Class: Doorkeeper::Config

Inherits:
Object
  • Object
show all
Extended by:
Option
Includes:
Validations
Defined in:
lib/doorkeeper/config.rb,
lib/doorkeeper/config/option.rb,
lib/doorkeeper/config/validations.rb,
lib/doorkeeper/config/abstract_builder.rb

Overview

Doorkeeper option DSL could be reused in extensions to build their own configurations. To use the Option DSL gems need to define builder_class method that returns configuration Builder class. This exception raises when they don't define it.

Defined Under Namespace

Modules: Option, Validations Classes: AbstractBuilder, Builder

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from Option

extended, option

Methods included from Validations

#validate!

Instance Attribute Details

#application_secret_fallback_strategy ⇒ Object (readonly)

Returns the value of attribute application_secret_fallback_strategy.



554
555
556
 
# File 'lib/doorkeeper/config.rb', line 554

def application_secret_fallback_strategy
  @application_secret_fallback_strategy
end

#enable_multiple_database_roles ⇒ Object (readonly)

Returns the value of attribute enable_multiple_database_roles.



554
555
556
 
# File 'lib/doorkeeper/config.rb', line 554

def enable_multiple_database_roles
  @enable_multiple_database_roles
end

#reuse_access_token ⇒ Object (readonly)

Returns the value of attribute reuse_access_token.



554
555
556
 
# File 'lib/doorkeeper/config.rb', line 554

def reuse_access_token
  @reuse_access_token
end

#token_secret_fallback_strategy ⇒ Object (readonly)

Returns the value of attribute token_secret_fallback_strategy.



554
555
556
 
# File 'lib/doorkeeper/config.rb', line 554

def token_secret_fallback_strategy
  @token_secret_fallback_strategy
end

Instance Method Details

#access_grant_model ⇒ ActiveRecord::Base, ...

Doorkeeper Access Grant model class.

Returns:

  • (ActiveRecord::Base, Mongoid::Document, Sequel::Model) 


581
582
583
 
# File 'lib/doorkeeper/config.rb', line 581

def access_grant_model
  @access_grant_model ||= access_grant_class.constantize
end

#access_token_methods ⇒ Object 



751
752
753
754
755
756
757
 
# File 'lib/doorkeeper/config.rb', line 751

def access_token_methods
  @access_token_methods ||= %i[
    from_bearer_authorization
    from_access_token_param
    from_bearer_param
  ]
end

#access_token_model ⇒ ActiveRecord::Base, ...

Doorkeeper Access Token model class.

Returns:

  • (ActiveRecord::Base, Mongoid::Document, Sequel::Model) 


573
574
575
 
# File 'lib/doorkeeper/config.rb', line 573

def access_token_model
  @access_token_model ||= access_token_class.constantize
end

#allow_blank_redirect_uri?(application = nil) ⇒ Boolean

Returns:

  • (Boolean) 


843
844
845
846
847
848
849
 
# File 'lib/doorkeeper/config.rb', line 843

def allow_blank_redirect_uri?(application = nil)
  if allow_blank_redirect_uri.respond_to?(:call)
    allow_blank_redirect_uri.call(grant_flows, application)
  else
    allow_blank_redirect_uri
  end
end

#allow_grant_flow_for_client ⇒ Boolean

Allows to customize OAuth grant flows that each application support. You can configure a custom block (or use a class respond to #call) that must return true in case Application instance supports requested OAuth grant flow during the authorization request to the server. This configuration doesn't set flows per application, it only allows to check if application supports specific grant flow.

For example you can add an additional database column to oauth_applications table, say t.array :grant_flows, default: [], and store allowed grant flows that can be used with this application there. Then when authorization requested Doorkeeper will call this block to check if specific Application (passed with client_id and/or client_secret) is allowed to perform the request for the specific grant type (authorization, password, client_credentials, etc).

Example of the block:

->(flow, client) { client.grant_flows.include?(flow) }

In case this option invocation result is false, Doorkeeper server returns :unauthorized_client error and stops the request.

