rodauth-oauth 1.6.6 → 1.6.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d114c188d7d68d73ec35837c57c6491022be90288a56aecc7dd61b26949d2509
-  data.tar.gz: d6d55020809cc6397d23b00f85b89fd948e0b79ffd7970a1956b1b938419ad3d
+  metadata.gz: 47de1ced2a621692058d69609ccb69999440ac8ca3de7f7a43f8522a81b93a20
+  data.tar.gz: 4822470b6f682648a772b8d7244000a68557875ee12ebd2126033f58128d9241
 SHA512:
-  metadata.gz: 546dd06b480c261c6818a7852cb85c4366011631190c4ee749ef59e33a8cb11b3fd1fedca8e7a7bf79e100f1ee406a3f8e71a895e1b0e4fe66abc63d0ba83efa
-  data.tar.gz: 8239900aebd23ba93d91311a06bb66d88a0a732d70772bc6ef6b0b21d01c91225e1cdc5b76d0a14de3400aa3fd02cbb7d0a406ed2b9a43693f5008d4563c40e5
+  metadata.gz: 29604d9791ebdab3ea7a85a8ad05cc1ff32aaf8b73aad85b367be9cdd2ab5f199540d25b179147ef5346da7d709fcbf470aac05db6b903d80c483ce47214d399
+  data.tar.gz: 7d853b0d1a139fe2d10ec2d865493c8bdf9db313df79e4778e44943900f5634eabb03ac851a65f4f0bc31708014b037116ac46bf150b9fed8bee93fab5f9909c

data/doc/release_notes/1_6_7.md

@@ -0,0 +1,17 @@
+### 1.6.7
+
+#### Improvements
+
+* Some new capabilities were built into `rodauth` recently, which `rodauth-oauth` now taps into:
+  * plugins are now object shape friendly, by defining ivars using `rodauth`'s `:uses_instance_variables` auth method (introduced in v2.44)
+  * `:oidc` plugin `get_oidc_param` and `get_additional_param` now have a default implementation, which raises an error (eliminates warnings).
+  * `only_json?` auth method is no longer defined (unless the `:jwt` plugin is used).
+  * some internal methods were now moved to private, instead of being needlessly exposed (eliminates security warnings).
+* a new auth method, `confidential?(oauth_application)`, was added to the `:oauth_base` plugin, which is now used internally to check in some key flows whether the OAuth client application is a public or a confidential client, as it's defined in the OAuth RFC:
+  * when using the `:oauth_dynamic_client_registration` plugin, a client secret won't be generated for public clients (same logic will be applied for client registration management endpoints).
+  * when using the `:oauth_application_management` plugin, default templates will include a client type column, and omit the client secret for public clients, where they would previously.
+
+#### Bugfixes
+
+* do not render null fields in the payload of the oauth server metadata endpoint (RFC 8414 section 2 requires omission of undefined values, so clients can apply the recommended defaults).
+* fixed regexp used for json requests (same fix as in [rodauth](https://github.com/jeremyevans/rodauth/commit/3e0d7ab2d49a5733d1afcaaf1062b8a8258aa57a))

data/lib/generators/rodauth/oauth/templates/app/views/rodauth/oauth_application.html.erb

@@ -7,8 +7,14 @@
     <dd><%= oauth_application[rodauth.oauth_applications_description_column] %></dd>
     <dt><%= rodauth.oauth_applications_homepage_url_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_homepage_url_column] %></dd>
+    <dt><%= rodauth.oauth_applications_client_type_label %>: </dt>
+    <dd><%= rodauth.oauth_application_client_type_label(oauth_application) %></dd>
     <dt><%= rodauth.oauth_applications_client_id_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_client_id_column] %></dd>
+    <% if rodauth.confidential?(oauth_application) %>
+      <dt><%= rodauth.oauth_applications_client_secret_label %>: </dt>
+      <dd><%= oauth_application[rodauth.oauth_applications_client_secret_column] %></dd>
+    <% end %>
     <dt><%= rodauth.oauth_applications_redirect_uri_label %>: </dt>
     <dd><%= oauth_application[rodauth.oauth_applications_redirect_uri_column] %></dd>
     <dt><%= rodauth.oauth_applications_scopes_label %>: </dt>

