ module Rodauth
         A128GCM A256GCM A128CBC-HS256 A256CBC-HS512
       ]
 
-      def jwk_export(key)
+      def key_to_jwk(key)
         JSON::JWK.new(key)
       end
 
+      def jwk_export(key)
+        key_to_jwk(key)
+      end
+
+      def jwk_import(jwk)
+        JSON::JWK.new(jwk)
+      end
+
+      def jwk_key(jwk)
+        jwk = jwk_import(jwk) unless jwk.is_a?(JSON::JWK)
+        jwk.to_key
+      end
+
+      def jwk_thumbprint(jwk)
+        jwk = jwk_import(jwk) if jwk.is_a?(Hash)
+        jwk.thumbprint
+      end
+
       def jwt_encode(payload,
                      jwks: nil,
                      encryption_algorithm: oauth_jwt_jwe_keys.keys.dig(0, 0),
@@ -287,8 +302,26 @@ module Rodauth
         auth_value_method :oauth_jwt_jwe_encryption_methods_supported, []
       end
 
+      def key_to_jwk(key)
+        JWT::JWK.new(key)
+      end
+
       def jwk_export(key)
-        JWT::JWK.new(key).export
+        key_to_jwk(key).export
+      end
+
+      def jwk_import(jwk)
+        JWT::JWK.import(jwk)
+      end
+
+      def jwk_key(jwk)
+        jwk = jwk_import(jwk) unless jwk.is_a?(JWT::JWK)
+        jwk.keypair
+      end
+
+      def jwk_thumbprint(jwk)
+        jwk = jwk_import(jwk) if jwk.is_a?(Hash)
+        JWT::JWK::Thumbprint.new(jwk).generate
       end
 
       def jwt_encode(payload,
@@ -445,6 +478,14 @@ module Rodauth
         raise "#{__method__} is undefined, redefine it or require either \"jwt\" or \"json-jwt\""
       end
 
+      def jwk_import(_jwk)
+        raise "#{__method__} is undefined, redefine it or require either \"jwt\" or \"json-jwt\""
+      end
+
+      def jwk_thumbprint(_jwk)
+        raise "#{__method__} is undefined, redefine it or require either \"jwt\" or \"json-jwt\""
+      end
+
       def jwt_encode(_token)
         raise "#{__method__} is undefined, redefine it or require either \"jwt\" or \"json-jwt\""
       end

data/lib/rodauth/features/oauth_jwt_secured_authorization_request.rb

@@ -46,28 +46,7 @@ module Rodauth
         request_object = response.body
       end
 
-      request_sig_enc_opts = {
-        jws_algorithm: oauth_application[oauth_applications_request_object_signing_alg_column],
-        jws_encryption_algorithm: oauth_application[oauth_applications_request_object_encryption_alg_column],
-        jws_encryption_method: oauth_application[oauth_applications_request_object_encryption_enc_column]
-      }.compact
-
-      request_sig_enc_opts[:jws_algorithm] ||= "none" if oauth_request_object_signing_alg_allow_none
-
-      if request_sig_enc_opts[:jws_algorithm] == "none"
-        jwks = nil
-      elsif (jwks = oauth_application_jwks(oauth_application))
-        jwks = JSON.parse(jwks, symbolize_names: true) if jwks.is_a?(String)
-      else
-        redirect_response_error("invalid_request_object")
-      end
-
-      claims = jwt_decode(request_object,
-                          jwks: jwks,
-                          verify_jti: false,
-                          verify_iss: false,
-                          verify_aud: false,
-                          **request_sig_enc_opts)
+      claims = decode_request_object(request_object)
 
       redirect_response_error("invalid_request_object") unless claims
 
@@ -105,6 +84,35 @@ module Rodauth
       request_uris.nil? || request_uris.split(oauth_scope_separator).one? { |uri| request_uri.start_with?(uri) }
     end
 
+    def decode_request_object(request_object)
+      request_sig_enc_opts = {
+        jws_algorithm: oauth_application[oauth_applications_request_object_signing_alg_column],
+        jws_encryption_algorithm: oauth_application[oauth_applications_request_object_encryption_alg_column],
+        jws_encryption_method: oauth_application[oauth_applications_request_object_encryption_enc_column]
+      }.compact
+
+      request_sig_enc_opts[:jws_algorithm] ||= "none" if oauth_request_object_signing_alg_allow_none
+
+      if request_sig_enc_opts[:jws_algorithm] == "none"
+        jwks = nil
+      elsif (jwks = oauth_application_jwks(oauth_application))
+        jwks = JSON.parse(jwks, symbolize_names: true) if jwks.is_a?(String)
+      else
+        redirect_response_error("invalid_request_object")
+      end
+
+      claims = jwt_decode(request_object,
+                          jwks: jwks,
+                          verify_jti: false,
+                          verify_iss: false,
+                          verify_aud: false,
+                          **request_sig_enc_opts)
+
+      redirect_response_error("invalid_request_object") unless claims
+
+      claims
+    end
+
     def oauth_server_metadata_body(*)
       super.tap do |data|
         data[:request_parameter_supported] = true

data/lib/rodauth/features/oauth_pushed_authorization_request.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require "rodauth/oauth"
+
+module Rodauth
+  Feature.define(:oauth_pushed_authorization_request, :OauthJwtPushedAuthorizationRequest) do
+    depends :oauth_authorize_base
+
+    auth_value_method :oauth_require_pushed_authorization_requests, false
+    auth_value_method :oauth_applications_require_pushed_authorization_requests_column, :require_pushed_authorization_requests
+    auth_value_method :oauth_pushed_authorization_request_expires_in, 90 # 90 seconds
+    auth_value_method :oauth_require_pushed_authorization_request_iss_request_object, true
+
+    auth_value_method :oauth_pushed_authorization_requests_table, :oauth_pushed_requests
+
+    %i[
+      oauth_application_id params code expires_in
+    ].each do |column|
+      auth_value_method :"oauth_pushed_authorization_requests_#{column}_column", column
+    end
+
+    # /par
+    auth_server_route(:par) do |r|
+      require_oauth_application
+      before_par_route
+
+      r.post do
+        validate_par_params
+
+        ds = db[oauth_pushed_authorization_requests_table]
+
+        code = oauth_unique_id_generator
+        push_request_params = {
+          oauth_pushed_authorization_requests_oauth_application_id_column => oauth_application[oauth_applications_id_column],
+          oauth_pushed_authorization_requests_code_column => code,
+          oauth_pushed_authorization_requests_params_column => URI.encode_www_form(request.params),
+          oauth_pushed_authorization_requests_expires_in_column => Sequel.date_add(Sequel::CURRENT_TIMESTAMP,
+                                                                                   seconds: oauth_pushed_authorization_request_expires_in)
+        }
+
+        rescue_from_uniqueness_error do
+          ds.insert(push_request_params)
+        end
+
+        json_response_success(
+          "request_uri" => "urn:ietf:params:oauth:request_uri:#{code}",
+          "expires_in" => oauth_pushed_authorization_request_expires_in
+        )
+      end
+    end
+
+    def check_csrf?
+      case request.path
+      when par_path
+        false
+      else
+        super
+      end
+    end
+
+    private
+
+    def validate_par_params
+      # https://datatracker.ietf.org/doc/html/rfc9126#section-2.1
+      # The request_uri authorization request parameter is one exception, and it MUST NOT be provided.
+      redirect_response_error("invalid_request") if param_or_nil("request_uri")
+
+      if (request_object = param_or_nil("request")) && features.include?(:oauth_jwt_secured_authorization_request)
+        claims = decode_request_object(request_object)
+
+        # https://datatracker.ietf.org/doc/html/rfc9126#section-3-5.3
+        # reject the request if the authenticated client_id does not match the client_id claim in the Request Object
+        if (client_id = claims["client_id"]) && (client_id != oauth_application[oauth_applications_client_id_column])
+          redirect_response_error("invalid_request_object")
+        end
+
+        # requiring the iss claim to match the client_id is at the discretion of the authorization server
+        if oauth_require_pushed_authorization_request_iss_request_object &&
+           (iss = claims.delete("iss")) &&
+           iss != oauth_application[oauth_applications_client_id_column]
+          redirect_response_error("invalid_request_object")
+        end
+
+        if (aud = claims.delete("aud")) && !verify_aud(aud, oauth_jwt_issuer)
+          redirect_response_error("invalid_request_object")
+        end
+
+        claims.delete("exp")
+        request.params.delete("request")
+
+        claims.each do |k, v|
+          request.params[k.to_s] = v
+        end
+      end
+
+      validate_authorize_params
+    end
+
+    def validate_authorize_params
+      return super unless request.get? && request.path == authorize_path
+
+      if (request_uri = param_or_nil("request_uri"))
+        code = request_uri.delete_prefix("urn:ietf:params:oauth:request_uri:")
+
+        table = oauth_pushed_authorization_requests_table
+        ds = db[table]
+
+        pushed_request = ds.where(
+          oauth_pushed_authorization_requests_oauth_application_id_column => oauth_application[oauth_applications_id_column],
+          oauth_pushed_authorization_requests_code_column => code
+        ).where(
+          Sequel.expr(Sequel[table][oauth_pushed_authorization_requests_expires_in_column]) >= Sequel::CURRENT_TIMESTAMP
+        ).first
+
+        redirect_response_error("invalid_request") unless pushed_request
+
+        URI.decode_www_form(pushed_request[oauth_pushed_authorization_requests_params_column]).each do |k, v|
+          request.params[k.to_s] = v
+        end
+
+      elsif oauth_require_pushed_authorization_requests ||
+            (oauth_application && oauth_application[oauth_applications_require_pushed_authorization_requests_column])
+        redirect_authorize_error("request_uri")
+      end
+      super
+    end
+
+    def oauth_server_metadata_body(*)
+      super.tap do |data|
+        data[:require_pushed_authorization_requests] = oauth_require_pushed_authorization_requests
+        data[:pushed_authorization_request_endpoint] = par_url
+      end
+    end
+  end
+end

data/lib/rodauth/features/oauth_tls_client_auth.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "ipaddr"
+require "uri"
+require "rodauth/oauth"
+
+module Rodauth
+  Feature.define(:oauth_tls_client_auth, :OauthTlsClientAuth) do
+    depends :oauth_jwt_base
+
+    auth_value_method :oauth_tls_client_certificate_bound_access_tokens, false
+
+    %i[
+      tls_client_auth_subject_dn tls_client_auth_san_dns
+      tls_client_auth_san_uri tls_client_auth_san_ip
+      tls_client_auth_san_email tls_client_certificate_bound_access_tokens
+    ].each do |column|
+      auth_value_method :"oauth_applications_#{column}_column", column
+    end
+
+    auth_value_method :oauth_grants_certificate_thumbprint_column, :certificate_thumbprint
+
+    def oauth_token_endpoint_auth_methods_supported
+      super | %w[tls_client_auth self_signed_tls_client_auth]
+    end
+
+    private
+
+    def validate_token_params
+      # For all requests to the authorization server utilizing mutual-TLS client authentication,
+      # the client MUST include the client_id parameter
+      redirect_response_error("invalid_request") if client_certificate && !param_or_nil("client_id")
+
+      super
+    end
+
+    def require_oauth_application
+      return super unless client_certificate
+
+      authorization_required unless oauth_application
+
+      if supports_auth_method?(oauth_application, "tls_client_auth")
+        # It relies on a validated certificate chain [RFC5280]
+
+        ssl_verify = request.env["SSL_CLIENT_VERIFY"] || request.env["HTTP_SSL_CLIENT_VERIFY"] || request.env["HTTP_X_SSL_CLIENT_VERIFY"]
+
+        authorization_required unless ssl_verify == "SUCCESS"
+
+        # and a single subject distinguished name (DN) or a single subject alternative name (SAN) to
+        # authenticate the client. Only one subject name value of any type is used for each client.
+
+        name_matches = if oauth_application[:tls_client_auth_subject_dn]
+                         distinguished_name_match?(client_certificate.subject, oauth_application[:tls_client_auth_subject_dn])
+                       elsif (dns = oauth_application[:tls_client_auth_san_dns])
+                         client_certificate_sans.any? { |san| san.tag == 2 && OpenSSL::SSL.verify_hostname(dns, san.value) }
+                       elsif (uri = oauth_application[:tls_client_auth_san_uri])
+                         uri = URI(uri)
+                         client_certificate_sans.any? { |san| san.tag == 6 && URI(san.value) == uri }
+                       elsif (ip = oauth_application[:tls_client_auth_san_ip])
+                         ip = IPAddr.new(ip).hton
+                         client_certificate_sans.any? { |san| san.tag == 7 && san.value == ip }
+                       elsif (email = oauth_application[:tls_client_auth_san_email])
+                         client_certificate_sans.any? { |san| san.tag == 1 && san.value == email }
+                       else
+                         false
+                       end
+        authorization_required unless name_matches
+
+        oauth_application
+      elsif supports_auth_method?(oauth_application, "self_signed_tls_client_auth")
+        jwks = oauth_application_jwks(oauth_application)
