Class: Doorkeeper::Config::Builder

Inherits:
AbstractBuilder show all
Defined in:
lib/doorkeeper/config.rb

Overview

Default Doorkeeper configuration builder

Instance Attribute Summary

Attributes inherited from AbstractBuilder

#config

Instance Method Summary collapse

Methods inherited from AbstractBuilder

#build, #initialize

Constructor Details

This class inherits a constructor from Doorkeeper::Config::AbstractBuilder

Instance Method Details

#access_token_methods(*methods) ⇒ Object

Change the way access token is authenticated from the request object. By default it retrieves first from the HTTP_AUTHORIZATION header, then falls back to the :access_token or :bearer_token params from the params object.

Parameters:

  • methods (Array) —

    Define access token methods



120
121
122
 
# File 'lib/doorkeeper/config.rb', line 120

def access_token_methods(*methods)
  @config.instance_variable_set(:@access_token_methods, methods)
end

#api_only ⇒ Object

Use an API mode for applications generated with --api argument It will skip applications controller, disable forgery protection



187
188
189
 
# File 'lib/doorkeeper/config.rb', line 187

def api_only
  @config.instance_variable_set(:@api_only, true)
end

#client_authentication(*methods) ⇒ Object

Declare which client authentication methods (RFC 6749 §2.3) are accepted and the order in which they are tried. Accepts either an array or varargs, so both forms are honoured exactly as written:

client_authentication %i[client_secret_basic client_secret_post none]
client_authentication :client_secret_basic, :client_secret_post

Unlike the deprecated client_credentials option, the listed methods are used verbatim — nothing (in particular :none) is appended, so a restrictive configuration is never silently broadened.

Parameters:

  • methods (Array<Symbol>) —

    the client authentication method names



110
111
112
 
# File 'lib/doorkeeper/config.rb', line 110

def client_authentication(*methods)
  @config.instance_variable_set(:@client_authentication, methods.flatten)
end

#client_credentials(*methods) ⇒ Object

Deprecated.

Use the client_authentication option instead. The legacy :from_basic / :from_params methods are automatically converted to the :client_secret_basic / :client_secret_post authentication methods. :none (public client support) is appended only when :from_params was configured, since that is the only legacy method that accepted a bare client_id without a secret — :from_basic on its own never did, so it is not broadened. Callable extractors are wrapped in a legacy adapter so they keep working during the deprecation window.

Change the way client credentials are retrieved from the request object.

Parameters:

  • methods (Array) —

    Define client credentials



80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
 
# File 'lib/doorkeeper/config.rb', line 80

def client_credentials(*methods)
  deprecated(
    "client_credentials",
    "Use the client_authentication option instead. Automatically converting to client_authentication",
  )

  client_authentication = Doorkeeper::ClientAuthentication.from_legacy_client_credentials(methods)

  if client_authentication.empty?
    Kernel.warn(
      "[DOORKEEPER] No known client_credentials method detected, " \
      "cannot automatically convert to client_authentication option",
    )
  else
    @config.instance_variable_set(:@client_credentials_methods, client_authentication)
  end
end

#confirm_application_owner ⇒ Object 



30
31
32
 
# File 'lib/doorkeeper/config.rb', line 30

def confirm_application_owner
  @config.instance_variable_set(:@confirm_application_owner, true)
end

#default_scopes(*scopes) ⇒ Object

Define default access token scopes for your provider

token scopes

Parameters:

  • scopes (Array) —

    Default set of access (OAuth::Scopes.new)



48
49
50
 
# File 'lib/doorkeeper/config.rb', line 48

def default_scopes(*scopes)
  @config.instance_variable_set(:@default_scopes, OAuth::Scopes.from_array(scopes))
end

#enable_application_owner(opts = {}) ⇒ Object

Provide support for an owner to be assigned to each registered application (disabled by default) Optional parameter confirmation: true (default false) if you want to enforce ownership of a registered application

Parameters:

  • opts (Hash) (defaults to: {}) —

    the options to confirm if an application owner is present

  • opts[Boolean] (Hash) —

    a customizable set of options



25
26
27
28
 
# File 'lib/doorkeeper/config.rb', line 25

def enable_application_owner(opts = {})
  @config.instance_variable_set(:@enable_application_owner, true)
  confirm_application_owner if opts[:confirmation].present? && opts[:confirmation]
end

#enable_dynamic_scopes(opts = {}) ⇒ Object

Provide support for dynamic scopes (e.g. user:*) (disabled by default) Optional parameter delimiter (default ":") if you want to customize the delimiter separating the scope name and matching value.

Parameters:

  • opts (Hash) (defaults to: {}) —

    the options to configure dynamic scopes



39
40
41
42
 
# File 'lib/doorkeeper/config.rb', line 39

def enable_dynamic_scopes(opts = {})
  @config.instance_variable_set(:@enable_dynamic_scopes, true)
  @config.instance_variable_set(:@dynamic_scopes_delimiter, opts[:delimiter] || ":")
end

#enable_multiple_database_roles ⇒ Object

Enable support for multiple database configurations with read replicas. When enabled, wraps database write operations to ensure they use the primary (writable) database when automatic role switching is enabled.

For ActiveRecord (Rails 6.1+), this uses ActiveRecord::Base.connected_to(role: :writing). Other ORM extensions can implement their own primary database targeting logic.

This prevents ActiveRecord::ReadOnlyError when using read replicas with Rails automatic role switching. Enable this if your application uses multiple databases with automatic role switching for read replicas.