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -8,7 +8,9 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :homepage_url, null: true
       t.string :redirect_uri, null: false
       t.string :client_id, null: false, index: { unique: true }
-      t.string :client_secret, null: false, index: { unique: true }
+      # change `:null` contraints to false if you want to support confidential clients only, and
+      # no scheme relying on JWT private keys advertised by the JWKs uri.
+      t.string :client_secret, null: true, index: { unique: true }
       t.string :registration_access_token, null: true
       t.string :scopes, null: false
       t.datetime :created_at, null: false, default: -> { "CURRENT_TIMESTAMP(6)" }

data/lib/rodauth/features/oauth_application_management.rb

@@ -35,8 +35,11 @@ module Rodauth
     translatable_method :oauth_applications_jwks_uri_label, "JSON Web Keys URI"
     translatable_method :oauth_applications_homepage_url_label, "Homepage URL"
     translatable_method :oauth_applications_redirect_uri_label, "Redirect URI"
-    translatable_method :oauth_applications_client_secret_label, "Client Secret"
     translatable_method :oauth_applications_client_id_label, "Client ID"
+    translatable_method :oauth_applications_client_secret_label, "Client Secret"
+    translatable_method :oauth_applications_client_type_label, "Client Type"
+    translatable_method :oauth_applications_confidential_label, "Confidential"
+    translatable_method :oauth_applications_public_label, "Public"
 
     %w[type token refresh_token expires_in revoked_at].each do |param|
       translatable_method :"oauth_grants_#{param}_label", param.gsub("_", " ").capitalize
@@ -58,9 +61,18 @@ module Rodauth
     translatable_method :oauth_no_grants_text, "No oauth grants yet!"
 
     auth_methods(
-      :oauth_application_path
+      :oauth_application_path,
+      :oauth_application_client_type_label
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_applications,
+        :@oauth_grants,
+        :@field_errors
+      )
+    end
+
     def oauth_applications_path(opts = {})
       route_path(oauth_applications_route, opts)
     end
@@ -69,6 +81,14 @@ module Rodauth
       "#{oauth_applications_path}/#{id}"
     end
 
+    def oauth_application_client_type_label(oauth_application)
+      if confidential?(oauth_application)
+        oauth_applications_confidential_label
+      else
+        oauth_applications_public_label
+      end
+    end
+
     # /oauth-applications routes
     def load_oauth_application_management_routes
       request.on(oauth_applications_route) do

data/lib/rodauth/features/oauth_authorize_base.rb

@@ -34,6 +34,13 @@ module Rodauth
       :authorize_form_params
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@error,
+        :@back_url
+      )
+    end
+
     OAUTH_ACCESS_TYPES = %w[offline online].freeze
 
     OAUTH_APPROVAL_PROMPTS = %w[force auto].freeze

data/lib/rodauth/features/oauth_base.rb

@@ -76,7 +76,7 @@ module Rodauth
       account_id
       name description scopes
       client_id client_secret
-      homepage_url redirect_uri
+      confidential homepage_url redirect_uri
       token_endpoint_auth_method grant_types response_types response_modes
       logo_uri tos_uri policy_uri jwks jwks_uri
       contacts software_id software_version
@@ -107,9 +107,7 @@ module Rodauth
 
     auth_value_method :is_authorization_server?, true
 
-    auth_value_methods(:only_json?)
-
-    auth_value_method :json_request_regexp, %r{\bapplication/(?:vnd\.api\+)?json\b}i
+    auth_value_method :json_request_regexp, %r{\Aapplication/(?:vnd\.api\+)?json\b}i
 
     # METADATA
     auth_value_method :oauth_metadata_service_documentation, nil
@@ -130,9 +128,18 @@ module Rodauth
       :oauth_unique_id_generator,
       :require_authorizable_account,
       :oauth_account_ds,
-      :oauth_application_ds
+      :oauth_application_ds,
+      :confidential?
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@json_request,
+        :@oauth_application,
+        :@authorization_token
+      )
+    end
+
     # /token
     auth_server_route(:token) do |r|
       require_oauth_application
@@ -233,7 +240,7 @@ module Rodauth
     end
 
     def oauth_application
-      return @oauth_application if defined?(@oauth_application)
+      return @oauth_application if @oauth_application
 
       client_id = param_or_nil("client_id")
 
@@ -242,6 +249,21 @@ module Rodauth
       @oauth_application = db[oauth_applications_table].filter(oauth_applications_client_id_column => client_id).first
     end
 
+    def confidential?(oauth_application)
+      token_endpoint_auth_method = oauth_application[oauth_applications_token_endpoint_auth_method_column]
+
+      # https://datatracker.ietf.org/doc/html/rfc7591#section-2
+      # "none": The client is a public client as defined in OAuth 2.0, Section 2.1, and does not have a client secret.
+      return false if token_endpoint_auth_method == "none"
+
+      oauth_confidential_token_endpoint_auth_methods.include?(token_endpoint_auth_method) ||
+        !(
+          # not exclusively registering implicit grant
+          Array(oauth_application[oauth_applications_grant_types_column]).include?("implicit") &&
+          Array(oauth_application[oauth_applications_response_types_column]).include?("token")
+        )
+    end
+
     def fetch_access_token
       if (token = request.params["access_token"])
         if request.post? && !(request.content_type.start_with?("application/x-www-form-urlencoded") &&
@@ -270,7 +292,7 @@ module Rodauth
     end
 
     def authorization_token
-      return @authorization_token if defined?(@authorization_token)
+      return @authorization_token if @authorization_token
 
       # check if there is a token
       access_token = fetch_access_token
@@ -329,6 +351,10 @@ module Rodauth
 
     private
 
+    def oauth_confidential_token_endpoint_auth_methods
+      %w[client_secret_basic client_secret_post]
+    end
+
     def oauth_account_ds(account_id)
       account_ds(account_id)
     end
@@ -763,19 +789,22 @@ module Rodauth
       issuer = base_url
       issuer += "/#{path}" if path
 
-      {
+      payload = {
         issuer: issuer,
         token_endpoint: token_url,
         scopes_supported: oauth_application_scopes,
         response_types_supported: oauth_response_types_supported,
         response_modes_supported: oauth_response_modes_supported,
         grant_types_supported: oauth_grant_types_supported,
-        token_endpoint_auth_methods_supported: oauth_token_endpoint_auth_methods_supported,
-        service_documentation: oauth_metadata_service_documentation,
-        ui_locales_supported: oauth_metadata_ui_locales_supported,
-        op_policy_uri: oauth_metadata_op_policy_uri,
-        op_tos_uri: oauth_metadata_op_tos_uri
+        token_endpoint_auth_methods_supported: oauth_token_endpoint_auth_methods_supported
       }
+
+      # RFC 8414, section 2: unused optional metadata parameters must be omitted, not null
+      payload[:service_documentation] = oauth_metadata_service_documentation if oauth_metadata_service_documentation
+      payload[:ui_locales_supported] = oauth_metadata_ui_locales_supported if oauth_metadata_ui_locales_supported
+      payload[:op_policy_uri] = oauth_metadata_op_policy_uri if oauth_metadata_op_policy_uri
+      payload[:op_tos_uri] = oauth_metadata_op_tos_uri if oauth_metadata_op_tos_uri
+      payload
     end
 
     def redirect_response_error(error_code, message = nil)

data/lib/rodauth/features/oauth_device_code_grant.rb

@@ -38,6 +38,11 @@ module Rodauth
     auth_methods(
       :generate_user_code
     )
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_grant
+      )
+    end
 
     # /device-authorization
     auth_server_route(:device_authorization) do |r|

data/lib/rodauth/features/oauth_dpop.rb

@@ -54,6 +54,14 @@ module Rodauth
 
     auth_methods(:validate_dpop_proof_usage)
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@dpop_access_token,
+        :@dpop_claims,
+        :@dpop_thumbprint
+      )
+    end
+
     def require_oauth_authorization(*scopes)
       @dpop_access_token = fetch_access_token_from_authorization_header("dpop")
 

data/lib/rodauth/features/oauth_dynamic_client_registration.rb

@@ -12,10 +12,21 @@ module Rodauth
     auth_value_method :oauth_applications_registration_access_token_column, :registration_access_token
     auth_value_method :registration_client_uri_route, "register"
 
+    translatable_method :register_no_client_secret_if_public, "Client secret is not allowed for a public client"
+
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_application_params,
+        :@oauth_application_unrecognized_params
+      )
+    end
+
     PROTECTED_APPLICATION_CREATE_ATTRIBUTES = %w[account_id client_id].freeze
 
-    PROTECTED_APPLICATION_UPDATE_ATTRIBUTES = %w[account_id client_id registration_access_token registration_client_uri
-                                                 client_secret_expires_at client_id_issued_at].freeze
+    PROTECTED_APPLICATION_UPDATE_ATTRIBUTES = %w[
+      account_id client_id registration_access_token
+      registration_client_uri client_secret_expires_at client_id_issued_at
+    ].freeze
 
     HIDDEN_APPLICATION_ATTRIBUTES = %w[id account_id client_id client_secret client_secret_hash].freeze
 
@@ -39,15 +50,24 @@ module Rodauth
               json_response_oauth_application(oauth_application)
             end
             request.on method: :put do
-              validate_client_registration_params(request.params, PROTECTED_APPLICATION_UPDATE_ATTRIBUTES)
+              params = request.params
+
+              validate_client_registration_params(params, PROTECTED_APPLICATION_UPDATE_ATTRIBUTES)
 
-              if request.params.key?("client_secret") && !secret_matches?(oauth_application, request.params["client_secret"])
+              if params.key?("client_secret") && !secret_matches?(oauth_application, params["client_secret"])
                 # if the client includes the "client_secret" field in the request, the value of this field MUST match the currently
                 # issued client secret for that client.  The client MUST NOT be allowed to overwrite its existing client secret with
                 # its own chosen value.
                 authorization_required
               end
 
+              if params.key?("client_secret")
+                next_oauth_application = oauth_application.merge(@oauth_application_params)
+                unless confidential?(next_oauth_application)
+                  register_throw_json_response_error("invalid_client_metadata", register_no_client_secret_if_public)
+                end
+              end
+
               oauth_application = transaction do
                 applications_ds = db[oauth_applications_table]
                                   .where(oauth_applications_client_id_column => client_id)
@@ -108,7 +128,7 @@ module Rodauth
 
     def _before_register
       raise %{dynamic client registration requires authentication.
-        Override ´before_register` to perform it.
+        Override `before_register` to perform it.
         example:
 
           before_register do
@@ -324,6 +344,7 @@ module Rodauth
         return_params["response_types"] = %w[code]
         "code"
       end
+
       rescue_from_uniqueness_error do
         initialize_create_params(create_params, return_params)
         create_params.delete_if { |k, _| !application_columns.include?(k) }
@@ -341,15 +362,22 @@ module Rodauth
       # "client_id_issued_at" is a number, expressed as seconds since 1970-01-01T00:00:00Z.
       return_params["client_id_issued_at"] = Time.now.to_i
 
