rodauth-oauth 1.6.5 → 1.6.7

data/lib/rodauth/features/oauth_dynamic_client_registration.rb

@@ -12,7 +12,23 @@ module Rodauth
     auth_value_method :oauth_applications_registration_access_token_column, :registration_access_token
     auth_value_method :registration_client_uri_route, "register"
 
-    PROTECTED_APPLICATION_ATTRIBUTES = %w[account_id client_id].freeze
+    translatable_method :register_no_client_secret_if_public, "Client secret is not allowed for a public client"
+
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_application_params,
+        :@oauth_application_unrecognized_params
+      )
+    end
+
+    PROTECTED_APPLICATION_CREATE_ATTRIBUTES = %w[account_id client_id].freeze
+
+    PROTECTED_APPLICATION_UPDATE_ATTRIBUTES = %w[
+      account_id client_id registration_access_token
+      registration_client_uri client_secret_expires_at client_id_issued_at
+    ].freeze
+
+    HIDDEN_APPLICATION_ATTRIBUTES = %w[id account_id client_id client_secret client_secret_hash].freeze
 
     def load_registration_client_uri_routes
       request.on(registration_client_uri_route) do
@@ -34,19 +50,23 @@ module Rodauth
               json_response_oauth_application(oauth_application)
             end
             request.on method: :put do
-              %w[client_id registration_access_token registration_client_uri client_secret_expires_at
-                 client_id_issued_at].each do |prohibited_param|
-                if request.params.key?(prohibited_param)
-                  register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(prohibited_param))
-                end
+              params = request.params
+
+              validate_client_registration_params(params, PROTECTED_APPLICATION_UPDATE_ATTRIBUTES)
+
+              if params.key?("client_secret") && !secret_matches?(oauth_application, params["client_secret"])
+                # if the client includes the "client_secret" field in the request, the value of this field MUST match the currently
+                # issued client secret for that client.  The client MUST NOT be allowed to overwrite its existing client secret with
+                # its own chosen value.
+                authorization_required
               end
-              validate_client_registration_params
 
-              # if the client includes the "client_secret" field in the request, the value of this field MUST match the currently
-              # issued client secret for that client.  The client MUST NOT be allowed to overwrite its existing client secret with
-              # its own chosen value.
-              authorization_required if request.params.key?("client_secret") && secret_matches?(oauth_application,
-                                                                                                request.params["client_secret"])
+              if params.key?("client_secret")
+                next_oauth_application = oauth_application.merge(@oauth_application_params)
+                unless confidential?(next_oauth_application)
+                  register_throw_json_response_error("invalid_client_metadata", register_no_client_secret_if_public)
+                end
+              end
 
               oauth_application = transaction do
                 applications_ds = db[oauth_applications_table]
@@ -80,7 +100,7 @@ module Rodauth
           end
         end
 
-        validate_client_registration_params
+        validate_client_registration_params(request.params, PROTECTED_APPLICATION_CREATE_ATTRIBUTES)
 
         response_params = transaction do
           before_register
@@ -108,7 +128,7 @@ module Rodauth
 
     def _before_register
       raise %{dynamic client registration requires authentication.
-        Override ´before_register` to perform it.
+        Override `before_register` to perform it.
         example:
 
           before_register do
@@ -119,8 +139,14 @@ module Rodauth
       }
     end
 
-    def validate_client_registration_params(request_params = request.params)
+    def validate_client_registration_params(request_params, protected_attributes = PROTECTED_APPLICATION_CREATE_ATTRIBUTES)
+      @oauth_application_unrecognized_params = []
       @oauth_application_params = request_params.each_with_object({}) do |(key, value), params|
+        if protected_attributes.include?(key)
+          register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(key))
+          next
+        end
+
         case key
         when "redirect_uris"
           if value.is_a?(Array)
@@ -179,6 +205,10 @@ module Rodauth
             end
           end
           key = __send__(:"oauth_applications_#{key}_column")
+        when "client_secret"
+          # use internal routine which may hash the secret
+          set_client_secret(params, value)
+          next
         when "jwks"
           register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(value)) unless value.is_a?(Hash)
           if request_params.key?("jwks_uri")
@@ -248,13 +278,14 @@ module Rodauth
           key = __send__(:"oauth_applications_#{key}_column")
         else
           if respond_to?(:"oauth_applications_#{key}_column")
-            if PROTECTED_APPLICATION_ATTRIBUTES.include?(key)
-              register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(key))
-            end
             property = :"oauth_applications_#{key}_column"
             key = __send__(property)
           elsif !db[oauth_applications_table].columns.include?(key.to_sym)
-            register_throw_json_response_error("invalid_client_metadata", register_invalid_param_message(key))
+            # https://datatracker.ietf.org/doc/html/rfc7591#section-3.1
+            # "The authorization server MUST ignore any client metadata sent by the client that it
+            # does not understand".
+            @oauth_application_unrecognized_params << key
+            next
           end
         end
         params[key] = value
@@ -285,6 +316,9 @@ module Rodauth
       applications_ds = db[oauth_applications_table]
       application_columns = applications_ds.columns
 
+      # ignored metadata is not part of the registration, so it does not belong in the response either
+      Array(@oauth_application_unrecognized_params).each { |key| return_params.delete(key) }
+
       # set defaults
       create_params = @oauth_application_params
 
@@ -310,8 +344,9 @@ module Rodauth
         return_params["response_types"] = %w[code]
         "code"
       end
+
       rescue_from_uniqueness_error do
-        initialize_register_params(create_params, return_params)
+        initialize_create_params(create_params, return_params)
         create_params.delete_if { |k, _| !application_columns.include?(k) }
         applications_ds.insert(create_params)
       end
@@ -319,27 +354,30 @@ module Rodauth
       return_params
     end
 
-    def initialize_register_params(create_params, return_params)
+    def initialize_create_params(create_params, return_params)
       client_id = oauth_unique_id_generator
       create_params[oauth_applications_client_id_column] = client_id
       return_params["client_id"] = client_id
-      return_params["client_id_issued_at"] = Time.now.utc.iso8601
+      # https://datatracker.ietf.org/doc/html/rfc7591#section-3.2.1
+      # "client_id_issued_at" is a number, expressed as seconds since 1970-01-01T00:00:00Z.
+      return_params["client_id_issued_at"] = Time.now.to_i
 
-      registration_access_token = oauth_unique_id_generator
-      create_params[oauth_applications_registration_access_token_column] = secret_hash(registration_access_token)
-      return_params["registration_access_token"] = registration_access_token
-      return_params["registration_client_uri"] = "#{base_url}/#{registration_client_uri_route}/#{return_params['client_id']}"
+      if create_params.key?(oauth_applications_client_secret_column) && !confidential?(create_params)
+        register_throw_json_response_error("invalid_client_metadata", register_no_client_secret_if_public)
+      end
+
+      return_params.delete("client_secret")
+
+      unless (client_secret = create_params.key?(oauth_applications_client_secret_column))
+        # do not generate a secret for a confidential client
+        return unless confidential?(create_params)
 
-      if create_params.key?(oauth_applications_client_secret_column)
-        set_client_secret(create_params, create_params[oauth_applications_client_secret_column])
-        return_params.delete("client_secret")
-      else
         client_secret = oauth_unique_id_generator
-        set_client_secret(create_params, client_secret)
         return_params["client_secret"] = client_secret
         return_params["client_secret_expires_at"] = 0
-
       end
+
+      set_client_secret(create_params, client_secret)
     end
 
     def register_throw_json_response_error(code, message)
@@ -404,7 +442,7 @@ module Rodauth
       params = methods.map { |k| k.to_s[/\Aoauth_applications_(\w+)_column\z/, 1] }.compact
 
       body = params.each_with_object({}) do |k, hash|
-        next if %w[id account_id client_id client_secret cliennt_secret_hash].include?(k)
+        next if HIDDEN_APPLICATION_ATTRIBUTES.include?(k)
 
         value = oauth_application[__send__(:"oauth_applications_#{k}_column")]
 

data/lib/rodauth/features/oauth_grant_management.rb

@@ -25,6 +25,12 @@ module Rodauth
       :oauth_grant_path
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_grants
+      )
+    end
+
     def oauth_grants_path(opts = {})
       route_path(oauth_grants_route, opts)
     end

data/lib/rodauth/features/oauth_jwt.rb

@@ -51,7 +51,7 @@ module Rodauth
     def authorization_token
       return super unless oauth_jwt_access_tokens
 
-      return @authorization_token if defined?(@authorization_token)
+      return @authorization_token if @authorization_token
 
       @authorization_token = decode_access_token
     end

data/lib/rodauth/features/oauth_jwt_base.rb

@@ -18,6 +18,11 @@ module Rodauth
 
     auth_value_method :oauth_jwt_jwe_copyright, nil
 
+    # Clock-skew leeway, in seconds, tolerated when rejecting a JWT whose iat (issued-at) is in the
+    # future. iat is informational per RFC 7519 section 4.1.6, so this only guards against tokens
+    # issued well ahead of now. Applies to the json-jwt verification path (see jwt_decode).
+    auth_value_method :oauth_jwt_iat_leeway, 30
+
     auth_methods(
       :jwt_encode,
       :jwt_decode,
@@ -28,6 +33,14 @@ module Rodauth
       :resource_owner_params_from_jwt_claims
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_jwt_issuer,
+        :@oauth_jwt_audience,
+        :@_jwt_key
+      )
+    end
+
     private
 
     def oauth_jwt_issuer
@@ -266,15 +279,28 @@ module Rodauth
                  end
 
         now = Time.now
-        if verify_claims &&
-           (!claims[:exp] || Time.at(claims[:exp]) < now) &&
-           claims[:nbf] && Time.at(claims[:nbf]) < now &&
-           claims[:iat] && Time.at(claims[:iat]) < now &&
-           verify_iss && claims[:iss] != oauth_jwt_issuer &&
-           verify_aud && !verify_aud(claims[:aud], claims[:client_id]) &&
-           verify_jti && !verify_jti(claims[:jti], claims)
-
-          return
+        if verify_claims
+          # Each line asserts that a claim is acceptable: absent / not checked, or valid. The token
+          # is rejected unless all of them hold. These are deliberately PASS conditions joined with
+          # `&&` -- the inverse (failure conditions joined with `&&`) only rejects when every check
+          # fails at once, which was the original verification bug. exp/nbf/iat are optional and
+          # only enforced when present (e.g. DPoP proofs carry no exp).
+          #
+          # iat is informational per RFC 7519 section 4.1.6 (RFC 9068 section 4 requires it be present,
+          # not verified), so we only reject tokens issued in the future, tolerating
+          # oauth_jwt_iat_leeway seconds of clock skew. Both backends now honor oauth_jwt_iat_leeway:
+          # the ruby-jwt path disables verify_iat (which removed iat_leeway in 2.2.0, jwt/ruby-jwt#319)
+          # and performs the same leeway'd future-iat check manually, so behavior is unified.
+          # A non-numeric iat is malformed (NumericDate per RFC 7519); reject it rather than letting
+          # Time.at raise, mirroring the ruby-jwt path so both backends reject malformed iat alike.
+          claims_valid = (!claims[:exp] || Time.at(claims[:exp]) >= now) &&
+                         (!claims[:nbf] || Time.at(claims[:nbf]) <= now) &&
+                         (!claims[:iat] || (claims[:iat].is_a?(Numeric) && Time.at(claims[:iat]) <= now + oauth_jwt_iat_leeway)) &&
+                         (!verify_iss || claims[:iss] == oauth_jwt_issuer) &&
+                         (!verify_aud || verify_aud(claims[:aud], claims[:client_id])) &&
+                         (!verify_jti || verify_jti(claims[:jti], claims))
+
+          return unless claims_valid
         end
 
         return if verify_headers && !verify_headers.call(claims.header)
@@ -413,7 +439,12 @@ module Rodauth
         #
         # issuer: check that server generated the token
         # aud: check the audience field (client is who he says he is)
-        # iat: check that the token didn't expire
+        # exp: check that the token hasn't expired
+        # iat: informational per RFC 7519 section 4.1.6, so we only reject a future iat, tolerating
+        #      oauth_jwt_iat_leeway seconds of clock skew. ruby-jwt's verify_iat offers no leeway knob
+        #      (iat_leeway was removed in 2.2.0, jwt/ruby-jwt#319), so verify_iat is disabled below and
+        #      iat is checked manually -- unifying behavior with the json-jwt path, which honors the
+        #      same oauth_jwt_iat_leeway.
         #
         # subject can't be verified automatically without having access to the account id,
         # which we don't because that's the whole point.
@@ -425,7 +456,9 @@ module Rodauth
                                    # can't use stock aud verification, as it's dependent on the client application id
                                    verify_aud: false,
                                    verify_jti: (verify_jti ? method(:verify_jti) : false),
-                                   verify_iat: true
+                                   # iat is verified manually below (with leeway) rather than via
+                                   # ruby-jwt's verify_iat, which rejects a future iat with no leeway.
+                                   verify_iat: false
                                  }
                                else
                                  {}
@@ -456,6 +489,16 @@ module Rodauth
                             JWT.decode(token, nil, true, jwks: jwks, algorithms: algorithms, **verify_claims_params)
                           end
 
+        # iat is only rejected when issued in the future, tolerating oauth_jwt_iat_leeway seconds of
+        # clock skew -- mirroring the json-jwt path so both backends behave identically. ruby-jwt
+        # claims are string-keyed. Since verify_iat is disabled above, ruby-jwt no longer validates
+        # that iat is a NumericDate, so reject a non-numeric iat here rather than letting Time.at
+        # raise an error the JWT::DecodeError handler would not catch.
+        if verify_claims && (iat = claims["iat"])
+          return unless iat.is_a?(Numeric)
+          return if Time.at(iat) > Time.now + oauth_jwt_iat_leeway
+        end
+
         return if verify_claims && verify_aud && !verify_aud(claims["aud"], claims["client_id"])
 
         return if verify_headers && !verify_headers.call(headers)
@@ -496,7 +539,7 @@ module Rodauth
         JWT.decode(token, nil, false)
       end
     else
-      # :nocov:
+      # simplecov:enable
       def jwk_export(_key)
         raise "#{__method__} is undefined, redefine it or require either \"jwt\" or \"json-jwt\""
       end
@@ -520,7 +563,7 @@ module Rodauth
       def private_jwk?(_jwk)
         raise "#{__method__} is undefined, redefine it or require either \"jwt\" or \"json-jwt\""
       end
-      # :nocov:
+      # simplecov:disable
     end
   end
 end

data/lib/rodauth/features/oauth_jwt_bearer_grant.rb

@@ -28,6 +28,14 @@ module Rodauth
 
     private
 
+    def oauth_confidential_token_endpoint_auth_methods
+      if oauth_applications_client_secret_hash_column.nil?
+        super | %w[client_secret_jwt private_key_jwt urn:ietf:params:oauth:client-assertion-type:jwt-bearer]
+      else
+        super | %w[private_key_jwt]
+      end
+    end
+
     def require_oauth_application_from_jwt_bearer_assertion_issuer(assertion)
       claims = jwt_assertion(assertion)
 

data/lib/rodauth/features/oauth_jwt_jwks.rb

@@ -17,6 +17,12 @@ module Rodauth
       end
     end
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@jwks_set
+      )
+    end
+
     private
 
     def oauth_server_metadata_body(path = nil)

data/lib/rodauth/features/oauth_jwt_secured_authorization_request.rb

@@ -23,6 +23,12 @@ module Rodauth
 
     auth_value_method :max_param_bytesize, nil if Rodauth::VERSION >= "2.26.0"
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@require_signed_request_object
+      )
+    end
+
     private
 
     # /authorize
@@ -93,7 +99,7 @@ module Rodauth
     end
 
     def require_signed_request_object?
-      return @require_signed_request_object if defined?(@require_signed_request_object)
+      return @require_signed_request_object if @require_signed_request_object
 
       @require_signed_request_object = (oauth_application[oauth_applications_require_signed_request_object_column] if oauth_application)
       @require_signed_request_object = oauth_require_signed_request_object if @require_signed_request_object.nil?

data/lib/rodauth/features/oauth_pkce.rb

@@ -9,6 +9,11 @@ module Rodauth
     auth_value_method :oauth_require_pkce, true
     auth_value_method :oauth_pkce_challenge_method, "S256"
 
+    # TODO: change to false in a major version bump
+    # RFC 7636 §4.2 discourages the "plain" transform: it transmits the raw code_verifier,
+    # so an intercepted authorization request exposes it and defeats PKCE.
+    auth_value_method :oauth_pkce_allow_plain_method, true
+
     auth_value_method :oauth_grants_code_challenge_column, :code_challenge
     auth_value_method :oauth_grants_code_challenge_method_column, :code_challenge_method
 
@@ -17,6 +22,16 @@ module Rodauth
     auth_value_method :oauth_unsupported_transform_algorithm_error_code, "invalid_request"
     translatable_method :oauth_unsupported_transform_algorithm_message, "transform algorithm not supported"
 
+    def authorize_form_params
+      super.tap do |params|
+        %w[code_challenge code_challenge_method].each do |param_name|
+          if (param_value = param_or_nil(param_name))
+            params << { "name" => param_name, "value" => param_value, "type" => "hidden" }
+          end
+        end
+      end
+    end
+
     private
 
     def supports_auth_method?(oauth_application, auth_method)
@@ -61,7 +76,13 @@ module Rodauth
       if param_or_nil("code_challenge")
 
         challenge_method = param_or_nil("code_challenge_method")
-        redirect_response_error("code_challenge_required") unless oauth_pkce_challenge_method == challenge_method
+
+        # Reject the weak "plain" transform unless it has been explicitly opted into. This runs
+        # before the supported-method check so the disabled method surfaces a meaningful error
+        # instead of the generic "code challenge required".
+        redirect_response_error("unsupported_transform_algorithm") if challenge_method == "plain" && !oauth_pkce_allow_plain_method
+
+        redirect_response_error("code_challenge_required") unless oauth_pkce_challenge_methods.include?(challenge_method)
       else
         return unless oauth_require_pkce
 
@@ -74,19 +95,29 @@ module Rodauth
 
       case grant[oauth_grants_code_challenge_method_column]
       when "plain"
-        challenge == verifier
+        # A grant stored with the weak "plain" method must not be redeemable unless the
+        # method has been explicitly enabled, otherwise PKCE is silently downgraded.
+        redirect_response_error("unsupported_transform_algorithm") unless oauth_pkce_allow_plain_method
+        timing_safe_eql?(verifier.to_s, challenge.to_s)
       when "S256"
         generated_challenge = Base64.urlsafe_encode64(Digest::SHA256.digest(verifier), padding: false)
 
-        challenge == generated_challenge
+        timing_safe_eql?(generated_challenge, challenge.to_s)
       else
         redirect_response_error("unsupported_transform_algorithm")
       end
     end
 
+    # The PKCE transform methods the server accepts. "S256" is always supported; the weak "plain"
+    # transform is only included when explicitly opted into via oauth_pkce_allow_plain_method.
+    def oauth_pkce_challenge_methods
+      oauth_pkce_allow_plain_method ? %w[S256 plain] : %w[S256]
+    end
+
     def oauth_server_metadata_body(*)
       super.tap do |data|
-        data[:code_challenge_methods_supported] = oauth_pkce_challenge_method
+        # RFC 8414: code_challenge_methods_supported is a JSON array of the supported methods.
+        data[:code_challenge_methods_supported] = oauth_pkce_challenge_methods
       end
     end
   end

data/lib/rodauth/features/oauth_pushed_authorization_request.rb

@@ -19,6 +19,12 @@ module Rodauth
       auth_value_method :"oauth_pushed_authorization_requests_#{column}_column", column
     end
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@require_signed_request_object
+      )
+    end
+
     # /par
     auth_server_route(:par) do |r|
       require_oauth_application

data/lib/rodauth/features/oauth_resource_indicators.rb

@@ -8,8 +8,14 @@ module Rodauth
 
     auth_value_method :oauth_grants_resource_column, :resource
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@resource_indicators
+      )
+    end
+
     def resource_indicators
-      return @resource_indicators if defined?(@resource_indicators)
+      return @resource_indicators if @resource_indicators
 
       resources = param_or_nil("resource")
 
@@ -46,6 +52,15 @@ module Rodauth
       authorization_required unless token_indicators.any? { |resource| base_url.start_with?(resource) }
     end
 
+    def authorize_form_params
+      super.tap do |params|
+        # the "resource" param may be repeated, so it carries one entry per resource indicator
+        Array(resource_indicators).each do |resource|
+          params << { "name" => "resource", "value" => resource, "type" => "hidden" }
+        end
+      end
+    end
+
     private
 
     def validate_token_params

data/lib/rodauth/features/oauth_resource_server.rb

@@ -13,7 +13,7 @@ module Rodauth
     )
 
     def authorization_token
-      return @authorization_token if defined?(@authorization_token)
+      return @authorization_token if @authorization_token
 
       # check if there is a token
       access_token = fetch_access_token

data/lib/rodauth/features/oauth_saml_bearer_grant.rb

@@ -34,6 +34,13 @@ module Rodauth
       :account_from_saml2_bearer_assertion
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@saml_settings,
+        :@assertion
+      )
+    end
+
     def oauth_grant_types_supported
       super | %w[urn:ietf:params:oauth:grant-type:saml2-bearer]
     end
@@ -98,9 +105,8 @@ module Rodauth
       settings
     end
 
-    # rubocop:disable Naming/MemoizedInstanceVariableName
     def parse_saml_assertion(assertion)
-      return @assertion if defined?(@assertion)
+      return @assertion if @assertion
 
       response = OneLogin::RubySaml::Response.new(assertion)
 
@@ -129,7 +135,6 @@ module Rodauth
 
       @assertion = response
     end
-    # rubocop:enable Naming/MemoizedInstanceVariableName
 
     def oauth_server_metadata_body(*)
       super.tap do |data|

data/lib/rodauth/features/oauth_tls_client_auth.rb

@@ -21,12 +21,24 @@ module Rodauth
 
     auth_value_method :oauth_grants_certificate_thumbprint_column, :certificate_thumbprint
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@client_certificate,
+        :@certificate,
+        :@client_certificate_sans
+      )
+    end
+
     def oauth_token_endpoint_auth_methods_supported
       super | %w[tls_client_auth self_signed_tls_client_auth]
     end
 
     private
 
+    def oauth_confidential_token_endpoint_auth_methods
+      super | %w[tls_client_auth self_signed_tls_client_auth]
+    end
+
     def validate_token_params
       # For all requests to the authorization server utilizing mutual-TLS client authentication,
       # the client MUST include the client_id parameter
@@ -124,7 +136,7 @@ module Rodauth
     end
 
     def client_certificate
-      return @client_certificate if defined?(@client_certificate)
+      return @client_certificate if @client_certificate
 
       unless (pem_cert = request.env["SSL_CLIENT_CERT"] || request.env["HTTP_SSL_CLIENT_CERT"] || request.env["HTTP_X_SSL_CLIENT_CERT"])
         return
@@ -136,7 +148,7 @@ module Rodauth
     end
 
     def client_certificate_sans
-      return @client_certificate_sans if defined?(@client_certificate_sans)
+      return @client_certificate_sans if @client_certificate_sans
 
       @client_certificate_sans =
         if client_certificate

data/lib/rodauth/features/oauth_token_revocation.rb

@@ -117,7 +117,8 @@ module Rodauth
     def oauth_server_metadata_body(*)
       super.tap do |data|
         data[:revocation_endpoint] = revoke_url
-        data[:revocation_endpoint_auth_methods_supported] = nil # because it's client_secret_basic
+        # revocation_endpoint_auth_methods_supported must be absent: it defaults to client_secret_basic
+        data.delete(:revocation_endpoint_auth_methods_supported)
       end
     end
   end