rodauth-oauth 1.6.4 → 1.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83351fdb82b53fcc94fbafcfe1f3a2057b887b633ae39c4de24a5268136164ec
-  data.tar.gz: 6b1d1f26cfc189cb6d18269af0634f358724a156bd26edc514bb008615e55e68
+  metadata.gz: cc6a614c797762b13c8b97dc51abf5191dc09ef919e27fd394f46504b62410c7
+  data.tar.gz: 3c6003d4131e03514a5bf8acd674cc1b7d8fcacd9eada7ab98044fc3f037fc95
 SHA512:
-  metadata.gz: c2197aad8a6e0d0e5d46ef2b18f0730133d06463c1115c60a949b079849c8bb5ab62e1424db5fea1ede68ae5ff1084dfe805a4247164387163a16f8b5f425c40
-  data.tar.gz: 63f3c8bfff288028767e833735c8c1496595a9ec08a7c06463df98fe2b93ad987d95e42e0e68c08c24698b97a454924a326d6326c056f41181920c189f04472d
+  metadata.gz: 997c1e682fc4f482d0ea367a918c4db15130535294db13f19c52c558f152eca78fd197461d74ce269e77a56b36cf465b8b7e9d2424f3b999cb6491782c8d69f6
+  data.tar.gz: 2109d08b8911e33697e08e528899d45535de16c1cc994d663324c51161fed1f6e35386849413adb6dadbb526b2b75c64522865cbdf90798042ca8e68767362cf

data/doc/release_notes/1_6_5.md

@@ -0,0 +1,10 @@
+### 1.6.5
+
+#### Bugfixes
+
+* `:oauth_dynamic_client_registration` feature: scoping to the client being updated, preventing thst the resulting database operations touch every row in the `"oauth_applications"` table.
+* `:json` feature: fixed implementation of `json_request?`.
+* `json-jwt` support: set explicit `:skip_verification` parameter when the jwt decoding algorithm is  `"none"`.
+* rails generators: add missing uniqueness constraint to the index on the `"issuer"` column of the `"oauth_saml_settings"` table.
+* rails generators: remove the `"jti"` column entry from the `"oauth_dpop_proofs"` table (already made the pkey in the `create_table` instruction).
+* Make `password_hash` method public, which restores compatibility with `rodauth` v2.28 or more recent; `rodauth` **minimum supported version** becomes 2.28.0 as a result, which should not be perceived as a breaking change, as there are no other significant API changes, and ruby version support remains the same.

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -136,10 +136,10 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.boolean :check_idp_cert_expiration, null: true
       t.text :name_identifier_format, null: true
       t.string :audience, null: true
-      t.string :issuer, null: false, unique: true
+      t.string :issuer, null: false, index: { unique: true }
     end
 
-    create_table :oauth_dpop_proofs, primary_key: :jti do |t|
+    create_table :oauth_dpop_proofs, id: false, primary_key: :jti do |t|
       t.string :jti, null: false
       t.datetime :first_use, null: false, default: -> { "CURRENT_TIMESTAMP(6)" }
     end

data/lib/rodauth/features/oauth_base.rb

@@ -191,10 +191,10 @@ module Rodauth
       (accept = request.env["HTTP_ACCEPT"]) && accept =~ json_request_regexp
     end
 
-    # copied from the jwt feature
+    # copied from the json feature
     def json_request?
-      return super if features.include?(:jsonn)
-      return @json_request if defined?(@json_request)
+      return super if features.include?(:json)
+      return @json_request unless @json_request.nil?
 