-      if create_params.key?(oauth_applications_client_secret_column)
-        return_params.delete("client_secret")
-      else
+      if create_params.key?(oauth_applications_client_secret_column) && !confidential?(create_params)
+        register_throw_json_response_error("invalid_client_metadata", register_no_client_secret_if_public)
+      end
+
+      return_params.delete("client_secret")
+
+      unless (client_secret = create_params.key?(oauth_applications_client_secret_column))
+        # do not generate a secret for a confidential client
+        return unless confidential?(create_params)
+
         client_secret = oauth_unique_id_generator
-        set_client_secret(create_params, client_secret)
         return_params["client_secret"] = client_secret
         return_params["client_secret_expires_at"] = 0
-
       end
+
+      set_client_secret(create_params, client_secret)
     end
 
     def register_throw_json_response_error(code, message)

data/lib/rodauth/features/oauth_grant_management.rb

@@ -25,6 +25,12 @@ module Rodauth
       :oauth_grant_path
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_grants
+      )
+    end
+
     def oauth_grants_path(opts = {})
       route_path(oauth_grants_route, opts)
     end

data/lib/rodauth/features/oauth_jwt.rb

@@ -51,7 +51,7 @@ module Rodauth
     def authorization_token
       return super unless oauth_jwt_access_tokens
 
-      return @authorization_token if defined?(@authorization_token)
+      return @authorization_token if @authorization_token
 
       @authorization_token = decode_access_token
     end

data/lib/rodauth/features/oauth_jwt_base.rb

@@ -33,6 +33,14 @@ module Rodauth
       :resource_owner_params_from_jwt_claims
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oauth_jwt_issuer,
+        :@oauth_jwt_audience,
+        :@_jwt_key
+      )
+    end
+
     private
 
     def oauth_jwt_issuer

data/lib/rodauth/features/oauth_jwt_bearer_grant.rb

@@ -28,6 +28,14 @@ module Rodauth
 
     private
 
+    def oauth_confidential_token_endpoint_auth_methods
+      if oauth_applications_client_secret_hash_column.nil?
+        super | %w[client_secret_jwt private_key_jwt urn:ietf:params:oauth:client-assertion-type:jwt-bearer]
+      else
+        super | %w[private_key_jwt]
+      end
+    end
+
     def require_oauth_application_from_jwt_bearer_assertion_issuer(assertion)
       claims = jwt_assertion(assertion)
 

data/lib/rodauth/features/oauth_jwt_jwks.rb

@@ -17,6 +17,12 @@ module Rodauth
       end
     end
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@jwks_set
+      )
+    end
+
     private
 
     def oauth_server_metadata_body(path = nil)

data/lib/rodauth/features/oauth_jwt_secured_authorization_request.rb

@@ -23,6 +23,12 @@ module Rodauth
 
     auth_value_method :max_param_bytesize, nil if Rodauth::VERSION >= "2.26.0"
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@require_signed_request_object
+      )
+    end
+
     private
 
     # /authorize
@@ -93,7 +99,7 @@ module Rodauth
     end
 
     def require_signed_request_object?
-      return @require_signed_request_object if defined?(@require_signed_request_object)
+      return @require_signed_request_object if @require_signed_request_object
 
       @require_signed_request_object = (oauth_application[oauth_applications_require_signed_request_object_column] if oauth_application)
       @require_signed_request_object = oauth_require_signed_request_object if @require_signed_request_object.nil?

data/lib/rodauth/features/oauth_pushed_authorization_request.rb

@@ -19,6 +19,12 @@ module Rodauth
       auth_value_method :"oauth_pushed_authorization_requests_#{column}_column", column
     end
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@require_signed_request_object
+      )
+    end
+
     # /par
     auth_server_route(:par) do |r|
       require_oauth_application

data/lib/rodauth/features/oauth_resource_indicators.rb

@@ -8,8 +8,14 @@ module Rodauth
 
     auth_value_method :oauth_grants_resource_column, :resource
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@resource_indicators
+      )
+    end
+
     def resource_indicators
-      return @resource_indicators if defined?(@resource_indicators)
+      return @resource_indicators if @resource_indicators
 
       resources = param_or_nil("resource")
 

data/lib/rodauth/features/oauth_resource_server.rb

@@ -13,7 +13,7 @@ module Rodauth
     )
 
     def authorization_token
-      return @authorization_token if defined?(@authorization_token)
+      return @authorization_token if @authorization_token
 
       # check if there is a token
       access_token = fetch_access_token

data/lib/rodauth/features/oauth_saml_bearer_grant.rb

@@ -34,6 +34,13 @@ module Rodauth
       :account_from_saml2_bearer_assertion
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@saml_settings,
+        :@assertion
+      )
+    end
+
     def oauth_grant_types_supported
       super | %w[urn:ietf:params:oauth:grant-type:saml2-bearer]
     end
@@ -98,9 +105,8 @@ module Rodauth
       settings
     end
 
-    # rubocop:disable Naming/MemoizedInstanceVariableName
     def parse_saml_assertion(assertion)
-      return @assertion if defined?(@assertion)
+      return @assertion if @assertion
 
       response = OneLogin::RubySaml::Response.new(assertion)
 
@@ -129,7 +135,6 @@ module Rodauth
 
       @assertion = response
     end
-    # rubocop:enable Naming/MemoizedInstanceVariableName
 
     def oauth_server_metadata_body(*)
       super.tap do |data|

data/lib/rodauth/features/oauth_tls_client_auth.rb

@@ -21,12 +21,24 @@ module Rodauth
 
     auth_value_method :oauth_grants_certificate_thumbprint_column, :certificate_thumbprint
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@client_certificate,
+        :@certificate,
+        :@client_certificate_sans
+      )
+    end
+
     def oauth_token_endpoint_auth_methods_supported
       super | %w[tls_client_auth self_signed_tls_client_auth]
     end
 
     private
 
+    def oauth_confidential_token_endpoint_auth_methods
+      super | %w[tls_client_auth self_signed_tls_client_auth]
+    end
+
     def validate_token_params
       # For all requests to the authorization server utilizing mutual-TLS client authentication,
       # the client MUST include the client_id parameter
@@ -124,7 +136,7 @@ module Rodauth
     end
 
     def client_certificate
-      return @client_certificate if defined?(@client_certificate)
+      return @client_certificate if @client_certificate
 
       unless (pem_cert = request.env["SSL_CLIENT_CERT"] || request.env["HTTP_SSL_CLIENT_CERT"] || request.env["HTTP_X_SSL_CLIENT_CERT"])
         return
@@ -136,7 +148,7 @@ module Rodauth
     end
 
     def client_certificate_sans
-      return @client_certificate_sans if defined?(@client_certificate_sans)
+      return @client_certificate_sans if @client_certificate_sans
 
       @client_certificate_sans =
         if client_certificate

data/lib/rodauth/features/oauth_token_revocation.rb

@@ -117,7 +117,8 @@ module Rodauth
     def oauth_server_metadata_body(*)
       super.tap do |data|
         data[:revocation_endpoint] = revoke_url
-        data[:revocation_endpoint_auth_methods_supported] = nil # because it's client_secret_basic
+        # revocation_endpoint_auth_methods_supported must be absent: it defaults to client_secret_basic
+        data.delete(:revocation_endpoint_auth_methods_supported)
       end
     end
   end

data/lib/rodauth/features/oidc.rb

@@ -115,6 +115,12 @@ module Rodauth
       :json_webfinger_payload
     )
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@acr
+      )
+    end
+
     # /userinfo
     auth_server_route(:userinfo) do |r|
       r.on method: %i[get post] do
@@ -221,6 +227,14 @@ module Rodauth
       end
     end
 
+    def get_oidc_param(_, _)
+      raise NotImplementedError, "`get_oidc_param(account, claim)` auth method must be implemented to use oidc scopes."
+    end
+
+    def get_additional_param(_, _)
+      raise NotImplementedError, "`get_oidc_param(account, claim)` auth method must be implemented to use oidc scopes."
+    end
+
     def oauth_response_types_supported
       grant_types = oauth_grant_types_supported
       oidc_response_types = %w[id_token none]
@@ -626,35 +640,27 @@ module Rodauth
       claims_locales = claims_locales.split(" ").map(&:to_sym) if claims_locales
 
       unless oidc_scopes.empty?
-        if respond_to?(:get_oidc_param)
-          get_oidc_param = proxy_get_param(:get_oidc_param, claims, claims_locales, additional_claims_info)
+        get_oidc_param = proxy_get_param(:get_oidc_param, claims, claims_locales, additional_claims_info)
 
-          oidc_scopes.each do |scope|
-            scope_claims = claims
-            params = scopes_by_claim[scope]
-            params = params.empty? ? OIDC_SCOPES_MAP[scope] : (OIDC_SCOPES_MAP[scope] & params)
+        oidc_scopes.each do |scope|
+          scope_claims = claims
+          params = scopes_by_claim[scope]
+          params = params.empty? ? OIDC_SCOPES_MAP[scope] : (OIDC_SCOPES_MAP[scope] & params)
 
-            scope_claims = (claims["address"] = {}) if scope == "address"
+          scope_claims = (claims["address"] = {}) if scope == "address"
 
-            params.each do |param|
-              get_oidc_param[account, param, scope_claims]
-            end
+          params.each do |param|
+            get_oidc_param[account, param, scope_claims]
           end
-        else
-          warn "`get_oidc_param(account, claim)` must be implemented to use oidc scopes."
         end
       end
 
       return if additional_scopes.empty?
 
-      if respond_to?(:get_additional_param)
-        get_additional_param = proxy_get_param(:get_additional_param, claims, claims_locales, additional_claims_info)
+      get_additional_param = proxy_get_param(:get_additional_param, claims, claims_locales, additional_claims_info)
 
-        additional_scopes.each do |scope|
-          get_additional_param[account, scope.to_sym]
-        end
-      else
-        warn "`get_additional_param(account, claim)` must be implemented to use oidc scopes."
+      additional_scopes.each do |scope|
+        get_additional_param[account, scope.to_sym]
       end
     end
 

data/lib/rodauth/features/oidc_frontchannel_logout.rb

@@ -22,6 +22,14 @@ module Rodauth
     auth_value_method :oauth_applications_frontchannel_logout_uri_column, :frontchannel_logout_uri
     auth_value_method :oauth_applications_frontchannel_logout_session_required_column, :frontchannel_logout_session_required
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@visited_sites,
+        :@frontchannel_logout_redirect,
+        :@frontchannel_logout_urls
+      )
+    end
+
     attr_reader :frontchannel_logout_urls
 
     attr_reader :frontchannel_logout_redirect
@@ -32,6 +40,8 @@ module Rodauth
       super
     end
 
+    private
+
     def _logout_response
       visited_sites = @visited_sites
 
@@ -71,8 +81,6 @@ module Rodauth
       return_response frontchannel_logout_view
     end
 
-    private
-
     def generate_frontchannel_logout_urls(visited_sites, logout_urls)
       @frontchannel_logout_urls = logout_urls.flat_map do |client_id, logout_url|
         next unless logout_url

data/lib/rodauth/features/oidc_rp_initiated_logout.rb

@@ -13,6 +13,12 @@ module Rodauth
 
     attr_reader :oidc_logout_redirect
 
+    if respond_to?(:uses_instance_variables)
+      uses_instance_variables(
+        :@oidc_logout_redirect
+      )
+    end
+
     # /oidc-logout
     auth_server_route(:oidc_logout) do |r|
       require_authorizable_account
@@ -109,12 +115,12 @@ module Rodauth
       end
     end
 
+    private
+
     def _oidc_logout_response
       redirect(oidc_logout_redirect)
     end
 