See: https://guides.rubyonrails.org/active_record_multiple_databases.html#activating-automatic-role-switching



151
152
153
 
# File 'lib/doorkeeper/config.rb', line 151

def enable_multiple_database_roles
  @config.instance_variable_set(:@enable_multiple_database_roles, true)
end

#enforce_configured_scopes ⇒ Object

Forbids creating/updating applications with arbitrary scopes that are not in configuration, i.e. default_scopes or optional_scopes. (disabled by default)



200
201
202
 
# File 'lib/doorkeeper/config.rb', line 200

def enforce_configured_scopes
  @config.instance_variable_set(:@enforce_configured_scopes, true)
end

#enforce_content_type ⇒ Object

Enforce request content type as the spec requires: disabled by default for backward compatibility.



206
207
208
 
# File 'lib/doorkeeper/config.rb', line 206

def enforce_content_type
  @config.instance_variable_set(:@enforce_content_type, true)
end

#force_pkce ⇒ Object

Require non-confidential apps to use PKCE (send a code_verifier) when requesting an access_token using an authorization code (disabled by default)



181
182
183
 
# File 'lib/doorkeeper/config.rb', line 181

def force_pkce
  @config.instance_variable_set(:@force_pkce, true)
end

#hash_application_secrets(using: nil, fallback: nil) ⇒ Object

Allow optional hashing of application secrets before persisting them. Will be used for hashing of input token and grants.

Parameters:

  • using (defaults to: nil) —

    Provide a different secret storage implementation for applications

  • fallback (defaults to: nil) —

    Provide a fallback secret storage implementation for applications or use :plain to fallback to plain application secrets



233
234
235
236
237
238
 
# File 'lib/doorkeeper/config.rb', line 233

def hash_application_secrets(using: nil, fallback: nil)
  default = "::Doorkeeper::SecretStoring::Sha256Hash"
  configure_secrets_for :application,
                        using: using || default,
                        fallback: fallback
end

#hash_token_secrets(using: nil, fallback: nil) ⇒ Object

Allow optional hashing of input tokens before persisting them. Will be used for hashing of input token and grants.

Parameters:

  • using (defaults to: nil) —

    Provide a different secret storage implementation class for tokens

  • fallback (defaults to: nil) —

    Provide a fallback secret storage implementation class for tokens or use :plain to fallback to plain tokens



218
219
220
221
222
223
 
# File 'lib/doorkeeper/config.rb', line 218

def hash_token_secrets(using: nil, fallback: nil)
  default = "::Doorkeeper::SecretStoring::Sha256Hash"
  configure_secrets_for :token,
                        using: using || default,
                        fallback: fallback
end

#optional_scopes(*scopes) ⇒ Object

Define default access token scopes for your provider

token scopes

Parameters:

  • scopes (Array) —

    Optional set of access (OAuth::Scopes.new)



56
57
58
 
# File 'lib/doorkeeper/config.rb', line 56

def optional_scopes(*scopes)
  @config.instance_variable_set(:@optional_scopes, OAuth::Scopes.from_array(scopes))
end

#reuse_access_token ⇒ Object

Reuse access token for the same resource owner within an application (disabled by default) Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/383



135
136
137
 
# File 'lib/doorkeeper/config.rb', line 135

def reuse_access_token
  @config.instance_variable_set(:@reuse_access_token, true)
end

#revoke_previous_authorization_code_token ⇒ Object

Only allow one valid access token obtained via authorization code per client. If a new access token is obtained before the old one expired, the old one gets revoked (disabled by default)



175
176
177
 
# File 'lib/doorkeeper/config.rb', line 175

def revoke_previous_authorization_code_token
  @config.instance_variable_set(:@revoke_previous_authorization_code_token, true)
end

#revoke_previous_client_credentials_token ⇒ Object

TODO: maybe make it more generic for other flows too? Only allow one valid access token obtained via client credentials per client. If a new access token is obtained before the old one expired, the old one gets revoked (disabled by default)



168
169
170
 
# File 'lib/doorkeeper/config.rb', line 168

def revoke_previous_client_credentials_token
  @config.instance_variable_set(:@revoke_previous_client_credentials_token, true)
end

#scopes_by_grant_type(hash = {}) ⇒ Object

Define scopes_by_grant_type to limit certain scope to certain grant_type Default set to {} i.e. no limitation on scopes usage

Parameters:

  • with (Hash) —

    grant_types as keys.



63
64
65
 
# File 'lib/doorkeeper/config.rb', line 63

def scopes_by_grant_type(hash = {})
  @config.instance_variable_set(:@scopes_by_grant_type, hash)
end

#use_polymorphic_resource_owner ⇒ Object

Enables polymorphic Resource Owner association for Access Grant and Access Token models. Requires additional database columns to be setup.



193
194
195
 
# File 'lib/doorkeeper/config.rb', line 193

def use_polymorphic_resource_owner
  @config.instance_variable_set(:@polymorphic_resource_owner, true)
end

#use_refresh_token(enabled = true, &block) ⇒ Object

Issue access tokens with refresh token (disabled if not set)



125
126
127
128
129
130
 
# File 'lib/doorkeeper/config.rb', line 125

def use_refresh_token(enabled = true, &block)
  @config.instance_variable_set(
    :@refresh_token_enabled,
    block || enabled,
  )
end

#use_url_path_for_native_authorization ⇒ Object

Choose to use the url path for native autorization codes Enabling this flag sets the authorization code response route for native redirect uris to oauth/authorize/. The default is oauth/authorize/native?code=. Rationale: https://github.com/doorkeeper-gem/doorkeeper/issues/1143



160
161
162
 
# File 'lib/doorkeeper/config.rb', line 160

def use_url_path_for_native_authorization
  @config.instance_variable_set(:@use_url_path_for_native_authorization, true)
end