Module: Doorkeeper::AccessGrantMixin::ClassMethods

Defined in:
lib/doorkeeper/models/access_grant_mixin.rb

Instance Method Summary collapse

Instance Method Details

#access_token_revoked_on_reuse? ⇒ Boolean

Replay protection for authorization codes (RFC 6749 §4.1.2, §10.5) is active only when the access_token_id column exists (added by the doorkeeper:grant_reuse_revocation generator): the column records the access token issued when the code was exchanged, so a second exchange attempt can revoke it.

Returns:

  • (Boolean) 


115
116
117
 
# File 'lib/doorkeeper/models/access_grant_mixin.rb', line 115

def access_token_revoked_on_reuse?
  column_names.include?("access_token_id")
end

#by_token(token) ⇒ Doorkeeper::AccessGrant?

Searches for Doorkeeper::AccessGrant record with the specific token value.

Parameters:

  • token (#to_s) —

    token value (any object that responds to #to_s)

Returns:



32
33
34
 
# File 'lib/doorkeeper/models/access_grant_mixin.rb', line 32

def by_token(token)
  find_by_plaintext_token(:token, token)
end

#fallback_secret_strategy ⇒ Doorkeeper::SecretStoring::Base

Determine the fallback storing strategy Unless configured, there will be no fallback

Returns:



135
136
137
 
# File 'lib/doorkeeper/models/access_grant_mixin.rb', line 135

def fallback_secret_strategy
  ::Doorkeeper.config.token_secret_fallback_strategy
end

#generate_code_challenge(code_verifier) ⇒ #to_s

suitable for PKCE validation

Parameters:

  • code_verifier (#to_s) —

    a one time use value (any object that responds to #to_s)

Returns:

  • (#to_s) —

    An encoded code challenge based on the provided verifier



95
96
97
 
# File 'lib/doorkeeper/models/access_grant_mixin.rb', line 95

def generate_code_challenge(code_verifier)
  Base64.urlsafe_encode64(Digest::SHA256.digest(code_verifier), padding: false)
end

#pkce_supported? ⇒ Boolean

Returns:

  • (Boolean) 


99
100
101
 
# File 'lib/doorkeeper/models/access_grant_mixin.rb', line 99

def pkce_supported?
  column_names.include?("code_challenge")
end

#resource_indicators_supported? ⇒ Boolean

RFC 8707: resource indicators are supported only when the resource column exists (added by the doorkeeper:resource_indicators generator).

Returns:

  • (Boolean) 


106
107
108
 
# File 'lib/doorkeeper/models/access_grant_mixin.rb', line 106

def resource_indicators_supported?
  column_names.include?("resource")
end

#revoke_all_for(application_id, resource_owner, clock = Time) ⇒ Object

Revokes AccessGrant records that have not been revoked and associated with the specific Application and Resource Owner.

Parameters:

  • application_id (Integer) —

    ID of the Application

  • resource_owner (ActiveRecord::Base, Integer) —

    instance of the Resource Owner model or it's ID



44
45
46
47
48
49
50
51
52
53
 
# File 'lib/doorkeeper/models/access_grant_mixin.rb', line 44

def revoke_all_for(application_id, resource_owner, clock = Time)
  with_primary_role do
    by_resource_owner(resource_owner)
      .where(
        application_id: application_id,
        revoked_at: nil,
      )
      .update_all(revoked_at: clock.now.utc)
  end
end

#secret_strategy ⇒ Doorkeeper::SecretStoring::Base

Determines the secret storing transformer Unless configured otherwise, uses the plain secret strategy

Returns:



125
126
127
 
# File 'lib/doorkeeper/models/access_grant_mixin.rb', line 125

def secret_strategy
  ::Doorkeeper.config.token_secret_strategy
end