-    private
-
     # Logout
 
     def validate_oidc_logout_params

data/lib/rodauth/features/oidc_self_issued.rb

@@ -19,7 +19,7 @@ module Rodauth
     }.freeze
 
     def oauth_application
-      return @oauth_application if defined?(@oauth_application)
+      return @oauth_application if @oauth_application
 
       return super unless (registration = param_or_nil("registration"))
 

data/lib/rodauth/oauth/database_extensions.rb

@@ -2,7 +2,7 @@
 
 module Rodauth
   module OAuth
-    # rubocop:disable Naming/MethodName
+    # rubocop:disable-next Naming/MethodName
     def self.ExtendDatabase(db)
       Module.new do
         dataset = db.dataset
@@ -87,6 +87,5 @@ module Rodauth
         end
       end
     end
-    # rubocop:enable Naming/MethodName
   end
 end

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.6.6"
+    VERSION = "1.6.7"
   end
 end

data/locales/en.yml

@@ -40,6 +40,9 @@ en:
     oauth_applications_redirect_uri_label: "Redirect URL"
     oauth_applications_client_secret_label: "Client Secret"
     oauth_applications_client_id_label: "Client ID"
+    oauth_applications_client_type_label: "Client Type"
+    oauth_applications_confidential_label: "Confidential"
+    oauth_applications_public_label: "Public"
     oauth_no_applications_text: "No oauth applications yet!"
     oauth_grant_user_code_label: "User code"
     oauth_grant_user_jws_jwk_label: "JSON Web Keys"
@@ -87,3 +90,4 @@ en:
     oauth_use_dpop_nonce_message: "DPoP nonce is required"
     oauth_access_token_dpop_bound_message: "DPoP bound access token requires DPoP proof"
     oauth_multiple_auth_methods_message: "Multiple methods used to include access token"
+    register_no_client_secret_if_public: "Client secret is not allowed for a public OAuth application"

data/locales/pt.yml

@@ -40,6 +40,9 @@ pt:
     oauth_applications_redirect_uri_label: "URL para redireccionamento"
     oauth_applications_client_secret_label: "Segredo de cliente"
     oauth_applications_client_id_label: "ID do cliente"
+    oauth_applications_client_type_label: "Tipo de cliente"
+    oauth_applications_confidential_label: "Confidencial"
+    oauth_applications_public_label: "Público"
     oauth_no_applications_text: "Nenhum aplicativo OAuth ainda!"
     oauth_grant_user_code_label: "Código do usuário"
     oauth_grant_user_jws_jwk_label: "Chaves JSON Web"
@@ -77,3 +80,4 @@ pt:
     oauth_saml_assertion_single_issuer_message: "A asserção SAML tem que ter um único emissor"
     oauth_saml_settings_not_found_message: "Nenhuma configuração SAML encontrada para o emissor"
     oauth_invalid_id_token_hint_message: "ID token hint inválido"
+    register_no_client_secret_if_public: "Segredo de cliente não é permitido em um aplicativo OAuth público"

data/templates/oauth_application.str

@@ -1,7 +1,10 @@
 <div id="oauth-application">
   <dl>
+    <dt class="confidential">#{rodauth.oauth_applications_client_type_label}</dt>
+    <dd class="confidential">#{rodauth.oauth_application_client_type_label(@oauth_application)}</dd>
     #{
-      params = [*rodauth.oauth_application_required_params, "client_id", "client_secret"]
+      params = [*rodauth.oauth_application_required_params, "client_id"]
+      params << "client_secret" if rodauth.confidential?(@oauth_application)
       if rodauth.features.include?(:oauth_jwt)
         params += %w[jwks]
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.6.6
+  version: 1.6.7
 platform: ruby
 authors:
 - Tiago Cardoso
@@ -94,6 +94,7 @@ extra_rdoc_files:
 - doc/release_notes/1_6_4.md
 - doc/release_notes/1_6_5.md
 - doc/release_notes/1_6_6.md
+- doc/release_notes/1_6_7.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -146,6 +147,7 @@ files:
 - doc/release_notes/1_6_4.md
 - doc/release_notes/1_6_5.md
 - doc/release_notes/1_6_6.md
+- doc/release_notes/1_6_7.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb