rodauth-oauth 1.6.5 → 1.6.7

data/lib/rodauth/features/oidc.rb

@@ -115,6 +115,12 @@ module Rodauth
       :json_webfinger_payload
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@acr
+      )
+    end
+
     # /userinfo
     auth_server_route(:userinfo) do |r|
       r.on method: %i[get post] do
@@ -221,6 +227,14 @@ module Rodauth
       end
     end
 
+    def get_oidc_param(_, _)
+      raise NotImplementedError, "`get_oidc_param(account, claim)` auth method must be implemented to use oidc scopes."
+    end
+
+    def get_additional_param(_, _)
+      raise NotImplementedError, "`get_oidc_param(account, claim)` auth method must be implemented to use oidc scopes."
+    end
+
     def oauth_response_types_supported
       grant_types = oauth_grant_types_supported
       oidc_response_types = %w[id_token none]
@@ -235,6 +249,16 @@ module Rodauth
       super unless subject_type == "pairwise"
     end
 
+    def authorize_form_params
+      super.tap do |params|
+        %w[prompt nonce ui_locales claims_locales claims acr_values].each do |param_name|
+          if (param_value = param_or_nil(param_name))
+            params << { "name" => param_name, "value" => param_value, "type" => "hidden" }
+          end
+        end
+      end
+    end
+
     private
 
     if defined?(::I18n)
@@ -616,35 +640,27 @@ module Rodauth
       claims_locales = claims_locales.split(" ").map(&:to_sym) if claims_locales
 
       unless oidc_scopes.empty?
-        if respond_to?(:get_oidc_param)
-          get_oidc_param = proxy_get_param(:get_oidc_param, claims, claims_locales, additional_claims_info)
+        get_oidc_param = proxy_get_param(:get_oidc_param, claims, claims_locales, additional_claims_info)
 
-          oidc_scopes.each do |scope|
-            scope_claims = claims
-            params = scopes_by_claim[scope]
-            params = params.empty? ? OIDC_SCOPES_MAP[scope] : (OIDC_SCOPES_MAP[scope] & params)
+        oidc_scopes.each do |scope|
+          scope_claims = claims
+          params = scopes_by_claim[scope]
+          params = params.empty? ? OIDC_SCOPES_MAP[scope] : (OIDC_SCOPES_MAP[scope] & params)
 
-            scope_claims = (claims["address"] = {}) if scope == "address"
+          scope_claims = (claims["address"] = {}) if scope == "address"
 
-            params.each do |param|
-              get_oidc_param[account, param, scope_claims]
-            end
+          params.each do |param|
+            get_oidc_param[account, param, scope_claims]
           end
-        else
-          warn "`get_oidc_param(account, claim)` must be implemented to use oidc scopes."
         end
       end
 
       return if additional_scopes.empty?
 
-      if respond_to?(:get_additional_param)
-        get_additional_param = proxy_get_param(:get_additional_param, claims, claims_locales, additional_claims_info)
+      get_additional_param = proxy_get_param(:get_additional_param, claims, claims_locales, additional_claims_info)
 
-        additional_scopes.each do |scope|
-          get_additional_param[account, scope.to_sym]
-        end
-      else
-        warn "`get_additional_param(account, claim)` must be implemented to use oidc scopes."
+      additional_scopes.each do |scope|
+        get_additional_param[account, scope.to_sym]
       end
     end
 

data/lib/rodauth/features/oidc_dynamic_client_registration.rb

@@ -287,7 +287,7 @@ module Rodauth
       "The application type '#{application_type}' is not allowed."
     end
 
-    def initialize_register_params(create_params, return_params)
+    def initialize_create_params(create_params, return_params)
       super
       registration_access_token = oauth_unique_id_generator
       create_params[oauth_applications_registration_access_token_column] = secret_hash(registration_access_token)

data/lib/rodauth/features/oidc_frontchannel_logout.rb

@@ -2,10 +2,10 @@
 
 require "rodauth/oauth"
 
-# :nocov:
+# simplecov:enable
 raise LoadError, "the `:oidc_frontchannel_logout` requires rodauth 2.32.0 or higher" if Rodauth::VERSION < "2.32.0"
 
-# :nocov:
+# simplecov:disable
 
 module Rodauth
   Feature.define(:oidc_frontchannel_logout, :OidFrontchannelLogout) do
@@ -22,6 +22,14 @@ module Rodauth
     auth_value_method :oauth_applications_frontchannel_logout_uri_column, :frontchannel_logout_uri
     auth_value_method :oauth_applications_frontchannel_logout_session_required_column, :frontchannel_logout_session_required
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@visited_sites,
+        :@frontchannel_logout_redirect,
+        :@frontchannel_logout_urls
+      )
+    end
+
     attr_reader :frontchannel_logout_urls
 
     attr_reader :frontchannel_logout_redirect
@@ -32,6 +40,8 @@ module Rodauth
       super
     end
 
+    private
+
     def _logout_response
       visited_sites = @visited_sites
 
@@ -71,8 +81,6 @@ module Rodauth
       return_response frontchannel_logout_view
     end
 
-    private
-
     def generate_frontchannel_logout_urls(visited_sites, logout_urls)
       @frontchannel_logout_urls = logout_urls.flat_map do |client_id, logout_url|
         next unless logout_url

data/lib/rodauth/features/oidc_rp_initiated_logout.rb

@@ -13,6 +13,12 @@ module Rodauth
 
     attr_reader :oidc_logout_redirect
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oidc_logout_redirect
+      )
+    end
+
     # /oidc-logout
     auth_server_route(:oidc_logout) do |r|
       require_authorizable_account
@@ -109,12 +115,12 @@ module Rodauth
       end
     end
 
+    private
+
     def _oidc_logout_response
       redirect(oidc_logout_redirect)
     end
 
-    private
-
     # Logout
 
     def validate_oidc_logout_params

data/lib/rodauth/features/oidc_self_issued.rb

@@ -19,7 +19,7 @@ module Rodauth
     }.freeze
 
     def oauth_application
-      return @oauth_application if defined?(@oauth_application)
+      return @oauth_application if @oauth_application
 
       return super unless (registration = param_or_nil("registration"))
 
@@ -38,6 +38,14 @@ module Rodauth
       @oauth_application = client_params
     end
 
+    def authorize_form_params
+      super.tap do |params|
+        if (param_value = param_or_nil("registration"))
+          params << { "name" => "registration", "value" => param_value, "type" => "hidden" }
+        end
+      end
+    end
+
     private
 
     def oauth_response_types_supported

data/lib/rodauth/oauth/database_extensions.rb

@@ -2,7 +2,7 @@
 
 module Rodauth
   module OAuth
-    # rubocop:disable Naming/MethodName
+    # rubocop:disable-next Naming/MethodName
     def self.ExtendDatabase(db)
       Module.new do
         dataset = db.dataset
@@ -87,6 +87,5 @@ module Rodauth
         end
       end
     end
-    # rubocop:enable Naming/MethodName
   end
 end

data/lib/rodauth/oauth/ttl_store.rb

@@ -23,7 +23,7 @@ class Rodauth::OAuth::TtlStore
   def set(key, &block)
     @store_mutex.synchronize do
       # short circuit
-      return @store[key][:payload] if @store[key] && @store[key][:ttl] < now
+      return @store[key][:payload] if @store[key] && @store[key][:ttl] > now
     end
 
     payload, ttl = block.call
@@ -33,9 +33,9 @@ class Rodauth::OAuth::TtlStore
     @store_mutex.synchronize do
       # given that the block call triggers network, and two requests for the same key be processed
       # at the same time, this ensures the first one wins.
-      return @store[key][:payload] if @store[key] && @store[key][:ttl] < now
+      return @store[key][:payload] if @store[key] && @store[key][:ttl] > now
 
-      @store[key] = { payload: payload, ttl: ttl || (now + DEFAULT_TTL) }
+      @store[key] = { payload: payload, ttl: now + (ttl || DEFAULT_TTL) }
     end
     @store[key][:payload]
   end

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.6.5"
+    VERSION = "1.6.7"
   end
 end

data/locales/en.yml

@@ -40,6 +40,9 @@ en:
     oauth_applications_redirect_uri_label: "Redirect URL"
     oauth_applications_client_secret_label: "Client Secret"
     oauth_applications_client_id_label: "Client ID"
+    oauth_applications_client_type_label: "Client Type"
+    oauth_applications_confidential_label: "Confidential"
+    oauth_applications_public_label: "Public"
     oauth_no_applications_text: "No oauth applications yet!"
     oauth_grant_user_code_label: "User code"
     oauth_grant_user_jws_jwk_label: "JSON Web Keys"
@@ -87,3 +90,4 @@ en:
     oauth_use_dpop_nonce_message: "DPoP nonce is required"
     oauth_access_token_dpop_bound_message: "DPoP bound access token requires DPoP proof"
     oauth_multiple_auth_methods_message: "Multiple methods used to include access token"
+    register_no_client_secret_if_public: "Client secret is not allowed for a public OAuth application"

data/locales/pt.yml

@@ -40,6 +40,9 @@ pt:
     oauth_applications_redirect_uri_label: "URL para redireccionamento"
     oauth_applications_client_secret_label: "Segredo de cliente"
     oauth_applications_client_id_label: "ID do cliente"
+    oauth_applications_client_type_label: "Tipo de cliente"
+    oauth_applications_confidential_label: "Confidencial"
+    oauth_applications_public_label: "Público"
     oauth_no_applications_text: "Nenhum aplicativo OAuth ainda!"
     oauth_grant_user_code_label: "Código do usuário"
     oauth_grant_user_jws_jwk_label: "Chaves JSON Web"
@@ -77,3 +80,4 @@ pt:
     oauth_saml_assertion_single_issuer_message: "A asserção SAML tem que ter um único emissor"
     oauth_saml_settings_not_found_message: "Nenhuma configuração SAML encontrada para o emissor"
     oauth_invalid_id_token_hint_message: "ID token hint inválido"
+    register_no_client_secret_if_public: "Segredo de cliente não é permitido em um aplicativo OAuth público"

data/templates/authorize.str

@@ -10,7 +10,7 @@
   <p class="lead">
   #{
     application_uri = rodauth.oauth_application[rodauth.oauth_applications_homepage_url_column]
-    application_name = application_uri ? (<<-LINK) : rodauth.oauth_application[rodauth.oauth_applications_name_column]
+    application_name = application_uri ? (<<-LINK) : h(rodauth.oauth_application[rodauth.oauth_applications_name_column])
       <a target="_blank" href="#{h(application_uri)}">
         #{h(rodauth.oauth_application[rodauth.oauth_applications_name_column])}
       </a>
@@ -62,7 +62,7 @@
     #{
       rodauth.authorize_scopes.map do |scope|
         if rodauth.features.include?(:oidc) && scope == "offline_access"
-          "<input type=\"hidden\" name=\"scope[]\" value=\"#{scope}\" />"
+          "<input type=\"hidden\" name=\"scope[]\" value=\"#{h(scope)}\" />"
         else
           <<-HTML
             <div class="form-check">
@@ -74,34 +74,16 @@
       end.join
     }
 
-    <input type="hidden" name="client_id" value="#{rodauth.param("client_id")}"/>
-    #{"<input type=\"hidden\" name=\"access_type\" value=\"#{rodauth.param("access_type")}\"/>" if rodauth.param_or_nil("access_type")}
-    #{"<input type=\"hidden\" name=\"response_type\" value=\"#{rodauth.param("response_type")}\"/>" if rodauth.param_or_nil("response_type")}
-    #{"<input type=\"hidden\" name=\"response_mode\" value=\"#{rodauth.param("response_mode")}\"/>" if rodauth.param_or_nil("response_mode")}
-    #{"<input type=\"hidden\" name=\"state\" value=\"#{rodauth.param("state")}\"/>" if rodauth.param_or_nil("state")}
-    #{"<input type=\"hidden\" name=\"redirect_uri\" value=\"#{rodauth.redirect_uri}\"/>" if rodauth.param_or_nil("redirect_uri")}
-    #{"<input type=\"hidden\" name=\"code_challenge\" value=\"#{rodauth.param("code_challenge")}\"/>" if rodauth.features.include?(:oauth_pkce) && rodauth.param_or_nil("code_challenge")}
-    #{"<input type=\"hidden\" name=\"code_challenge_method\" value=\"#{rodauth.param("code_challenge_method")}\"/>" if rodauth.features.include?(:oauth_pkce) && rodauth.param_or_nil("code_challenge_method")}
-    #{"<input type=\"hidden\" name=\"prompt\" value=\"#{rodauth.param("prompt")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("prompt")}
-    #{"<input type=\"hidden\" name=\"nonce\" value=\"#{rodauth.param("nonce")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("nonce")}
-    #{"<input type=\"hidden\" name=\"ui_locales\" value=\"#{rodauth.param("ui_locales")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("ui_locales")}
-    #{"<input type=\"hidden\" name=\"claims_locales\" value=\"#{rodauth.param("claims_locales")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("claims_locales")}
-    #{"<input type=\"hidden\" name=\"claims\" value=\"#{h(rodauth.param("claims"))}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("claims")}
-    #{"<input type=\"hidden\" name=\"acr_values\" value=\"#{rodauth.param("acr_values")}\"/>" if rodauth.features.include?(:oidc) && rodauth.param_or_nil("acr_values")}
-    #{"<input type=\"hidden\" name=\"registration\" value=\"#{h(rodauth.param("registration"))}\"/>" if rodauth.features.include?(:oidc_self_issued) && rodauth.param_or_nil("registration")}
     #{
-      if rodauth.features.include?(:oauth_resource_indicators) && rodauth.resource_indicators
-        rodauth.resource_indicators.map do |resource|
-          "<input type=\"hidden\" name=\"resource\" value=\"#{resource}\"/>"
-        end.join
-      end
-      }
-    #{"<input type=\"hidden\" name=\"dpop_jkt\" value=\"#{h(rodauth.param("dpop_jkt"))}\"/>" if rodauth.features.include?(:oauth_dpop) && rodauth.param_or_nil("dpop_jkt")}
+      rodauth.authorize_form_params.map do |field|
+        "<input type=\"#{h(field["type"])}\" name=\"#{h(field["name"])}\" value=\"#{h(field["value"])}\"/>"
+      end.join
+    }
   </div>
   <p class="text-center">
     <input type="submit" class="btn btn-outline-primary" value="#{h(rodauth.oauth_authorize_button)}"/>
-    <a href="#{rodauth.redirect_uri}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{ "&state=#{rodauth.param("state")}" if rodauth.param_or_nil("state")}" class="btn btn-outline-danger">
-      #{rodauth.oauth_cancel_button}
+    <a href="#{h(rodauth.redirect_uri)}?error=access_denied&error_description=The+resource+owner+or+authorization+server+denied+the+request#{ "&state=#{CGI.escape(rodauth.param("state"))}" if rodauth.param_or_nil("state")}" class="btn btn-outline-danger">
+      #{h(rodauth.oauth_cancel_button)}
     </a>
   </p>
 </form>

data/templates/device_verification.str

@@ -10,15 +10,15 @@
       scopes = @oauth_grant[rodauth.oauth_grants_scopes_column].split(rodauth.oauth_scope_separator)
       scopes.map do |scope|
         <<-HTML
-          <li class="list-group-item">#{scope}</li>
+          <li class="list-group-item">#{h(scope)}</li>
         HTML
       end.join
     }
     </ul>
   </div>
-  <input type="hidden" name="user_code" value="#{rodauth.param("user_code")}"/>
+  <input type="hidden" name="user_code" value="#{h(rodauth.param("user_code"))}"/>
   <p class="text-center">
     <input type="submit" class="btn btn-outline-primary" value="#{h(rodauth.oauth_device_verification_button)}"/>
-    <a href="#{rodauth.device_path}?error=access_denied" class="btn btn-outline-danger">#{rodauth.oauth_cancel_button}</a>
+    <a href="#{rodauth.device_path}?error=access_denied" class="btn btn-outline-danger">#{h(rodauth.oauth_cancel_button)}</a>
   </p>
 </form>

data/templates/oauth_application.str

@@ -1,7 +1,10 @@
 <div id="oauth-application">
   <dl>
+    <dt class="confidential">#{rodauth.oauth_applications_client_type_label}</dt>
+    <dd class="confidential">#{rodauth.oauth_application_client_type_label(@oauth_application)}</dd>
     #{
-      params = [*rodauth.oauth_application_required_params, "client_id", "client_secret"]
+      params = [*rodauth.oauth_application_required_params, "client_id"]
+      params << "client_secret" if rodauth.confidential?(@oauth_application)
       if rodauth.features.include?(:oauth_jwt)
         params += %w[jwks]
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.6.5
+  version: 1.6.7
 platform: ruby
 authors:
 - Tiago Cardoso
@@ -93,6 +93,8 @@ extra_rdoc_files:
 - doc/release_notes/1_6_3.md
 - doc/release_notes/1_6_4.md
 - doc/release_notes/1_6_5.md
+- doc/release_notes/1_6_6.md
+- doc/release_notes/1_6_7.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -144,6 +146,8 @@ files:
 - doc/release_notes/1_6_3.md
 - doc/release_notes/1_6_4.md
 - doc/release_notes/1_6_5.md
+- doc/release_notes/1_6_6.md
+- doc/release_notes/1_6_7.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -244,7 +248,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Implementation of the OAuth 2.0 protocol on top of rodauth.
 test_files: []