+
+        thumbprint = jwk_thumbprint(key_to_jwk(client_certificate.public_key))
+
+        # The client is successfully authenticated if the certificate that it presented during the handshake
+        # matches one of the certificates configured or registered for that particular client.
+        authorization_required unless jwks.any? { |jwk| Array(jwk[:x5c]).first == thumbprint }
+
+        oauth_application
+      else
+        super
+      end
+    rescue URI::InvalidURIError, IPAddr::InvalidAddressError
+      authorization_required
+    end
+
+    def store_token(grant_params, update_params = {})
+      return super unless client_certificate && (
+        oauth_tls_client_certificate_bound_access_tokens ||
+        oauth_application[oauth_applications_tls_client_certificate_bound_access_tokens_column]
+      )
+
+      update_params[oauth_grants_certificate_thumbprint_column] = jwk_thumbprint(key_to_jwk(client_certificate.public_key))
+      super
+    end
+
+    def jwt_claims(oauth_grant)
+      claims = super
+
+      return claims unless oauth_grant[oauth_grants_certificate_thumbprint_column]
+
+      claims[:cnf] = {
+        "x5t#S256" => oauth_grant[oauth_grants_certificate_thumbprint_column]
+      }
+
+      claims
+    end
+
+    def json_token_introspect_payload(grant_or_claims)
+      claims = super
+
+      return claims unless grant_or_claims && grant_or_claims[oauth_grants_certificate_thumbprint_column]
+
+      claims[:cnf] = {
+        "x5t#S256" => grant_or_claims[oauth_grants_certificate_thumbprint_column]
+      }
+
+      claims
+    end
+
+    def oauth_server_metadata_body(*)
+      super.tap do |data|
+        data[:tls_client_certificate_bound_access_tokens] = oauth_tls_client_certificate_bound_access_tokens
+      end
+    end
+
+    def client_certificate
+      return @client_certificate if defined?(@client_certificate)
+
+      unless (pem_cert = request.env["SSL_CLIENT_CERT"] || request.env["HTTP_SSL_CLIENT_CERT"] || request.env["HTTP_X_SSL_CLIENT_CERT"])
+        return
+      end
+
+      return if pem_cert.empty?
+
+      @certificate = OpenSSL::X509::Certificate.new(pem_cert)
+    end
+
+    def client_certificate_sans
+      return @client_certificate_sans if defined?(@client_certificate_sans)
+
+      @client_certificate_sans = begin
+        return [] unless client_certificate
+
+        san = client_certificate.extensions.find { |ext| ext.oid == "subjectAltName" }
+
+        return [] unless san
+
+        ostr = OpenSSL::ASN1.decode(san.to_der).value.last
+
+        sans = OpenSSL::ASN1.decode(ostr.value)
+
+        return [] unless sans
+
+        sans.value
+      end
+    end
+
+    def distinguished_name_match?(sub1, sub2)
+      sub1 = OpenSSL::X509::Name.parse(sub1) if sub1.is_a?(String)
+      sub2 = OpenSSL::X509::Name.parse(sub2) if sub2.is_a?(String)
+      # OpenSSL::X509::Name#cp calls X509_NAME_cmp via openssl.
+      # https://www.openssl.org/docs/manmaster/man3/X509_NAME_cmp.html
+      # This procedure adheres to the matching rules for Distinguished Names (DN) given in
+      # RFC 4517 section 4.2.15 and RFC 5280 section 7.1.
+      sub1.cmp(sub2).zero?
+    end
+  end
+end

data/lib/rodauth/features/oidc.rb

@@ -68,7 +68,7 @@ module Rodauth
     auth_value_method :oauth_application_scopes, %w[openid]
 
     %i[
-      subject_type application_type sector_identifier_uri
+      subject_type application_type sector_identifier_uri initiate_login_uri
       id_token_signed_response_alg id_token_encrypted_response_alg id_token_encrypted_response_enc
       userinfo_signed_response_alg userinfo_encrypted_response_alg userinfo_encrypted_response_enc
     ].each do |column|
@@ -112,7 +112,7 @@ module Rodauth
 
           throw_json_response_error(oauth_authorization_required_error_status, "invalid_token") unless oauth_scopes.include?("openid")
 
-          account = db[accounts_table].where(account_id_column => claims["sub"]).first
+          account = account_ds(claims["sub"]).first
 
           throw_json_response_error(oauth_authorization_required_error_status, "invalid_token") unless account
 
@@ -126,7 +126,7 @@ module Rodauth
 
           oauth_grant = valid_oauth_grant_ds(
             oauth_grants_oauth_application_id_column => @oauth_application[oauth_applications_id_column],
-            oauth_grants_account_id_column => account[account_id_column]
+            **resource_owner_params_from_jwt_claims(claims)
           ).first
 
           claims_locales = oauth_grant[oauth_grants_claims_locales_column] if oauth_grant
@@ -333,8 +333,9 @@ module Rodauth
 
         identifier_uri = URI(identifier_uri).host
 
-        account_id = oauth_grant[oauth_grants_account_id_column]
-        Digest::SHA256.hexdigest("#{identifier_uri}#{account_id}#{oauth_jwt_subject_secret}")
+        account_ids = oauth_grant.values_at(oauth_grants_resource_owner_columns)
+        values = [identifier_uri, *account_ids, oauth_jwt_subject_secret]
+        Digest::SHA256.hexdigest(values.join)
       else
         raise StandardError, "unexpected subject (#{subject_type})"
       end
@@ -434,8 +435,8 @@ module Rodauth
     end
 
     def create_oauth_grant_with_token(create_params = {})
+      create_params.merge!(resource_owner_params)
       create_params[oauth_grants_type_column] = "hybrid"
-      create_params[oauth_grants_account_id_column] = account_id
       create_params[oauth_grants_expires_in_column] = Sequel.date_add(Sequel::CURRENT_TIMESTAMP, seconds: oauth_access_token_expires_in)
       authorization_code = create_oauth_grant(create_params)
       access_token = if oauth_jwt_access_tokens
@@ -587,14 +588,14 @@ module Rodauth
           additional_info = additional_claims_info[param] || EMPTY_HASH
           value = additional_info["value"] || meth[account, param]
           value = nil if additional_info["values"] && additional_info["values"].include?(value)
-          cl[param] = value if value
+          cl[param] = value unless value.nil?
         end
       elsif claims_locales.nil?
         lambda do |account, param, cl = claims|
           additional_info = additional_claims_info[param] || EMPTY_HASH
           value = additional_info["value"] || meth[account, param, nil]
           value = nil if additional_info["values"] && additional_info["values"].include?(value)
-          cl[param] = value if value
+          cl[param] = value unless value.nil?
         end
       else
         lambda do |account, param, cl = claims|
@@ -691,7 +692,7 @@ module Rodauth
 
     def oidc_grant_params
       grant_params = {
-        oauth_grants_account_id_column => account_id,
+        **resource_owner_params,
         oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
         oauth_grants_scopes_column => scopes.join(oauth_scope_separator)
       }

data/lib/rodauth/features/oidc_dynamic_client_registration.rb

@@ -43,7 +43,11 @@ module Rodauth
         end
       end
 
-      if (value = @oauth_application_params[oauth_applications_sector_identifier_uri_column])
+      if (value = @oauth_application_params[oauth_applications_sector_identifier_uri_column]) && !check_valid_uri?(value)
+        register_throw_json_response_error("invalid_redirect_uri", register_invalid_uri_message(value))
+      end
+
+      if (value = @oauth_application_params[oauth_applications_initiate_login_uri_column])
         uri = URI(value)
 
         unless uri.scheme == "https" || uri.host == "localhost"
@@ -219,5 +223,13 @@ module Rodauth
     def register_invalid_application_type_message(application_type)
       "The application type '#{application_type}' is not allowed."
     end
+
+    def initialize_register_params(create_params, return_params)
+      super
+      registration_access_token = oauth_unique_id_generator
+      create_params[oauth_applications_registration_access_token_column] = secret_hash(registration_access_token)
+      return_params["registration_access_token"] = registration_access_token
+      return_params["registration_client_uri"] = "#{base_url}/#{registration_client_uri_route}/#{return_params['client_id']}"
+    end
   end
 end

data/lib/rodauth/features/oidc_rp_initiated_logout.rb

@@ -36,10 +36,9 @@ module Rodauth
 
             oauth_application = db[oauth_applications_table].where(oauth_applications_client_id_column => claims["aud"]).first
             oauth_grant = db[oauth_grants_table]
-                          .where(
-                            oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column],
-                            oauth_grants_account_id_column => account_id
-                          ).first
+                          .where(resource_owner_params)
+                          .where(oauth_grants_oauth_application_id_column => oauth_application[oauth_applications_id_column])
+                          .first
 
             # check whether ID token belongs to currently logged-in user
             redirect_logout_with_error(oauth_invalid_client_message) unless oauth_grant && claims["sub"] == jwt_subject(oauth_grant,

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.1.0"
+    VERSION = "1.2.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-01-10 00:00:00.000000000 Z
+date: 2023-02-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rodauth
@@ -68,6 +68,7 @@ extra_rdoc_files:
 - doc/release_notes/0_9_3.md
 - doc/release_notes/1_0_0.md
 - doc/release_notes/1_1_0.md
+- doc/release_notes/1_2_0.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -107,6 +108,7 @@ files:
 - doc/release_notes/0_9_3.md
 - doc/release_notes/1_0_0.md
 - doc/release_notes/1_1_0.md
+- doc/release_notes/1_2_0.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -138,9 +140,11 @@ files:
 - lib/rodauth/features/oauth_jwt_secured_authorization_request.rb
 - lib/rodauth/features/oauth_management_base.rb
 - lib/rodauth/features/oauth_pkce.rb
+- lib/rodauth/features/oauth_pushed_authorization_request.rb
 - lib/rodauth/features/oauth_resource_indicators.rb
 - lib/rodauth/features/oauth_resource_server.rb
 - lib/rodauth/features/oauth_saml_bearer_grant.rb
+- lib/rodauth/features/oauth_tls_client_auth.rb
 - lib/rodauth/features/oauth_token_introspection.rb
 - lib/rodauth/features/oauth_token_revocation.rb
 - lib/rodauth/features/oidc.rb