rodauth-oauth 1.6.7 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47de1ced2a621692058d69609ccb69999440ac8ca3de7f7a43f8522a81b93a20
-  data.tar.gz: 4822470b6f682648a772b8d7244000a68557875ee12ebd2126033f58128d9241
+  metadata.gz: 86f6ed47ccab8da1af7b8be2bd1929e24c12f1fd6fa959a5edfdee273bd0b70d
+  data.tar.gz: 10e0c26c907bfb5027ce2f77d67f4a85135cae1bf487a33c0847914084423896
 SHA512:
-  metadata.gz: 29604d9791ebdab3ea7a85a8ad05cc1ff32aaf8b73aad85b367be9cdd2ab5f199540d25b179147ef5346da7d709fcbf470aac05db6b903d80c483ce47214d399
-  data.tar.gz: 7d853b0d1a139fe2d10ec2d865493c8bdf9db313df79e4778e44943900f5634eabb03ac851a65f4f0bc31708014b037116ac46bf150b9fed8bee93fab5f9909c
+  metadata.gz: 8564ff9e316d23f319b3f26746175971c0ac5d027f50ceade63728aaddd5013edf8b36ab9547be421525e15856234a69505c69c0cfa8176f24a770e7817b9a2e
+  data.tar.gz: d1e4d2f419de9dda4eafb7d91d320e3cbc80eae5ab511ad45ab5f52c4ec38f7b0c8c18b8154fd743f53b87028d77f789278530235ab336d0ee638a6b3f80f73f

data/README.md

@@ -55,6 +55,7 @@ This gem implements the following RFCs and features of OAuth:
 * `oauth_dynamic_client_registration` - [Dynamic Client Registration Protocol](https://datatracker.ietf.org/doc/html/rfc7591) and [Dynamic Client Registration Management](https://www.rfc-editor.org/rfc/rfc7592);
 * OAuth application and token management dashboards;
 *  The recommendations for [Native Apps](https://www.rfc-editor.org/rfc/rfc8252);
+* `oauth_client_id_metadata_document` - [Client ID Metadata Document](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/);
 
 It also implements several components of [OpenID Connect](https://openid.net/connect/) on top of the OAuth features it provides, including:
 

data/doc/release_notes/1_7_0.md

@@ -0,0 +1,9 @@
+# 1.7.0
+
+## Features
+
+### Client ID Metadata Document Support
+
+`rodauth-oauth` supports the Client ID Metadata Document Standard (also known as CIMD), via the `oauth_client_id_metadata_document` feature. In a nutshell, this provides a way by which a Client Application can identify itself to the authorization server, without prior dynamic client registration or other existing registration.
+
+More info about the feature [in the docs](https://gitlab.com/os85/rodauth-oauth/-/wikis/Client-ID-Metadata-Document).

data/lib/generators/rodauth/oauth/templates/db/migrate/create_rodauth_oauth.rb

@@ -9,7 +9,8 @@ class CreateRodauthOauth < ActiveRecord::Migration<%= migration_version %>
       t.string :redirect_uri, null: false
       t.string :client_id, null: false, index: { unique: true }
       # change `:null` contraints to false if you want to support confidential clients only, and
-      # no scheme relying on JWT private keys advertised by the JWKs uri.
+      # no scheme relying on JWT private keys advertised by the JWKs uri; keep this as true if
+      # supporting public clients or CIMD.
       t.string :client_secret, null: true, index: { unique: true }
       t.string :registration_access_token, null: true
       t.string :scopes, null: false

data/lib/rodauth/features/oauth_client_id_metadata_document.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require "rodauth/oauth"
+
+module Rodauth
+  Feature.define(:oauth_client_id_metadata_document, :OauthClientIdMetadataDocument) do
+    depends :oauth_authorize_base
+
+    DOT_SEGMENTS = %w[. ..].freeze
+
+    FORBIDDEN_TOKEN_AUTH_METHODS = %w[client_secret_post client_secret_basic client_secret_jwt].freeze
+
+    def oauth_application
+      super || begin
+        client_id = param_or_nil("client_id")
+
+        return unless client_id && valid_cimd_url?(client_id)
+
+        return if @client_id_lookup
+
+        @client_id_lookup = true
+
+        client_metadata = http_request_with_cache(client_id)
+
+        # 4.1 The client metadata document MUST contain a client_id property whose value MUST match the URL of the document
+        redirect_response_error("invalid_request") unless client_metadata[:client_id] == client_id
+
+        validate_client_metadata_document(client_metadata)
+
+        @client_id_lookup = false
+
+        # rewrite metadata params into column names
+        create_params = Hash[
+          client_metadata.map do |k, v|
+            k = case k
+                when :redirect_uris
+                  v = v.join(" ")
+                  :redirect_uri
+                when :client_uri
+                  :homepage_url
+                when :grant_types, :response_types, :contacts
+                  v = v.join(" ")
+                  k
+                when :client_name
+                  :name
+                when :scope
+                  :scopes
+                else
+                  k
+                end
+            [send(:"oauth_applications_#{k}_column"), v]
+          end
+        ]
+
+        applications_ds = db[oauth_applications_table]
+        application_columns = applications_ds.columns
+
+        create_params.delete_if { |k, _| !application_columns.include?(k) }
+        @oauth_application = __insert_or_do_nothing_and_return__(
+          applications_ds,
+          oauth_applications_id_column,
+          [oauth_applications_client_id_column],
+          create_params
+        )
+      end
+    end
+
+    private
+
+    def valid_cimd_url?(client_id)
+      return false unless URI::DEFAULT_PARSER.make_regexp("https").match?(client_id)
+
+      uri = URI(client_id)
+      # Client identifier URLs MUST have an "https" scheme,
+      return false unless uri.scheme == "https"
+
+      path = uri.path
+      # MUST contain a path component
+      return false if path.empty? ||
+                      # MUST NOT contain single-dot or double-dot path segments
+                      path.split("/").any? { |seg| DOT_SEGMENTS.include?(seg) }
+
+      return false unless
+        # MUST NOT contain a fragment component
+        (uri.fragment.nil? || uri.fragment.empty?) &&
+        # MUST NOT contain a username or password Client identifier URLs
+        (uri.userinfo.nil? || uri.userinfo.empty?) &&
+        # SHOULD NOT include a query string component, and MAY contain a port.
+        (uri.query.nil? || uri.query.empty?)
+
+      true
+    end
+
+    def validate_client_metadata_document(metadata)
+      if (token_endpoint_auth_method = metadata[:token_endpoint_auth_method]) &&
+         FORBIDDEN_TOKEN_AUTH_METHODS.include?(token_endpoint_auth_method)
+        # the token_endpoint_auth_method property MUST NOT include client_secret_post, client_secret_basic, client_secret_jwt,
+        # or any other method based around a shared symmetric secret
+        redirect_response_error("invalid_request")
+      end
+
+      # the client_secret and client_secret_expires_at properties MUST NOT be used
+      redirect_response_error("invalid_request") if metadata.key?(:client_secret) || metadata.key?(:client_secret_expires_at)
+    end
+
+    def oauth_server_metadata_body(*)
+      super.tap do |data|
+        data[:client_id_metadata_document_supported] = true
+      end
+    end
+  end
+end

data/lib/rodauth/oauth/version.rb

@@ -2,6 +2,6 @@
 
 module Rodauth
   module OAuth
-    VERSION = "1.6.7"
+    VERSION = "1.7.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rodauth-oauth
 version: !ruby/object:Gem::Version
-  version: 1.6.7
+  version: 1.7.0
 platform: ruby
 authors:
 - Tiago Cardoso
@@ -95,6 +95,7 @@ extra_rdoc_files:
 - doc/release_notes/1_6_5.md
 - doc/release_notes/1_6_6.md
 - doc/release_notes/1_6_7.md
+- doc/release_notes/1_7_0.md
 files:
 - CHANGELOG.md
 - LICENSE.txt
@@ -148,6 +149,7 @@ files:
 - doc/release_notes/1_6_5.md
 - doc/release_notes/1_6_6.md
 - doc/release_notes/1_6_7.md
+- doc/release_notes/1_7_0.md
 - lib/generators/rodauth/oauth/install_generator.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_application.rb
 - lib/generators/rodauth/oauth/templates/app/models/oauth_grant.rb
@@ -169,6 +171,7 @@ files:
 - lib/rodauth/features/oauth_authorize_base.rb
 - lib/rodauth/features/oauth_base.rb
 - lib/rodauth/features/oauth_client_credentials_grant.rb
+- lib/rodauth/features/oauth_client_id_metadata_document.rb
 - lib/rodauth/features/oauth_device_code_grant.rb
 - lib/rodauth/features/oauth_dpop.rb
 - lib/rodauth/features/oauth_dynamic_client_registration.rb