Parameters:

  • allow_grant_flow_for_client (Proc) —

    Block or any object respond to #call

Returns:

  • (Boolean) —

    true if allow or false if forbid the request



369
 
# File 'lib/doorkeeper/config.rb', line 369

option :allow_grant_flow_for_client,    default: ->(_grant_flow, _client) { true }

#allow_grant_flow_for_client?(grant_flow, client) ⇒ Boolean

Returns:

  • (Boolean) 


851
852
853
854
855
 
# File 'lib/doorkeeper/config.rb', line 851

def allow_grant_flow_for_client?(grant_flow, client)
  return true unless option_defined?(:allow_grant_flow_for_client)

  allow_grant_flow_for_client.call(grant_flow, client)
end

#api_only ⇒ Object 



593
594
595
 
# File 'lib/doorkeeper/config.rb', line 593

def api_only
  @api_only ||= false
end

#application_model ⇒ ActiveRecord::Base, ...

Doorkeeper Application model class.

Returns:

  • (ActiveRecord::Base, Mongoid::Document, Sequel::Model) 


589
590
591
 
# File 'lib/doorkeeper/config.rb', line 589

def application_model
  @application_model ||= application_class.constantize
end

#application_secret_hashed? ⇒ Boolean

Returns:

  • (Boolean) 


664
665
666
 
# File 'lib/doorkeeper/config.rb', line 664

def application_secret_hashed?
  instance_variable_defined?(:"@application_secret_strategy")
end

#application_secret_strategy ⇒ Object 



672
673
674
 
# File 'lib/doorkeeper/config.rb', line 672

def application_secret_strategy
  @application_secret_strategy ||= ::Doorkeeper::SecretStoring::Plain
end

#authorization_response_flows ⇒ Object 



763
764
765
766
 
# File 'lib/doorkeeper/config.rb', line 763

def authorization_response_flows
  @authorization_response_flows ||= enabled_grant_flows.select(&:handles_response_type?) +
                                    deprecated_authorization_flows
end

#authorization_response_types ⇒ Object 



772
773
774
 
# File 'lib/doorkeeper/config.rb', line 772

def authorization_response_types
  authorization_response_flows.map(&:response_type_matches)
end

#calculate_authorization_response_types ⇒ Object

[NOTE]: deprecated and will be removed soon



808
809
810
 
# File 'lib/doorkeeper/config.rb', line 808

def calculate_authorization_response_types
  []
end

#calculate_grant_flows ⇒ Object

Calculates grant flows configured by the user in Doorkeeper configuration considering registered aliases that is exposed to single or multiple other flows.

The refresh_token flow is added implicitly when use_refresh_token is configured, so the result lists every enabled flow (useful for RFC 8414 authorization server metadata).



827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
 
# File 'lib/doorkeeper/config.rb', line 827

def calculate_grant_flows
  configured_flows = grant_flows.map(&:to_s)
  aliases = Doorkeeper::GrantFlow.aliases.keys.map(&:to_s)

  flows = configured_flows - aliases
  aliases.each do |flow_alias|
    next unless configured_flows.include?(flow_alias)

    flows.concat(Doorkeeper::GrantFlow.expand_alias(flow_alias))
  end

  flows << "refresh_token" if refresh_token_enabled?

  flows.flatten.uniq
end

#calculate_token_grant_types ⇒ Object

[NOTE]: deprecated and will be removed soon



813
814
815
816
817
 
# File 'lib/doorkeeper/config.rb', line 813

def calculate_token_grant_types
  types = grant_flows - ["implicit"]
  types << "refresh_token" if refresh_token_enabled?
  types.uniq
end

#clear_cache! ⇒ Object 



559
560
561
562
563
564
565
566
567
 
# File 'lib/doorkeeper/config.rb', line 559

def clear_cache!
  %i[
    application_model
    access_token_model
    access_grant_model
  ].each do |var|
    remove_instance_variable("@#{var}") if instance_variable_defined?("@#{var}")
  end
end

#client_authentication ⇒ Object

The configured client authentication method names (RFC 6749 §2.3), defaulting to the registry's DEFAULT_METHODS when not set.



728
729
730
731
732
 
# File 'lib/doorkeeper/config.rb', line 728

def client_authentication
  return Doorkeeper::ClientAuthentication::DEFAULT_METHODS.dup unless instance_variable_defined?(:@client_authentication)

  @client_authentication
end

#client_authentication_methods ⇒ Object

Resolves the configured client authentication methods (RFC 6749 §2.3) into the registered Doorkeeper::ClientAuthentication::Method objects.

Honors the deprecated client_credentials option for backwards compatibility: if it was used it provides the source of truth, unless client_authentication was also set explicitly, in which case the latter wins.



