rodauth-oauth 1.6.3 → 1.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99a936bfd8b23b07d5f7611c86d2098573bc83e8d9eb2dbf0531936385bc5e29
-  data.tar.gz: 9fb05d801cda3f35e9a9a4326933d98c6ea20c304e80be014b0ade2d1009bf03
+  metadata.gz: cc6a614c797762b13c8b97dc51abf5191dc09ef919e27fd394f46504b62410c7
+  data.tar.gz: 3c6003d4131e03514a5bf8acd674cc1b7d8fcacd9eada7ab98044fc3f037fc95
 SHA512:
-  metadata.gz: fcfa0988b7fe51d1455073913591850df119e98a7e38296c1b43bf509e9f6279094a538d13eb751d7e8ff3eac85d15678ecd7aa883c2c452818f13e13a9630e3
-  data.tar.gz: e311c4bb35bfe6f131dbf0c79e7d0f9cb4d75fa5ba0d709c13fcdce7875c807553c5d46020300362952f576980034667dc7c97d27ed5bf4f7540d0874728b5f0
+  metadata.gz: 997c1e682fc4f482d0ea367a918c4db15130535294db13f19c52c558f152eca78fd197461d74ce269e77a56b36cf465b8b7e9d2424f3b999cb6491782c8d69f6
+  data.tar.gz: 2109d08b8911e33697e08e528899d45535de16c1cc994d663324c51161fed1f6e35386849413adb6dadbb526b2b75c64522865cbdf90798042ca8e68767362cf

data/README.md

@@ -50,6 +50,7 @@ This gem implements the following RFCs and features of OAuth:
 * `oauth_assertion_base` - [Assertion Framework](https://datatracker.ietf.org/doc/html/rfc7521);
   * `oauth_saml_bearer_grant` - [SAML 2.0 Bearer Assertion](https://datatracker.ietf.org/doc/html/rfc7522);
   * `oauth_jwt_bearer_grant` - [JWT Bearer Assertion](https://datatracker.ietf.org/doc/html/rfc7523);
+* `oauth_dpop` - [OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)](https://datatracker.ietf.org/doc/rfc9449/);
 
 * `oauth_dynamic_client_registration` - [Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) and [Dynamic Client Registration Management](https://www.rfc-editor.org/rfc/rfc7592);
 * OAuth application and token management dashboards;
@@ -67,7 +68,7 @@ It also implements several components of [OpenID Connect](https://openid.net/con
 * `oidc_frontchannel_logout` - [Frontchannel Logout](https://gitlab.com/os85/rodauth-oauth/-/wikis/Frontchannel-Logout);
 * `oidc_backchannel_logout` - [Backchannel Logout](https://gitlab.com/os85/rodauth-oauth/-/wikis/Backchannel-Logout);
 
-This gem supports also rails (through [rodauth-rails]((https://github.com/janko/rodauth-rails))).
+This gem supports also rails (via [rodauth-rails]((https://github.com/janko/rodauth-rails)), which also dictates the versioning policy).
 
 
 ## Installation

data/doc/release_notes/1_6_4.md

@@ -0,0 +1,9 @@
+### 1.6.4
+
+#### Bugfixes
+
+* on `/userinfo` request, enforce existence of oauth grant before proceeding with the userinfo requests.
+
+#### Chore
+
+* linting + tweaks to example scripts.

data/doc/release_notes/1_6_5.md

@@ -0,0 +1,10 @@
+### 1.6.5
+
+#### Bugfixes
+
+* `:oauth_dynamic_client_registration` feature: scoping to the client being updated, preventing thst the resulting database operations touch every row in the `"oauth_applications"` table.
+* `:json` feature: fixed implementation of `json_request?`.
+* `json-jwt` support: set explicit `:skip_verification` parameter when the jwt decoding algorithm is  `"none"`.
+* rails generators: add missing uniqueness constraint to the index on the `"issuer"` column of the `"oauth_saml_settings"` table.
+* rails generators: remove the `"jti"` column entry from the `"oauth_dpop_proofs"` table (already made the pkey in the `create_table` instruction).
+* Make `password_hash` method public, which restores compatibility with `rodauth` v2.28 or more recent; `rodauth` **minimum supported version** becomes 2.28.0 as a result, which should not be perceived as a breaking change, as there are no other significant API changes, and ruby version support remains the same.