       @json_request = request.content_type =~ json_request_regexp
     end
@@ -221,13 +221,11 @@ module Rodauth
     def oauth_application
       return @oauth_application if defined?(@oauth_application)
 
-      @oauth_application = begin
-        client_id = param_or_nil("client_id")
+      client_id = param_or_nil("client_id")
 
-        return unless client_id
+      return unless client_id
 
-        db[oauth_applications_table].filter(oauth_applications_client_id_column => client_id).first
-      end
+      @oauth_application = db[oauth_applications_table].filter(oauth_applications_client_id_column => client_id).first
     end
 
     def fetch_access_token
@@ -309,6 +307,12 @@ module Rodauth
       self.class.send(:define_method, :__one_oauth_token_per_account) { one_oauth_token_per_account }
     end
 
+    def password_hash(password)
+      return super if features.include?(:login_password_requirements_base)
+
+      BCrypt::Password.create(password, cost: BCrypt::Engine::DEFAULT_COST)
+    end
+
     private
 
     def oauth_account_ds(account_id)
@@ -455,12 +459,6 @@ module Rodauth
       oauth_grant[oauth_grants_oauth_application_id_column] == oauth_application[oauth_applications_id_column]
     end
 
-    def password_hash(password)
-      return super if features.include?(:login_password_requirements_base)
-
-      BCrypt::Password.create(password, cost: BCrypt::Engine::DEFAULT_COST)
-    end
-
     def generate_token(grant_params = {}, should_generate_refresh_token = true)
       if grant_params[oauth_grants_id_column] && oauth_reuse_access_token &&
          (

data/lib/rodauth/features/oauth_dynamic_client_registration.rb

@@ -50,6 +50,7 @@ module Rodauth
 
               oauth_application = transaction do
                 applications_ds = db[oauth_applications_table]
+                                  .where(oauth_applications_client_id_column => client_id)
                 __update_and_return__(applications_ds, @oauth_application_params)
               end
               json_response_oauth_application(oauth_application)

data/lib/rodauth/features/oauth_jwt_base.rb

@@ -259,7 +259,7 @@ module Rodauth
                    elsif jws_key
                      JSON::JWT.decode(token, jws_key)
                    else
-                     JSON::JWT.decode(token, nil, jws_algorithm)
+                     JSON::JWT.decode(token, (:skip_verification if jws_algorithm == "none"), jws_algorithm)
                    end
                  elsif (jwks = auth_server_jwks_set)
                    JSON::JWT.decode(token, JSON::JWK::Set.new(jwks))

data/lib/rodauth/features/oauth_tls_client_auth.rb

@@ -138,21 +138,20 @@ module Rodauth
     def client_certificate_sans
       return @client_certificate_sans if defined?(@client_certificate_sans)
 
-      @client_certificate_sans = begin
-        return [] unless client_certificate
-
-        san = client_certificate.extensions.find { |ext| ext.oid == "subjectAltName" }
-
-        return [] unless san
-
-        ostr = OpenSSL::ASN1.decode(san.to_der).value.last
-
-        sans = OpenSSL::ASN1.decode(ostr.value)
-
-        return [] unless sans
-
-        sans.value
-      end
+      @client_certificate_sans =
+        if client_certificate
+          if (san = client_certificate.extensions.find { |ext| ext.oid == "subjectAltName" })
+            ostr = OpenSSL::ASN1.decode(san.to_der).value.last
+
+            sans = OpenSSL::ASN1.decode(ostr.value)
+
+            sans ? sans.value : []
+          else
+            []
+          end
+        else
+          []
+        end
     end
 
     def distinguished_name_match?(sub1, sub2)

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.6.4"
+    VERSION = "1.6.5"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.6.4
+  version: 1.6.5
 platform: ruby
 authors:
 - Tiago Cardoso
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.28'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.0'
+        version: '2.28'
 description: Implementation of the OAuth 2.0 protocol on top of rodauth.
 email:
 - cardoso_tiago@hotmail.com
@@ -92,6 +92,7 @@ extra_rdoc_files:
 - doc/release_notes/1_6_2.md
 - doc/release_notes/1_6_3.md
 - doc/release_notes/1_6_4.md
+- doc/release_notes/1_6_5.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -142,6 +143,7 @@ files:
 - doc/release_notes/1_6_2.md
 - doc/release_notes/1_6_3.md
 - doc/release_notes/1_6_4.md
+- doc/release_notes/1_6_5.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb