Module: Doorkeeper::OAuth::ResourceIndicatorValidator

Defined in:
lib/doorkeeper/oauth/resource_indicator_validator.rb

Overview

Validates the resource parameter per RFC 8707.

The resource value MUST be an absolute URI without a fragment component. Multiple resource parameters MAY be present.

See Also:

Class Method Summary collapse

Class Method Details

.valid?(resource_indicators) ⇒ Boolean

Returns true when the values are syntactically valid.

Returns:

  • (Boolean) —

    true when the values are syntactically valid



45
46
47
48
49
 
# File 'lib/doorkeeper/oauth/resource_indicator_validator.rb', line 45

def valid?(resource_indicators)
  return true if resource_indicators.blank?

  Array(resource_indicators).reject(&:blank?).all? { |uri| valid_uri?(uri) }
end

.valid_uri?(uri) ⇒ Boolean

Returns:

  • (Boolean) 


51
52
53
54
55
56
57
58
59
60
61
62
63
 
# File 'lib/doorkeeper/oauth/resource_indicator_validator.rb', line 51

def valid_uri?(uri)
  return false unless uri.is_a?(String)

  parsed = URI.parse(uri)
  # MUST be absolute URI
  return false unless parsed.absolute?
  # MUST NOT include a fragment
  return false if parsed.fragment

  true
rescue URI::InvalidURIError, TypeError
  false
end

.validate!(resource_indicators, config_validator: nil, client: nil, grant_resource_indicators: nil) ⇒ Array<String>

Validates and normalizes an array of resource indicator values.

Parameters:

  • resource_indicators (Array<String>, String, nil) —

    One or more resource URIs

  • config_validator (Proc, nil) (defaults to: nil) —

    Custom validator from configuration

  • client (Doorkeeper::OAuth::Client, nil) (defaults to: nil) —

    The requesting client

  • grant_resource_indicators (Array<String>, nil) (defaults to: nil) —

    Resource indicators from the original authorization grant (for subset enforcement on token requests)

Returns:

  • (Array<String>) —

    Validated resource indicator URIs

Raises:



26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
 
# File 'lib/doorkeeper/oauth/resource_indicator_validator.rb', line 26

def validate!(resource_indicators, config_validator: nil, client: nil, grant_resource_indicators: nil)
  return [] if resource_indicators.blank?

  indicators = Array.wrap(resource_indicators).reject(&:blank?).uniq
  return [] if indicators.empty?

  indicators.each { |uri| validate_uri!(uri) }

  # If the token request specifies resources, they must be a subset of those
  # originally granted (RFC 8707 ยง2.2).
  raise Errors::InvalidTarget if grant_resource_indicators.present? && (indicators - grant_resource_indicators).any?

  # Custom server policy validation
  raise Errors::InvalidTarget if config_validator && !config_validator.call(indicators, client)

  indicators
end

.validate_uri!(uri) ⇒ Object

Raises:



65
66
67
 
# File 'lib/doorkeeper/oauth/resource_indicator_validator.rb', line 65

def validate_uri!(uri)
  raise Errors::InvalidTarget unless valid_uri?(uri)
end