705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
 
# File 'lib/doorkeeper/config.rb', line 705

def client_authentication_methods
  return @client_authentication_methods if defined?(@client_authentication_methods)

  # When both the deprecated +client_credentials+ and the new
  # +client_authentication+ are set, +client_authentication+ wins. The
  # conflict is warned about at validation time (see Validations), not here,
  # so the message is not swallowed by this memoised resolver.
  only_legacy = instance_variable_defined?(:@client_credentials_methods) &&
                !instance_variable_defined?(:@client_authentication)
  names = only_legacy ? @client_credentials_methods : client_authentication

  # Names configured more than once resolve to the same registered Method
  # instance, so identity-based #uniq drops the duplicates (which would
  # otherwise be matched against requests twice and advertised twice in
  # the server metadata) while distinct legacy callable adapters survive.
  @client_authentication_methods = names.filter_map do |name|
    # Legacy callables are already wrapped as Method adapters (see #client_credentials).
    name.is_a?(Doorkeeper::ClientAuthentication::Method) ? name : Doorkeeper::ClientAuthentication.get(name)
  end.uniq
end

#client_credentials_methods ⇒ Object

Deprecated.

Renamed to client_authentication_methods. This alias keeps external callers (e.g. doorkeeper-openid_connect) working for one release and will be removed afterwards. It returns the legacy symbol names (e.g. :from_basic) rather than the internal Method objects so that consumers mapping from those symbols keep working unchanged.



739
740
741
742
743
744
745
746
747
748
749
 
# File 'lib/doorkeeper/config.rb', line 739

def client_credentials_methods
  unless defined?(@client_credentials_methods_rename_warned)
    Kernel.warn(
      "[DOORKEEPER] Doorkeeper.config.client_credentials_methods has been renamed to " \
      "client_authentication_methods and will be removed in a future version.",
    )
    @client_credentials_methods_rename_warned = true
  end

  Doorkeeper::ClientAuthentication.to_legacy_client_credentials_names(client_authentication_methods)
end

#confirm_application_owner? ⇒ Boolean

Returns:

  • (Boolean) 


652
653
654
 
# File 'lib/doorkeeper/config.rb', line 652

def confirm_application_owner?
  option_set? :confirm_application_owner
end

#default_scopes ⇒ Object 



676
677
678
 
# File 'lib/doorkeeper/config.rb', line 676

def default_scopes
  @default_scopes ||= OAuth::Scopes.new
end

#deprecated_authorization_flows ⇒ Object

[NOTE]: deprecated and will be removed soon



791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
 
# File 'lib/doorkeeper/config.rb', line 791

def deprecated_authorization_flows
  response_types = calculate_authorization_response_types

  if response_types.any?
    ::Kernel.warn <<~WARNING
      Please, don't patch Doorkeeper::Config#calculate_authorization_response_types method.
      Register your custom grant flows using the public API:
      `Doorkeeper::GrantFlow.register(grant_flow_name, **options)`.
    WARNING
  end

  response_types.map do |response_type|
    Doorkeeper::GrantFlow::FallbackFlow.new(response_type, response_type_matches: response_type)
  end
end

#deprecated_token_grant_types_resolver ⇒ Object

[NOTE]: deprecated and will be removed soon



781
782
783
 
# File 'lib/doorkeeper/config.rb', line 781

def deprecated_token_grant_types_resolver
  @deprecated_token_grant_types ||= calculate_token_grant_types
end

#dynamic_scopes_delimiter ⇒ Object 



644
645
646
 
# File 'lib/doorkeeper/config.rb', line 644

def dynamic_scopes_delimiter
  @dynamic_scopes_delimiter
end

#enable_application_owner? ⇒ Boolean

Returns:

  • (Boolean) 


636
637
638
 
# File 'lib/doorkeeper/config.rb', line 636

def enable_application_owner?
  option_set? :enable_application_owner
end

#enable_dynamic_scopes? ⇒ Boolean

Returns:

  • (Boolean) 


640
641
642
 
# File 'lib/doorkeeper/config.rb', line 640

def enable_dynamic_scopes?
  option_set? :enable_dynamic_scopes
end

#enabled_grant_flows ⇒ Object 



759
760
761
 
# File 'lib/doorkeeper/config.rb', line 759

def enabled_grant_flows
  @enabled_grant_flows ||= calculate_grant_flows.map { |name| Doorkeeper::GrantFlow.get(name) }.compact
end

#enforce_configured_scopes? ⇒ Boolean

Returns:

  • (Boolean) 


632
633
634
 
# File 'lib/doorkeeper/config.rb', line 632

def enforce_configured_scopes?
  option_set? :enforce_configured_scopes
end

#enforce_content_type ⇒ Object 



597
598
599
 
# File 'lib/doorkeeper/config.rb', line 597

def enforce_content_type
  @enforce_content_type ||= false
end

#force_pkce? ⇒ Boolean

Returns:

  • (Boolean) 


628
629
630
 
# File 'lib/doorkeeper/config.rb', line 628

def force_pkce?
  option_set? :force_pkce
end

#native_authorization_code_route ⇒ Object 



785
786
787
788
 
# File 'lib/doorkeeper/config.rb', line 785

def native_authorization_code_route
  @use_url_path_for_native_authorization = false unless defined?(@use_url_path_for_native_authorization)
  @use_url_path_for_native_authorization ? "/:code" : "/native"
end

#option_defined?(name) ⇒ Boolean

Returns:

  • (Boolean) 


857
858
859
 
# File 'lib/doorkeeper/config.rb', line 857

def option_defined?(name)
  instance_variable_defined?("@#{name}")
end

#optional_scopes ⇒ Object 



680
681
682
 
# File 'lib/doorkeeper/config.rb', line 680

def optional_scopes
  @optional_scopes ||= OAuth::Scopes.new
end

#pkce_code_challenge_methods_supported ⇒ Object 



692
693
694
695
696
 
# File 'lib/doorkeeper/config.rb', line 692

def pkce_code_challenge_methods_supported
  return [] unless access_grant_model.pkce_supported?

  pkce_code_challenge_methods
end

#polymorphic_resource_owner? ⇒ Boolean

Returns:

  • (Boolean) 


648
649
650
 
# File 'lib/doorkeeper/config.rb', line 648

def polymorphic_resource_owner?
  option_set? :polymorphic_resource_owner
end

#raise_on_errors? ⇒ Boolean

Returns:

  • (Boolean) 


656
657
658
 
# File 'lib/doorkeeper/config.rb', line 656

def raise_on_errors?
  handle_auth_errors == :raise
end

#redirect_on_errors? ⇒ Boolean

Returns:

  • (Boolean) 


660
661
662
 
# File 'lib/doorkeeper/config.rb', line 660

def redirect_on_errors?
  handle_auth_errors == :redirect
end

#refresh_token_enabled? ⇒ Boolean

Returns:

  • (Boolean) 


601
602
603
604
605
606
607
 
# File 'lib/doorkeeper/config.rb', line 601

def refresh_token_enabled?
  if defined?(@refresh_token_enabled)
    @refresh_token_enabled
  else
    false
  end
end

#resolve_controller(name) ⇒ Object 



609
610
611
612
613
614
615
616
617
618
 
# File 'lib/doorkeeper/config.rb', line 609

def resolve_controller(name)
  config_option = public_send(:"#{name}_controller")
  controller_name = if config_option.respond_to?(:call)
                      instance_exec(&config_option)
                    else
                      config_option
                    end

  controller_name.constantize
end

#revoke_previous_authorization_code_token? ⇒ Boolean

Returns:

  • (Boolean) 


624
625
626
 
# File 'lib/doorkeeper/config.rb', line 624

def revoke_previous_authorization_code_token?
  option_set? :revoke_previous_authorization_code_token
end

#revoke_previous_client_credentials_token? ⇒ Boolean

Returns:

  • (Boolean) 


620
621
622
 
# File 'lib/doorkeeper/config.rb', line 620

def revoke_previous_client_credentials_token?
  option_set? :revoke_previous_client_credentials_token
end

#scopes ⇒ Object 



684
685
686
 
# File 'lib/doorkeeper/config.rb', line 684

def scopes
  @scopes ||= default_scopes + optional_scopes
end

#scopes_by_grant_type ⇒ Object 



688
689
690
 
# File 'lib/doorkeeper/config.rb', line 688

def scopes_by_grant_type
  @scopes_by_grant_type ||= {}
end

#token_grant_flows ⇒ Object 



768
769
770
 
# File 'lib/doorkeeper/config.rb', line 768

def token_grant_flows
  @token_grant_flows ||= calculate_token_grant_flows
end

#token_grant_types ⇒ Object 



776
777
778
 
# File 'lib/doorkeeper/config.rb', line 776

def token_grant_types
  token_grant_flows.map(&:grant_type_matches)
end

#token_secret_strategy ⇒ Object 



668
669
670
 
# File 'lib/doorkeeper/config.rb', line 668

def token_secret_strategy
  @token_secret_strategy ||= ::Doorkeeper::SecretStoring::Plain
end