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -136,10 +136,10 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.boolean :check_idp_cert_expiration, null: true
       t.text :name_identifier_format, null: true
       t.string :audience, null: true
-      t.string :issuer, null: false, unique: true
+      t.string :issuer, null: false, index: { unique: true }
     end
 
-    create_table :oauth_dpop_proofs, primary_key: :jti do |t|
+    create_table :oauth_dpop_proofs, id: false, primary_key: :jti do |t|
       t.string :jti, null: false
       t.datetime :first_use, null: false, default: -> { "CURRENT_TIMESTAMP(6)" }
     end

data/lib/rodauth/features/oauth_authorize_base.rb

@@ -33,6 +33,10 @@ module Rodauth
       :oauth_grants_resource_owner_columns
     )
 
+    OAUTH_ACCESS_TYPES = %w[offline online].freeze
+
+    OAUTH_APPROVAL_PROMPTS = %w[force auto].freeze
+
     # /authorize
     auth_server_route(:authorize) do |r|
       require_authorizable_account
@@ -106,22 +110,18 @@ module Rodauth
       false
     end
 
-    ACCESS_TYPES = %w[offline online].freeze
-
     def check_valid_access_type?
       return true unless use_oauth_access_type?
 
       access_type = param_or_nil("access_type")
-      !access_type || ACCESS_TYPES.include?(access_type)
+      !access_type || OAUTH_ACCESS_TYPES.include?(access_type)
     end
 
-    APPROVAL_PROMPTS = %w[force auto].freeze
-
     def check_valid_approval_prompt?
       return true unless use_oauth_access_type?
 
       approval_prompt = param_or_nil("approval_prompt")
-      !approval_prompt || APPROVAL_PROMPTS.include?(approval_prompt)
+      !approval_prompt || OAUTH_APPROVAL_PROMPTS.include?(approval_prompt)
     end
 
     def resource_owner_params
@@ -142,7 +142,7 @@ module Rodauth
         oauth_grants_redirect_uri_column => redirect_uri,
         oauth_grants_scopes_column => scopes.join(oauth_scope_separator),
         oauth_grants_access_type_column => "online"
-      ).count.zero?
+      ).none?
 
       # if there's a previous oauth grant for the params combo, it means that this user has approved before.
       request.env["REQUEST_METHOD"] = "POST"

data/lib/rodauth/features/oauth_base.rb

@@ -191,10 +191,10 @@ module Rodauth
       (accept = request.env["HTTP_ACCEPT"]) && accept =~ json_request_regexp
     end
 
-    # copied from the jwt feature
+    # copied from the json feature
     def json_request?
-      return super if features.include?(:jsonn)
-      return @json_request if defined?(@json_request)
+      return super if features.include?(:json)
+      return @json_request unless @json_request.nil?
 
       @json_request = request.content_type =~ json_request_regexp
     end
@@ -221,13 +221,11 @@ module Rodauth
     def oauth_application
       return @oauth_application if defined?(@oauth_application)
 
-      @oauth_application = begin
-        client_id = param_or_nil("client_id")
+      client_id = param_or_nil("client_id")
 
-        return unless client_id
+      return unless client_id
 
-        db[oauth_applications_table].filter(oauth_applications_client_id_column => client_id).first
-      end
+      @oauth_application = db[oauth_applications_table].filter(oauth_applications_client_id_column => client_id).first
     end
 
     def fetch_access_token
@@ -309,6 +307,12 @@ module Rodauth
       self.class.send(:define_method, :__one_oauth_token_per_account) { one_oauth_token_per_account }
     end
 
+    def password_hash(password)
+      return super if features.include?(:login_password_requirements_base)
+
+      BCrypt::Password.create(password, cost: BCrypt::Engine::DEFAULT_COST)
+    end
+
     private
 
     def oauth_account_ds(account_id)
@@ -455,21 +459,15 @@ module Rodauth
       oauth_grant[oauth_grants_oauth_application_id_column] == oauth_application[oauth_applications_id_column]
     end
 
-    def password_hash(password)
-      return super if features.include?(:login_password_requirements_base)
-
-      BCrypt::Password.create(password, cost: BCrypt::Engine::DEFAULT_COST)
-    end
-
     def generate_token(grant_params = {}, should_generate_refresh_token = true)
-      if grant_params[oauth_grants_id_column] && (oauth_reuse_access_token &&
-           (
-             if oauth_grants_token_hash_column
-               grant_params[oauth_grants_token_hash_column]
-             else
-               grant_params[oauth_grants_token_column]
-             end
-           ))
+      if grant_params[oauth_grants_id_column] && oauth_reuse_access_token &&
+         (
+           if oauth_grants_token_hash_column
+             grant_params[oauth_grants_token_hash_column]
+           else
+             grant_params[oauth_grants_token_column]
+           end
+         )
         return grant_params
       end
 

data/lib/rodauth/features/oauth_dynamic_client_registration.rb

@@ -18,7 +18,7 @@ module Rodauth
       request.on(registration_client_uri_route) do
         # CLIENT REGISTRATION URI
         request.on(String) do |client_id|
-          (token = (v = request.env["HTTP_AUTHORIZATION"]) && v[/\A *Bearer (.*)\Z/, 1])
+          token = (v = request.env["HTTP_AUTHORIZATION"]) && v[/\A *Bearer (.*)\Z/, 1]
 
           next unless token
 
@@ -50,6 +50,7 @@ module Rodauth
 
               oauth_application = transaction do
                 applications_ds = db[oauth_applications_table]
+                                  .where(oauth_applications_client_id_column => client_id)
                 __update_and_return__(applications_ds, @oauth_application_params)
               end
               json_response_oauth_application(oauth_application)

data/lib/rodauth/features/oauth_jwt_base.rb

@@ -259,21 +259,21 @@ module Rodauth
                    elsif jws_key
                      JSON::JWT.decode(token, jws_key)
                    else
-                     JSON::JWT.decode(token, nil, jws_algorithm)
+                     JSON::JWT.decode(token, (:skip_verification if jws_algorithm == "none"), jws_algorithm)
                    end
                  elsif (jwks = auth_server_jwks_set)
                    JSON::JWT.decode(token, JSON::JWK::Set.new(jwks))
                  end
 
         now = Time.now
-        if verify_claims && (
-            (!claims[:exp] || Time.at(claims[:exp]) < now) &&
-            (claims[:nbf] && Time.at(claims[:nbf]) < now) &&
-            (claims[:iat] && Time.at(claims[:iat]) < now) &&
-            (verify_iss && claims[:iss] != oauth_jwt_issuer) &&
-            (verify_aud && !verify_aud(claims[:aud], claims[:client_id])) &&
-            (verify_jti && !verify_jti(claims[:jti], claims))
-          )
+        if verify_claims &&
+           (!claims[:exp] || Time.at(claims[:exp]) < now) &&
+           claims[:nbf] && Time.at(claims[:nbf]) < now &&
+           claims[:iat] && Time.at(claims[:iat]) < now &&
+           verify_iss && claims[:iss] != oauth_jwt_issuer &&
+           verify_aud && !verify_aud(claims[:aud], claims[:client_id]) &&
+           verify_jti && !verify_jti(claims[:jti], claims)
+
           return
         end
 
@@ -347,7 +347,6 @@ module Rodauth
       def jwt_encode(payload,
                      signing_algorithm: oauth_jwt_keys.keys.first,
                      headers: {}, **)
-
         key = oauth_jwt_keys[signing_algorithm] || _jwt_key
         key = key.first if key.is_a?(Array)
 
@@ -475,7 +474,6 @@ module Rodauth
           jwe_key: oauth_jwt_jwe_keys[[jws_encryption_algorithm, jws_encryption_method]] || oauth_jwt_jwe_keys.values.first,
           **args
         )
-
           token = if jwks && jwks.any? { |k| k[:use] == "enc" }
                     JWE.__rodauth_oauth_decrypt_from_jwks(token, jwks, alg: jws_encryption_algorithm, enc: jws_encryption_method)
                   elsif jwe_key

data/lib/rodauth/features/oauth_tls_client_auth.rb

@@ -138,21 +138,20 @@ module Rodauth
     def client_certificate_sans
       return @client_certificate_sans if defined?(@client_certificate_sans)
 
-      @client_certificate_sans = begin
-        return [] unless client_certificate
-
-        san = client_certificate.extensions.find { |ext| ext.oid == "subjectAltName" }
-
-        return [] unless san
-
-        ostr = OpenSSL::ASN1.decode(san.to_der).value.last
-
-        sans = OpenSSL::ASN1.decode(ostr.value)
-
-        return [] unless sans
-
-        sans.value
-      end
+      @client_certificate_sans =
+        if client_certificate
+          if (san = client_certificate.extensions.find { |ext| ext.oid == "subjectAltName" })
+            ostr = OpenSSL::ASN1.decode(san.to_der).value.last
+
+            sans = OpenSSL::ASN1.decode(ostr.value)
+
+            sans ? sans.value : []
+          else
+            []
+          end
+        else
+          []
+        end
     end
 
     def distinguished_name_match?(sub1, sub2)

data/lib/rodauth/features/oauth_token_introspection.rb

@@ -99,7 +99,7 @@ module Rodauth
     private
 
     def require_oauth_application_for_introspect
-      (token = (v = request.env["HTTP_AUTHORIZATION"]) && v[/\A *Bearer (.*)\Z/, 1])
+      token = (v = request.env["HTTP_AUTHORIZATION"]) && v[/\A *Bearer (.*)\Z/, 1]
 
       return require_oauth_application unless token
 

data/lib/rodauth/features/oidc.rb

@@ -144,7 +144,9 @@ module Rodauth
             **resource_owner_params_from_jwt_claims(claims)
           ).first
 
-          claims_locales = oauth_grant[oauth_grants_claims_locales_column] if oauth_grant
+          throw_json_response_error(oauth_authorization_required_error_status, "invalid_token") unless oauth_grant
+
+          claims_locales = oauth_grant[oauth_grants_claims_locales_column]
 
           if (claims = oauth_grant[oauth_grants_claims_column])
             claims = JSON.parse(claims)
@@ -317,9 +319,8 @@ module Rodauth
       # MUST ignore the offline_access request unless the Client
       # is using a response_type value that would result in an
       # Authorization Code
-      if sc && sc.include?("offline_access") && !(param_or_nil("prompt") == "consent" && (
-                (response_type = param_or_nil("response_type")) && response_type.split(" ").include?("code")
-              ))
+      if sc && sc.include?("offline_access") && !(param_or_nil("prompt") == "consent" &&
+                (response_type = param_or_nil("response_type")) && response_type.split(" ").include?("code"))
         sc.delete("offline_access")
 
         request.params["scope"] = sc.join(" ")
@@ -792,9 +793,7 @@ module Rodauth
     # Metadata
 
     def openid_configuration_body(path = nil)
-      metadata = oauth_server_metadata_body(path).select do |k, _|
-        VALID_METADATA_KEYS.include?(k)
-      end
+      metadata = oauth_server_metadata_body(path).slice(*VALID_METADATA_KEYS)
 
       scope_claims = oauth_application_scopes.each_with_object([]) do |scope, claims|
         oidc, param = scope.split(".", 2)
@@ -873,7 +872,7 @@ module Rodauth
       return unless digest
 
       hash = digest.digest(hash)
-      hash = hash[0...hash.size / 2]
+      hash = hash[0...(hash.size / 2)]
       Base64.urlsafe_encode64(hash).tr("=", "")
     end
   end

data/lib/rodauth/features/oidc_dynamic_client_registration.rb

@@ -132,8 +132,8 @@ module Rodauth
         end
       end
 
-      if features.include?(:oidc_rp_initiated_logout) && (defined?(oauth_applications_post_logout_redirect_uris_column) &&
-           (value = @oauth_application_params[oauth_applications_post_logout_redirect_uris_column]))
+      if features.include?(:oidc_rp_initiated_logout) && defined?(oauth_applications_post_logout_redirect_uris_column) &&
+         (value = @oauth_application_params[oauth_applications_post_logout_redirect_uris_column])
         if value.is_a?(Array)
           @oauth_application_params[oauth_applications_post_logout_redirect_uris_column] = value.each do |redirect_uri|
             unless check_valid_uri?(redirect_uri)

data/lib/rodauth/features/oidc_rp_initiated_logout.rb

@@ -23,7 +23,7 @@ module Rodauth
         catch_error do
           validate_oidc_logout_params
 
-          claims = oauth_application = nil
+          claims = nil
 
           if (id_token_hint = param_or_nil("id_token_hint"))
             #

data/lib/rodauth/oauth/database_extensions.rb

@@ -81,7 +81,7 @@ module Rodauth
           end
 
           def __insert_or_do_nothing_and_return__(dataset, pkey, unique_columns, params)
-            find_params = params.select { |key, _| unique_columns.include?(key) }
+            find_params = params.slice(*unique_columns)
             dataset.where(find_params).first || __insert_and_return__(dataset, pkey, params)
           end
         end

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.6.3"
+    VERSION = "1.6.5"
   end
 end

metadata

@@ -1,14 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.6.3
+  version: 1.6.5
 platform: ruby
 authors:
 - Tiago Cardoso
-autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-07-26 00:00:00.000000000 Z
+date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: base64
@@ -30,24 +29,24 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.28'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.28'
 description: Implementation of the OAuth 2.0 protocol on top of rodauth.
 email:
 - cardoso_tiago@hotmail.com
 executables: []
 extensions: []
 extra_rdoc_files:
+- CHANGELOG.md
 - LICENSE.txt
-- README.md
 - MIGRATION-GUIDE-v1.md
-- CHANGELOG.md
+- README.md
 - doc/release_notes/0_0_1.md
 - doc/release_notes/0_0_2.md
 - doc/release_notes/0_0_3.md
@@ -92,6 +91,8 @@ extra_rdoc_files:
 - doc/release_notes/1_6_1.md
 - doc/release_notes/1_6_2.md
 - doc/release_notes/1_6_3.md
+- doc/release_notes/1_6_4.md
+- doc/release_notes/1_6_5.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -141,6 +142,8 @@ files:
 - doc/release_notes/1_6_1.md
 - doc/release_notes/1_6_2.md
 - doc/release_notes/1_6_3.md
+- doc/release_notes/1_6_4.md
+- doc/release_notes/1_6_5.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -227,7 +230,6 @@ metadata:
   source_code_uri: https://gitlab.com/os85/rodauth-oauth
   changelog_uri: https://gitlab.com/os85/rodauth-oauth/-/blob/master/CHANGELOG.md
   rubygems_mfa_required: 'true'
-post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -242,8 +244,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.5.3
-signing_key:
+rubygems_version: 3.6.9
 specification_version: 4
 summary: Implementation of the OAuth 2.0 protocol on top of rodauth.
 test_files: []